)]}' { "log": [ { "commit": "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907", "tree": "35e4248213006b8c37f54118790a99b673c84fd9", "parents": [ "d6d3455d8751854e0d1820f14184682e23ac4475" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 20:04:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 20:04:55 2026 -0700" }, "message": "Linux 7.3-rc7\n" }, { "commit": "d6d3455d8751854e0d1820f14184682e23ac4475", "tree": "3107f1b1b6e6a358126d76304bf914f234a0124c", "parents": [ "f47959816751f02a711aab27cf1c805bd4964819", "3d8cc52db2f86b624308321c58513019f6b21eec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:49:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:49:08 2026 -0700" }, "message": "Merge tag \u0027landlock-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock fix from Mickaël Salaün:\n \"This fixes a Clang bug by removing an annotation, which was introduced\n mostly for documentation\"\n\n* tag \u0027landlock-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Drop __counted_by from landlock_domain.handled_masks\n" }, { "commit": "f47959816751f02a711aab27cf1c805bd4964819", "tree": "83d3dedf60510bf1b1d1fa632d7f847b51ff715a", "parents": [ "5906f156e8818d29839d7d7280b691f627b59883", "00765a3467b992d0eb56704a28887256317eb4bd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:33:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:33:26 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A small collection of driver specific fixes, plus a new device ID in\n the DesignWare device tree binding.\n\n One of the sg2044 fixes which enforces clock limits properly is more\n critical than average since getting them wrong might lead to data\n corruption\"\n\n* tag \u0027spi-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi\n spi: sg2044-nor: Honor SPI clock limits\n spi: sg2044-nor: Return transfer errors\n spi: cadence-qspi: Fix status polling with octal DTR chips\n spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock\n" }, { "commit": "5906f156e8818d29839d7d7280b691f627b59883", "tree": "f53ccc2f9524159381015fe343e8768b2be80065", "parents": [ "d5b6dc381db93ff2d1888f7d99c06e0bd85f4083", "28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:28:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:28:36 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"There\u0027s a couple of core fixes here: there were a couple of issues\n with of_regulator_bulk_get_all() not behaving consistently with the\n other bulk regulator APIs which caused memory leaks and error handling\n issues in users.\n\n We also have a couple of fairly standard driver specific fixes\"\n\n* tag \u0027regulator-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: ltc3676: don\u0027t read the write-only HRST and CLIRQ registers\n regulator: of: state who owns the array from of_regulator_bulk_get_all()\n regulator: of: fill in supply names in of_regulator_bulk_get_all()\n regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4\n" }, { "commit": "d5b6dc381db93ff2d1888f7d99c06e0bd85f4083", "tree": "428c10f5bd4c1c345642d4b48943fb2318e83b95", "parents": [ "4375b45d7060a6a3f41e14a9181c5c913ea474a4", "469fa055664bfd8717b087a80d59c03055789c17" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:23:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:23:19 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Driver (and tape media changer) only fixes. Three of the fixes are\n about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO)\n but the unsafe MMIO is the least obvious logic change\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ\n scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()\n scsi: ch: Do not keep references to data transfer element devices\n scsi: ufs: mediatek: Handle mPHY power-on failures\n scsi: qedi: Initialize callback state before registration\n scsi: ufs: core: Hold a clock reference across the probe\n" }, { "commit": "4375b45d7060a6a3f41e14a9181c5c913ea474a4", "tree": "265c34a6704ac644eb104ea06490fd357f3f9937", "parents": [ "b7c0316c1a062dbadd0d62f1b796dd3264915242", "41cab3a71dc7be62114d91cc849424879062d324" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:00:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:00:33 2026 -0700" }, "message": "Merge tag \u0027block-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - Fix swapped ZRASF zone state values for full and read only\n - nvme-multipath revalidate head zones after unfreezing the head\n queue\n - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\",\n which broke things\n - nvmet fixes for invalid NSIDs on feature 82h and using the local\n P2P device on metadata allocation failure\n\n - zloop: zero out only the unread tail of a short read\n\n* tag \u0027block-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"\n zloop: zero out only the unread tail of short reads\n nvmet: use the local P2P device on metadata allocation failure\n nvme-multipath: revalidate head zones after unfreezing the head queue\n nvme: fix swapped ZRASF zone state values for full and read only\n nvmet: return Invalid Field for invalid NSIDs feature 82h\n" }, { "commit": "3d8cc52db2f86b624308321c58513019f6b21eec", "tree": "b45592a5161df6fc99a2beaa872744a9b2bcebc4", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Nguyen Ngoc Thang", "email": "ngocthang2710.1999@gmail.com", "time": "Sat Oct 10 23:44:49 2026 +0700" }, "committer": { "name": "Mickaël Salaün", "email": "mic@digikod.net", "time": "Sun Oct 11 17:54:21 2026 +0200" }, "message": "landlock: Drop __counted_by from landlock_domain.handled_masks\n\nWith clang 22 and CONFIG_FORTIFY_SOURCE, the second\nlandlock_restrict_self() call hits a bogus fortify report in\ninherit_ruleset():\n\n memcpy: detected buffer overflow: 4 byte write of buffer size 0\n Call Trace:\n __fortify_panic\n landlock_merge_ruleset\n __se_sys_landlock_restrict_self\n\nhandled_masks[] lives in an anonymous struct inside the anonymous union\nthat overlays work_free. For such a flexible array, clang computes the\naddress of the __counted_by counter as the start of the array instead of\n\u0026num_layers. The bound is then read from handled_masks[0], i.e. from\nthe first layer\u0027s access masks, which is not a count. The same layout\ncrashes clang itself in a standalone test.\n\nThe annotation was added as documentation, so drop it rather than\nrestructure the union. Keep the information in the member comment.\n\nReported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003da0eecb22de4d821a9e5d\nFixes: bd3a19800dd1 (\"landlock: Add counted_by in landlock_domain\")\nSigned-off-by: Nguyen Ngoc Thang \u003cngocthang2710.1999@gmail.com\u003e\nLink: https://lore.kernel.org/r/20261010164450.194439-1-ngocthang2710.1999@gmail.com\nReviewed-by: Günther Noack \u003cgnoack3000@gmail.com\u003e\nReported-by: Konrad Dybcio \u003ckonrad.dybcio@oss.qualcomm.com\u003e\nReported-by: Mike Bommarito \u003cmichael.bommarito@gmail.com\u003e\nCloses: https://lore.kernel.org/r/20261009115108.17819-1-michael.bommarito@gmail.com\n[mic: Rebased on master, where the array is handled_masks[], updated the\nfortify report, added the clang bug link and the other reports]\nSigned-off-by: Mickaël Salaün \u003cmic@digikod.net\u003e\n" }, { "commit": "b7c0316c1a062dbadd0d62f1b796dd3264915242", "tree": "4027fdac2db753c97e0778eccd854367b4322e50", "parents": [ "5f97a3ec36a1c2c9e4847eaf1b071707792b9035", "fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:53:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:53:11 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Don\u0027t spin on local work the exiting task can\u0027t run.\n\n For a ring still R_DISABLED when the task got its tctx node, the\n submitter is set later and may be another task, so DEFER_TASKRUN\n local work stays pending forever and the exiting task spins in\n do_exit().\n\n - Don\u0027t charge the SQ/CQ rings or provided buffer rings to\n RLIMIT_MEMLOCK. The region API conversion started charging them,\n which the rings had been exempt from.\n\n - Don\u0027t exempt disabled rings from task restrictions on register\n\n - Populate the CONNECT filter fields for a 24-byte sockaddr_in6\n\n* tag \u0027io_uring-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/cancel: don\u0027t spin on local work the task can\u0027t run\n io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n io_uring/register: don\u0027t exempt disabled rings from task restrictions\n io_uring/kbuf: don\u0027t charge provided buffer rings to RLIMIT_MEMLOCK\n io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK\n" }, { "commit": "5f97a3ec36a1c2c9e4847eaf1b071707792b9035", "tree": "0c617b328e3352aa83e0e7b0c2bbe1f9e713f509", "parents": [ "4d61397c866eb1ae656c39fa9f28766e4388776b", "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:34:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:34:34 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"This fixes a data corruption vector where a user could trick the\n exchange-range feature to add shared blocks beyond the file\u0027s EOF,\n which may then be used to modify data on another file\"\n\n* tag \u0027xfs-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: fix exchange-range-to-eof file size exchange\n xfs: stop exchanging reflink flags when exchanging mappings\n" }, { "commit": "4d61397c866eb1ae656c39fa9f28766e4388776b", "tree": "1a1aeecffd604e64e156b122da3b8776bdfac9b4", "parents": [ "b2d929a1c2a887dd046e0af2d4a06dbf4e7d87a6", "87db7795cbaaf636ae22ae031f4906db7bb77803" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:23:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:23:06 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-10-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Work around AMD TLBI Erratum #1718 (Borislav Petkov)\n\n* tag \u0027x86-urgent-2026-10-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/CPU/AMD: Fix AMD TLBI Erratum #1718\n" }, { "commit": "b2d929a1c2a887dd046e0af2d4a06dbf4e7d87a6", "tree": "14f01a6ab6f0cb190206c1f3936392ae775da7b0", "parents": [ "b88c841d11641923fa3a4da011d7202cd89df68a", "d4f25b097e46d82718bb737d4540c99b7ab0a408" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:13:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:13:52 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"Several security fixes, a significant strnlen() regression fix, and\n several other miscellaneous fixes:\n\n - Fix a regression in the Zbb-enabled strnlen() implementation when\n huge counts are specified\n\n - When userspace pointer masking is enabled, strip the tag from\n user-specified pointers in two spots in the RISC-V futex code where\n this was missing\n\n - When CONFIG_SHADOW_CALL_STACK\u003dy, use a supervisor mode-only CSR bit\n to determine whether the trap came from userspace or not, rather\n than a userspace-writable register\n\n - Reset the HSTATUS.HU bit during CPU initialization to avoid\n unexpected behavior, as the RISC-V specification does not require\n this bit to be hardware-reset\n\n - Fix the T-Head GhostWrite probing code when\n !CONFIG_ERRATA_THEAD_MAE\n\n - Fix RV32 boots using 32-bit.config by constraining NR_CPUS\n\n - Implement a workaround for SiFive MAL-9092, which requires fences\n around hypervisor load/store instructions\n\n - Fix the RISC-V patch_map() code to work properly for EXECMEM\n addresses when !CONFIG_STRICT_MODULE_RWX\n\n - Fix ptrace register set access reporting when CFI landing pad or\n shadow stack support is enabled\n\n - Avoid copying garbage into the target\u0027s vstate when\n PTRACE_SETREGSET is called with a short iov_len\n\n - Fix load_unaligned_zeropad() on RV32 kernels with\n CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS\u003dy\n\n - Fix build breakage for any userspace program that includes\n uapi/asm/vendor/mips.h\n\n - Fix a build warning for 32-bit allmodconfig builds related to\n SiFive errata\n\n - Fix misspecified inline assembly constraints in the vector context\n save/restore code\"\n\n* tag \u0027riscv-for-linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: fix load_unaligned_zeropad() fixup for RV32\n riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\n riscv: ptrace: Zero-initialize regset buffers before copyin\n riscv: ptrace: reject CFI regset access when extensions are absent\n riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds\n riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n riscv: futex: untag the user pointer before the atomic access\n riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts\n riscv: patch: fix handling of bpf-jit execmem addresses\n RISC-V: Clear HSTATUS.HU on CPU initialization\n RISC-V: errata: Add SiFive MAL-9092 workaround\n riscv: vector: Fix output operands in context save\n riscv: vector: Fix data pointer constraints in context save/restore\n riscv: limit sifive errata to CONFIG_64BIT\n riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header\n" }, { "commit": "b88c841d11641923fa3a4da011d7202cd89df68a", "tree": "5c9cec398cc29997a149322823efd5733187d8e8", "parents": [ "a5ebb76233b79db01e82e061173cb73c6d2b5c6b", "41363c27b8509bd4efcba244803edac9ba25d1b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:10:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:10:43 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - A fix for the ati_remote2 sysfs attributes handling, resolving type\n confusion after conversion to dev_groups\n\n - Updates to the xpad joystick driver adding support for the Corsair\n Novablade Pro controller (wired and 2.4 GHz wireless) and a newer\n hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox.\n\n* tag \u0027input-for-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox\n Input: xpad - add support for Corsair Novablade Pro\n Input: ati_remote2 - fix type confusion in device attribute handlers\n" }, { "commit": "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9", "tree": "8f7329cadc94d2d2e9a3e8d78ec27bd53fcf54cb", "parents": [ "d84d6c1a7f1e2de9e601703a326a4c1b7b421943" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Wed Oct 07 10:02:27 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sun Oct 11 08:23:43 2026 +0200" }, "message": "xfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE\u0027s TO_EOF flag. The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what\u0027s going wrong:\n\n\u003e Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n\u003e that gets rewritten and file1 is the one that ends up with the flag\n\u003e cleared.\n\u003e\n\u003e Start, nothing shared:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [201] [202]\n\u003e\tdonor1 size 4096 -\u003e [300]\n\u003e\tdonor2 size 4096 -\u003e [400]\n\u003e\n\u003e 1. FICLONERANGE peer\u0027s block into file1\u0027s middle slot:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [100] [202] reflink flag set\n\u003e ^^^^^ both files own block 100\n\u003e\n\u003e 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n\u003e file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n\u003e are exchanged with it:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [200] [100] [300] reflink flag set\n\u003e ^^^^^^^^^^^ still owned, now past the size\n\u003e\tdonor1 size 12288 -\u003e [202]\n\u003e\n\u003e file1 says it is one block long while it still owns three. Nothing was\n\u003e unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n\u003e\n\u003e 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n\u003e By i_disk_size this is two one-block files exchanging everything, so\n\u003e xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [400] [100] [300] reflink flag CLEARED\n\u003e\tdonor2 size 4096 -\u003e [200]\n\u003e\n\u003e Block 100 is still shared with peer.\n\u003e\n\u003e 4. pwrite(file1, 4096, 4096), which is file1\u0027s second slot, block 100.\n\u003e xfs_is_cow_inode(file1) is false, so no CoW:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100] same block, new contents\n\u003e\n\u003e Block 100 is the only one that matters here. PoC below, it reads a file\n\u003e called peer in the current directory. The filesystem needs reflink and\n\u003e exchange-range, which mkfs.xfs 7.x turns on by default.\n\nSo yes, TO_EOF is screwing up the file size even if it\u0027s actually\nexchanging the data block correctly. The following is the intended\nbehavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:\n\n\"Ignore the length parameter. All bytes in file1_fd from file1_offset\n to EOF are moved to file2_fd, and file2\u0027s size is set to\n (file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in\n file2 from file2_offset to EOF are moved to file1 and file1\u0027s size is\n set to (file1_offset+(file2_length-file2_offset)).\"\n\nIn other words, if we only exchange a portion of the file data, then we\nshould only exchange the portion of the file size that relates to the\nexchanged data. Unfortunately, the code swaps the ondisk file size and\nthe incore file sizes, which is incorrect if the caller passes in a\nnonzero offset.\n\nHaving confused the file sizes, the PoC uses a second exchange-range\ncall on what looks like a non-reflinked single-block file. Because the\nfile size is set incorrectly, exchange-range thinks it\u0027s exchanging the\nfull contents of two files and clears the reflink flag on the broken\nfile. That enables an extending write of the broken file to rewrite the\nshared block that\u0027s just past EOF. This has become known colloquially\nas refluxfs.\n\nOnce the file sizes are set correctly, the second exchange-range no\nlonger thinks that it\u0027s doing a full-contents swap, so it won\u0027t clear\nthe reflink flag on either of its file arguments.\n\nNorbert followed up to an earlier version of this patch with a second\ncomplaint about us not handling the i_disk_size state correctly:\n\n\u003e The offsets are bounded against the incore i_size but subtracted from\n\u003e the ondisk i_disk_size, so a file that has not been written back gives\n\u003e xmi_isize1 \u003d 0 + (0 - 12288).\n\u003e\n\u003e For instance, you can do:\n\u003e\n\u003e $ xfs_io -f -c \"pwrite -q 0 4096\" -c fsync file1\n\u003e $ xfs_io -f -c \"pwrite -q 0 12288\" \\\n\u003e -c \"exchangerange -s 0 -d 12288 file1\" dirty\n\u003e $ stat -c %s file1\n\u003e 0\n\u003e $ stat -c %i file1\n\u003e 131\n\u003e $ sudo xfs_io -r -c \"bulkstat_single 131\" . | grep bs_size\n\u003e bs_size \u003d 18446744073709539328\n\nThat\u0027s wrong, and the new file size update logic depends on the ondisk\ni_disk_size matching the incore i_size, so flush the pagecache as needed\nto push it upwards.\n\nLink: https://lore.kernel.org/linux-xfs/1E196589-DEBE-40AC-AFEA-D420DAAB067F@doyensec.com/\nReported-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nCc: stable@vger.kernel.org # v6.10\nFixes: 966ceafc7a4371 (\"xfs: create deferred log items for file mapping exchanges\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "d84d6c1a7f1e2de9e601703a326a4c1b7b421943", "tree": "12c73b8337b4b875fd3565ce858cbbc0cc217a55", "parents": [ "a5ebb76233b79db01e82e061173cb73c6d2b5c6b" ], "author": { "name": "Norbert Szetei", "email": "norbert@doyensec.com", "time": "Wed Oct 07 16:43:22 2026 +0200" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sun Oct 11 08:23:38 2026 +0200" }, "message": "xfs: stop exchanging reflink flags when exchanging mappings\n\nWhen an exchange covers both files from offset 0 to i_disk_size,\nxmi_can_exchange_reflink_flags() assumes every mapping moved and hands\nthe reflink flag over to the other file.\n\nThat assumption is wrong. A file can still own shared blocks past\ni_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size\nwithout unmapping anything. The flag is cleared anyway, and the next\nwrite to such a block happens in place instead of CoW, corrupting the\nother file that shares it.\n\nCommit a23eca88448e (\"xfs: fix exchange-range reflink flag clearing\nissue with INO1_WRITTEN\") fixed one instance of this. Rather than add\nanother special case, stop moving the flags.\nxfs_exchmaps_ensure_reflink() already sets the flag on both inodes\nbefore the exchange, so both just keep it.\n\nNothing sets CLEAR_INO{1,2}_REFLINK anymore. Intents logged by older\nkernels may still carry them; recovery already masks them off, so they\nstay in the log format mask and are ignored.\n\nXFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from\none inode to the other along with the extents. Just removing that is\nnot enough here: the exchange path flags both inodes up front in\nxfs_exchmaps_ensure_reflink(), but swapext has no such step, so the\ninode receiving the shared extents would be left without the flag.\nSet it on both inodes instead, and make sure both have a CoW fork,\nsince an inode with the reflink flag is expected to have one.\n\nThe flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a\ntruncate to zero removes it.\n\nFixes: 966ceafc7a43 (\"xfs: create deferred log items for file mapping exchanges\")\nFixes: f0bc4d134b46 (\"xfs: swap inode reflink flags when swapping inode extents\")\nCc: stable@vger.kernel.org # v6.10\nAssisted-by: LLM\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "a5ebb76233b79db01e82e061173cb73c6d2b5c6b", "tree": "b493225b8e2a8f99a4a25b51c1879b0b544f4aea", "parents": [ "bb934c29fda8dcd409145a0deddc1a8095fec930", "7484bc43ba6b8e189b482db5b75e7842890a82b1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:57:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:57:30 2026 -0700" }, "message": "Merge tag \u0027edac_urgent_for_v7.3_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fix from Borislav Petkov:\n\n - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND\n MSR to only two bits. It is perfectly fine to do so because no system\n ever supported more than 2 bits of information (the Chip Selects used\n were only 4 maximum) and newer hardware will use only 2 bits anyway\n\n* tag \u0027edac_urgent_for_v7.3_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/amd64: Mask UMC chip select to the four implemented selects\n" }, { "commit": "bb934c29fda8dcd409145a0deddc1a8095fec930", "tree": "5832030025fae27d15bdf8999ea7fdb61f2a8725", "parents": [ "b62f58bd7187ddbefa66913ec742137680ca5b22", "c61e23ed14359e6289c08e55940dd3401fe27db0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:50:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:50:50 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-10-11\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Ailie:\n \"Live from Dublin Airport, it\u0027s Saturday Night drm fixes.\n\n This week has the missing misc fixes from last week which I tracked\n down and seemed to be a race/bug in my lei setup somehow, once I asked\n lei to ignore it\u0027s cache I got the missing email. But there are more\n misc fixes this week and amd and intel ones.\n\n The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and\n imagination in the middle, with a bunch of small single fixes.\n\n Bit busier than I\u0027d like, but the missing misc might explain it,\n anyways time for me to fly home.\n\n fb:\n - defer setup when fbdev_probe() fails, not just on -EAGAIN\n\n bridge:\n - Fix unlocked list_del in drm_bridge_add()\n - Fix unlocked list access in drm_bridge_attach()\n - th1520-dw-hdmi:\n - Fix error check on dw_hdmi_probe() return value\n - Fix remove() callback\n\n aspeed:\n - Balance the display clock enable on teardown\n\n i915:\n - Fix a GT park race that could trigger spurious RPM wakelock\n warnings\n - Fix execbuffer relocation cleanup to avoid out-of-bounds free\n\n xe:\n - i2c removal\n - system Controller Maibox header handling\n - two bo pin/unpin accounting bugs\n - not emitting a w/a twice\n - xe_mmio_wait32() to honor delay/sleep maximums\n\n amdgpu:\n - Fix direct scanout alpha on some DRM_FORMATs\n - UserQ fixes\n - Fix tearing flips with PSR\n - GPU reset vblank fix\n - Debugfs register interface fix\n - Fix display mode patching\n - Expand Mac reserved memory workaround\n\n amdkfd:\n - SDMA doorbell fix\n - Fix dma-buf reference leak in error path\n\n imagination:\n - fix reference and vm_bo handling in remap()\n - size page table preallocation by device address\n\n gud:\n - don\u0027t keep a connector without a CRTC as connector_state\n\n panthor:\n - validate userspace queue count against initialized firmware\n slot count\n\n nouveau:\n - fix null ptr regression\n - skip turing CE workaround for non-GR\n\n vmwgfx:\n - validate pitch value\n - add blend mode property\n\n vc4:\n - drain hangcheck timer on unbind\n - free BO cache on teardown\n - use kvmalloc_objs for bo cache size list\n - disable V3D interrupt across runtime suspend\n - fix binner slot allocation\n - fix fw refcount leak\"\n\n* tag \u0027drm-fixes-2026-10-11\u0027 of https://gitlab.freedesktop.org/drm/kernel: (39 commits)\n drm/nouveau: Skip the Turing CE workaround object for non-GR channels\n drm/vc4: Fix binner slot allocation failing on an idle GPU\n drm/vc4: Disable the V3D interrupt across runtime suspend\n drm/imagination: Size page table preallocation by device address\n drm/imagination: Fix reference and vm_bo handling in remap()\n drm/amdgpu: make Mac FB workaround generic\n drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info\n drm/amd/display: Don\u0027t replace a sink mode that shares the native totals\n drm/amdkfd: align SDMA doorbell base for shader doorbell writes\n drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks\n drm/amdgpu: serialize vblank counter reads against GPU reset\n drm/amd/display: disable self-refresh on tearing flips\n drm/amdgpu/userq: return the memdup_user() error for the user MQD\n drm/amdgpu/userq: only accept doorbell BOs as queue doorbell\n drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs\n drm/xe/i2c: cancel the client work on remove\n drm/xe/sysctrl: Fix mailbox header handling\n drm/i915/gt: Unmask interrupts only when ACTIVE is true\n drm/i915/gem: Prevent overstepping exec array boundary\n drm/gud: don\u0027t keep a connector without a CRTC as connector_state\n ...\n" }, { "commit": "b62f58bd7187ddbefa66913ec742137680ca5b22", "tree": "c50cd93252da977d70acd0d5aaec92ac4b52c558", "parents": [ "3857c2fe5449541e24afc5efdb0f81a8a8f9a3a0", "ae8364085574203e7f4ea961921a1c7493bcb6de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:41:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:41:28 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fix from Andi Shyti:\n \"Just one qcom-geni fix for a runtime PM reference leak\n during transfer setup\"\n\n* tag \u0027i2c-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: qcom-geni: release runtime PM reference when set_rate fails\n" }, { "commit": "c61e23ed14359e6289c08e55940dd3401fe27db0", "tree": "4daa2c2a5b8cedb6661b37d5caf224ca932e860a", "parents": [ "492c4ded0ff7c7f162f35eea37984db5b0f2b5ba", "6ccf996a0dec1852dab94ad865f27b4904750e12" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:57:56 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:58:03 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-10-09\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA pointer assignment fix for gud, a reference fix and a preallocation\nsize fix for imagination, a suspend fix and an allocation fix when idle\nfor vc4, and a hardware variant fix for nouveau.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cself@mripard.dev\u003e\nLink: https://patch.msgid.link/asjkbknTHg2t8JGy@houat\n" }, { "commit": "492c4ded0ff7c7f162f35eea37984db5b0f2b5ba", "tree": "c8223877f505461ca772e6d8071d0d58f7c66a2c", "parents": [ "a8013cbe8d403051aae151f9e35e5f3c8af89a02", "c7f44ec5c4ec760e74351f1843dcb8322f67cbf6" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:53:22 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:57:33 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-10-08\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-10-08:\n\namdgpu:\n- Fix direct scanout alpha on some DRM_FORMATs\n- UserQ fixes\n- Fix tearing flips with PSR\n- GPU reset vblank fix\n- Debugfs register interface fix\n- Fix display mode patching\n- Expand Mac reserved memory workaround\n\namdkfd:\n- SDMA doorbell fix\n- Fix dma-buf reference leak in error path\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com\n" }, { "commit": "a8013cbe8d403051aae151f9e35e5f3c8af89a02", "tree": "8f8fb8b8a41b99f6fba07efdcd146c3289f5dd9c", "parents": [ "5a768f5f76d8833b02b00f99d246cba6c463760b", "611857adc9e7b0ee1239a0baf38498922ca5a12e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:47:12 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:47:37 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-10-08\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nFixes on:\n - i2c removal (Fan)\n - system Controller Maibox header handling (Mallesh)\n - two bo pin/unpin accounting bugs (Thomas)\n - not emitting a w/a twice (Tvrtko)\n - xe_mmio_wait32() to honor delay/sleep maximums (Alan)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com\n" }, { "commit": "3857c2fe5449541e24afc5efdb0f81a8a8f9a3a0", "tree": "9274ea2a042a38c82b47be3b6db224da687aa17d", "parents": [ "b71ccf604fbdf78450d3b17b5d69365caba29061", "79c168e2aa957ed0054c93db17caba653b95e377" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:30:04 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:30:04 2026 +0200" }, "message": "Merge tag \u0027pci-v7.3-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fix from Bjorn Helgaas:\n \"This fixes some GPU initialization regressions caused by eddba19b8b5f\n (\"PCI/AER: Support Advisory Non-Fatal Errors\"), which appeared in\n v7.3-rc1.\n\n That commit also caused a MacBookPro16,1 spontaneous power-off\n regression; I expect a fix for that next week\"\n\n* tag \u0027pci-v7.3-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI/AER: Skip error recovery on false alarms\n" }, { "commit": "b71ccf604fbdf78450d3b17b5d69365caba29061", "tree": "b4920555f63456258e849269d5425044e5fd90fd", "parents": [ "f7bec60381da152e110bb71358c0903f9bc1826e", "c96ca94425b076dc398d929366e378d1e22ec794" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:26:56 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:26:56 2026 +0200" }, "message": "Merge tag \u0027mmc-v7.3-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC/MEMSTICK fixes from Ulf Hansson:\n \"MMC host:\n - cavium-octeon|thunderx: Destroy slot platform devices on remove\n - mtk-sd: Cancel request timeout work on remove\n - sdhci-sprd: Disable runtime PM on remove\n\n MEMSTICK:\n - Wait for request completion before freeing card\n - rtsx_usb_ms: Complete requests after eject instead of dropping\n them\"\n\n* tag \u0027mmc-v7.3-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n memstick: rtsx_usb_ms: complete requests after eject instead of dropping them\n memstick: core: wait for request completion before freeing card\n mmc: cavium-thunderx: destroy slot platform devices on remove\n mmc: cavium-octeon: destroy slot platform devices on remove\n mmc: sdhci-sprd: disable runtime PM on remove\n mmc: mtk-sd: Cancel request timeout work on remove\n" }, { "commit": "f7bec60381da152e110bb71358c0903f9bc1826e", "tree": "ab8d8ad8e7ea4ff8067e499e817ffc3cd13c6c7b", "parents": [ "5f6ee187fa3a7b3cee4b9dae6c3dda6d1d3237db", "2579cbe68005f46fc7f8f95364f6b101b07b9d1c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:22:38 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:22:38 2026 +0200" }, "message": "Merge tag \u0027media/v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fix from Mauro Carvalho Chehab:\n \"A fix for em28xx unregister code affecting devices with FM radio\n support\"\n\n* tag \u0027media/v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: em28xx: use video_unregister_device for radio_dev\n" }, { "commit": "5f6ee187fa3a7b3cee4b9dae6c3dda6d1d3237db", "tree": "e81727e07120fe8efa9a65952edf53ddfee75032", "parents": [ "9a06d4b7c5feedea819a00af0db1629e43f3def4", "07c75552f7fe636a0695baae506a7d72fabd3be4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:20:08 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:20:08 2026 +0200" }, "message": "Merge tag \u0027sound-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A dozen of small fixes. All device-specific quirks or fixes, and\n nothing exciting is expected.\n\n - USB-audio and HD-audio quirks\n\n - HD-audio TAS2781 codec fix\n\n - ctxfi driver memory leak fix\n\n - ASoC AMD quirks\n\n - ASoC cs35l56 and adau1372 codec fixes\"\n\n* tag \u0027sound-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts\n ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA\n ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI\n ASoC: cs35l56: Add DAI for SDCA OT25 stream\n ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM\n ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes\n ASoC: adau1372: allow sleepy powerdown GPIOs\n ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)\n ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)\n ALSA: hda/tas2781: Accept V1 calibration data without CRC\n ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H\n ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers\n" }, { "commit": "9a06d4b7c5feedea819a00af0db1629e43f3def4", "tree": "1a85684baabf1cc57052ba5c94a1fe0fcff002f3", "parents": [ "c8d4256f1081c191773de9f46e2ad8f5e8d05d30", "4c66c423593e26273ea0d644906ed007630c6f6d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:57:46 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:57:46 2026 +0200" }, "message": "Merge tag \u0027pmdomain-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain provider fixes from Ulf Hansson:\n\n - imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl\n\n - rockchip: Fix a couple of errors during probe\n\n* tag \u0027pmdomain-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: rockchip: don\u0027t ignore clock lookup errors on attach\n pmdomain: rockchip: fix clock leak on domain probe failure\n pmdomain: rockchip: propagate subdomain add errors\n pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains\n" }, { "commit": "c8d4256f1081c191773de9f46e2ad8f5e8d05d30", "tree": "a0a4249505eef08cf3f6680574c2bb3fd3564e29", "parents": [ "fc1c25014ff8e416d75e8a5ba3b9c0ba5eb8e877", "911655ab1dfb9d526978a75df3b210132620d30a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:49:55 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:49:55 2026 +0200" }, "message": "Merge tag \u0027dma-mapping-7.3-2026-10-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two more fixes for the corner cases in the DMA-mapping SWIOTLB code\n (Peng Fan and Marek Szyprowski)\"\n\n* tag \u0027dma-mapping-7.3-2026-10-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n swiotlb: fix default_swiotlb_limit() for non-growable default pool\n iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys\n" }, { "commit": "fc1c25014ff8e416d75e8a5ba3b9c0ba5eb8e877", "tree": "310c6faafceb48f403d54f97831dcb1ac0796c06", "parents": [ "f99005fbed4e8071110faa350cc5fa453afa1455", "e58c3805ed325fe2d4ae2dd467c0486cc860b733" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:01:12 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:01:12 2026 +0200" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity fix from Eric Biggers:\n \"Fix a regression from commit f77f281b6118 (\"fsverity: use a hashtable\n to find the fsverity_info\")\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n fsverity: RCU-delay the freeing of struct fsverity_info\n" }, { "commit": "f99005fbed4e8071110faa350cc5fa453afa1455", "tree": "2e5e41e0cadba5b7c961a82a7c17d00439bf0751", "parents": [ "9515f634dbed2bb8928fbb3b01102dd4e64f4aeb", "3d399224425573875b6f6f1181bd8cf9a28cc7d1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:37:44 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:37:44 2026 +0200" }, "message": "Merge tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n \"This contains fixes for the current development cycle.\n\n All of them came out of a review of the mount code that started with a\n bug report. The review modeled the corner cases of mount propagation,\n unmounting and mount reference counting and turned up a lot of bugs.\n Most of them years old. Most fixes come with a selftest.\n\n - Rework connected mounts.\n\n A mount that is unmounted together with its parent can stay\n attached to the parent to keep its mountpoint covered. That happens\n when the mountpoint is removed with rmdir(), unlink() or rename(),\n when a detached tree is dissolved, and for locked mounts in any\n umount that isn\u0027t synchronous, including the teardown of their\n mount namespace. The parent then owns the child and drops it on its\n own final mntput(). So any reference from the child\u0027s superblock\n back to one of its ancestors becomes a cycle that is never freed.\n\n A loop device backed by an image on a tmpfs and mounted on that\n same tmpfs is enough. Remove the directory the tmpfs is mounted on\n from the host, let the container\u0027s mount namespace exit, and the\n loop device, the tmpfs and the filesystem on the loop device are\n leaked for good. The same works with autofs, zram, ecryptfs,\n binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md,\n and the selftests have reproducers for them. This has been possible\n since v4.1. It is also why \"put_mnt_ns(): leave mounts connected\"\n was reverted in -rc5. Keeping every mount of a dying mount\n namespace connected made these cycles trivial to create.\n\n Every unmounted mount is now detached from its parent. Where the\n mountpoint has to stay covered the mount leaves a cover on the\n parent instead, allocated together with the mount. A lookup on the\n unmounted parent that hits a cover finds an empty immutable\n directory or file on the private nullfs instance. Nothing leads\n from a cover to another mount, so no unmounted mount owns another\n one and no cycle can form.\n\n This is visible to userspace. A formerly connected mount can no\n longer be reached through its unmounted parent and \"..\" inside it\n leads nowhere, as for every other lazily unmounted mount.\n\n With that the private nullfs instance becomes reachable from\n userspace, so it now refuses mounts on top, is mounted read-only,\n and refuses fsnotify marks and file locks. Its inodes are shared by\n every holder and a watch or a lock would otherwise reach across\n users. may_decode_fh() now also decides its subtree check under a\n single mount_lock hold, as a racing umount could otherwise let it\n decode into what a locked child covered.\n\n - umount:\n\n * Don\u0027t silently unmount busy mounts.\n\n Since v4.13 propagate_umount() takes down propagated copies of\n the victim with children as long as each child is an overmount or\n another copy of the victim, but propagate_mount_busy() only ever\n checked copies without children or with just an overmount. A\n container that moved a tree beneath its copy of a host mount lost\n that tree from under its open file descriptor to a plain umount()\n on the host. propagate_mount_busy() now applies the same rules,\n walking each chain of copies once.\n\n * Don\u0027t let a migrating task hide its reference from umount().\n\n mnt_get_count() sums the per-cpu counters under mount_lock but\n the mntget() and mntput() fast paths don\u0027t take it. A task that\n takes a reference on a cpu the sum has already passed and drops\n it after migrating to one the sum hasn\u0027t reached yet hides the\n reference it held to begin with, and umount() succeeds with the\n file still open. Gets and puts now live in separate per-cpu\n counters and all puts are summed before all gets with a full\n barrier in between, the way srcu_readers_active_idx_check() does\n it. mntget() is unchanged and mntput() gains an smp_wmb().\n\n * Check each submount for references right before unmounting it.\n\n shrink_submounts() and mark_mounts_for_expiry() checked all their\n victims up front. Unmounting the first could move a busy\n overmount to where the next victim\u0027s propagated copy is looked up\n and it was then unmounted without a check.\n\n * Never expire a locked mount.\n\n A shrinkable mount moved beneath a locked mount with\n MOVE_MOUNT_BENEATH takes over the lock, and umount() of an\n unlocked ancestor expired it and revealed what it covered. That\n umount() now fails with EBUSY as it does for any other locked\n child. A lazy umount still takes the whole tree.\n\n - Overmounts and locked mounts:\n\n * Unhash a dentry before detaching the mounts on it.\n\n unlink(), rmdir() and rename() detach the mounts on the victim\n but only d_delete() it once its inode is unlocked, a window that\n includes an expedited RCU grace period. In between, a lookup from\n a mount namespace in which the dentry is a mountpoint found it\n hashed, positive and uncovered. Drop the dentry first, as\n d_invalidate() already does.\n\n * Don\u0027t reveal overmounted entries in refwalk.\n\n A refwalk that had grabbed the dentry before the unlink never\n rechecked it the way rcuwalk does with d_seq and mount_lock.\n Without any artificial widening three walkers read the covered\n file 27 times in a minute. step_into() now fails an unhashed\n dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is\n retried.\n\n * Keep covered mounts covered in OPEN_TREE_NAMESPACE.\n\n Creating such a mount namespace only takes a user namespace and\n the copy followed bind mount rules: no children without\n AT_RECURSIVE and no unbindable mounts with it. An unprivileged\n user could see what mounts covered in the source, such as the\n parts of /proc and /sys that container runtimes mask. If the\n caller doesn\u0027t own the source mount namespace a non-recursive\n copy of a mount with something mounted below the requested\n directory is now refused and a recursive copy includes unbindable\n mounts, the way unshare() copies.\n\n * Keep the lock on a mount that a propagated copy is moved beneath.\n\n MNT_LOCKED moved to any mount that ended up beneath a locked\n mount, propagated copies included. A host mount and umount on a\n directory covered by a locked mount in a less privileged mount\n namespace left that cover unlocked for the namespace\u0027s owner to\n remove. Only mounts the caller places beneath take over the lock\n now.\n\n * Handle mount locking for automounts correctly. Which copies to\n lock was decided by the mount namespace of the task that\n triggered the automount. A task in a user namespace that\n triggered one on a host mount through a file descriptor got the\n host\u0027s own automount locked while its own copy stayed unlocked\n and could have nosuid, nodev and noexec cleared. Use the owner of\n the mount namespace the mount lands in.\n\n - Use-after-free and crashes:\n\n * Refuse an automount below a mount that is in no namespace.\n\n The private clones overlayfs uses for its layers have the\n MNT_NS_INTERNAL error pointer as their namespace, which\n finish_automount() let through and count_mounts() dereferenced. A\n fanotify filesystem mark on an overlayfs lower layer hands out\n file descriptors on such a clone. With debugfs as the lower layer\n opening \"tracing\" oopses with namespace_sem held for writing and\n every mount operation on the system blocks from then on.\n\n * Reset the old parent\u0027s -\u003eovermount in mnt_change_mountpoint().\n When propagate_umount() moved an overmount off a mount that a\n file descriptor kept alive, MOVE_MOUNT_BENEATH through that\n descriptor later followed the stale pointer into the freed\n overmount.\n\n * statmount() with STATMOUNT_BY_FD and pivot_root() read the parent\n of a mount that may be unmounted and only held by a file\n descriptor, while the parent\u0027s final mntput() can free it.\n statmount() now reads it under mount_lock and pivot_root() first\n checks that both mounts are in the caller\u0027s mount namespace.\n\n * Queue a mount only once for mount notifications. A mount\n reparented by one umount_tree() and taken down by the next under\n the same namespace_sem hold, as in shrink_submounts(), was queued\n twice. That cut the mounts queued in between out of notify_list\n while it still pointed at them, and once they were freed every\n later mount operation walked freed memory.\n\n * Don\u0027t let a pseudo dentry become the root of a mount. A bind\n mount of a bpf token file did that with a DCACHE_NORCU dentry,\n which is freed without an RCU grace period while lockless path\n walks may still look at it. Refuse to clone such a mount.\n\n * Don\u0027t inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily\n unmounted nsfs or pidfs mount through its file descriptor started\n out flagged as unmounted. Among other things __detach_mounts()\n then dropped the namespace\u0027s reference on it, the mount outlived\n its namespace and mount_setattr() through the descriptor read the\n freed namespace. A recursive bind mount of such a mount also\n copied the unmounted stack still attached to it. That now fails\n with EINVAL, copying the mount itself still works.\n\n * Remove the fsnotify marks of a mount namespace in free_mnt_ns()\n instead of the RCU callback that frees the namespace, where\n taking the group mutexes meant sleeping in softirq context.\n\n - Propagation and copies:\n\n * Keep a copied mount unbindable. Since v6.17 clone_mnt() didn\u0027t\n copy the unbindable flag, so every mount namespace created with\n CLONE_NEWNS had bindable copies of all unbindable mounts. This\n had been fixed once before.\n\n * Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the\n mount an unbindable slave, a state nothing else can produce, or\n silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE\n after restoring sharing and isn\u0027t affected.\n\n * Check a recursive bind mount for mount namespace loops.\n\n Recursively bind mounting a tree from another mount namespace\n could put a mount of a namespace\u0027s file inside that same\n namespace, which then pins itself and all its mounts. Repeating\n it leaks without limit, the reproducer took Shmem from 380 kB to\n 65916 kB. The copy is now checked with check_for_nsfs_mounts()\n before it is grafted, as move_mount() does.\n\n * Look at the topmost mount for a mount namespace file.\n\n attach_recursive_mnt() never looked at the topmost mount of the\n source\u0027s chain of overmounts. If that was the chain\u0027s only mount\n namespace file an existing mount at a propagated destination got\n buried below the root of the nsfs file where no path walk reaches\n it.\n\n * Don\u0027t put a mountpoint on a dentry that\u0027s being removed.\n\n attach_recursive_mnt() makes a mountpoint of the source\u0027s root\n without its inode lock, so a racing rmdir() of that directory\n could leave a mount on it that nothing ever detaches.\n d_set_mounted() now checks cant_mount() as well.\n\n - nullfs:\n\n * Take no inode lock for readdir of an immutable directory.\n\n The root of every empty mount namespace is the same nullfs\n directory and iterate_dir() held its i_rwsem across\n -\u003eiterate_shared(). A reader whose buffer faults on a FUSE mount\n of its own holds it for as long as its server wants, and with an\n exclusive locker queued behind it every lookup that misses the\n dcache, every create and every mount in that directory waits. One\n user of an empty mount namespace stalls all others. Directories\n with the new FOP_IMMUTABLE flag skip the lock.\n\n * Refuse to reconfigure internal superblocks through fspick(),\n MS_REMOUNT or the read-only remount that a synchronous umount()\n of the root does. For nullfs only root in the initial user\n namespace could do it, but the superblock is shared by every\n mount namespace and the flags showed up in statfs() for all of\n them.\n\n * Don\u0027t update the access time on nullfs and refuse F_SET_RW_HINT\n on an immutable inode.\n\n - unshare: Free an nsproxy that was never installed with\n nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped\n active references that were never taken, which triggered a warning\n and hid the caller\u0027s own namespaces from listns().\n\n - Smaller changes: mount_setattr() checks the target before it walks\n the tree to allocate peer group ids, unshare() puts the old\n fs_struct before the old namespaces, dissolve_on_fput() drops the\n file\u0027s reference to the tree itself, disconnect_mount() is\n simplified and the documentation of the propagated unmount rule is\n brought up to date\"\n\n* tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits)\n namespace: simplify disconnect_mount()\n selftests/filesystems: test covered mounts\n namespace: rework connected mounts\n nullfs: add an empty immutable regular file\n selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody\n selftests/filesystems: add a helper that holds a readdir in a page fault\n readdir: take no inode lock on an immutable directory\n nullfs: refuse file locks\n fsnotify: let a filesystem refuse marks on its objects\n namespace: nothing is mounted on or written through knullfs\n namespace: keep the private nullfs instance in knullfs\n fhandle: decide the subtree check under mount_lock\n selftests/filesystems: check that an automount below an overlay layer is refused\n selftests/filesystems: check the atime of the empty mount namespace root\n selftests/filesystems: check that a lock lands on the right mount and stays\n namespace: keep the lock on a mount that a propagated copy is moved beneath\n namespace: never expire a locked mount\n nullfs: don\u0027t update the access time\n namespace: handle mount locking for automounts correctly\n namespace: refuse an automount below a mount that is in no namespace\n ...\n" }, { "commit": "9515f634dbed2bb8928fbb3b01102dd4e64f4aeb", "tree": "0d1f379dc24d0d6a54716680535b3f62006f6fab", "parents": [ "af32da41b0327b9c6a37856ba82b6760d6c8d10e", "a9cd14bfb0c113f1cd77be4349784663bec71bb4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:32:55 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:32:55 2026 +0200" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"It finally seems to have calmed down on the arm64 fixes front, so\n please pull these two straightforward fixes for -rc7. One fixes the\n EL2 trap configuration for implementation-defined CPU PMU hardware\n during boot and the other fixes a kcov selftest failure by excluding\n our softirq early entry code:\n\n - Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU\n\n - Fix kcov boot selftest failure by excluding our early IRQ entry\n code\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: irq: exclude the softirq stack switch from KCOV\n arm64/boot: Don\u0027t set PMUv3p9 FGT2 bits without PMUv3\n" }, { "commit": "41363c27b8509bd4efcba244803edac9ba25d1b5", "tree": "b0369d2b5d7f86d94d8994b118ca0af194668798", "parents": [ "f9282b8aa85a8c97c50d656db75feb6d76fc7cbe" ], "author": { "name": "Bihaan Sen", "email": "stevewholikesthings@gmail.com", "time": "Fri Sep 25 17:14:38 2026 +0530" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:19:05 2026 -0700" }, "message": "Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox\n\nThe 8BitDo Pro 2 Wired Controller for Xbox is already matched by the\nvendor-wide XPAD_XBOXONE_VENDOR(0x2dc8) entry, but a later hardware\nrevision reports product ID 0x201e, which has no entry in the\nxpad_device table. The device therefore binds and functions but is\nexposed to userspace as \"Generic X-Box pad\".\n\nAdd the VID/PID pair so the controller is named correctly, and set\nMAP_SHARE_BUTTON to expose the share button as KEY_RECORD.\n\nSigned-off-by: Bihaan Sen \u003cstevewholikesthings@gmail.com\u003e\nLink: https://patch.msgid.link/20260925114459.110253-1-stevewholikesthings@gmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f9282b8aa85a8c97c50d656db75feb6d76fc7cbe", "tree": "7a5e79c3ff12c16f15021e19a187459d54dcc1b8", "parents": [ "f321cc430c49b6c1be0d53f2ef19d8342d8029cc" ], "author": { "name": "Krzysztof Furman", "email": "krisfur@proton.me", "time": "Fri Oct 09 15:47:10 2026 +0100" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:15:35 2026 -0700" }, "message": "Input: xpad - add support for Corsair Novablade Pro\n\nAdd device IDs for the Corsair Novablade Pro leverless fight controller\nin both wired (0x2b1f) and 2.4 GHz receiver (0x2b2b) modes, and add\nCorsair\u0027s vendor ID to the Xbox 360 vendor match list.\n\nOutside of its PS4/PS5 modes the controller uses the Xbox 360 protocol\n(vendor-specific class, subclass 93, protocol 1) on interface 0, which\nxpad does not currently bind, so no gamepad device is created. The\nPS4/PS5 modes present a standard HID gamepad and already work with\nhid-generic.\n\nTested on 7.2.5 with the 2.4 GHz receiver and wired.\n\nAssisted-by: Claude Opus 5.5\nSigned-off-by: Krzysztof Furman \u003ckrisfur@proton.me\u003e\nLink: https://patch.msgid.link/20261009-xpad-corsair-novablade-v1-1-e58746bef99f@proton.me\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f321cc430c49b6c1be0d53f2ef19d8342d8029cc", "tree": "eb5dd4fd022b53887e9eabed4d1cb7c91b568d23", "parents": [ "3bf8d603fd45649c106cae6290a10f20b1bbb569" ], "author": { "name": "Haotian Zhang", "email": "vulab@iscas.ac.cn", "time": "Fri Oct 09 10:48:25 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 10:58:35 2026 -0700" }, "message": "Input: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data.\n\nFixes: b20d6bf8014b (\"Input: ati-remote2 - use driver core to instantiate device attributes\")\nAssisted-by: DeepSeek-V4.1-Flash\nSigned-off-by: Haotian Zhang \u003cvulab@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20261009040302.3087205-1-vulab@iscas.ac.cn\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7", "tree": "b1379df89b350034d5593dc13d2355dd7675a684", "parents": [ "aa5d5f8e502318e783545ba5d04bb40130b83e20" ], "author": { "name": "Cen Zhang (Microsoft Security FORGE Labs)", "email": "cenzhang@linux.microsoft.com", "time": "Thu Oct 08 15:16:02 2026 -0400" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:33:09 2026 -0600" }, "message": "io_uring/cancel: don\u0027t spin on local work the task can\u0027t run\n\nio_uring_cancel_generic() refuses to sleep while any ring on the exiting\ntask\u0027s tctx has local work pending. It assumes the task is that ring\u0027s\nsubmitter and that the next io_uring_try_cancel_requests() pass will run\nthe work. This does not hold for a ring that was still\nIORING_SETUP_R_DISABLED when the task got its tctx node from\nio_uring_create() or io_ringfd_register(). The submitter is set later by\nIORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the\nsubmitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To\nthe exiting task the work stays pending forever, the loop never reaches\nschedule(), and the task trips the WARN_ON_ONCE() once and then spins in\ndo_exit().\n\nAn unprivileged user can set this up at will by creating a disabled\nring, having a child enable it and stop, posting to the ring with\nIORING_OP_MSG_RING and exiting with a request in flight that only the\nchild can complete. The exiting thread burns a CPU until the child runs\nor dies, and with panic_on_warn set the WARN panics the kernel.\n\nFix by skipping the sleep only when io_allowed_defer_tw_run() allows the\ntask to run the work. This is reasonable since work it cannot run cannot\ncomplete any of its requests either, so nothing is lost by sleeping.\nDrop the WARN_ON_ONCE() since handing a disabled ring to another thread\nis a supported scenario, not a bug state.\n\nFixes: 360cd42c4e95 (\"io_uring: optimise io_req_local_work_add\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nSigned-off-by: Cen Zhang (Microsoft Security FORGE Labs) \u003ccenzhang@linux.microsoft.com\u003e\nLink: https://patch.msgid.link/20261008191602.45101-1-cenzhang@linux.microsoft.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "aa5d5f8e502318e783545ba5d04bb40130b83e20", "tree": "67c6256f0e53e7a056e8240e01f87bf773f5d16c", "parents": [ "6da8f402e362b2f546e2efb7167fc9597aef6faf" ], "author": { "name": "Natasha Klaus", "email": "natalie.klaus@runtimeverification.com", "time": "Fri Oct 09 16:38:07 2026 +0300" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:33:09 2026 -0600" }, "message": "io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len \u003e\u003d sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port \u003d\u003d P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode.\n\nFixes: 899bea8248ce (\"io_uring/net: allow filtering on IORING_OP_CONNECT\")\nCc: stable@vger.kernel.org # 7.2\nSigned-off-by: Natasha Klaus \u003cnatalie.klaus@runtimeverification.com\u003e\nLink: https://patch.msgid.link/20261009133807.730724-1-natalie.klaus@runtimeverification.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "6da8f402e362b2f546e2efb7167fc9597aef6faf", "tree": "549fbcfcac9ac4135e5ce4878f2fd125954aed5b", "parents": [ "cde56daf4b93f474dc256dbcc5205035223ae6f5" ], "author": { "name": "Eugene Gvozdetsky", "email": "gvozdet@gmail.com", "time": "Fri Oct 09 01:08:49 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:32:55 2026 -0600" }, "message": "io_uring/register: don\u0027t exempt disabled rings from task restrictions\n\nA ring created with IORING_SETUP_R_DISABLED is exempt from its register\nrestrictions until it is enabled. This lets the creator register the\nrestrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,\nwhether or not that opcode is in the allowed set.\n\nSince commit ed82f35b926b (\"io_uring: allow registration of per-task\nrestrictions\"), a ring also inherits restrictions from the task that\ncreates it, and the same exemption applies to those. A task whose\nregister opcodes are restricted can therefore create a disabled ring,\nissue any register opcode on it, and then enable it.\n\nMark rings whose restrictions were inherited from the task, and keep\nchecking register opcodes for them while the ring is disabled. Enabling\nsuch a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the\ntask\u0027s allowed set. Per-ring restrictions registered on a disabled ring\nwork as before.\n\nFixes: ed82f35b926b (\"io_uring: allow registration of per-task restrictions\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5-5\nSigned-off-by: Eugene Gvozdetsky \u003cgvozdet@gmail.com\u003e\nLink: https://patch.msgid.link/20261009-iouring-task-restrict-fix-v1-1-a49daf55a12c@gmail.com\n[axboe: amend with inheritance flag fixup]\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "cde56daf4b93f474dc256dbcc5205035223ae6f5", "tree": "26080bca928a985c1fa634edff765e481ea3e40e", "parents": [ "b59cabf9b4acb65f3f9968087ca0e18010d85076" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Oct 08 13:07:38 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:20:41 2026 -0600" }, "message": "io_uring/kbuf: don\u0027t charge provided buffer rings to RLIMIT_MEMLOCK\n\nJust like with the SQ and CQ rings, the provided buffer rings were also\nnot charged against the memlock limit prior to the below mentioned\ncommit. Restore that behavior.\n\nFixes: ef62de3c4ad5 (\"io_uring/kbuf: use region api for pbuf rings\")\nReported-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nCc: stable@vger.kernel.org\nTested-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "af32da41b0327b9c6a37856ba82b6760d6c8d10e", "tree": "1908c1d636394d7ab56ed3e469eb41e9cd357fd6", "parents": [ "6c377d19d4a5116d9bec5203aa3c6c11523e7898", "37f12441f557468a56c1e27790413aa78c82afa2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "message": "Merge tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from wireless, wireguard, CAN and Bluetooth.\n We have one known regression to wrap up in VLAN handling.\n\n Current release - regressions:\n\n - Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex\n\n Previous releases - regressions:\n\n - can: fix regression in handling RPS after migrating metadata to skb_ext\n\n - eth:\n - iavf: fix regressions in reconfig impacting bonding\n - mana: fix packet forwarding performance regression\n - stmmac: remove buggy VLAN acceleration support\n\n Previous releases - always broken:\n\n - a few high prio fixes for tun, and af_packet\n\n - amt: fix a UaF on tunnel teardown\n\n - eth:\n - bnxt: fix PCIe AER recovery and FLR handling issues\n - macb: don\u0027t modify Tx skbs before taking ownership\n - axienet: don\u0027t leak Tx skbs on interface stop\n\n - wifi:\n - nxpwifi: number of LLM-ish fixes\n - assorted mt76 fixes\"\n\n* tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)\n net: macb: copy shared skbs before appending the FCS\n net: macb: check TX ring before modifying skb\n vsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n wireguard: noise: reject response consumption after intermediate initiation\n wireguard: queueing: preserve tstamp_type when encapsulating packet\n net: openvswitch: validate transport header presence in set_ipv6_addr\n net/smc: protect clcsock lifetime in smc_getname\n ipv6: do not warn on route notification size race\n ipv4: do not warn on route notification size race\n ipv4: validate checksum_start before completing checksum\n ptp: ocp: fix PCIe delay estimation calculation\n xen/netfront: don\u0027t leak the skb when xennet_fill_frags() fails\n net/packet: call packet_parse_headers after virtio_net_hdr_to_skb\n xen/netfront: drop RX packets with a short Ethernet header\n net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n net: sparx5: free the matchall entry on destroy\n selftests: mlxsw: Test port range occupancy on template create\n mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n net: dsa: microchip: fix KSZ8765 fiber detection\n net/mlx5e: Order ICOSQ cc update after CQ doorbell\n ...\n" }, { "commit": "6ccf996a0dec1852dab94ad865f27b4904750e12", "tree": "99390fd342d15271103c45caad0cde813093052a", "parents": [ "cca01232d94adcb10f7c8c5bb8ce072b045fcb58" ], "author": { "name": "Mary Guillemard", "email": "mary@mary.zone", "time": "Wed Oct 07 16:30:15 2026 +0200" }, "committer": { "name": "Lyude Paul", "email": "lyude@redhat.com", "time": "Thu Oct 08 18:14:46 2026 -0400" }, "message": "drm/nouveau: Skip the Turing CE workaround object for non-GR channels\n\nThis workaround is here for the old Gallium driver and predate async CE\nand NVDEC. Instead of only skipping it for NVDEC, let\u0027s only apply it\nin case of GR channels.\n\nThis should make async CE work properly on Turing by stopping the assign\nof a GRCE. (here CE0)\n\nSigned-off-by: Mary Guillemard \u003cmary@mary.zone\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nReviewed-by: Daniel Almeida \u003cdaniel.almeida@collabora.com\u003e\nSigned-off-by: Lyude Paul \u003clyude@redhat.com\u003e\nLink: https://patch.msgid.link/20261007-turing-async-ce-fix-v1-1-12ee6ccd1a3c@mary.zone\n" }, { "commit": "79c168e2aa957ed0054c93db17caba653b95e377", "tree": "254c799e92bc304ba52721cf1d85d90d2020626e", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Lukas Wunner", "email": "lukas@wunner.de", "time": "Thu Oct 08 14:26:00 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Thu Oct 08 14:33:04 2026 -0500" }, "message": "PCI/AER: Skip error recovery on false alarms\n\nAlex is seeing a probe failure of the amdgpu driver after the Root Port\nabove an AMD Navi10 GPU has been reset. The reset was performed to recover\nfrom a Firmware First reported Fatal Error.\n\nHowever all status registers in the Root Port\u0027s AER Extended Capability are\nblank, so apparently the platform firmware raised a false alarm.\n\nThe issue is only occurring since commit eddba19b8b5f (\"PCI/AER: Support\nAdvisory Non-Fatal Errors\"). It looks like enabling Advisory Non-Fatal\nErrors causes code paths to be exercised in platform firmware which were\nnever validated before.\n\nSkip error recovery on false alarms, i.e. if no unmasked errors were\nactually signaled.\n\nNote that this will also skip recovery if both the Status and Mask\nregisters are \"all ones\", as would be the case for inaccessible devices.\nHowever that seems justified because it would imply either a hot-unplug\nevent or a Surprise Down Error further up in the hierarchy. Interfering\nwith recovery from that seems uncalled for.\n\nFixes: eddba19b8b5f (\"PCI/AER: Support Advisory Non-Fatal Errors\")\nReported-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d222095\nSigned-off-by: Lukas Wunner \u003clukas@wunner.de\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/0552ed277e40a288e0157af799257ee6ec722534.1791460615.git.lukas@wunner.de\n" }, { "commit": "cca01232d94adcb10f7c8c5bb8ce072b045fcb58", "tree": "08a173557f1c3eb715599ffa6e160bb0407dacba", "parents": [ "6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Wed Sep 30 15:20:44 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Oct 08 16:21:07 2026 -0300" }, "message": "drm/vc4: Fix binner slot allocation failing on an idle GPU\n\nA job\u0027s binner slots are returned to bin_alloc_used by vc4_complete_exec(),\nwhich runs from the job_done workqueue, but the seqno\nvc4_v3d_get_bin_slot() waits on is incremented earlier, in the function\nvc4_irq_finish_render_job(). Therefore, a waiter can wake, retry, and still\nfind the pool full because the worker has not run. By then, the job might\nhave left the render_job_list, so no seqno remains to wait on and the\nallocation fails returning -ENOMEM.\n\nThis scenario can be reproduced on a Raspberry Pi 3 by using a burst of\nsmall jobs (e.g. Piglit\u0027s `quick_gl` suite), with userspace seeing a\nrejected submit for a pool about to become free.\n\nNote that the slots are held from validation until the render completes,\nso the pool can also be exhausted by jobs still queued on bin_job_list,\nleaving render_job_list empty and nothing to wait on.\n\nRelease the slots from the FRDONE handler and wait on the pool instead of\non one job\u0027s seqno. This bounds the wait to the actual resource. Also, by\nclaiming the slot inside the wait condition, another submit is unable to\ntake the slot between the wakeup and the retry. vc4_complete_exec() keeps\nclearing the slots for jobs that never completed, and now wakes the\nwaiters too.\n\nNote that the wait takes a deadline, since the two callers need different\nones. The submit path is a user task and can be interrupted, so it waits\nwithout one. On the other hand, vc4_overflow_mem_work() runs on a worker\nand never sees a signal, so it needs a deadline. During a reset,\nvc4_irq_disable() masks V3D_DRIVER_IRQS before draining the worker, and\nwith those masked nothing can release a slot. This deadlocks: the worker\nwould wait for slots that only the reset can free, while the reset waits\nin cancel_work_sync() for the worker.\n\nFixes: 553c942f8b2c (\"drm/vc4: Allow using more than 256MB of CMA memory.\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nLink: https://patch.msgid.link/20260930182204.1877361-1-mcanal@igalia.com\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f", "tree": "b721b4c7c31f55d2a856c401909df001ae0b0d67", "parents": [ "789f290b2e81d42820bddcb4010ffbc2ae2ded54" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Fri Sep 25 16:10:19 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Oct 08 16:20:06 2026 -0300" }, "message": "drm/vc4: Disable the V3D interrupt across runtime suspend\n\nvc4_irq_disable() masks the V3D interrupt sources and then calls\nsynchronize_irq() before the V3D is powered down. However, by itself,\nthis is not enough to quiesce the interrupt handler.\n\nsynchronize_irq() waits for handlers that have already set\nIRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.\nA GIC interrupt chip is able to mark an interrupt active as soon as a\nCPU acknowledges it, so there these checks cover the whole dispatch path.\nOn RPi 0-3, however, the interrupt controller is ARMCTRL, which has no\nactive state. A CPU that has read the hwirq out of the pending register\nbut has not yet reached handle_level_irq() stays invisible to\nsynchronize_irq().\n\nDuring a power transition, vc4_irq() may therefore run after the power\ndomain is off, where every V3D register read will return 0xdeadbeef.\n0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn\u0027t\ntrigger NULL pointer dereference issues only because the functions\nvc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early\nwhen there is no job pointer, but OUTOMEM is still able to schedule\nvc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.\n\nTherefore, fix the spurious interrupts by disabling the interrupt line\nacross the PM transition. To preserve the enable/disable balance, move\nvc4_irq_install() and request the IRQ line disabled before the first\nruntime resume.\n\nFixes: 9b6f461582e6 (\"drm/vc4: v3d: Stop disabling interrupts\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nLink: https://patch.msgid.link/20260925191318.541938-1-mcanal@igalia.com\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "b59cabf9b4acb65f3f9968087ca0e18010d85076", "tree": "b96b8138447ea250ae4932cf6298671d4375861d", "parents": [ "a92193c91e8839fe5fc209616ea95465ae4b919d" ], "author": { "name": "Hengyu Liang", "email": "hengyul@cs.unc.edu", "time": "Tue Oct 06 08:57:32 2026 -0400" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Oct 08 13:07:38 2026 -0600" }, "message": "io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK\n\nCommit 8078486e1d53 (\"io_uring: use region api for SQ\") and commit\n81a4058e0cd0 (\"io_uring: use region api for CQ\") made io_uring_setup()\nallocate the rings with io_create_region().\n\nHowever, io_create_region() charges the memory to RLIMIT_MEMLOCK, and\nthe rings had been exempt from that limit since commit 26bfa89e25f4\n(\"io_uring: place ring SQ/CQ arrays under memcg memory limits\"). As of\nnow, a user without CAP_IPC_LOCK gets ENOMEM from io_uring_setup() when\ntheir rings exceed the limit, which is 8 MiB by default. PostgreSQL\ndevelopers have already hit this in their io_uring tests [1].\n\nThe issue can be reproduced with a simple liburing program, run as an\nunprivileged user:\n\n #include \u003cliburing.h\u003e\n #include \u003cstdio.h\u003e\n\n int main(void)\n {\n static struct io_uring ring[64];\n int i;\n\n for (i \u003d 0; i \u003c 64; i++)\n if (io_uring_queue_init(4096, \u0026ring[i], 0) \u003c 0)\n break;\n printf(\"%d rings\\n\", i);\n return 0;\n }\n\nBefore those commits (v6.13), it prints \"64 rings\". After those commits\n(v6.14), it prints \"21 rings\".\n\nThis patch makes io_create_region() take the user to charge, and passes\nno user for the SQ/CQ rings.\n\nLink: https://www.postgresql.org/message-id/flat/667f7dcf-404b-4898-a426-57ca6e0617f6@gmail.com [1]\nFixes: 8078486e1d53 (\"io_uring: use region api for SQ\")\nFixes: 81a4058e0cd0 (\"io_uring: use region api for CQ\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nLink: https://lore.kernel.org/io-uring/20261006125732.3425762-1-hengyul@cs.unc.edu/\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "37f12441f557468a56c1e27790413aa78c82afa2", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3", "9151d6c42799105e109c8b54dbaad91ce0e17c47" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:54 2026 -0700" }, "message": "Merge branch \u0027net-macb-fix-software-fcs-handling-of-shared-and-requeued-skbs\u0027\n\nNicolai Buchwitz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: macb: fix software FCS handling of shared and requeued skbs\n\nWhile testing the genet MTU series I used a Raspberry Pi CM5 (RP1 GEM)\nas pktgen source for the CM4. With clone_skb the CM5 rebooted after a\nfew seconds. Further investigation showed that macb_pad_and_fcs()\nappends the FCS in place, so the shared skb grows with every transmit\nuntil BQL completes more than was queued and dql_completed() hits its\nBUG_ON.\n\nThe same code also modifies the skb before the TX ring check, so a\nNETDEV_TX_BUSY retry gets an skb that was already replaced or grown.\n\nPatch 1 checks the ring first, patch 2 copies shared skbs.\n\nTested on Raspberry CM5 with pktgen at 60/20000 bytes, clone_skb 0/\n1000, burst 1/32.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-0-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9151d6c42799105e109c8b54dbaad91ce0e17c47", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "6b48ed85ae0ca37c7403ef5d512be75975844f2f" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: copy shared skbs before appending the FCS\n\nmacb_pad_and_fcs() appends the FCS in place when the skb has tailroom.\nA shared skb, as pktgen sends in clone_skb mode, grows by one FCS per\ntransmit. BQL then completes more bytes than were queued and\ndql_completed() hits its BUG_ON.\n\nOn a Raspberry Pi CM5 (RP1 GEM) pktgen with clone_skb 1000 burst 32 at\n60 bytes kills the box within seconds.\n\nCopy shared skbs before appending the FCS. Clearing IFF_TX_SKB_SHARING\nwould also fix it but makes pktgen refuse clone_skb on macb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-2-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6b48ed85ae0ca37c7403ef5d512be75975844f2f", "tree": "009f5227692a79a54dc6d9f5da534e11059f1f99", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: check TX ring before modifying skb\n\nmacb_pad_and_fcs() replaces or extends the skb before the ring space\ncheck. On NETDEV_TX_BUSY the stack requeues an skb that is already freed\nor grown.\n\nCheck the ring first, using the padded length for the descriptor count.\nNonlinear skbs always take the copy path so the count can assume a\nlinear skb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-1-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c24a4e87e219072e5e106f6791146cbf3b056b3", "tree": "c2a0498021ae56990a1be3cd207ba25477c780b7", "parents": [ "fe4167bf53b61405f97614f644f6a63a5d6ad034" ], "author": { "name": "Ilia Gavrilov", "email": "Ilia.Gavrilov@infotecs.ru", "time": "Thu Oct 08 14:41:17 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:46:13 2026 -0700" }, "message": "vsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n\nDuring the closure of a datagram socket, the vmci_transport_recv_dgram_cb()\nfunction may be called, which will add the packets\nto the socket\u0027s backlog; then, after the receive queue is cleared,\nthe __release_sock() function will move the packet back from the socket\u0027s\nbacklog to the receive queue, which will lead to a memory leak.\n\nsock_close\n __sock_release\n __vsock_release\n // take ownership by user-space\n lock_sock_nested\n sock_set_flag(sk, SOCK_DEAD)\n vmci_transport_release\n vmci_dispatch_dgs\n vmci_datagram_invoke_guest_handler\n vmci_transport_recv_dgram_cb\n sk_receive_skb\n if (!sock_owned_by_user(sk))\n [...]\n (!) else if sk_add_backlog()\n [...]\n (!) skb_queue_purge(\u0026sk-\u003esk_receive_queue)\n\n release_sock\n __release_sock\n // move all packets from the backlog\n // to the receive queue\n (!) sk_backlog_rcv\n vsock_queue_rcv_skb\n [...]\n __sock_queue_rcv_skb\n if (!sock_flag(sk, SOCK_DEAD))\n // Since the socket is \"dead\", the function will not\n // be called\n sk-\u003esk_data_ready(sk)\n sock_release_ownership(sk);\n sock_put\n\nAdd a receive queue cleanup in the socket destructor to fix this.\n\nsyzkaller report:\n\nunreferenced object 0xffff8880117bfb80 (size 240):\n comm \"irq/56-vmw_vmci\", pid 205, jiffies 4295064448 (age 73.992s)\n hex dump (first 32 bytes):\n 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.\u0026.....x.\u0026.....\n 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........\u0026.....\n backtrace:\n [\u003cffffffff82be8d97\u003e] __alloc_skb+0x287/0x330 net/core/skbuff.c:505\n [\u003cffffffffa114bcbd\u003e] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]\n [\u003cffffffffa05072c6\u003e] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]\n [\u003cffffffffa050ad75\u003e] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]\n [\u003cffffffffa050b025\u003e] vmci_interrupt+0x55/0x290 [vmw_vmci]\n [\u003cffffffff8137ad2b\u003e] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205\n [\u003cffffffff8137c7ae\u003e] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314\n [\u003cffffffff81253dd6\u003e] kthread+0x2e6/0x3a0 kernel/kthread.c:376\n [\u003cffffffff81004392\u003e] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.\n\nFixes: d021c344051a (\"VSOCK: Introduce VM Sockets\")\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Ilia Gavrilov \u003cIlia.Gavrilov@infotecs.ru\u003e\nLink: https://patch.msgid.link/20261008144046.90853-1-Ilia.Gavrilov@infotecs.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fe4167bf53b61405f97614f644f6a63a5d6ad034", "tree": "3652ea0cc192daa10c08397192b1a0b8ba57670f", "parents": [ "3c6a4b11330fe424557538a98fca9f0a4c5bf313", "d0305f8d90029556260c6824b61c493c424eba9e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:39 2026 -0700" }, "message": "Merge branch \u0027wireguard-fixes-for-7-3-rc7\u0027\n\nJason A. Donenfeld says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWireGuard fixes for 7.3-rc7\n\nThis series contains two important WireGuard fixes\n\n1) Stop zeroing out skb-\u003etstamp_type when encapsulating packets, so that\n fq behaves correctly, from Ramses de Norre.\n\n2) Make sure handshake state isn\u0027t swapped out while locks are\n released, reported by Jérémy Jean.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261008130124.724119-1-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d0305f8d90029556260c6824b61c493c424eba9e", "tree": "3652ea0cc192daa10c08397192b1a0b8ba57670f", "parents": [ "65ab9de4bdd4c05d8277cfc20ae0b9f5aff60897" ], "author": { "name": "Jason A. Donenfeld", "email": "Jason@zx2c4.com", "time": "Thu Oct 08 14:59:16 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:38 2026 -0700" }, "message": "wireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it\u0027s running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that\u0027s already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which point thread B resumes, because either its finished\nits calculations or was finally allowed to acquire down_write(). Thread\nB then copies the state back to the peer, and begins a new session,\nusing that state, which is the same session as the one made in thread A.\n\nThread A\t\t\tThread B\t\t\tThread C\n\ndown_read()\n sA \u003d handshake-\u003estate\n memcpy(cA, handshake-\u003ecrypto)\nup_read()\nif (sA !\u003d 1)\n goto fail\nslow_crypto(cA)\n\t\t\t\tdown_read()\n\t\t\t\t sB \u003d handshake-\u003estate\n\t\t\t\t memcpy(cB, handshake-\u003ecrypto)\n\t\t\t\tup_read()\n\t\t\t\tif (sB !\u003d 1)\n\t\t\t\t goto fail\n\t\t\t\tslow_crypto(cB)\ndown_write()\n if (sA !\u003d handshake-\u003estate)\n goto fail\n memcpy(handshake-\u003ecrypto, cA)\n handshake-\u003estate \u003d 2\nup_write()\ndown_write()\n if (handshake-\u003estate !\u003d 2)\n goto fail\n derive_session(handshake-\u003ecrypto)\nup_write()\n\t\t\t\t\t\t\t\tdown_write()\n\t\t\t\t\t\t\t\t slow_crypto(handshake-\u003ecrypto)\n\t\t\t\t\t\t\t\t handshake-\u003estate \u003d 1\n\t\t\t\t\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (sB !\u003d handshake-\u003estate)\n\t\t\t\t goto fail\n\t\t\t\t memcpy(handshake-\u003ecrypto, cB)\n\t\t\t\t handshake-\u003estate \u003d 2\n\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (handshake-\u003estate !\u003d 2)\n\t\t\t\t goto fail\n\t\t\t\t derive_session(handshake-\u003ecrypto)\n\t\t\t\tup_write()\n\nThis seems basically impossible to hit in a meaningful way in practice,\nbut ensure that it absolutely cannot happen by comparing the ephemeral\nprivate key that\u0027s on the stack with the latest one that the peer\u0027s\nhandshake state has.\n\nCc: stable@vger.kernel.org\nFixes: e7096c131e51 (\"net: WireGuard secure network tunnel\")\nReported-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20261008130124.724119-4-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "65ab9de4bdd4c05d8277cfc20ae0b9f5aff60897", "tree": "9d95e48bcea0bdea94c5a0f6a64f51eae07abd4b", "parents": [ "3c6a4b11330fe424557538a98fca9f0a4c5bf313" ], "author": { "name": "Ramses de Norre", "email": "ramses@well-founded.dev", "time": "Thu Oct 08 14:59:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:38 2026 -0700" }, "message": "wireguard: queueing: preserve tstamp_type when encapsulating packet\n\nSending traffic through a wireguard tunnel on a host using the fq\nqdisc fills the log with:\n\n fq: likely mono tstamp with tstamp_type 0\n\nAn skb carries a timestamp in skb-\u003etstamp and, separately, a\nskb-\u003etstamp_type field recording which clock that timestamp came from.\nThe two have to agree.\n\nWhen wireguard encapsulates a packet it calls wg_reset_packet(), which\nclears the fields that must not leak from the inner packet into the\ntunnel packet. It does so in two steps:\n\n skb_scrub_packet(skb, true);\n memset(\u0026skb-\u003eheaders, 0, sizeof(skb-\u003eheaders));\n\nskb_scrub_packet() deliberately keeps skb-\u003etstamp when it holds a\nmonotonic timestamp: that value is the time the packet is scheduled to\nbe sent, and the qdisc still needs it. The memset then zeroes\nskb-\u003etstamp_type, because that field sits inside the headers group\nwhile skb-\u003etstamp does not. The packet therefore leaves wireguard\ncarrying a monotonic timestamp labelled as a realtime one.\n\nNothing noticed until commit c4f796c4f16b (\"net_sched: sch_fq: convert\nskb-\u003etstamp if not monotonic\"): fq used to assume every timestamp was\nmonotonic. It now consults tstamp_type, spots the mismatch, warns, and\nfalls back to treating the value as monotonic. Pacing still ends up\ncorrect, so the log spam is the actual problem.\n\nSave tstamp_type before the memset and restore it when encapsulating,\nnext to the hash fields that are already carried over this way. When\ndecapsulating it stays zeroed, which is right: an incoming packet\u0027s\ntimestamp is a realtime receive timestamp.\n\nFixes: d98d58a00261 (\"net: Set skb-\u003emono_delivery_time and clear it after sch_handle_ingress()\")\nSigned-off-by: Ramses de Norre \u003cramses@well-founded.dev\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@kernel.org\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20261008130124.724119-3-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3c6a4b11330fe424557538a98fca9f0a4c5bf313", "tree": "204be600ed191b6c040ac994154190bc882a4798", "parents": [ "64a6b36b0e1855288080bc5f89769f27d6dc03c8" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Thu Oct 08 12:41:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:33:38 2026 -0700" }, "message": "net: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key-\u003eip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto. Because skb-\u003etransport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET\u003dy although\nit is completely harmless.\n\nFix this by returning early in update_ipv6_checksum() if l4_proto is\nNEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset\nfor fragments while preserving the debug warning for any other protocol\nwhere the transport header is unexpectedly missing.\n\nSee the syzbot trace:\n\n!skb_transport_header_was_set(skb)\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635\n[...]\nRIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]\nRIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]\nRIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]\nRIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399\n[...]\nCall Trace:\n \u003cTASK\u003e\n set_ipv6 net/openvswitch/actions.c:531 [inline]\n do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366\n ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592\n ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705\n genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114\n genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218\n netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800\n\nReported-by: syzbot+4cc63fcfb3845e149969@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d4cc63fcfb3845e149969\nFixes: 3fdbd1ce11e5 (\"openvswitch: add ipv6 \u0027set\u0027 action\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/20261008104135.4722-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "64a6b36b0e1855288080bc5f89769f27d6dc03c8", "tree": "23b3e56944f4ebff357aa5e1d7f6b9306d601553", "parents": [ "d5788029c34fa7f27ab23f88a4f878e8913042a9" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Thu Oct 08 16:44:44 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:33:12 2026 -0700" }, "message": "net/smc: protect clcsock lifetime in smc_getname\n\nsmc_getname() dereferences smc-\u003eclcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\n\nA getsockname() caller can load smc-\u003eclcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock-\u003eops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall\u0027s file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\n\nKASAN reported the following with test-only timing instrumentation:\n\n BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\n Read of size 8 at addr ffff888109abb4e0 by task poc/103\n Call Trace:\n smc_getname+0x19e/0x1b0\n do_getsockname+0xe5/0x170\n __sys_getsockname+0x8c/0x100\n\n Allocated by task 95:\n sock_alloc_inode+0x1e/0x280\n sock_alloc+0x3d/0x240\n __sock_create+0x7e/0x430\n smc_create+0x121/0x240\n\n Freed by task 0:\n kmem_cache_free+0xcc/0x340\n rcu_core+0x50a/0x1850\n\n Last potentially related work creation:\n evict+0x446/0x6c0\n smc_clcsock_release+0xa8/0xd0\n smc_close_active_abort+0x26a/0x3a0\n __smc_lgr_terminate.part.0+0x137/0x2e0\n\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback\u0027s return value otherwise.\n\nFixes: b03faa1fafc8 (\"net/smc: postpone release of clcsock\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20261008084444.787449-1-nicoyip.dev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d5788029c34fa7f27ab23f88a4f878e8913042a9", "tree": "63c8f114e845faceccaec8ee8450a6f0b1773faf", "parents": [ "6785011f8b16abf40b1e9d8b2e332232b3e68822", "c97426ec649d99596d8969e1a052c16b14b7b485" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:39 2026 -0700" }, "message": "Merge branch \u0027ipv4-ipv6-do-not-warn-on-route-notification-size-races\u0027\n\nDaehyeon Ko says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4/ipv6: do not warn on route notification size races\n\nA nexthop group can grow between route notification sizing and filling.\nBoth IPv4 and IPv6 can then legitimately return -EMSGSIZE, so remove the\nstale warnings while preserving their existing error paths.\n\nPatch 1 is unchanged from v1. Patch 2 adds the IPv6 counterpart requested\nby Ido. No new build or runtime test was run; both changes only delete the\nstale comment and WARN_ON().\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c97426ec649d99596d8969e1a052c16b14b7b485", "tree": "63c8f114e845faceccaec8ee8450a6f0b1773faf", "parents": [ "e02a5b6588161673ef75a4bc5cdfb62bd493374d" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Thu Oct 08 14:29:23 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:36 2026 -0700" }, "message": "ipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node(). With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.\n\nFixes: 907eea486888 (\"net: ipv6: Emit notification when fib hardware flags are changed\")\nReported-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20261007114003.GA1011260@shredder/\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/4012604727e5ba80b69ccd4d08796511397ddaef.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e02a5b6588161673ef75a4bc5cdfb62bd493374d", "tree": "f5f8e3b24a1605932cbef9b43f4a0eb30fdb6030", "parents": [ "6785011f8b16abf40b1e9d8b2e332232b3e68822" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Thu Oct 08 14:29:22 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:36 2026 -0700" }, "message": "ipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.\n\nFixes: 680aea08e78c (\"net: ipv4: Emit notification when fib hardware flags are changed\")\nReported-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20261004082043.GB92032@shredder/\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/b7e203fc5867651cb67ef84aa03e082f0f76008e.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6785011f8b16abf40b1e9d8b2e332232b3e68822", "tree": "777d8a04fab8b680e27e8bf8c4fb5d5c17227ca2", "parents": [ "f8c8bd159a9bf626dd4921b7746ff481fce8c758" ], "author": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Wed Oct 07 18:42:49 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:03:47 2026 -0700" }, "message": "ipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.\n\nCc: stable@vger.kernel.org\nFixes: f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\")\nFixes: bfd5f4a3d605 (\"packet: Add GSO/csum offload support.\")\nReported-by: Paulos Yibelo \u003chabte.yibelo@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/20260922030310.8684-2-habte.yibelo@gmail.com/\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/0a012b4923e189c4c593ef4f471e5ff0edbe9030.1791412497.git.mst@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8c8bd159a9bf626dd4921b7746ff481fce8c758", "tree": "2b97f1992807f5413ad59c280aa11e4bf4915391", "parents": [ "93ccaf1c26e2133396173b76a071e59024daa622" ], "author": { "name": "Vadim Fedorenko", "email": "vadim.fedorenko@linux.dev", "time": "Wed Oct 07 20:33:59 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:01:02 2026 -0700" }, "message": "ptp: ocp: fix PCIe delay estimation calculation\n\nThe commit in fixes introduced a high cap for delayas U64_MAX value\nwhile ktime_t is actually s64. This is wrong cap as it becomes negative\nvalue and any comparison to a real delay will fail to update delay\nvalue. Use KTIME_MAX constant as correct max cap for PCIe delay.\n\nThe issue was hit in production (a negative value is observed):\n\n # cat /sys/class/timecard/ocp0/ts_window_adjust\n -3\n\nFixes: aa05fe67bcd64 (\"ptp: ocp: Improve PCIe delay estimation\")\nSigned-off-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261007203359.417270-1-vadim.fedorenko@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "93ccaf1c26e2133396173b76a071e59024daa622", "tree": "4e49a3d06692a62bcfd603de3a584be2b521ac6a", "parents": [ "513e23857a3a64fa73a1deb36a385eecd4ad7690" ], "author": { "name": "Josef Bacik", "email": "josef@toxicpanda.com", "time": "Wed Oct 07 17:57:32 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:00:01 2026 -0700" }, "message": "xen/netfront: don\u0027t leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb\u0027s frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path. That path moves what\u0027s left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it\u0027s never\nfreed. Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above it does.\n\nFixes: ad4f15dc2c70 (\"xen/netfront: don\u0027t bug in case of too many frags\")\nCc: stable@vger.kernel.org\nSigned-off-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\nLink: https://patch.msgid.link/20261007-b4-xen-netfront-fill-frags-leak-v1-1-a8a01ff9cd52@toxicpanda.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "513e23857a3a64fa73a1deb36a385eecd4ad7690", "tree": "0d0789ca9e6c5b4ef999c134bdb122e6c3dda182", "parents": [ "089e58805c452e52179482b1025a8e309a57f801" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Wed Oct 07 13:57:30 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:59:20 2026 -0700" }, "message": "net/packet: call packet_parse_headers after virtio_net_hdr_to_skb\n\nSOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets\nwithout VIRTIO_NET_HDR_F_NEEDS_CSUM.\n\npacket_parse_headers() sets skb-\u003eprotocol to VLAN but advances\nskb-\u003enetwork_header past the VLAN tags. virtio_net_hdr_to_skb()\nthen flow dissects these packets, which parses the network header as a\nVLAN tag, and fails.\n\nCall packet_parse_headers() after virtio_net_hdr_to_skb() instead.\n\nThis matches tun_get_user() and tap_get_user() and thus simplifies\noverall complexity.\n\nCommit 01fdecc0480d (\"net: packet: fix wrong transport_header when\nsending VLAN-tagged frame\") fixed the same issue for the transport\nheader probe in packet_parse_headers(). That probe is now skipped if\nvirtio_net_hdr_to_skb() already set the transport header, avoiding a\nredundant dissection.\n\nImplementation details:\n- Do not set skb-\u003eprotocol to the RX wildcard ETH_P_ALL. SOCK_RAW then\n derives it from the link layer header, as before. SOCK_DGRAM now\n leaves it 0, or derives it from gso_type for GSO with NEEDS_CSUM.\n- Keep virtio_net_hdr_set_proto() last, so that the link layer protocol\n takes priority over gso_type.\n\nReported-by: Junnan Zhang \u003czhangjn_dev@163.com\u003e\nCloses: https://lore.kernel.org/netdev/20260821085722.24036-1-zhangjn_dev@163.com/\nFixes: dfed913e8b55 (\"net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO\")\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20261007175816.3138556-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "089e58805c452e52179482b1025a8e309a57f801", "tree": "f6cf606daeb9b15d84270c04ac3ec22fa3dbc0ff", "parents": [ "ab9414ed70bd783e902a85c350620dee269bcb2b" ], "author": { "name": "Josef Bacik", "email": "josef@toxicpanda.com", "time": "Wed Oct 07 17:55:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:58:31 2026 -0700" }, "message": "xen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans(). pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb-\u003elen is longer,\nand eth_type_trans() BUG()s in __skb_pull(). If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header. This also checks\nthe return value of the pull, which was ignored.\n\nFixes: 0d160211965b (\"xen: add virtual network device driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nLink: https://patch.msgid.link/20261007-b4-xen-netfront-short-head-v1-1-12d7113a7e4e@toxicpanda.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab9414ed70bd783e902a85c350620dee269bcb2b", "tree": "af7cabc8b5b64cb4b88c52dc191be184822f64e0", "parents": [ "2b82e16d6084cbc651e3c902198f1945408ee1a5" ], "author": { "name": "Josef Bacik", "email": "josef@toxicpanda.com", "time": "Wed Oct 07 17:29:34 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:57:41 2026 -0700" }, "message": "net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller\u0027s buffer\nis left as it was. The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver\u0027s TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn\u0027t fill. The checksum usually\nwon\u0027t match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn\u0027t.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().\n\nFixes: 65249feb6b3d (\"net: add support for skbs with unreadable frags\")\nCc: stable@vger.kernel.org\nSigned-off-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/20261007-b4-skb-copy-csum-stale-bytes-v1-1-adbbde033fb3@toxicpanda.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2b82e16d6084cbc651e3c902198f1945408ee1a5", "tree": "0b6ccf6751194935d32a27c89f8c67389e1bcf5d", "parents": [ "ff6f5157e034f81c2d6482259fc656cd0fe5a8ff" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed Oct 07 17:03:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:55:23 2026 -0700" }, "message": "net: sparx5: free the matchall entry on destroy\n\nsparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for\nevery offloaded matchall filter and adds it to sparx5-\u003emall_entries.\nsparx5_tc_matchall_destroy() removes the entry from the list, but never\nfrees it, so the entry of every deleted mirror and goto matchall filter\nis leaked.\n\nFree the entry after unlinking it.\n\nThe leak was discovered by an AI code review agent, and reproduced with\nkmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and\ndeleting matchall mirror and goto filters. With the fix, kmemleak no\nlonger reports the leak.\n\nCc: stable@vger.kernel.org\nFixes: 1ede4acf045c (\"net: sparx5: add bookkeeping code for matchall rules\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261007-sparx5-matchall-kfree-net-v1-1-c8918685b337@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ff6f5157e034f81c2d6482259fc656cd0fe5a8ff", "tree": "829db06971b3900b274aa125a0883e57b911effe", "parents": [ "fc13ba44da197a186f2f4d77c5b7d73d0f99f053", "71198b59df56a9a0115115091cc1aad2a4e3c74d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:26 2026 -0700" }, "message": "Merge branch \u0027mlxsw-fix-port-range-register-leak\u0027\n\nPetr Machata says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlxsw: Fix port range register leak\n\nWhen the mlxsw driver parses a port range template rule, it acquires the\nactual port range registers. The parsing is only done to determine the\nelement usage, so the registers can be deallocated right away, but this is\nnever done, and the registers are leaked. Plug this leak and add a selftest\nthat would have caught it.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1791294384.git.petrm@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "71198b59df56a9a0115115091cc1aad2a4e3c74d", "tree": "829db06971b3900b274aa125a0883e57b911effe", "parents": [ "7ea07afb230f1342ab0f9365edd0aae137f425d3" ], "author": { "name": "Petr Machata", "email": "petrm@nvidia.com", "time": "Tue Oct 06 16:21:29 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:24 2026 -0700" }, "message": "selftests: mlxsw: Test port range occupancy on template create\n\nAdd a test that creates a tc chain template matching on both source and\ndestination port ranges and verifies via devlink-resource occupancy that\nthis does not leak port range registers, neither while the template\nexists nor after it is deleted.\n\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/e7b37b80adb7ac8b0ef20a22d7654a6656c1c545.1791294384.git.petrm@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7ea07afb230f1342ab0f9365edd0aae137f425d3", "tree": "db69eb17befeba65b705f492a2741fdb7f628120", "parents": [ "fc13ba44da197a186f2f4d77c5b7d73d0f99f053" ], "author": { "name": "Petr Machata", "email": "petrm@nvidia.com", "time": "Tue Oct 06 16:21:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:24 2026 -0700" }, "message": "mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n\nmlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template\ninto a stack-local struct mlxsw_sp_acl_rule_info purely to compute\nrulei.values.elusage. Parsing can acquire port range registers via\nmlxsw_sp_flower_parse_ports_range(), but since this rulei never goes\nthrough mlxsw_sp_acl_rulei_destroy(), those registers were never\nreleased, including through chain template deletion.\n\nFactor out of mlxsw_sp_acl_rulei_destroy() the code to actually\nrelease the necessary resources and call from\nmlxsw_sp_flower_tmplt_create() to plug the leak.\n\nThe issue was found during a review of Wentao Liang\u0027s patch referenced\nbelow.\n\nFixes: fe22f7410527 (\"mlxsw: spectrum_flower: Add ability to match on port ranges\")\nReported-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nCloses: https://lore.kernel.org/netdev/20260917113236.2149095-1-vulab@iscas.ac.cn/\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/95339cf970ce78e1a74aa86ffcc104ecf7c7762c.1791294384.git.petrm@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fc13ba44da197a186f2f4d77c5b7d73d0f99f053", "tree": "34babcea535b1596fa74dfa8a282074450f4b0fb", "parents": [ "b056ca4d3742d0769f91137bb1ce3215428398f7" ], "author": { "name": "Sebastien Royen", "email": "sebastien.royen@armadeus.com", "time": "Wed Oct 07 10:05:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:48:00 2026 -0700" }, "message": "net: dsa: microchip: fix KSZ8765 fiber detection\n\nThe KSZ8765 is similar to the KSZ8795 but has two fiber ports.\n\nKSZ8_PORT_STATUS_0 is used to detect fiber mode. It is currently\ndefined as 0x08, which is the Global Control 6 MIB Control register\nand has bit 7 defined as Flush Counter.\n\nSet KSZ8_PORT_STATUS_0 to 0x18, which is the Port 1 Status 0 register\nwhere bit 7 is the Fiber Mode bit.\n\nThis issue was discovered when upgrading an embedded device from kernel\n5.10 to 6.16. The device was using a KSZ8765 device tree configuration\nand the corresponding hardware, but during boot the kernel incorrectly\ndetected it as a KSZ8795. The relevant boot messages were:\n\n ksz-switch spi0.0: found switch: KSZ8795, rev 0\n ksz-switch spi0.0: Device tree specifies chip KSZ8765 but found KSZ8795, please fix it!\n\nCc: stable@vger.kernel.org\nFixes: 91a98917a883 (\"net: dsa: microchip: move switch chip_id detection to ksz_common\")\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Sebastien Royen \u003csebastien.royen@armadeus.com\u003e\nLink: https://patch.msgid.link/20261007080557.15719-1-sebastien.royen@armadeus.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b056ca4d3742d0769f91137bb1ce3215428398f7", "tree": "9c0c42b1bbfa6218f34ee241a308774b4b4f1893", "parents": [ "726be6a0e81ac603b34a5953623bb39c86cf495a" ], "author": { "name": "Li RongQing", "email": "lirongqing@baidu.com", "time": "Tue Oct 06 13:58:20 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:44:21 2026 -0700" }, "message": "net/mlx5e: Order ICOSQ cc update after CQ doorbell\n\nmlx5e_poll_ico_cq() requires sq-\u003ecc to be updated only after\nmlx5_cqwq_update_db_record(), otherwise a CQ overrun may occur.\n\nThe current implementation updates sq-\u003ecc before the CQ doorbell\nrecord, violating this ordering requirement.\n\nUpdate the CQ doorbell record first and use dma_wmb() before updating\nsq-\u003ecc. This ensures that the CQ space is released to the device\nbefore the corresponding ICOSQ consumer index is updated by software.\n\nFixes: fd9b4be8002c (\"net/mlx5e: RX, Support multiple outstanding UMR posts\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261006105820.257208-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "726be6a0e81ac603b34a5953623bb39c86cf495a", "tree": "58fb22832e85b7cb5810bd85aed5f9a6039c5a96", "parents": [ "259c4a519100e9182f264f8009ee212b32774277", "c017800af5c71ebb2e6209eebf5c60c19850ffe7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:16 2026 -0700" }, "message": "Merge branch \u0027veth-fix-peer-netdev_xdp_act_ndo_xmit-after-gro-is-toggled-while-down\u0027\n\nTianyi Gao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nveth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down\n\nToggling GRO on a veth device while it is down leaves its peer\u0027s\nNETDEV_XDP_ACT_NDO_XMIT flag stale once the device comes up. XDP\nredirects into the peer are then rejected with -EOPNOTSUPP, or, if GRO\nwas turned off, accepted and then dropped with -ENXIO. Patch 1 refreshes\nthe peer\u0027s flags in veth_open().\n\nPatch 2 extends veth.sh to check the peer\u0027s flag after GRO is toggled\nwhile the device is down, in both directions.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261006173241.65945-1-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c017800af5c71ebb2e6209eebf5c60c19850ffe7", "tree": "58fb22832e85b7cb5810bd85aed5f9a6039c5a96", "parents": [ "3f090039995f609a8e236f37980dee5712dded61" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Tue Oct 06 18:32:37 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:14 2026 -0700" }, "message": "selftests: net: veth: test peer ndo-xmit after GRO toggle while down\n\nTest that toggling GRO on a veth device while it is down updates the\npeer\u0027s ndo-xmit XDP feature once the device comes up, for both GRO on\nand GRO off.\n\nxdp-features is only visible through netlink, so read it with the ynl\nCLI, as double_udp_encap.sh does. Skip the checks if the CLI is not\nfound, as in an installed kselftest tree.\n\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nLink: https://patch.msgid.link/20261006173241.65945-3-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3f090039995f609a8e236f37980dee5712dded61", "tree": "019fc6b48dcedd012a5a021d57a1eae059f3394a", "parents": [ "259c4a519100e9182f264f8009ee212b32774277" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Tue Oct 06 18:32:36 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:13 2026 -0700" }, "message": "veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down\n\nA veth device advertises NETDEV_XDP_ACT_NDO_XMIT only if its peer has an\nXDP program attached or GRO enabled, that is, only if the peer will have\nNAPI to receive the frames.\n\nveth_set_features() updates the peer\u0027s flag when GRO is toggled, but\nreturns early if the device is down, and veth_open() only refreshes the\nflags of the device being opened. Toggling GRO while the device is down\ntherefore leaves the peer\u0027s flag stale after the device comes up.\n\nIf GRO was enabled while down, the device comes up with NAPI but the\npeer does not advertise NDO_XMIT, and devmap rejects redirects to the\npeer with -EOPNOTSUPP. If GRO was disabled while down, the device comes\nup without NAPI but the peer still advertises NDO_XMIT, so redirects are\naccepted and then dropped in veth_xdp_xmit() with -ENXIO.\n\nCommit 7a6102aa6df0 (\"veth: Update XDP feature set when bringing up\ndevice\") made veth_open() refresh the device\u0027s own flags. Refresh the\npeer\u0027s flags there too. The peer\u0027s flag depends on this device\u0027s XDP\nprogram and GRO setting, not on whether the peer is up, so it is\ncorrect to set it even if the peer is down.\n\nFixes: 8267fc71abb2 (\"veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag\")\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261006173241.65945-2-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "259c4a519100e9182f264f8009ee212b32774277", "tree": "b956a3611e9e908bc9f76445f9841da7ee451491", "parents": [ "6d25ffca055a77787c21a36b66c253f76239411b" ], "author": { "name": "Hamza Mahfooz", "email": "hamzamahfooz@linux.microsoft.com", "time": "Fri Oct 02 21:36:47 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:42:03 2026 -0700" }, "message": "net: mana: reserve RX buffer headroom to fix forwarding performance\n\nCommit 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers\ninstead of full pages to improve memory efficiency.\") started handing\nout RX buffers with zero headroom so that two buffers fit into one page\nat the default MTU.\n\nThe MANA TX path, however, stores the per scatter-gather entry DMA\nmappings in `struct mana_skb_head` at skb-\u003ehead, and mana_start_xmit()\ntherefore calls skb_cow_head(skb, MANA_HEADROOM). The port advertises\nthis requirement as ndev-\u003eneeded_headroom \u003d MANA_HEADROOM.\n\nAs a result every packet that is received and then forwarded out of a\nMANA port fails the skb_cow() in ip_forward() and gets reallocated and\ncopied by pskb_expand_head(). This is invisible to a plain RX or TX\nworkload, but it puts a full skb reallocation plus memcpy on the hot\npath of every single forwarded packet, which is exactly what a\nrouter/NVA workload does.\n\nRestore the headroom. Note that reserving MANA_HEADROOM (232) is not\nenough: ip_forward() asks for LL_RESERVED_SPACE(dev), which rounds\nhard_header_len + needed_headroom up to HH_DATA_MOD and is 256 bytes on\nethernet. Use LL_RESERVED_SPACE() directly so the value keeps tracking\nboth constants. Also, since LL_RESERVED_SPACE() tracks MANA_HEADROOM,\nit grows with MAX_SKB_FRAGS and for MAX_SKB_FRAGS \u003e\u003d 19 it is greater\nthan 256, so we have to account for that by using the headroom the RX\nqueue actually uses (instead of assuming XDP_PACKET_HEADROOM) and\nturning MANA_XDP_MTU_MAX into MANA_XDP_MTU_MAX(ndev) (note that at the\ndefault CONFIG_MAX_SKB_FRAGS\u003d17 they are equivalent).\n\nAt the default MTU on a 4K page this means a buffer no longer fits twice\ninto a page (SKB_DATA_ALIGN(1500 + MANA_RXBUF_PAD + 256) \u003d 2112), so the\nfrag-vs-single decision is now made by computing the real buffer size\ninstead of comparing the MTU against PAGE_SIZE / 2. The page_pool\nfragment path is still used wherever at least two buffers genuinely fit,\ne.g. on 16K and 64K page sizes.\n\nMeasured on an Azure VM with a MANA NIC acting as a forwarding NVA (UDP,\n1400 byte payload, 4 streams, 8 Gbps offered, only the forwarding\nnode\u0027s kernel differs), 8 runs each, median:\n\n forwarded pps throughput\n before 272,830 3.06 Gbps\n after 390,560 4.37 Gbps (+43%)\n\nperf on the forwarding node, same workload:\n\n memset_orig __pi_memcpy pskb_expand_head\n before 10.07% 3.96% present\n after 0.94% 0.64% gone\n\nCc: stable@vger.kernel.org\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nSigned-off-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261003013647.2051416-1-hamzamahfooz@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5a768f5f76d8833b02b00f99d246cba6c463760b", "tree": "c7c30dd2e84f7a66afbba74320331696f576b578", "parents": [ "5da1129613f27b5fdf7f3a47235e0fae71fa99ef", "5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 09 01:55:39 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 09 01:55:41 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-10-08\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for v7.3-rc7:\n- Fix a GT park race that could trigger spurious RPM wakelock warnings\n- Fix execbuffer relocation cleanup to avoid out-of-bounds free\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/49ac4a9f496e1dadbf71740eb0d1f443598b2632@intel.com\n" }, { "commit": "6c377d19d4a5116d9bec5203aa3c6c11523e7898", "tree": "aaf86020951b9694b463c98d164c3fa8757e8b38", "parents": [ "47324d3a5b3abd781295044d01d92d09f184e872", "3e78d7b063230d39ffc42e80ee665b6c32a6adeb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 17:37:49 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 17:37:49 2026 +0200" }, "message": "Merge tag \u0027ext4_for_linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4\n\nPull ext4 fixes from Ted Ts\u0027o:\n \"Mark the ext4 data\u003djournal feature as being deprecated and will be\n removed in 2028.\n\n Also designate the primary branch that Sashiko and other tools use to\n find the primary development branch in the ext4 tree\"\n\n* tag \u0027ext4_for_linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:\n ext4: mark data\u003djournal as deprecated and will be removed in January 2028.\n MAINTAINERS: name the ext4 dev branch\n" }, { "commit": "3e78d7b063230d39ffc42e80ee665b6c32a6adeb", "tree": "d39b5cad1df500d5fe99c6eba2e87534d3f10324", "parents": [ "4b1d04693e5ef388d8c6110bc93ee0d0681f9711" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Sep 24 10:58:12 2026 -0400" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Oct 08 11:21:30 2026 -0400" }, "message": "ext4: mark data\u003djournal as deprecated and will be removed in January 2028.\n\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n" }, { "commit": "4b1d04693e5ef388d8c6110bc93ee0d0681f9711", "tree": "355d11ba4ab560ebf76a0c73419a1ffceaefeb2d", "parents": [ "93f51579e7df248780214094418f205253383cc5" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Wed Sep 23 18:17:49 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Oct 08 11:21:30 2026 -0400" }, "message": "MAINTAINERS: name the ext4 dev branch\n\nThe ext4 T: entry names the repository without a branch, so tools that\ndefault to the repository\u0027s HEAD select master, which still points at a\nmerge from October 2020 (96485e446260). Development happens on dev,\nwhich is also the branch linux-next merges. Name it.\n\nThe Sashiko review bot, for one, falls back to HEAD this way and has\nbeen reviewing ext4 patches against that tree. Its review of an EA\ninode refcount fix reported a Critical double decrement and an\nundefined function after applying the patch to that stale baseline;\nneither holds on dev.\n\nLink: https://lore.kernel.org/all/20260916072420.316321F000FF@smtp.kernel.org/\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nAcked-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260923101749.3505886-1-matthias.goergens@gmail.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n" }, { "commit": "47324d3a5b3abd781295044d01d92d09f184e872", "tree": "4c9fa5b31d3b63ede60685727a04290b9e30dd1f", "parents": [ "156c9ca041377f9ffa5967c7debc5fd0f667d395", "0d6c5794fd633427f0d4ad8b51d94061295649da" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:35:07 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:35:07 2026 +0200" }, "message": "Merge tag \u0027pwrseq-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull power sequencing fixes from Bartosz Golaszewski:\n\n - add missing PCI device IDs for Thinkpad T14s gen6 which should have\n been part of commit a39ac4651e3b (\"power: sequencing: pcie-m2: Match\n WCN6855 and WCN7851 UART BT variants by subdevice ID\") in\n pwrseq-pcie-m2\n\n - fix memory leak in pwrseq-pcie-m2 (leaking the array returned by\n of_regulator_bulk_get_all())\n\n* tag \u0027pwrseq-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()\n power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids\n" }, { "commit": "156c9ca041377f9ffa5967c7debc5fd0f667d395", "tree": "3ab1f74ab3a8d4bec253a241843afe0d9d62c572", "parents": [ "b732c98215831db36eff1cbbcd0df2f98b765f4e", "7efa1a1953cd6b20b23a3524d5b4b81789c6ef25" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:33:05 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:33:05 2026 +0200" }, "message": "Merge tag \u0027gpio-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix runtime PM leak in error path in gpio-xilinx\n\n - fix race when arming the IRQ poll worker in gpio-mpsse\n\n - fix devres cleanup path on probe error in gpio-exar\n\n* tag \u0027gpio-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: mpsse: fix race when arming the IRQ poll worker\n gpio: exar: initialize the ID before registering its cleanup\n gpio: xilinx: fix runtime PM leak on request error path\n" }, { "commit": "b732c98215831db36eff1cbbcd0df2f98b765f4e", "tree": "e9a30d3dd21a271a8e29acd0d4f0b6e5c10d0397", "parents": [ "0c2669a9f4a1d607e7591ae50ccf3c432a0aff08", "80ce29104123be4d61b5912dae543c70af0fcb75" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 12:35:20 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 12:35:20 2026 +0200" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-10-07-21-48\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n\n - Update .mailmap entries for Andy Yan and John Garry\n\n - Fix read-only MAP_SHARED /dev/zero mappings so they retain\n shared-file semantics instead of being treated as anonymous memory,\n also avoiding a CONFIG_DEBUG_VM assertion\n\n - Fix 32-bit build warnings in the hugetlb-mmap selftest caused by\n using the wrong printf format for size_t values\n\n - Fix a boot-time crash when early function tracing causes CPA to free\n kernel page tables before the workqueues used for deferred freeing\n are available\n\n - Fix two MREMAP_DONTUNMAP locked_vm accounting leaks: one caused by\n an mlock-on-fault VMA self-merging, and one caused by partially\n remapping a locked VMA\n\n* tag \u0027mm-hotfixes-stable-2026-10-07-21-48\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mailmap: update entry for Andy Yan\n drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly\n selftests/mm: cleanup -Wformat issues in hugetlb-mmap\n mm: don\u0027t schedule deferred kernel page table freeing while booting\n mailmap: update addresses for John Garry\n mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP\n mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge\n" }, { "commit": "911655ab1dfb9d526978a75df3b210132620d30a", "tree": "66f368bf4213088f4aab003ab3a71540a7e093a7", "parents": [ "057e5e07420c753f248f9ce148040ab6dcf8359f" ], "author": { "name": "Marek Szyprowski", "email": "m.szyprowski@samsung.com", "time": "Wed Sep 30 10:50:55 2026 +0200" }, "committer": { "name": "Marek Szyprowski", "email": "m.szyprowski@samsung.com", "time": "Thu Oct 08 12:13:28 2026 +0200" }, "message": "swiotlb: fix default_swiotlb_limit() for non-growable default pool\n\nCommit ad96ce3252db (\"swiotlb: determine potential physical address\nlimit\") changed default_swiotlb_limit() to return the maximum physical\naddress that could ever be used by dynamically allocated pools, so that\nthe value stays constant when CONFIG_SWIOTLB_DYNAMIC\u003dy. However,\nio_tlb_default_mem.phys_limit is returned even when the default pool\ncannot grow, e.g. when swiotlb_init_remap() is called with a remap\ncallback.\n\nThis breaks Xen dom0 on x86: pci_xen_swiotlb_init() passes SWIOTLB_ANY\nand xen_swiotlb_fixup(), so phys_limit is set to the top of dom0 memory,\nalthough xen_swiotlb_fixup() makes the default pool below the 32-bit\nboundary. xen_swiotlb_dma_supported() then rejects 32-bit DMA masks,\neven though the bounce buffer is perfectly usable by such devices.\n\nReturn phys_limit only if the default pool can actually grow, otherwise\nreport the real end of the default pool, like in the\n!CONFIG_SWIOTLB_DYNAMIC case.\n\nReported-by: Andreas Greve \u003candreas.greve@a-greve.de\u003e\nReported-by: James Dingwall \u003cjames@dingwall.me.uk\u003e\nFixes: ad96ce3252db (\"swiotlb: determine potential physical address limit\")\nCloses: https://lore.kernel.org/xen-devel/f74668db-52fd-4575-8372-7bfdf10d62ac@a-greve.de/\nCc: stable@vger.kernel.org\nAssisted-by: Claude Opus 5.5 (1M context) \u003cnoreply@anthropic.com\u003e\nTested-by: James Dingwall \u003cjames@dingwall.me.uk\u003e\nLink: https://lore.kernel.org/all/20261005070518.1590097-1-m.szyprowski@samsung.com/\nSigned-off-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\n" }, { "commit": "789f290b2e81d42820bddcb4010ffbc2ae2ded54", "tree": "6ada3fff37cd1b82e2fb69e9be5d870af671907c", "parents": [ "196d4d10c1b33ae176685ff42a9994a5952b1d0f" ], "author": { "name": "Gyeyoung Baek", "email": "gye976@gmail.com", "time": "Thu Oct 01 22:39:13 2026 +0900" }, "committer": { "name": "Alessio Belle", "email": "alessio.belle@imgtec.com", "time": "Thu Oct 08 10:32:31 2026 +0100" }, "message": "drm/imagination: Size page table preallocation by device address\n\nCommit 0a8224058a58 (\"drm/imagination: Fix page count for page table for\nmap() interface\") passed the device address to\npvr_mmu_op_context_create(), but the preallocation is still sized from\ndevice_addr + sgt_offset with an exclusive end. The offset into the\nobject\u0027s pages has no place in a device-virtual range, and the exclusive\nend allocates one table too many when the range ends on a table\nboundary.\n\nCount the tables from device_addr and the inclusive end of the range.\n\nThe new calculation does not take page table indices into account. This\nfixes another issue with the previous implementation, where the\ndifference between start and end indices could underflow when a mapping\ncrossed a page table boundary. This would lead to the driver\npreallocating a huge number of MMU pages, exhausting system memory and\ntriggering an out of memory panic.\n\nFixes: 0a8224058a58 (\"drm/imagination: Fix page count for page table for map() interface\")\nFixes: ff5f643de0bf (\"drm/imagination: Add GEM and VM related code\")\nSigned-off-by: Gyeyoung Baek \u003cgye976@gmail.com\u003e\nReviewed-by: Brajesh Gupta \u003cbrajesh.gupta@imgtec.com\u003e\nReviewed-by: Alessio Belle \u003calessio.belle@imgtec.com\u003e\nCc: stable@vger.kernel.org\n[Alessio: add paragraph to point out OOM bug being fixed, cc stable]\nLink: https://patch.msgid.link/20261001-pvr-fixes-a-v2-2-f58254e5dfb8@gmail.com\nSigned-off-by: Alessio Belle \u003calessio.belle@imgtec.com\u003e\n" }, { "commit": "196d4d10c1b33ae176685ff42a9994a5952b1d0f", "tree": "2d6cc356bd057e78df853f0bdd21f7e6e0f53d2c", "parents": [ "71ec70ea26e399eb8371fe9d2d5bf5dab09570fb" ], "author": { "name": "Gyeyoung Baek", "email": "gye976@gmail.com", "time": "Thu Oct 01 22:39:12 2026 +0900" }, "committer": { "name": "Alessio Belle", "email": "alessio.belle@imgtec.com", "time": "Thu Oct 08 10:32:27 2026 +0100" }, "message": "drm/imagination: Fix reference and vm_bo handling in remap()\n\nWhen a map overlaps part of an existing mapping, pvr_vm_gpuva_remap()\nsplits the mapping into prev/next parts covering what the request did\nnot take, instead of creating something new. It gets two things wrong.\n\n- A GEM reference is taken for each part but it\u0027s never needed and never\n dropped, so it leaks one reference per split (remap-next-in-2m in\n tests/imagination/pvr_vm_map.c):\n\n CRITICAL: 33558528 bytes of shmem still held after close\n\n- The parts still belong to the original object being split, but\n pvr_vm_gpuva_remap() links them to ctx-\u003egpuvm_bo, the new object\u0027s\n vm_bo:\n\n prev_va --obj--\u003e BO_A BO_B \u003c--obj-- vm_bo (ctx-\u003egpuvm_bo)\n \\___________link___________/ (mismatch: BO_A !\u003d BO_B)\n\n drm_gpuva_link() catches the mismatch:\n\n WARNING: drivers/gpu/drm/drm_gpuvm.c:2108 at drm_gpuva_link+0x2ec/0x310\n drm_WARN_ON(obj !\u003d vm_bo-\u003eobj)\n Call trace:\n drm_gpuva_link\n pvr_vm_gpuva_remap\n __drm_gpuvm_sm_map\n pvr_vm_map\n pvr_ioctl_vm_map\n\n Link them to op-\u003eremap.unmap-\u003eva-\u003evm_bo instead.\n\nThe locking of the GPUVA lists of the other objects touched by a split is\nnot addressed here; it is handled by switching the GPUVM to immediate\nmode.\n\nFixes: ff5f643de0bf (\"drm/imagination: Add GEM and VM related code\")\nSigned-off-by: Gyeyoung Baek \u003cgye976@gmail.com\u003e\nReviewed-by: Brajesh Gupta \u003cbrajesh.gupta@imgtec.com\u003e\nLink: https://patch.msgid.link/20261001-pvr-fixes-a-v2-1-f58254e5dfb8@gmail.com\nSigned-off-by: Alessio Belle \u003calessio.belle@imgtec.com\u003e\n" }, { "commit": "07c75552f7fe636a0695baae506a7d72fabd3be4", "tree": "c101dad957a9fba0ab01ed8dba6b1e4189020e3d", "parents": [ "13dffca9043500ed6033d770b491a043fb952bc5", "9ca0d0d0249230135dbf6fa1b9168e260151babc" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 08 10:49:55 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 08 10:49:55 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.3-rc6\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.3\n\nA fairly small collection of fixes and a few device quirks, nothing\nespecially remarkable unless you have the affected system.\n" }, { "commit": "00765a3467b992d0eb56704a28887256317eb4bd", "tree": "5fce6821683e462db7d0a3b65f6daa53a30234c8", "parents": [ "61d44a2c07b2ad3f7db167f17ff2461ffe78441c" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Thu Oct 08 09:00:58 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 08 09:51:12 2026 +0200" }, "message": "spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi\n\nAdd the compatible for the Synaptics SL2610 SoC SPI controllers, which\nare compatible with the Synopsys DesignWare APB SSI.\n\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20261008010058.28382-1-jszhang@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "0c2669a9f4a1d607e7591ae50ccf3c432a0aff08", "tree": "5fbe07899ae22662b7f05d4af23c32595180a3a0", "parents": [ "8fc6e594884a65ec99c78ad05e7fae110ad714d9", "1fc2d80928b706147e371602dabd0ba927dfe4a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:44:07 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:44:07 2026 +0200" }, "message": "Merge tag \u0027soc-fixes-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n\n - Four distinct issues in TEE firmware, all fairly minor\n\n - Five devicetree mistakes on NXP i.MX8, lx2160a and Qualcomm\n based machines, one of these may cause file system corruption\n from an incorrect SD card supply voltage\n\n - Five fixes for clk drivers on new Qualcomm platforms,\n addressing issues with incorrect enable states\n\n* tag \u0027soc-fixes-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n MAINTAINERS: update my email address\n tee: optee: ffa: support shared memory offsets on large-page kernels\n optee: register TEE devices only once fully initialized\n tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()\n arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply\n arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value\n arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single\n arm64: dts: lx2160a: fix incorrect pinmux\n clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable\n clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable\n clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks\n clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks\n clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks\n arm64: dts: qcom: x1-denali: Fix microphone distortion\n tee: qcomtee: fix kernel-doc warnings\n" }, { "commit": "8fc6e594884a65ec99c78ad05e7fae110ad714d9", "tree": "92949a925fa4fbb5ed0f43c9ff0a248f0a94a689", "parents": [ "4cc6bbaeb3afe9166380eccd8d166d2dd75c0278", "cfb3293c4573289f11f913611f530ea6b1926d67" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:36:57 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:36:57 2026 +0200" }, "message": "Merge tag \u0027usb-mtu3.2026.10.06a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu\n\nPull tracing fix from Paul McKenney:\n \"Fix a double-dereference splat in TP_printk in usb mtu3. This was a\n pre-existing bug that can corrupt tracing output, but which was\n exposed this cycle by additional checking that was added to the\n tracing subsystem.\n\n This splat is reporting a double-dereference that can result in\n garbage traces being dumped due to the possibility of the TP_printk()\n being executed without the benefit of main memory being present.\n\n The fix is to move the extra dereference from TP_printk() time to\n TP_fast_assign() time\"\n\n* tag \u0027usb-mtu3.2026.10.06a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:\n usb: mtu3: Fix double dereference in TP_printk\n" }, { "commit": "4cc6bbaeb3afe9166380eccd8d166d2dd75c0278", "tree": "8826673106a0aea9dcc25ef351aa72b64c13a072", "parents": [ "7b63ef2d55f24519e7e9e5f4d15dbea03f126e40", "26f90559a77cac4b8fdfa3491732b7c7e08210ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:30:50 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:30:50 2026 +0200" }, "message": "Merge tag \u0027urgent.2026.10.01a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux\n\nPull RCU fix from Paul McKenney:\n \"Fix spurious WARN_ON() for rcu_segcblist_n_cbs() in\n cleanup_srcu_struct()\n\n This issue was introduced by 78a38cbf6f20 (\"srcu: Queue\n sdp-\u003ework when the delay timer is successfully deleted\")\n during this merge window.\n\n Enough people are hitting this that I am sending it now\n rather than waiting for the next merge window. Especially\n given that it is a simple one-liner\"\n\n* tag \u0027urgent.2026.10.01a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:\n srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()\n" }, { "commit": "d4f25b097e46d82718bb737d4540c99b7ab0a408", "tree": "ee23f6e2a965d27bb52ccbeb8ee1d2fd84b8f1f7", "parents": [ "4d0697f192975dab5985e921989be1d85cf580e9" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Mon Sep 07 21:07:50 2026 +0200" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Oct 07 20:25:09 2026 -0600" }, "message": "riscv: fix load_unaligned_zeropad() fixup for RV32\n\nThe fixup for load_unaligned_zeropad() runs when REG_L crosses into an\nunmapped page. REG_L is lw on RV32 and ld on RV64, but the fixup assumes\nan 8-byte load: it rounds the address down to 8 bytes and derives the\nshift from three address bits.\n\nOn RV32, a load starting in the last three bytes of a mapped page selects\nthe word four bytes earlier and shifts it by 40, 48, or 56 bits, more than\nthe register width. The caller gets earlier bytes instead of the string\ntail followed by zeroes. This affects RV32 MMU kernels built with\nRISCV_EFFICIENT_UNALIGNED_ACCESS\u003dy, which selects DCACHE_WORD_ACCESS\nand lets dcache name hashing and comparison and strscpy() use this\npath.\n\nDerive the alignment and offset masks from sizeof(data) instead of a fixed\n8. This makes RV32 use the correct source word. RV64 code is unchanged: the\ncomplete extable.o is byte-for-byte identical before and after.\n\nFixes: d0fdc20b0429 (\"riscv: select DCACHE_WORD_ACCESS for efficient unaligned access HW\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nLink: https://patch.msgid.link/20260907190750.26303-1-kmehltretter@gmail.com\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "6d25ffca055a77787c21a36b66c253f76239411b", "tree": "c00da6c861729f69f6265eb7f99d0ab59573303f", "parents": [ "c57b2e60d4bf29707c51b39ed3bacbcce2f3ba2e" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Tue Oct 06 12:51:08 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 19:17:52 2026 -0700" }, "message": "cipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30. Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30. Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and\nrouter_alert offsets when they follow CIPSO. cipso_len is the distance\nthe first memmove() shifts those options. The later header move and\nnetwork-header reset relocate the bytes and their offset base together.\n\nFixes: 89aa3619d141 (\"cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options\")\nCc: stable@vger.kernel.org\nReviewed-by: Ondrej Mosnáček \u003comosnacek@gmail.com\u003e\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nAcked-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nLink: https://patch.msgid.link/20261006035108.3101440-1-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c57b2e60d4bf29707c51b39ed3bacbcce2f3ba2e", "tree": "45a326abe9435960c33833e666b85332b5138787", "parents": [ "1d6500523b8d5112afe0118173ebc8c1ca23784e" ], "author": { "name": "Haishuang Yan", "email": "yanhaishuang@cmss.chinamobile.com", "time": "Fri Oct 02 23:30:39 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 19:15:08 2026 -0700" }, "message": "bareudp: set the inner protocol to the protocol of the packet\n\nbareudp_xmit_skb() sets the inner protocol of the skb to the configured\nethertype, and bareudp6_xmit_skb() does not set it at all. The inner\nprotocol is used by skb_udp_tunnel_segment() to segment the inner packet\nwhen GSO has to be done in software, for instance when the lower device\ndoes not offload the checksum.\n\nWith multiproto, an IPv4 device also carries IPv6, so the IPv6 header\nis parsed as an IPv4 one. With IPv6 underlay, the inner protocol is\nwhatever the skb had before. In both cases segmentation fails and the\npackets are dropped. With veth tx checksum offload disabled, iperf3 TCP\nover bareudp gets about 10 Mbit/s with thousands of retransmits instead\nof about 700 Mbit/s for IPv6 over IPv4 and for both families over IPv6,\nwhile IPv4 over IPv4 works.\n\nAt this point skb-\u003eprotocol is the protocol of the inner packet, which\nbareudp_xmit() has already checked against the configuration, so use it\non both paths.\n\nFixes: 571912c69f0e (\"net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.\")\nFixes: 4b5f67232d95 (\"net: Special handling for IP \u0026 MPLS.\")\nSigned-off-by: Haishuang Yan \u003cyanhaishuang@cmss.chinamobile.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261002153039.462663-1-yanhaishuang@cmss.chinamobile.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d6500523b8d5112afe0118173ebc8c1ca23784e", "tree": "80bb7a68882473ee671e4db59605c57ef565e1b4", "parents": [ "f202578efc738b883cfa04889eb97328914265a7" ], "author": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Thu Oct 01 15:24:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 19:00:32 2026 -0700" }, "message": "e1000e: add system to disable K1 list\n\nJavier reports seeing packet loss issues related to the re-enablement\nof K1; disabling it makes the issues go away. Add the reported system\nto have K1 disabled by default.\n\nReproduction steps (from the Link):\nPlug the cable and ping the default gateway on the LAN. No suspend/resume\ninvolved, machine freshly booted and on AC power. Nothing e1000e-related in\ndmesg apart from the link up/down messages; no \"Hardware Unit Hang\".\n\nDefault (K1 enabled):\n\n $ ping -c 30 192.168.10.1\n --- 192.168.10.1 ping statistics ---\n 30 packets transmitted, 18 received, 40% packet loss, time 29734ms\n rtt min/avg/max/mdev \u003d 0.211/0.315/0.384/0.046 ms\n\nThe lost packets are spread over the run (seq 6, 8, 9, 11, 13, 14, 16, 19,\n20, 24, 25, 30), not a single burst. DHCP on this link also takes 1-2\nminutes to get a lease, consistent with incoming packets being dropped.\n\nWith K1 disabled at runtime:\n\n # ethtool --set-priv-flags enp0s31f6 disable-k1 on\n $ ethtool --show-priv-flags enp0s31f6\n Private flags for enp0s31f6:\n s0ix-enabled: on\n disable-k1 : on\n\n $ ping -c 30 192.168.10.1\n --- 192.168.10.1 ping statistics ---\n 30 packets transmitted, 30 received, 0% packet loss, time 29713ms\n rtt min/avg/max/mdev \u003d 0.169/0.251/0.468/0.054 ms\n\n $ ping -c 30 192.168.10.1\n --- 192.168.10.1 ping statistics ---\n 30 packets transmitted, 30 received, 0% packet loss, time 29677ms\n rtt min/avg/max/mdev \u003d 0.101/0.222/0.360/0.064 ms\n\nI have only compile tested this, but Javier has tested that disabling K1\non his system (Lenovo ThinkPad P14s Gen 5 (Intel), I219-LM [8086:550a])\nresolves his issues.\n\nCc: stable@vger.kernel.org\nFixes: 578294b8b60d (\"e1000e: Reconfigure PLL clock gate timeout and re-enable K1 on Meteor Lake\")\nReported-by: Javier Herrera \u003cjavier.herrera@afronta.com\u003e\nLink: https://lore.kernel.org/intel-wired-lan/CAKRuCQLWEcci9hPgNUmvq44Bd2H30T5_vP\u003dexMjsknXMN5Yh9A@mail.gmail.com/\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20261001222443.3500206-7-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4d0697f192975dab5985e921989be1d85cf580e9", "tree": "6b20edba59ddf21f55cf495fe417bf247dd3a026", "parents": [ "59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97" ], "author": { "name": "Ziyi Guo", "email": "guoziyi114@gmail.com", "time": "Thu Oct 01 13:57:11 2026 +0000" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Oct 07 19:38:05 2026 -0600" }, "message": "riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\n\nUnder CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel\nshadow call stack pointer (gp) only when the trap came from userspace.\nIt made that decision with scs_load_current_if_task_changed, which\ncompares the trap-time tp (read back from sscratch into s5) against the\ncurrent tp:\n\n\tbeq\t\\prev, tp, _skip_scs\n\tscs_load_current\n_skip_scs:\n\ntp is a user-writable register. A user task that sets tp to the\nlinear-map address of its own task_struct (\u0026current) before trapping\nmakes the comparison succeed (can achieve by brute force with KASLR\nenable under our test), so the kernel skips scs_load_current and\nkeeps running with the gp that userspace left in place. Under\nCONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and\nload_global_pointer is a no-op, so the compiler-emitted\n\"sd ra, -8(gp)\" / \"ld ra, -8(gp)\" in every non-leaf function then write\nto, and return through, an attacker-controlled address -- an\nunprivileged kernel arbitrary-write and control-flow-hijack primitive.\nThe poisoned gp is saved to task_struct.scs_sp on return, so the reload\nis skipped on every subsequent entry as well.\n\nDecide \"came from userspace\" from the hardware sstatus.SPP bit (already\nin s1 at this point) instead of from tp, mirroring the check that\nret_from_exception already uses a few instructions later. SPP is\nwritten by hardware on trap entry and cannot be forged from U-mode.\nLegitimate behaviour is unchanged: user entries (SPP\u003d0) reload the task\nshadow call stack, nested kernel entries (SPP\u003d1) skip it.\n\nFixes: d1584d791a29 (\"riscv: Implement Shadow Call Stack\")\nSigned-off-by: Ziyi Guo \u003cguoziyi114@gmail.com\u003e\nReviewed-by: Sami Tolvanen \u003csamitolvanen@google.com\u003e\nLink: https://patch.msgid.link/20261001135711.934152-1-guoziyi114@gmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "f202578efc738b883cfa04889eb97328914265a7", "tree": "7592c5928610fd78eee15e095de89a1c2c0a6a41", "parents": [ "a51d233ccd4889aadb71dace863525cc2b00271e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 07 06:56:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:57:04 2026 -0700" }, "message": "flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()\n\nbpf_flow_dissect() sanitizes the offsets returned by the BPF program\nwith clamp_t(u16, ..., hlen).\n\nIf hlen is bigger than 65535, the upper bound is truncated before\nthe comparison. For instance, with hlen \u003d\u003d 65536, both nhoff and\nthoff are forced to zero, even if the program returned sane values.\n\nThis is the same class of bug as the one fixed in commit 99bda1ecbd56\n(\"flow_dissector: avoid u16 truncation of skb-\u003elen when computing\nthoff\"). That fix does not cover the BPF path, because\n__skb_flow_dissect() returns early when a BPF flow dissector\nhandles the packet.\n\nstruct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen\nto U16_MAX before clamping.\n\nFound by sashiko while reviewing the commit above.\n\nFixes: d58e468b1112 (\"flow_dissector: implements flow dissector BPF hook\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261007045616.445596-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a51d233ccd4889aadb71dace863525cc2b00271e", "tree": "a3ccc2624764af44cb554a17afecbb4621ae3c91", "parents": [ "7fadfc8dc63fe77b3a2dd1e023915f6fad7efdac" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 07 07:17:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:53:31 2026 -0700" }, "message": "bnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n [fault reason 0x06] PTE Read access is not set\n bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n ...\n NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n if (length \u003c BNXT_MIN_PKT_SIZE) {\n pad \u003d BNXT_MIN_PKT_SIZE - length;\n if (skb_pad(skb, pad))\n goto tx_kick_pending;\n length \u003d BNXT_MIN_PKT_SIZE;\n }\n\n mapping \u003d dma_map_single(\u0026pdev-\u003edev, skb-\u003edata, len, DMA_TO_DEVICE);\n ...\n dma_unmap_len_set(tx_buf, len, len);\n\nHowever, \u0027len\u0027 was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n txbd-\u003etx_bd_len_flags_type \u003d\n cpu_to_le32(((len + pad) \u003c\u003c TX_BD_LEN_SHIFT) | flags |\n TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb-\u003edata ends near the boundary of a 4KB\npage (within \u0027pad\u0027 bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb-\u003edata\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)-\u003enr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb-\u003elen and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary \u0027pad\u0027 variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch.\n\nFixes: c0c050c58d84 (\"bnxt_en: New Broadcom ethernet driver.\")\nCc: stable@vger.kernel.org\nReported-by: Stefan Fleischmann \u003csfle@kth.se\u003e\nCloses: https://lore.kernel.org/netdev/20261004122616.56714cbd@nargothrond/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20261007051747.455273-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7fadfc8dc63fe77b3a2dd1e023915f6fad7efdac", "tree": "a7d7e8ed2c3699b737f16fe74672e9971dd65311", "parents": [ "9b6c20f788472d2042717a3c2f1bc60b2b77083e", "2e52da27096d9dbc487f303bbc10d44ad837a8c4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:04 2026 -0700" }, "message": "Merge branch \u0027bnxt_en-pcie-flr-aer-fixes\u0027\n\nMichael Chan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbnxt_en: PCIe FLR/AER fixes\n\nThis patchset is split from the earlier 9-patch series to limit the\nfixes to the PCIe FLR/AER issues only (patches 7 to 9). The other\nfixes (patches 1 to 6) will be sent to net-next separately.\n\nThe 1st patch is unchanged since v1. It refactors a bnxt_clear_bars()\nhelper needed by patch 2 and 3. Patch 2 fixes an issue during driver\ninit. in the kdump kernel on a Dell system with a smart PCIe switch\nupstream from the NIC. Patch 3 fixes an issue in the AER code path for\nnon-fatal errors found by a partner.\n\nThese patches have been regression tested on Broadcom 5750X and 5760X\nNICs running 237.x.x.x production FW.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261005204246.3822563-1-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2e52da27096d9dbc487f303bbc10d44ad837a8c4", "tree": "a7d7e8ed2c3699b737f16fe74672e9971dd65311", "parents": [ "386f887c8290f0747dd0180e98ec7a82811bc506" ], "author": { "name": "Pavan Chebbi", "email": "pavan.chebbi@broadcom.com", "time": "Mon Oct 05 13:42:46 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:01 2026 -0700" }, "message": "bnxt_en: Re-write the BARs following any type of PCIe errors\n\nCurrently the driver zeroes the BARs only when fatal PCIe errors\nare reported so that pci_restore_state() restores it. However\nfirmware handles both fatal and non-fatal errors the same way when\nit sees the slot reset resulting from the PCI_ERS_RESULT_NEED_RESET\nreturn code from the driver. This means that we must re-write the\nBARs post recovery even during non-fatal errors. Otherwise we will\nsee that every MMIO access returns all-ones and the firmware appears\ndead.\n\nZero-out the BARs during PCIe error recovery regardless of type of\nPCIe error, and make the wait after the hot reset unconditional.\n\nDisable memory decode and bus mastering before rewriting the BARs so\nthe device doesn\u0027t decode a half-updated address, bailing out if\nconfig space is still inaccessible. Defer pci_enable_device() until\nafter the BAR rewrite and restore, so the device isn\u0027t re-enabled\nwhile its BARs are still being rewritten, then re-enable the device\nand re-assert bus mastering. Guard the same Command register cleanup\non the re-enable failure path against an inaccessible device.\n\nSkip re-enabling the device in bnxt_io_slot_reset() if it is already\nenabled, so enable_cnt does not go unbalanced. A concurrent\nbnxt_fw_reset_task() can also be re-enabling the same device in its\nENABLE_DEV state, so guard that call the same way.\n\nFixes: f75d9a0aa967 (\"bnxt_en: Re-write PCI BARs after PCI fatal error.\")\nReviewed-by: Kalesh AP \u003ckalesh-anakkur.purayil@broadcom.com\u003e\nReviewed-by: Scott Branden \u003cscott.branden@broadcom.com\u003e\nSigned-off-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261005204246.3822563-4-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "386f887c8290f0747dd0180e98ec7a82811bc506", "tree": "fd41ece9ea3cfeac7049252d9ab35c3296410705", "parents": [ "8f5d59b9cfa69beab3b52cca621bb301c5af98aa" ], "author": { "name": "Michael Chan", "email": "michael.chan@broadcom.com", "time": "Mon Oct 05 13:42:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:01 2026 -0700" }, "message": "bnxt_en: Fix driver init in kdump kernel\n\nFix and strengthen the FLR sequence when initializing in the kdump\nkernel. If the NIC is behind a PCIe switch in synthetic (smart)\nmode, the switch may need to see that the BARs have been initialized\nbefore it will pass mem read/write TLPs to the NIC.\n\nOn a Dell system with a PEX89144 PCIe switch, echo c \u003e /proc/sysrq-trigger\nwill trigger fatal AER without this patch:\n\nbnxt_en 0000:67:00.0: enabling device (0000 -\u003e 0002)\n[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 5\n[Hardware Error]: event severity: recoverable\n[Hardware Error]: Error 0, type: fatal\n[Hardware Error]: section_type: PCIe error\n[Hardware Error]: port_type: 5, upstream switch port\n...\n\nAdd a new bnxt_kdump_reset() to do the expanded FLR sequence in the\nkdump kernel. We now disable bus master and memory, save the PCI\nstate, do the FLR, clear the BARs, and restore the PCI state. The\nBARs have to be cleared to ensure that they get re-initialized and\nvisible to the PCIe switch.\n\nSince it is the kdump kernel, we make every effort to continue in\nthe best possible way even if pci_save_state() or pcie_flr() returns\nerror. After FLR, we poll for an additional 5 seconds before\naborting in case the device is not properly returning CRS. This is\nsimilar to the 5-second wait in bnxt_io_slot_reset().\n\nFixes: 8743db4a9acf (\"bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs.\")\nReviewed-by: Kalesh AP \u003ckalesh-anakkur.purayil@broadcom.com\u003e\nSigned-off-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261005204246.3822563-3-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f5d59b9cfa69beab3b52cca621bb301c5af98aa", "tree": "68b05bc98787d2c7efbc3fd0f8085efd91bb7f6c", "parents": [ "9b6c20f788472d2042717a3c2f1bc60b2b77083e" ], "author": { "name": "Michael Chan", "email": "michael.chan@broadcom.com", "time": "Mon Oct 05 13:42:44 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:01 2026 -0700" }, "message": "bnxt_en: Add bnxt_clear_bars() helper\n\nIn bnxt_io_slot_reset(), we clear the 6 BAR registers. Add a helper\nfunction to do that. The helper will be used again in the next patch.\n\nReviewed-by: Kalesh AP \u003ckalesh-anakkur.purayil@broadcom.com\u003e\nReviewed-by: Somnath Kotur \u003csomnath.kotur@broadcom.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nSigned-off-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261005204246.3822563-2-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9b6c20f788472d2042717a3c2f1bc60b2b77083e", "tree": "5ccfae91814f26b9cdd15ea9cc9acbeba9219908", "parents": [ "fd4e7f1137291c7446278a0189f8064f29b5a605" ], "author": { "name": "Fredrik Nyberg", "email": "fredrik.nyberg@volvocars.com", "time": "Fri Oct 02 14:28:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 16:43:50 2026 -0700" }, "message": "net: usb: ax88179_178a: fix rx frame length for non-last packets\n\nCommit 4ce62d5b2f7a (\"net: usb: ax88179_178a: stop lying about\nskb-\u003etruesize\") replaced skb_clone() with a copy into a new skb for\nevery packet of a bulk-in transfer except the last one. The copy skips\nthe 2-byte IP alignment pseudo header but still copies pkt_len bytes,\nand pkt_len includes that header. Each of these frames is therefore\ndelivered with two extra trailing bytes: the 0xeeee pseudo header of\nthe next slot when the frame ends on an 8-byte boundary, or slot\npadding otherwise. The last packet is still trimmed to pkt_len - 2.\n\nIPv4 and IPv6 trim the extra bytes, so most traffic is unaffected.\nAnything that relies on the frame length is not. MACsec takes the ICV\nfrom the last 16 bytes and drops every such frame as InPktsNotValid. In\nour setup that was 0.2-1.2% of received MACsec frames, depending on how\nmany frames shared a transfer, including service discovery multicast.\n\nAllocate and copy pkt_len - 2 bytes, like the last-packet path.\n\nFixes: 4ce62d5b2f7a (\"net: usb: ax88179_178a: stop lying about skb-\u003etruesize\")\nCc: stable@vger.kernel.org\nSigned-off-by: Fredrik Nyberg \u003cfredrik.nyberg@volvocars.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261002-ax88179-rx-len-v1-1-f01a2a295079@volvocars.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd4e7f1137291c7446278a0189f8064f29b5a605", "tree": "01d2e9fb61033ea843065412e4f135ec80a45b12", "parents": [ "23609bce9e1de525d1d0e73fc68c6e7971d0b49e", "9727d1c4e1c971fc42b049b645fdda6852758835" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 16:23:43 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 16:23:44 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-10-07\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nSome more fixes:\n - ath12k: revert broken panic handler\n - mt76: SAR/MLO/STA/NAPI fixes\n - nxpwifi: race fixes, validation\n - libertas: revert botched frame size fix\n - brcmfmac: fix crash on P2P removal\n - mac80211: fix WARN on downlink OFDMA frames\n\n* tag \u0027wireless-2026-10-07\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (25 commits)\n Revert \"wifi: libertas: reject short monitor TX frames\"\n wifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n wifi: mac80211: don\u0027t estimate airtime for unsupported rate widths\n Revert \"wifi: ath12k: add panic handler\"\n wifi: nxpwifi: do not delete Rx reorder entries under RCU\n wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion\n wifi: nxpwifi: handle authentication frame allocation failures\n wifi: nxpwifi: fix the authentication frame length handling\n wifi: nxpwifi: zero the channel statistics array\n wifi: nxpwifi: free the aggregation buffer when the RA list disappears\n wifi: nxpwifi: wait for the wakeup timer before the adapter is freed\n wifi: nxpwifi: delete the station entry on the uAP deauth event\n wifi: nxpwifi: protect sta_list against concurrent add and delete\n wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()\n wifi: mt76: mt792x: pick the SAR table layout from the table itself\n wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit\n wifi: mt76: mt7603: initialize global station WCID\n wifi: mt76: mt7925: don\u0027t put the band auto marker in TGID\n wifi: mt76: mt7915: disable rx napi when removing device\n wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261007205143.464714-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9727d1c4e1c971fc42b049b645fdda6852758835", "tree": "71beac7a870e91bf7e4bfc7e15dca7ce4b7f8fbf", "parents": [ "08a3f02fea636e97a7422d1512f76dacdb5b0887" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 22:42:08 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 22:48:10 2026 +0200" }, "message": "Revert \"wifi: libertas: reject short monitor TX frames\"\n\nThis reverts commit 13ff543e0b2c713aedeaadadde686686e949dc78.\n\nThe \u0027goto free\u0027 just made things worse, causing a spinlock\nto be handled incorrectly. Revert this for now.\n\nReported-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nCc: stable@vger.kernel.org\nFixes: 13ff543e0b2c (\"wifi: libertas: reject short monitor TX frames\")\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "c7f44ec5c4ec760e74351f1843dcb8322f67cbf6", "tree": "f7b740b3f6e04cbed2744da1ed05920a8e639e72", "parents": [ "e6895021a328594368a2a19406a53ffca1ce51c7" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Sep 25 09:16:26 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Oct 07 13:14:55 2026 -0400" }, "message": "drm/amdgpu: make Mac FB workaround generic\n\nRather than adding a case of every chip where this is seen\njust check if the FB is at 0 and the ssid is apple. This\nshould cover all chips which fall into this case.\n\nTested-by: Ayhan Çiçek \u003cayhancicek@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c54e4d10507722398dc90cf3c532e50b86cf425a)\nCc: stable@vger.kernel.org\n" } ], "next": "e6895021a328594368a2a19406a53ffca1ce51c7" }