)]}' { "log": [ { "commit": "e43ffb69e0438cddd72aaa30898b4dc446f664f8", "tree": "4f844efc76f40c4cb998567f5348b46c128b6415", "parents": [ "8d9c51eac648ec953ea534b536d62337be3744b7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 15:14:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 15:14:24 2026 -0700" }, "message": "Linux 7.1-rc6\n" }, { "commit": "8d9c51eac648ec953ea534b536d62337be3744b7", "tree": "94032dd5785d14a2dc3b38a8a5d116b2a703cf34", "parents": [ "968966c2823a4b426a1c71101cb682faa0982892", "171022c7d594c133a45f92357a2a91475edabe20" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 11:50:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 11:50:39 2026 -0700" }, "message": "Merge tag \u0027media/v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fixes from Mauro Carvalho Chehab:\n\n - rc: igorplugusb: fix control request setup packet\n\n - vsp1: revert a couple patches to fix regressions when setting DRM\n pipelines\n\n* tag \u0027media/v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: rc: igorplugusb: fix control request setup packet\n Revert \"media: renesas: vsp1: brx: Fix format propagation\"\n Revert \"media: renesas: vsp1: Initialize format on all pads\"\n" }, { "commit": "968966c2823a4b426a1c71101cb682faa0982892", "tree": "60745a176326282c90775e53a156920ad6446126", "parents": [ "13bd441bb98e9cc91f9fb4449415e0519a0de7a9", "44eeff9bc467bc7d1fec34fc3f6001f385fe462c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:52:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:52:16 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-05-31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Make the clearcpuid\u003d boot parameter less prominent\n and warn about its dangers \u0026 caveats (Borislav Petkov)\n\n - Do not access the (new) PLATFORM_ID MSR when running\n as a guest (Borislav Petkov)\n\n - x86 ftrace: Relocate %rip-relative percpu refs in dynamic\n trampolines, to fix crash when using such trampolines\n (Alexis Lothoré)\n\n - Fix x86-64 CFI build error (Peter Zijlstra)\n\n - Revert FPU signal return magic number check optimization,\n because it broke CRIU and gVisor in certain FPU configurations\n (Andrei Vagin)\n\n* tag \u0027x86-urgent-2026-05-31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n Revert \"x86/fpu: Refine and simplify the magic number check during signal return\"\n x86/kvm/vmx: Fix x86_64 CFI build\n x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines\n x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a guest\n Documentation/arch/x86: Hide clearcpuid\u003d\n" }, { "commit": "13bd441bb98e9cc91f9fb4449415e0519a0de7a9", "tree": "25041ee4cfae04300db785d0aa69308ae4446335", "parents": [ "9cf1afe6de1dc9dfced6070328626830794bac9d", "85db7391310b1304d2dc8ae3b0b12105a9567147" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:45:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:45:08 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Two core changes, the only one of significance being the change to\n kick queues in SDEV_CANCEL which had a small window for stuck\n requests.\n\n The major driver fixes are the one to the FC transport class to widen\n the FPIN counter to counter a theoretical (and privileged) fabric\n traffic injection attack and the other is an iscsi fix where a\n malicious target could trick the kernel into an output buffer overrun.\n\n Both the driver fixes were AI assisted\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: iscsi: Validate CHAP_R length before base64 decode\n scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()\n scsi: megaraid_sas: Fix NULL pointer dereference on firmware duplicate completion\n scsi: devinfo: Add BLIST_NO_RSOC for Promise VTrak E310f\n scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues\n" }, { "commit": "9cf1afe6de1dc9dfced6070328626830794bac9d", "tree": "8368901815ce319358123ca1aae4c484592eecc7", "parents": [ "227abb780c68687d6800cf9eafaff0cbeca4bf45", "1d774589f924056b8403e271fdecaf9a803a50fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:33:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:33:08 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n\n - davinci: fix fallback bus frequency on missing clock-frequency\n\n - virtio: mark device ready initially\n\n* tag \u0027i2c-for-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: virtio: mark device ready before registering the adapter\n i2c: davinci: fix division by zero on missing clock-frequency\n" }, { "commit": "227abb780c68687d6800cf9eafaff0cbeca4bf45", "tree": "7d73343a34379cea7cc755fa4c964f5b150f0933", "parents": [ "174914ea551314c52a61713b9c4bde9e42d48073", "dab48a7e74e6a394f3aa0461a2b1fb0c7b38fcb8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:27:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 31 08:27:18 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - updates to Elan I2C touchpad driver to handle a new IC type and to\n validate size of supplied firmware to prevent OOB access\n\n - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II\n and \"Nova 2 Lite\" from GameSir controllers as well as a fix to\n prevent a potential OOB access when handling \"Share\" button\n\n - an update to Synaptics touchpad driver to use RMI mode for touchpad\n in Thinkpad E490\n\n - updates to Atmel MXT driver adding checks to prevent potential OOB\n accesses\n\n - a fix to IMS PCU driver to free correct amount of memory when tearing\n it down\n\n - a fixup to the recent change to Atlas buttons driver\n\n - a small cleanup in fm801-fp for PCI IDs table initialisation\n\n* tag \u0027input-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()\n Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490\n Input: atlas - check ACPI_COMPANION() against NULL\n Input: atmel_mxt_ts - check mem_size before calculating config memory size\n Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem\n Input: fm801-gp - simplify initialisation of pci_device_id array\n Input: xpad - add \"Nova 2 Lite\" from GameSir\n Input: xpad - add support for ASUS ROG RAIKIRI II\n Input: elan_i2c - validate firmware size before use\n Input: xpad - fix out-of-bounds access for Share button\n Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n Input: elan_i2c - increase device reset wait timeout after update FW\n Input: elan_i2c - add ic type 0x19\n" }, { "commit": "174914ea551314c52a61713b9c4bde9e42d48073", "tree": "c7035bc0abc5c8165911490194e52a303123633a", "parents": [ "9d87d0fc8c8e0a2a2b5026a169db2f270b4828c1", "9d2491197a00acf8c423512078458c2855102b66" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 17:05:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 17:05:58 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc6-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - fix uninitialized variable in smb2_writev_callback()\n\n - detect short folioq copy in cifs_copy_folioq_to_iter()\n\n* tag \u0027v7.1-rc6-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: fix uninitialized variable in smb2_writev_callback\n smb: client: detect short folioq copy in cifs_copy_folioq_to_iter()\n" }, { "commit": "9d87d0fc8c8e0a2a2b5026a169db2f270b4828c1", "tree": "c981811edb000e4fe0481b8e21265ef809eb0972", "parents": [ "a29c0b0cafc78a45f44ac4a98efee0c11dd7996d", "8fd2f26fa2a33cfe8ac043f976137ecf5b567f03" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 15:39:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 15:39:47 2026 -0700" }, "message": "Merge tag \u0027liveupdate-fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux\n\nPull liveupdate fixes from Mike Rapoport:\n \"Two kexec handover regression fixes:\n\n - fix order calculation for kho_unpreserve_pages() to make sure sure\n that the order calculation in kho_unpreserve_pages() mathes the\n order calculation in kho_preserve_pages().\n\n - fix math in calculation of KHO_TREE_MAX_DEPTH to make it work with\n 16KB pages\"\n\n* tag \u0027liveupdate-fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:\n kho: fix order calculation for kho_unpreserve_pages()\n kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes\n" }, { "commit": "a29c0b0cafc78a45f44ac4a98efee0c11dd7996d", "tree": "23c4227493d89a0276b0331e96285982a51bae8d", "parents": [ "670b77dfebe7257adc0defbc48a4c43cfdf6c8f6", "7c2eee9c136734825ff524dd8b2146438a4f8250" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 15:37:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 15:37:05 2026 -0700" }, "message": "Merge tag \u0027fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock\n\nPull memblock fix from Mike Rapoport:\n \"Fix regression from memblock_free_late() refactoring\n\n After refactoring of memblock_free_late() and free_init_pages() it\n became possible to call memblock_free() after memblock init data was\n discarded.\n\n Make sure memblock_free() does not touch memblock.reserved unless it\n is called early enough or when ARCH_KEEP_MEMBLOCK is enabled\"\n\n* tag \u0027fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:\n memblock: don\u0027t touch memblock arrays when memblock_free() is called late\n" }, { "commit": "171022c7d594c133a45f92357a2a91475edabe20", "tree": "87ffeb174ec8aa00c51ee37dcb3d18a079a9117d", "parents": [ "f78073e84c800ae146ce62447e7a685a5ceeb92d" ], "author": { "name": "Henri A", "email": "contact@henrialfonso.com", "time": "Wed May 20 10:25:44 2026 -0400" }, "committer": { "name": "Hans Verkuil", "email": "hverkuil+cisco@kernel.org", "time": "Sat May 30 18:21:47 2026 +0200" }, "message": "media: rc: igorplugusb: fix control request setup packet\n\nCommit eac69475b01f (\"media: rc: igorplugusb: heed coherency\nrules\") changed the control request storage from an embedded struct to\nan allocated pointer so it can obey DMA coherency rules.\n\nHowever, the driver still passes \u0026ir-\u003erequest to usb_fill_control_urb().\nThat points the URB setup packet at the pointer field itself rather than\nat the allocated struct usb_ctrlrequest.\n\nUSB core then interprets pointer bytes as the setup packet. This can\nproduce an invalid bRequestType and trigger the control direction warning\nreported by syzbot:\n\n usb 2-1: BOGUS control dir, pipe 80003580 doesn\u0027t match bRequestType 0\n\nPass ir-\u003erequest itself as the setup packet.\n\nFixes: eac69475b01f (\"media: rc: igorplugusb: heed coherency rules\")\nReported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d11f0e4f957c7c3bf3d51\nTested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com\nCc: stable@vger.kernel.org\nAssisted-by: Codex:GPT-5.5\nSigned-off-by: Henri A \u003ccontact@henrialfonso.com\u003e\nSigned-off-by: Sean Young \u003csean@mess.org\u003e\nSigned-off-by: Hans Verkuil \u003chverkuil+cisco@kernel.org\u003e\n" }, { "commit": "670b77dfebe7257adc0defbc48a4c43cfdf6c8f6", "tree": "60f52a85ef4edabdc8a8da0dac1a453efa287386", "parents": [ "495fb8dd7f1da991c5325f4a0a50d0b042f19523", "645d4eda1d0db0202ed8e4a2c3abb2ebce6b86ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 08:37:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 08:37:45 2026 -0700" }, "message": "Merge tag \u0027usb-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB and Thunderbolt fixes from Greg KH:\n \"Here is a set of USB fixes and new device ids for 7.1-rc6. Nothing\n major in here, just lots of tiny fixes for reported issues found by\n users and some older patches found by some scanning tools. Included in\n here are:\n\n - typec fixes found by fuzzers that have decided to finally look at\n that device interaction path (i.e. before a driver is bound to a\n device)\n\n - typec fixes for issues found by users\n\n - thunderbolt driver fixes for reported problems\n\n - cdns3 driver fixes\n\n - dwc3 driver fixes\n\n - new device quirks added\n\n - usb serial driver fixes for broken devices\n\n - other small driver fixes\n\n All of these have been in linux-next for over a week with no reported\n issues\"\n\n* tag \u0027usb-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (54 commits)\n USB: serial: cypress_m8: validate interrupt packet headers\n USB: serial: safe_serial: fix memory corruption with small endpoint\n USB: serial: omninet: fix memory corruption with small endpoint\n USB: serial: mxuport: fix memory corruption with small endpoint\n USB: serial: cypress_m8: fix memory corruption with small endpoint\n USB: cdc-acm: Fix bit overlap and move quirk definitions to header\n usb: dwc2: Fix use after free in debug code\n usb: chipidea: core: convert ci_role_switch to local variable\n usb: gadget: f_fs: serialize DMABUF cancel against request completion\n usb: gadget: f_fs: copy only received bytes on short ep0 read\n usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports\n dt-bindings: usb: Fix EIC7700 USB reset\u0027s issue\n usbip: vudc: Fix use after free bug in vudc_remove due to race condition\n dt-bindings: usb: ti,omap4-musb: Drop duplicate \u0027usb-phy\u0027 property constraints\n usb: storage: Add quirks for PNY Elite Portable SSD\n USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers\n usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize\n usb: usbtmc: check URB actual_length for interrupt-IN notifications\n xhci: tegra: Fix ghost USB device on dual-role port unplug\n usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind\n ...\n" }, { "commit": "495fb8dd7f1da991c5325f4a0a50d0b042f19523", "tree": "becb7b0c9a08fd796a91f50ab119e33d32d11fe3", "parents": [ "25447851777a53bd4b501e7f2cb418332ad584cc", "e4240d8845445d58b4b96f7066adfe175a61bd0c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 08:34:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 08:34:03 2026 -0700" }, "message": "Merge tag \u0027tty-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty/serial driver fixes from Greg KH:\n \"Here are some small serial driver fixes for 7.1-rc6. Included in here\n are:\n\n - mips serial driver fixes to resolve some long-standing issues with\n how they interacted with the console. That\u0027s the \"majority\" of the\n changes in this merge request\n\n - sh-sci driver regression fix\n\n - 8250 driver regression fixes\n\n - other small serial driver fixes for reported problems.\n\n All of these have been in linux-next for over a week with no reported\n issues\"\n\n* tag \u0027tty-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n serial: dz: Enable modular build\n serial: zs: Convert to use a platform device\n serial: dz: Convert to use a platform device\n serial: zs: Switch to using channel reset\n serial: zs: Fix bootconsole handover lockup\n serial: dz: Fix bootconsole handover lockup\n serial: dz: Fix bootconsole message clobbering at chip reset\n serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()\n serial: 8250: dispatch SysRq character in serial8250_handle_irq()\n serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)\n tty: serial: samsung: Remove redundant port lock acquisition in rx helpers\n serial: altera_jtaguart: handle uart_add_one_port() failures\n serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ\n serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma\n tty: add missing tty_driver include to tty_port.h\n serial: qcom-geni: fix UART_RX_PAR_EN bit position\n serial: sh-sci: fix memory region release in error path\n tty: serial: pch_uart: add check for dma_alloc_coherent()\n serial: zs: Fix swapped RI/DSR modem line transition counting\n" }, { "commit": "25447851777a53bd4b501e7f2cb418332ad584cc", "tree": "df40431330ef03032ee1e68393cc6632c416156a", "parents": [ "1246c246d9f684599e1dd7498043062c89fb0a36", "05d5d79440c2cc0784f91b61f2012753e66be472" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 08:30:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 30 08:30:12 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc/iio fixes from Greg KH:\n \"Here are some small char/misc/iio driver fixes for 7.1-rc6. Included\n in here are:\n\n - lots of small IIO driver fixes for reported problems.\n\n - Android binder bugfixes for reported issues.\n\n - small comedi test driver fixes\n\n - counter driver fix\n\n - parport driver fix (people still use this?)\n\n - rpi driver fix\n\n - uio driver fix\n\n All of these have been in linux-next for over a week with no reported\n problems\"\n\n* tag \u0027char-misc-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (41 commits)\n Revert \"gpib: cb7210: Fix region leak when request_irq fails\"\n misc: rp1: Send IACK on IRQ activate to fix kdump/kexec\n gpib: cb7210: Fix region leak when request_irq fails\n parport: Fix race between port and client registration\n uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\n rust_binder: Avoid holding lock when dropping delivered_death\n rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN\n comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()\n comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()\n iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw\n iio: gyro: itg3200: fix i2c read into the wrong stack location\n iio: dac: ad5686: fix powerdown control on dual-channel devices\n iio: dac: ad5686: acquire lock when doing powerdown control\n iio: temperature: tsys01: fix broken PROM checksum validation\n iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings\n iio: buffer: hw-consumer: fix use-after-free in error path\n iio: dac: ad5686: fix input raw value check\n iio: dac: ad5686: fix ref bit initialization for single-channel parts\n iio: ssp_sensors: cancel delayed work_refresh on remove\n iio: adc: meson-saradc: fix calibration buffer leak on error\n ...\n" }, { "commit": "1d774589f924056b8403e271fdecaf9a803a50fc", "tree": "e3c4046812d76509a5c53dcfd8b4005860440dd8", "parents": [ "e2aecff95bc6d59030332959a18f8c9f654961be" ], "author": { "name": "Alexis Bouzigues", "email": "BouziguesAlexis@JohnDeere.com", "time": "Fri May 29 09:28:14 2026 -0500" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Sat May 30 15:56:07 2026 +0200" }, "message": "i2c: virtio: mark device ready before registering the adapter\n\nvirtio_i2c_probe() synchronously probes child i2c drivers on the bus,\nbut peripherals may use the bus at probe for tasks like reading a chip\nid. The vhost-user-i2c backend stalls at such probes unless DRIVER_OK\nis already set before the virtqueue is first kicked.\n\nSet DRIVER_OK explicitly before i2c_add_adapter(), as done for the\nsame reason in commit f5866db64f34 (\"virtio_console: enable VQs\nearly\") and commit 71e4b8bf0482 (\"virtio_rpmsg: set DRIVER_OK before\nusing device\").\n\nSigned-off-by: Alexis Bouzigues \u003cBouziguesAlexis@JohnDeere.com\u003e\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\n" }, { "commit": "e2aecff95bc6d59030332959a18f8c9f654961be", "tree": "6d04c27c7114441f9ab9dfa3dd2f00a17b865c29", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d", "030675aa54cf757769b3db65642433d626b3ed7c" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Sat May 30 15:50:41 2026 +0200" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Sat May 30 15:50:41 2026 +0200" }, "message": "Merge tag \u0027i2c-host-fixes-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-host-fixes for v7.1-rc6\n\ndavinci: fix fallback bus frequency on missing clock-frequency\n" }, { "commit": "05d5d79440c2cc0784f91b61f2012753e66be472", "tree": "5dd739fd70746f2806be734a5cc6ecbeac388ac1", "parents": [ "36770417153644bc88281c7284730ef1d14d8d3c" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 30 12:25:36 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 30 12:25:36 2026 +0200" }, "message": "Revert \"gpib: cb7210: Fix region leak when request_irq fails\"\n\nThis reverts commit 2eae90a457baa0048a96ed38ad93090ee38c8b2f.\n\nTurns out not to be correct.\n\nLink: https://lore.kernel.org/r/PpNUbGhrvT8I_KayoDvQYI2PYjmMw1QEkuVBDZz2PwBsVVgPkBXJarc2mBM0IhiH3AQG0GtgqEsDRXNj3yUKEDBaZa25u73pAjvcE6vfRsg\u003d@protonmail.com\nReported-by: Dominik Karol Piątkowski \u003cdominik.karol.piatkowski@protonmail.com\u003e\nCc: Mark Brown \u003cbroonie@kernel.org\u003e\nCc: Hongling Zeng \u003czhongling0719@126.com\u003e\nCc: Hongling Zeng \u003czenghongling@kylinos.cn\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1246c246d9f684599e1dd7498043062c89fb0a36", "tree": "8a900b1660d4d2a93e05d8cf0431a8c3b5901918", "parents": [ "2765233a483febb1bf56f0abdcc5aa06d25633d7", "cc57232cae23c0df91b4a59d0f519141ce9b5b02" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 21:50:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 21:50:56 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc6-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - security fix for FSCTL_SET_SPARSE\n\n - fix leak in ksmbd_query_inode_status()\n\n - fix OOB read in smb_check_perm_dacl()\n\n* tag \u0027v7.1-rc6-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE\n ksmbd: release ksmbd_inode ref via ksmbd_inode_put on lookup paths\n ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops\n" }, { "commit": "2765233a483febb1bf56f0abdcc5aa06d25633d7", "tree": "284f469b4544480c55fb6296ac35a15d96c77ae1", "parents": [ "f5e5d3509bffb95c6648eb9795f7f236852ae62d", "7164d78559b0ff29931a366a840a9e5dd53d4b7c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 19:08:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 19:08:20 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-30\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Regular pull, doesn\u0027t seem too insane or AI owned, couple of UAF fixes\n and another repair for an earlier fix, mostly amdgpu and i915 display\n with xe/i915 accel, and misc core/driver fixes.\n\n It might be a bit bigger than usual at this stage, but I\u0027m not seeing\n anything too scary here.\n\n dumb-buffer:\n - prevent overflows in dumb-buffer creation\n\n dma-buf:\n - fix UAF in dma_buf_fd() tracepoint\n\n gem:\n - fix for the fix for the fix for the change handle ioctl\n\n i915:\n - Fix potential UAF in TTM object purge\n - Use polling when irqs are unavailable\n - Fix HDR pre-CSC LUT programming loop\n - Block DC states on vblank enable when Panel Replay supported\n - Use DC_OFF wake reference to block DC6 on vblank enable\n\n xe:\n - Restore IDLEDLY regiter on engine reset\n\n amdgpu:\n - GEM_OP warning fix\n - GEM_OP locking fix\n - Userq fixes\n - DCN 2.1 refclk fix\n - SI fix\n - HMM fixes\n\n amdkfd:\n - svm_range_set_attr locking fix\n - CRIU restore fix\n - KFD debugger fix\n\n amdxdna:\n - require IOMMU on AIE2\n\n hyperv:\n - improve protocol validation\n\n ivpu:\n - test write offset in debugfs\n\n rocket:\n - fix UAF in bo creation\"\n\n* tag \u0027drm-fixes-2026-05-30\u0027 of https://gitlab.freedesktop.org/drm/kernel: (33 commits)\n drm/gem: fix race between change_handle and handle_delete\n drm: prevent integer overflows in dumb buffer creation helpers\n dma-buf: fix UAF in dma_buf_fd() tracepoint\n drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx\n drm/amdgpu: fix amdgpu_hmm_range_get_pages\n drm/amdgpu/userq: use array instead of list for userq_vas\n drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid\n drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger\n drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper\n drm/amd/pm/si: Disregard vblank time when no displays are connected\n drm/amdkfd: Check for pdd drm file first in CRIU restore path\n drm/amdgpu: fix potential overflow in fs_info.debugfs_name\n drm/amdgpu/userq: make sure queue is valid in the hang_detect_work\n drm/amdgpu/userq: reserve root bo without interruption\n drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails\n drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index\n drm/amdkfd: fix NULL pointer bug in svm_range_set_attr\n drm/amd/display: Write REFCLK to 48MHz on DCN21\n drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock\n drm/amdgpu/userq: Fix doorbell object cleanup of queue\n ...\n" }, { "commit": "f5e5d3509bffb95c6648eb9795f7f236852ae62d", "tree": "a94c864e86a17c42b663a51546ca3cfdd7badcfc", "parents": [ "230ff934f744a4c2e4b74893ccf6734f6556db90", "79378db6a86c7014cce40b65252e6c18f5b8bcc2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 18:07:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 18:07:37 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"One substantive fix here, fixing corruption of the maximum frequency\n for spi-mem operations which caused users to remember what should have\n been a temporarily modified maximum frequency as the standard going\n forward, potentially causing instability when the modification raised\n rather than lowered the frequency.\n\n We also have a trivial patch which just documents the correct way to\n describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no\n code changes\"\n\n* tag \u0027spi-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: spi-mem: avoid mutating op template in spi_mem_supports_op()\n spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible\n" }, { "commit": "230ff934f744a4c2e4b74893ccf6734f6556db90", "tree": "0479ce6ed10b277e82f1f0509a3781dfa2ea8498", "parents": [ "f3be0c984ecbcb82b0bec408022c4ef738cb3843", "006c66d1d52f1905e6ccfb615cf27235e4e6e745" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 16:39:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 16:39:56 2026 -0700" }, "message": "Merge tag \u0027regmap-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fix from Mark Brown:\n \"Some other fixing in an API user turned up the fact that we weren\u0027t\n correctly applying cache only mode to volatile registers in\n regmap_update_bits(), causing us to try to access hardware that was\n powered off or otherwise not in a state to accept I/O. This fix\n returns an error instead, avoiding more serious consequences\"\n\n* tag \u0027regmap-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: reject volatile update_bits() in cache-only mode\n" }, { "commit": "f3be0c984ecbcb82b0bec408022c4ef738cb3843", "tree": "83120ec6d347562f899901db9e793864c398776e", "parents": [ "77590cacabb3bffba7e2e95c359889bc44241b68", "78ef59e7a6459b16f8102e0ee1c718443323d1af" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 15:46:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 15:46:40 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc6-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull more networking fixes from Jakub Kicinski:\n \"Quick follow up, nothing super urgent here. Main reason I\u0027m sending\n this out is because the IPsec and Bluetooth PRs did not make it\n yesterday. I don\u0027t want to have to send you all of this + whatever\n comes next week, for rc7. The fixes under \"Previous releases -\n regressions\" are for real user-reported regressions from v7.0.\n\n Previous releases - regressions:\n\n - Revert \"ipv6: preserve insertion order for same-scope addresses\"\n\n - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU on\n netns exit got backported to stable and was causing serious\n accumulation of dying netns\u0027s for real workloads\n\n - pcs-mtk-lynxi: fix bpi-r3 serdes configuration\n\n Previous releases - always broken:\n\n - usual grab bag of race, locking and leak fixes for Bluetooth\n\n - handful of page handling fixes for IPsec\"\n\n* tag \u0027net-7.1-rc6-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits)\n wireguard: send: append trailer after expanding head\n Revert \"ipv6: preserve insertion order for same-scope addresses\"\n net: skbuff: fix pskb_carve leaking zcopy pages\n ipv6: fix possible infinite loop in fib6_select_path()\n ipv6: fix possible infinite loop in rt6_fill_node()\n bpf: sockmap: fix tail fragment offset in bpf_msg_push_data\n vsock/virtio: bind uarg before filling zerocopy skb\n Revert \"esp: fix page frag reference leak on skb_to_sgvec failure\"\n net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration\n sctp: fix race between sctp_wait_for_connect and peeloff\n net: mana: Skip redundant detach on already-detached port\n net: mana: Add NULL guards in teardown path to prevent panic on attach failure\n Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()\n Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions\n Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n Bluetooth: ISO: fix UAF in iso_recv_frame\n Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\n Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading\n ...\n" }, { "commit": "77590cacabb3bffba7e2e95c359889bc44241b68", "tree": "70ef63a498a8e0cf4c0fbf05e354f8c44bb6ee9b", "parents": [ "d0ee290071b475410476b4126c72da4bf6a2194c", "175db11786bde9061db526bf1ac5107d915f5163" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 15:17:53 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 15:17:53 2026 -0700" }, "message": "Merge tag \u0027clang-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux\n\nPull clang build fix from Nathan Chancellor:\n \"A small fix to disable -Wattribute-alias for clang in the few places\n it is already disabled for GCC, now that tip of tree clang has\n implemented -Wattribute-alias as GCC has\"\n\n* tag \u0027clang-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux:\n Disable -Wattribute-alias for clang-23 and newer\n" }, { "commit": "44eeff9bc467bc7d1fec34fc3f6001f385fe462c", "tree": "53ac15a19f33cfdb0ee0d1a2c28e05fcdbf62056", "parents": [ "8aeb879baf12fe64889f019da9a4f8347c604e91" ], "author": { "name": "Andrei Vagin", "email": "avagin@google.com", "time": "Tue May 26 20:50:43 2026 +0000" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri May 29 15:05:30 2026 -0700" }, "message": "Revert \"x86/fpu: Refine and simplify the magic number check during signal return\"\n\nThis reverts\n\n dc8aa31a7ac2 (\"x86/fpu: Refine and simplify the magic number check during signal return\").\n\nThe aforementioned commit broke applications that construct signal frames in\nuserspace (such as CRIU and gVisor) if the frame\u0027s xstate size is smaller than\nthe kernel\u0027s fpstate-\u003euser_size.\n\nFurthermore, this introduces a critical issue for checkpoint/restore tools\nlike CRIU. If a process is checkpointed while inside a signal handler, its\nstack contains a signal frame formatted according to the source host\u0027s xstate\ncapabilities.\n\nIf that process is later restored on a destination host with larger xstate\ncapabilities (e.g., a newer CPU with more features enabled, resulting in\na larger fpstate-\u003euser_size), the kernel will look for FP_XSTATE_MAGIC2 at the\ndestination host\u0027s larger user_size offset instead of the offset encoded in\nthe frame\u0027s fx_sw-\u003exstate_size.\n\nThis causes the magic2 check to fail, forcing sigreturn to silently fall back\nto \"FX-only\" mode. Upon return from the signal handler, the process\u0027s extended\nstate is reset to initial values instead of being restored, leading to silent\ndata corruption.\n\nThe aforementioned commit cited\n\n d877550eaf2d (\"x86/fpu: Stop relying on userspace for info to fault in xsave buffer\")\n\nas justification to stop relying on userspace for the magic number check.\n\nHowever, these two changes are fundamentally different. The last one only\nchanged how much memory the kernel ensures is paged-in before running XRSTOR\nto prevent an infinite loop. It did not change the signal frame format or how\nthe layout is validated.\n\nReverting this change restores the use of fx_sw-\u003exstate_size for\nlocating magic2 and restores the necessary sanity checks, ensuring that\nthe signal frame remains self-describing and portable.\n\n [ bp: Massage commit message. ]\n\nFixes: dc8aa31a7ac2 (\"x86/fpu: Refine and simplify the magic number check during signal return\")\nSigned-off-by: Andrei Vagin \u003cavagin@google.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nAcked-by: Chang S. Bae \u003cchang.seok.bae@intel.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/all/20260429000623.3356606-1-avagin@google.com\n" }, { "commit": "7164d78559b0ff29931a366a840a9e5dd53d4b7c", "tree": "d3e48551711e666c87e29e29cc2fb17867a7a4ee", "parents": [ "6e40c937893338ed0b627c08f712ce7d66ddcf84" ], "author": { "name": "Zhenghang Xiao", "email": "kipreyyy@gmail.com", "time": "Tue May 26 16:53:13 2026 +0800" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 30 07:01:39 2026 +1000" }, "message": "drm/gem: fix race between change_handle and handle_delete\n\ndrm_gem_change_handle_ioctl leaves the old handle live in the IDR\nduring the window between spin_unlock(table_lock) and the final\nspin_lock(table_lock). A concurrent drm_gem_handle_delete on the old\nhandle succeeds in this window, decrements handle_count to 0, and frees\nthe GEM object while the new handle\u0027s IDR entry still references it.\n\nNULL the old handle\u0027s IDR entry before dropping table_lock so that any\nconcurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.\nRestore the old entry on the prime-bookkeeping error path.\n\nFixes: 5e28b7b94408 (\"drm: Set old handle to NULL before prime swap in change_handle\")\nSigned-off-by: Zhenghang Xiao \u003ckipreyyy@gmail.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://patch.msgid.link/20260526085313.26791-1-kipreyyy@gmail.com\n" }, { "commit": "d0ee290071b475410476b4126c72da4bf6a2194c", "tree": "82001265fdeda5056a72d53871b8f73c6dd4abea", "parents": [ "9215e74f228f2b239f41271da9e5076ee3439d1b", "713074d53be5c8684cb31fa7a8f09ffb679338d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 13:47:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 13:47:55 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"arm64:\n\n - Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by\n making sure the config symbol is correctly spelled out in the code\n\n - Don\u0027t reset the AArch32 view of the PMU counters to zero when the\n guest is writing to them\n\n - Fix an assorted collection of memory leaks in the newly added\n tracing code\n\n - Fix the capping of ZCR_EL2 which could be used in an unsanitised\n way by an L2 guest\n\n x86:\n\n - Include the kernel\u0027s linux/mman.h in KVM selftests to ensure\n MADV_COLLAPSE is defined, as older libc versions may not provide\n it.\n\n - Include execinfo.h if and only if KVM selftests are building\n against glibc, and provide a test_dump_stack() for non-glibc\n builds.\n\n - Silence an annoying RCU splat on (even non-KVM-related) panics.\n\n The splat is technically legit, but in practice not an issue. To\n have a race, you would need to unload the KVM modules at exactly\n the time a panic happens; and speaking of incredibly rare races,\n taking the locks risks introducing a deadlock if the module unload\n code took the lock on a CPU that has been halted. Which seems\n possibly more likely than the RCU grace period issue, so just shut\n it up. This code used to be in KVM but is now outside it; but the\n x86 maintainers haven\u0027t picked it up, so here we are.\n\n - Rate-limit global clock updates once again (but without delayed\n work), as KVM was subtly relying on the old rate-limiting for NPT\n correction to guard against \"update storms\" when running without a\n master clock on systems with overcommitted CPUs.\n\n - Fix a brown paper bag goof where KVM checked if ERAPS is \"dirty\"\n instead of marking it dirty when emulating INVPCID.\n\n - Flush the TLB when transitioning from xAVIC \u003d\u003e x2AVIC to ensure the\n CPU TLB doesn\u0027t contain AVIC-tagged entries for the APIC base GPA.\n\n - The top 10 commits fix buffer overflow (and potential TOC/TOU)\n flaws in the page state change protocol for encrypted VMs. AI\n models find it quite easily given it was reported three times, but\n aren\u0027t as good at writing a comprehensive fix. There\u0027s more to\n clean up in the area, which will come in 7.2\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)\n KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer\n KVM: SEV: Check PSC request indices against the actual size of the buffer\n KVM: SEV: Don\u0027t explicitly pass PSC buffer to snp_begin_psc()\n KVM: SEV: WARN if KVM attempts to setup scratch area with min_len\u003d\u003d0\n KVM: SEV: Compute the correct max length of the in-GHCB scratch area\n KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests\n KVM: SEV: Ignore Port I/O requests of length \u00270\u0027\n KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+\n KVM: SEV: Ignore MMIO requests of length \u00270\u0027\n KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor\n KVM: arm64: Fix memory leak in hyp_trace_unload()\n KVM: arm64: Fix rollback in hyp_trace_buffer_share_hyp()\n KVM: arm64: Fix meta-page unsharing in pKVM hyp tracing\n KVM: arm64: PMU: Preserve AArch32 counter low bits\n KVM: SVM: Flush the current TLB when transitioning from xAVIC \u003d\u003e x2AVIC\n KVM: x86: Fix ERAPS RAP clear on INVPCID single-context invalidation\n KVM: arm64: Fix CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC\n KVM: selftests: Guard execinfo.h inclusion for non-glibc builds\n KVM: x86: Rate-limit global clock updates on vCPU load\n ...\n" }, { "commit": "6e40c937893338ed0b627c08f712ce7d66ddcf84", "tree": "e97796af5ff2b9d72193a4edaad4b446395f708c", "parents": [ "e81d3b59f7288a7ffa81175586c2148dfa9d7dd9", "5ab62dd3687bcc2cc542b99385aabac5c996db6f" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 30 06:39:58 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 30 06:40:28 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-29\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namdxdna:\n- require IOMMU on AIE2\n\ndumb-buffer:\n- prevent overflows in dumb-buffer creation\n\ndma-buf:\n- fix UAF in dma_buf_fd() tracepoint\n\nhyperv:\n- improve protocol validation\n\nivpu:\n- test write offset in debugfs\n\nrocket:\n- fix UAF in bo creation\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260529070009.GA313534@linux.fritz.box\n" }, { "commit": "78ef59e7a6459b16f8102e0ee1c718443323d1af", "tree": "f0fbbe0162be13360b5e09262b90a2fcf5d0389b", "parents": [ "072aa0f5c3d8f11f3159037418ec45edce7440b8", "f75e3eb08fe31d30a9af6ed80cdd22e6772837e2" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 13:01:31 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 13:01:31 2026 -0700" }, "message": "Merge branch \u0027wireguard-fixes-for-7-1-rc6\u0027\n\nJason A. Donenfeld says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWireGuard fixes for 7.1-rc6\n\nPlease find one small patch, fixing the order of adding padding onto a\npacket, to ensure padding bytes get zeroed properly.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260529173134.3080773-1-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f75e3eb08fe31d30a9af6ed80cdd22e6772837e2", "tree": "f0fbbe0162be13360b5e09262b90a2fcf5d0389b", "parents": [ "072aa0f5c3d8f11f3159037418ec45edce7440b8" ], "author": { "name": "Jason A. Donenfeld", "email": "Jason@zx2c4.com", "time": "Fri May 29 19:31:34 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 13:01:27 2026 -0700" }, "message": "wireguard: send: append trailer after expanding head\n\nWith how this is currently written, we add the trailer, zero it out, and\nthen add the header space on. If that header space requires a\nreallocation + copy, the zeros in the trailer aren\u0027t copied, because the\nskb len hasn\u0027t actually been yet expanded to cover that. Instead add the\npadding at the end of the process rather than at the beginning.\n\nFixes: e7096c131e51 (\"net: WireGuard secure network tunnel\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20260529173134.3080773-2-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "072aa0f5c3d8f11f3159037418ec45edce7440b8", "tree": "9a5d7dc6df6c5c76679fe5b676c7a1c994ca0a01", "parents": [ "c84ff04def255edb51e57c9f969efdfade0da16a" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Fri May 29 13:23:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 13:00:54 2026 -0700" }, "message": "Revert \"ipv6: preserve insertion order for same-scope addresses\"\n\nChris Adams reported that preserving insertion order for same-scope\naddresses is causing SSH connections to be dropped after stopping a VM\nwhile running NetworkManager.\n\nNetworkManager caches the IPv6 address configuration, when a RA arrives,\nit determines the list of addresses to configure and checks if the\naddresses are already in the right order in the kernel. If they aren\u0027t,\nNetworkManager removes and re-adds them to achieve the desired order.\n\nAs the order changes, NetworkManager is confused and reconfigures the\naddresses on every update. In addition, this would also affect to cloud\ntooling that relies on IPv6 addresses order to identify primary and\nsecondaries addresses.\n\nThis reverts commit cb3de96eea66f5e4a580086c6a1be46e765f97f4.\n\nFixes: cb3de96eea66 (\"ipv6: preserve insertion order for same-scope addresses\")\nReported-by: Chris Adams \u003clinux@cmadams.net\u003e\nCloses: https://lore.kernel.org/netdev/20260521135310.GC977@cmadams.net/\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260529112357.5079-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c84ff04def255edb51e57c9f969efdfade0da16a", "tree": "d9d91746256c5170bf2ac70b129abcfc3c887c2e", "parents": [ "ff6e798c2eac3ebd0501ad7e796f583fab928de8", "6851161feb01cea41358c9ec304bd2f981fc8505" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 12:57:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 12:57:23 2026 -0700" }, "message": "Merge tag \u0027ipsec-2026-05-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-05-29\n\n1) xfrm: route MIGRATE notifications to caller\u0027s netns\n Thread the caller\u0027s netns through km_migrate() so that\n MIGRATE notifications go to the issuing netns, fixing both the\n init_net listener leak and MOBIKE notifications inside\n non-init netns. From Maoyi Xie.\n\n2) xfrm: ipcomp: Free destination pages on acomp errors\n Move the out_free_req label up so that allocated destination\n pages are released on decompression errors, not only on success.\n From Herbert Xu.\n\n3) xfrm: Check for underflow in xfrm_state_mtu\n Reject configurations that cause xfrm_state_mtu() to underflow,\n preventing a negative TFCPAD value from becoming a memset size\n that triggers an out-of-bounds write of several terabytes.\n From David Ahern.\n\n4) xfrm: ah: use skb_to_full_sk in async output callbacks\n Convert the possibly-incomplete skb-\u003esk to a full socket pointer\n in async AH callbacks so that a request_sock or timewait_sock\n never reaches xfrm_output_resume() downstream consumers.\n From Michael Bommarito.\n\n5) Add and revert: esp: fix page frag reference leak on skb_to_sgvec failure\n The patch does not fix te issue completely.\n\n6) xfrm: esp: restore combined single-frag length gate\n Check the aligned post-trailer combined length against a page limit\n in the fast path, preventing skb_page_frag_refill() from falling\n back to a page too small for the destination scatterlist.\n From Jingguo Tan.\n\n7) xfrm: iptfs: reset runtime state when cloning SAs\n Reinitialise the clone\u0027s mode_data runtime objects before\n publishing it, preventing queued skbs from being freed with\n list state copied from the original SA when migration fails.\n From Shaomin Chen.\n\n8) xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit\n Flush policy tables and drain the workqueue in a .pre_exit handler\n so that cleanup_net() pays one RCU grace period per batch instead\n of one per namespace, fixing stalls at high CLONE_NEWNET rates.\n From Usama Arif.\n\n9) xfrm: input: hold netns during deferred transport reinjection\n Take a netns reference when queueing deferred transport reinjection\n work and drop it after the callback completes, keeping the skb-\u003ecb\n net pointer valid until the deferred work runs.\n From Zhengchuan Liang.\n\n* tag \u0027ipsec-2026-05-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n Revert \"esp: fix page frag reference leak on skb_to_sgvec failure\"\n xfrm: input: hold netns during deferred transport reinjection\n xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit\n xfrm: iptfs: reset runtime state when cloning SAs\n xfrm: esp: restore combined single-frag length gate\n esp: fix page frag reference leak on skb_to_sgvec failure\n xfrm: ah: use skb_to_full_sk in async output callbacks\n xfrm: Check for underflow in xfrm_state_mtu\n xfrm: ipcomp: Free destination pages on acomp errors\n xfrm: route MIGRATE notifications to caller\u0027s netns\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260529092648.3878973-1-steffen.klassert@secunet.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ff6e798c2eac3ebd0501ad7e796f583fab928de8", "tree": "d3a7c5c004e21d60fe354db604d20e7d1e3f4f32", "parents": [ "9c7da87c2dc860bb17ca1ece942495d28b1ce3b9" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Thu May 28 19:43:53 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 12:55:27 2026 -0700" }, "message": "net: skbuff: fix pskb_carve leaking zcopy pages\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, frag pages are not refcounted but\ntheir lifetime is controlled by the attached ubuf_info. To make a copy\nof the skb_shared_info, we either should clear the flag and reference\nthe frags, or keep the flag and have frags unreferenced.\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() don\u0027t\nfollow the rule and thus can leak page references. Let\u0027s clear\nSKBFL_MANAGED_FRAG_REFS from the original skb to fix it. It\u0027s the\nsimplest way to address it, but there are more performant ways to do\nthat if it ever becomes a problem.\n\nLink: https://lore.kernel.org/all/20260523085809.26331-1-nvminh232@clc.fitus.edu.vn/\nFixes: 753f1ca4e1e50 (\"net: introduce managed frags infrastructure\")\nReported-by: Minh Nguyen \u003cminhnguyen.080505@gmail.com\u003e\nReported-by: Willem de Bruijn \u003cwillemdebruijn.kernel@gmail.com\u003e\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/1e2086aa69217d7f9c8da3d38f5be7160f1b4cd1.1779993185.git.asml.silence@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9c7da87c2dc860bb17ca1ece942495d28b1ce3b9", "tree": "d7fd1bb4dd324a79e403e40f5aff59fd1cd252ea", "parents": [ "9f72412bcf60144f252b0d6205106abf14344abc" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Wed May 27 13:31:31 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 12:41:00 2026 -0700" }, "message": "ipv6: fix possible infinite loop in fib6_select_path()\n\nFound while auditing the same pattern Sashiko reported in\nrt6_fill_node() [1]. Apply the same fix as\ncommit f8d8ce1b515a (\"ipv6: fix possible infinite loop in fib6_info_uses_dev()\").\n\nWriters holding tb6_lock can list_del_rcu(\u0026first-\u003efib6_siblings)\nwithout waiting for RCU readers; first-\u003efib6_siblings.next then\nstill points into the old ring and this softirq-side walker never\nreaches \u0026first-\u003efib6_siblings as its terminator. fib6_purge_rt()\nalways WRITE_ONCE()s first-\u003efib6_nsiblings to 0 before\nlist_del_rcu(), so an inside-loop check is a reliable detach signal.\n\n[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev\n\nFixes: d9ccb18f83ea (\"ipv6: Fix soft lockups in fib6_select_path under high next hop churn\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260527053133.180695-2-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9f72412bcf60144f252b0d6205106abf14344abc", "tree": "26562abafb4ba54a411c99602262599da37caafc", "parents": [ "f72eed9b84fb771019a955908132410a9ba9ea3f" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Wed May 27 13:31:30 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 12:40:05 2026 -0700" }, "message": "ipv6: fix possible infinite loop in rt6_fill_node()\n\nSashiko reported this issue [1]. Apply the same fix as\ncommit f8d8ce1b515a (\"ipv6: fix possible infinite loop in fib6_info_uses_dev()\").\n\nWriters holding tb6_lock can list_del_rcu(\u0026rt-\u003efib6_siblings)\nwithout waiting for RCU readers; rt-\u003efib6_siblings.next then still\npoints into the old ring and this softirq-side walker never reaches\n\u0026rt-\u003efib6_siblings, causing a CPU stall. fib6_del_route() always\nWRITE_ONCE()s rt-\u003efib6_nsiblings to 0 before list_del_rcu(), so an\ninside-loop check is a reliable detach signal.\n\n[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev\n\nFixes: d9ccb18f83ea (\"ipv6: Fix soft lockups in fib6_select_path under high next hop churn\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260527053133.180695-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f72eed9b84fb771019a955908132410a9ba9ea3f", "tree": "701c7e23794f92bcea58473b9e5cee30c21bd893", "parents": [ "1e584c304cfb94a759417130b1fc6d30b30c4cce" ], "author": { "name": "Yuqi Xu", "email": "xuyq21@lenovo.com", "time": "Wed May 27 11:48:15 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 12:38:35 2026 -0700" }, "message": "bpf: sockmap: fix tail fragment offset in bpf_msg_push_data\n\nWhen bpf_msg_push_data() inserts data in the middle of a scatterlist\nentry, it splits the original entry into a left fragment and a right\nfragment.\n\nThe right fragment offset is page-local, but the code advances it with\n`start`, which is the message-global insertion point. For inserts into a\nnon-first SG entry, this over-advances the offset and leaves the split\nlayout inconsistent.\n\nAdvance the right fragment offset by the fragment-local delta,\n`start - offset`, which matches the length removed from the front of the\noriginal entry.\n\nFixes: 6fff607e2f14 (\"bpf: sk_msg program helper bpf_msg_push_data\")\nCc: stable@kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSigned-off-by: Yuqi Xu \u003cxuyq21@lenovo.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nLink: https://patch.msgid.link/8b129d10566aa3eb43f61a8f9757bcf51707d324.1779636774.git.xuyq21@lenovo.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1e584c304cfb94a759417130b1fc6d30b30c4cce", "tree": "c84d7da6bbb99fc4e97994cbb68b7efea2c5d6f2", "parents": [ "422b5233b607476ac7176bfa2a101b9a103d7653" ], "author": { "name": "Jingguo Tan", "email": "tanjingguo@huawei.com", "time": "Wed May 27 10:33:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 29 12:38:00 2026 -0700" }, "message": "vsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_transport_alloc_skb() still\nfills the skb before it inherits that uarg. When fixed-buffer vectored\nzerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach\nmanaged frags and return -EMSGSIZE. The rollback path call kfree_skb()\nto free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so\nskb_release_data() falls through to ordinary frag unref.\n\nPass the uarg into virtio_transport_alloc_skb() and bind it immediately\nbefore virtio_transport_fill_skb(). This keeps control or no-payload skbs\nuntouched while ensuring success and rollback share one lifetime rule.\n\nFixes: 581512a6dc93 (\"vsock/virtio: MSG_ZEROCOPY flag support\")\nSigned-off-by: Lin Ma \u003cmalin89@huawei.com\u003e\nSigned-off-by: Rongzhen Cui \u003ccuirongzhen@huawei.com\u003e\nSigned-off-by: Jingguo Tan \u003ctanjingguo@huawei.com\u003e\nAcked-by: Arseniy Krasnov \u003cavkrasnov@salutedevices.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20260527023301.1075581-1-malin89@huawei.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "713074d53be5c8684cb31fa7a8f09ffb679338d9", "tree": "83a961a7589e056fde037558bfeb90aa3f7f7aab", "parents": [ "5ff17b19582309110269d76ce604453d2c401123", "c8cc238093ca6c99267032f6cfe78f59389f3157" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:59 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:59 2026 +0200" }, "message": "Merge commit \u0027kvm-psc-for-7.1\u0027 into HEAD\n" }, { "commit": "c8cc238093ca6c99267032f6cfe78f59389f3157", "tree": "ae7749e898b104245f073e2c16b4f7272fb04839", "parents": [ "121d88de56bc5c0ba0ce2f6381af67f948a7e7c1" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:35 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:29 2026 +0200" }, "message": "KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer\n\nUse READ_ONCE() when reading entries/indices from the guest-accessible\nPage State Change buffer to defend against TOCTOU bugs.\n\nDon\u0027t bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing\n(and not consuming the result!), as the guest isn\u0027t supposed to touch the\nbuffer while it\u0027s being processed. I.e. using READ_ONCE() is all about\nprotecting against misbehaving guests.\n\nFixes: 9b54e248d264 (\"KVM: SEV: Add support to handle Page State Change VMGEXIT\")\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-11-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "121d88de56bc5c0ba0ce2f6381af67f948a7e7c1", "tree": "25ff94ee98035b3e1859307c7e24e8ff3ad18933", "parents": [ "ebe4b2dc9cfbfb2d8f665667c4d08f4c6c9bec05" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:34 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:29 2026 +0200" }, "message": "KVM: SEV: Check PSC request indices against the actual size of the buffer\n\nWhen processing Page State Change (PSC) requests, validate the PSC buffer\nagainst the effective size of the scratch area, which could be less than\nthe maximum size if the guest provided a pointer that isn\u0027t exactly at the\nstart of the GHCB shared buffer.\n\nFixes: 9b54e248d264 (\"KVM: SEV: Add support to handle Page State Change VMGEXIT\")\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nReviewed-by: Michael Roth \u003cmichael.roth@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-10-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "ebe4b2dc9cfbfb2d8f665667c4d08f4c6c9bec05", "tree": "494da800ff8f99ef1e84c9a8b6a1261fab8992f7", "parents": [ "f185e05dce6f170f83c4ba602e969b1c3c7a22e6" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:33 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: Don\u0027t explicitly pass PSC buffer to snp_begin_psc()\n\nStop explicitly passing the PSC buffer to snp_begin_psc(): it *must*\nbe the scratch area. This will allow fixing a variety of bugs without\nfurther complicating the code.\n\nNo functional change intended.\n\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nReviewed-by: Michael Roth \u003cmichael.roth@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-9-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "f185e05dce6f170f83c4ba602e969b1c3c7a22e6", "tree": "40e9fcedabd9b1d4ca00d8a678555000cfca7245", "parents": [ "5867d7e202e09f037cefe77f7af4413c7c0fa088" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:32 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: WARN if KVM attempts to setup scratch area with min_len\u003d\u003d0\n\nNow that all paths in KVM properly validate the length needed for the\nscratch area, and are guaranteed to pass in a non-zero length, WARN if KVM\nattempts to configured the scratch area with min_len\u003d\u003d0 to guard against\nfuture bugs.\n\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nReviewed-by: Michael Roth \u003cmichael.roth@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-8-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "5867d7e202e09f037cefe77f7af4413c7c0fa088", "tree": "c2234b6d4ac8a68059e9d955391284f8a7afdcdd", "parents": [ "2be54670bdc017004c4a4b8bddb6ff02ebe7dbe2" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:31 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: Compute the correct max length of the in-GHCB scratch area\n\nWhen setting the length of the GHCB scratch area, and the area is in the\nGHCB shared buffer, set the effective length of the scratch area to the max\npossible size given the start of the guest-provided pointer, and the end of\nthe shared buffer.\n\nThe code was \"fine\" when first introduced, as KVM doesn\u0027t consult the\nlength of the buffer when emulating MMIO, because the passed in @len always\nspecifies the *max* size required. But for PSC requests, the incoming @len\nis just the minimum length (to process the header), and KVM needs to know\nthe full size of the scratch area to avoid buffer overflows (spoiler alert).\n\nOpportunistically rename @len \u003d\u003e @min_len to better reflect its role.\n\nFixes: 9b54e248d264 (\"KVM: SEV: Add support to handle Page State Change VMGEXIT\")\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nReviewed-by: Michael Roth \u003cmichael.roth@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-7-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "2be54670bdc017004c4a4b8bddb6ff02ebe7dbe2", "tree": "c9132d949f58456e98fc16b5578aaaa5a9addd26", "parents": [ "3988bd2723de407ae90fa7a6f6029b4e60238c58" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:30 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests\n\nWhen handling a Page State Change (PSC) #VMGEXIT use the size of the PSC\nheader as the minimum size for the scratch area. Per the GHCB spec, PSC\nrequests do NOT provide the length, i.e. using control-\u003eexit_info_2 for the\nlength is completely made up behavior. The existing code \"works\", e.g.\neven though Linux-as-a-guest always passes \u00270\u0027, because KVM doesn\u0027t do\nanything with the length when the request is in the GHCB\u0027s shared buffer.\n\nUse the header as the min length. Once the header is retrieved, KVM can\nuse the specified indices to compute the full size of the request.\n\nFixes: 9b54e248d264 (\"KVM: SEV: Add support to handle Page State Change VMGEXIT\")\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nReviewed-by: Michael Roth \u003cmichael.roth@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-6-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "3988bd2723de407ae90fa7a6f6029b4e60238c58", "tree": "9abd398c04c9e1ed27cc242cedbd35bff70debe3", "parents": [ "dcf1b2d4b0564a27e4ca7c654871aab4f9620046" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:29 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: Ignore Port I/O requests of length \u00270\u0027\n\nExplicitly ignore Port I/O requests of length \u00270\u0027 (or count \u00270\u0027), so that\nsetting up the software scratch area (and other code) doesn\u0027t have to\nworry about underflowing the length, and to allow for WARNing on trying\nto configure the scratch area with len\u003d\u003d0.\n\nFixes: 291bd20d5d88 (\"KVM: SVM: Add initial support for a VMGEXIT VMEXIT\")\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-5-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "dcf1b2d4b0564a27e4ca7c654871aab4f9620046", "tree": "cc97acdcd184f1be63eeb207805a3c3d843b3457", "parents": [ "1aa8a6dc7dac8b83234b53518311bf78231f4fa5" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:28 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+\n\nWhen using GHCB v2+, reject MMIO requests that are larger than 8 bytes.\nPer the GHCB spec:\n\n SW_EXITINFO2 must be less than or equal to 0x7fffffff for version 1 and\n less than or equal to 0x8 for all other versions.\n\nFixes: 4af663c2f64a (\"KVM: SEV: Allow per-guest configuration of GHCB protocol version\")\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-4-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "1aa8a6dc7dac8b83234b53518311bf78231f4fa5", "tree": "0d91078f66f920e7a2ca0330448a7f8cc0f81435", "parents": [ "db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 01 13:22:27 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: Ignore MMIO requests of length \u00270\u0027\n\nExplicitly ignore MMIO requests of length \u00270\u0027, so that setting up the\nsoftware scratch area (and other code) doesn\u0027t have to worry about\nunderflowing the length, and to allow for special casing \u00270\u0027 in the\nfuture.\n\nFixes: 8f423a80d299 (\"KVM: SVM: Support MMIO for an SEV-ES guest\")\nCc: stable@vger.kernel.org\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-3-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7", "tree": "07153559182b96f3c54f1f793bd1fa9e73b83c37", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d" ], "author": { "name": "Michael Roth", "email": "michael.roth@amd.com", "time": "Fri May 01 13:22:26 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 20:25:28 2026 +0200" }, "message": "KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n\nAs per the GHCB spec, when using GHCB v2+ require the software scratch area\nto reside in the GHCB\u0027s shared buffer. Note, things like Page State Change\n(PSC) requests _rely_ on this behavior, as the guest can\u0027t provide a length\nwhen making the request, i.e. the size of the guest payload is bounded by\nthe size of the shared buffer.\n\nFailure to force usage of the GHCB, and a slew of other flaws, lets a\nmalicious SNP guest corrupt host kernel heap memory, and leak host heap\nlayout information.\n\nsetup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),\nwhere exit_info_2 is guest-controlled. With exit_info_2\u003d24, this yields\na 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer\nholds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only\nentries[0] and entries[1] are in-bounds.\n\nsnp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)\nbut NOT against the actual buffer size:\n\n idx_end \u003d hdr-\u003eend_entry;\n\n if (idx_end \u003e\u003d VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer\n snp_complete_psc(svm, ...);\n return 1;\n }\n\n for (idx \u003d idx_start; idx \u003c\u003d idx_end; idx++) {\n entry_start \u003d entries[idx]; // OOB when idx \u003e\u003d 2\n\nThe guest sets end_entry\u003d10+, causing the host to iterate entries[2+]\nwhich are OOB into adjacent slab objects. For each OOB entry:\n\n - The host reads 8 bytes (OOB READ / info leak oracle)\n - If the data passes PSC validation, __snp_complete_one_psc() writes\n cur_page \u003d 1 or 512 into the entry (OOB WRITE, sev.c:3806)\n - If validation fails, the error response reveals whether adjacent\n memory is zero vs non-zero (information disclosure to guest)\n\nThe guest controls allocation size (exit_info_2), entry range\n(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly\nhit different slab positions.\n\nBy exploiting the variety of bugs, a malicious SEV-SNP guest can:\n - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)\n - OOB write cur_page bits into adjacent objects (heap corruption)\n - Trigger use-after-free conditions across VMGEXITs\n\nE.g. with KASAN enabled, a single insmod of the PoC guest module\nproduces 73 KASAN reports:\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890\n Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890\n Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199\n\n The buggy address belongs to the object at ffff888XXXXXXXXX\n which belongs to the cache kmalloc-cg-32 of size 32\n The buggy address is located N bytes to the right of\n allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)\n\n Breakdown:\n 62 slab-out-of-bounds (reads + writes past allocation)\n 7 slab-use-after-free\n 4 use-after-free\n\nAll credit to Stan for the wonderful description and reproducer!\n\nReported-by: Stan Shaw \u003cshawstan96@gmail.com\u003e\nCc: Michael Roth \u003cmichael.roth@amd.com\u003e\nCc: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nCc: Peter Gonda \u003cpgonda@google.com\u003e\nCc: Jacky Li \u003cjackyli@google.com\u003e\nFixes: 4af663c2f64a (\"KVM: SEV: Allow per-guest configuration of GHCB protocol version\")\nCc: stable@vger.kernel.org\nSigned-off-by: Michael Roth \u003cmichael.roth@amd.com\u003e\n[sean: write changelog]\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260501202250.2115252-2-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "9215e74f228f2b239f41271da9e5076ee3439d1b", "tree": "ef7bdb41e7588610ea8c6cc8d59709087cb50c59", "parents": [ "80169db922c1bfb2947e901514e33165a64787c2", "b051bb6bf0a231117036aa607cadf55be8e63910" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 10:41:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 10:41:07 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260529\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fix from Jens Axboe:\n \"Just a single fix for the block side, making a slight tweak to a fix\n from this cycle\"\n\n* tag \u0027block-7.1-20260529\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n blk-mq: reinsert cached request to the list\n" }, { "commit": "80169db922c1bfb2947e901514e33165a64787c2", "tree": "b83edfd84dcaf0f5ff348fb4b7aa7552c6fe1148", "parents": [ "3101173200b8ef6b725d7ab289e9508659b20d61", "a88c02915d9c6160cfc7ab1b26ed64b2993e2b94" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 10:36:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 10:36:57 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260529\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fix from Jens Axboe:\n \"Just a single fix for a regression introduced in this cycle, where\n we should ensure the node is visible before the entry is added to\n the tctx list\"\n\n* tag \u0027io_uring-7.1-20260529\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/tctx: set -\u003eio_uring before publishing the tctx node\n" }, { "commit": "5ff17b19582309110269d76ce604453d2c401123", "tree": "7d068461ee96571536a0e01cdc8296a73a635197", "parents": [ "b3978970165729eea7a80d10d52f17cc495672cd", "83726330748981372bde86ed5411d7b306612991" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 19:30:56 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 19:30:56 2026 +0200" }, "message": "Merge tag \u0027kvmarm-fixes-7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 7.1, take #4\n\n- Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by\n making sure the config symbol is correctly spelled out in the code\n\n- Don\u0027t reset the AArch32 view of the PMU counters to zero when the\n guest is writing to them\n\n- Fix an assorted collection of memory leaks in the newly added tracing\n code\n\n- Fix the capping of ZCR_EL2 which could be used in an unsanitised way\n by an L2 guest\n" }, { "commit": "b3978970165729eea7a80d10d52f17cc495672cd", "tree": "adfa8ff418b8be54595f53d62f89603ce700c272", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d", "a9e18aa3263f356edae305e29830e5fe63d8597a" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 19:28:16 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri May 29 19:28:16 2026 +0200" }, "message": "Merge tag \u0027kvm-x86-fixes-7.1-rc6\u0027 of https://github.com/kvm-x86/linux into HEAD\n\nKVM x86 fixes for 7.1-rcN\n\n - Include the kernel\u0027s linux/mman.h in KVM selftests to ensure MADV_COLLAPSE\n is defined, as older libc versions may not provide it.\n\n - Include execinfo.h if and only if KVM selftests are building against glibc,\n and provide a test_dump_stack() for non-glibc builds.\n\n - Fudge around an RCU splat in the emegerncy reboot code that is technically\n a legitimate flaw, but in practice is a non-issue and fixing the flaw, e.g.\n by adding locking, would incur meaningful risk, i.e. do more harm than good.\n\n - Rate-limit global clock updates once again (but without delayed work), as\n KVM was subtly relying on the old rate-limiting for NPT correction to guard\n against \"update storms\" when running without a master clock on systems with\n overcommitted CPUs.\n\n - Fix a brown paper bag goof where KVM checked if ERAPS is \"dirty\" instead of\n marking it dirty when emulating INVPCID.\n\n - Flush the TLB when transitioning from xAVIC \u003d\u003e x2AVIC to ensure the CPU TLB\n doesn\u0027t contain AVIC-tagged entries for the APIC base GPA.\n" }, { "commit": "3101173200b8ef6b725d7ab289e9508659b20d61", "tree": "02d85d47e63aaadac3a53372be078ae4f494ce79", "parents": [ "b0ab604210059c3626c9c77142b51f39e9842504", "d90f236f8b9e354848bd226f581db27755ab901d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 10:04:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 10:04:09 2026 -0700" }, "message": "Merge tag \u0027cxl-fixes-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl\n\nPull Compute Express Link (CXL) fixes from Dave Jiang:\n\n - cxl/test: update mock dev array before calling platform_device_add()\n\n* tag \u0027cxl-fixes-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:\n cxl/test: Update mock dev array before calling platform_device_add()\n" }, { "commit": "b0ab604210059c3626c9c77142b51f39e9842504", "tree": "a59fa067e69aae91c3cd4bd56110d568e23c9104", "parents": [ "7b5544596021351f22ac01d5586c71cbeebb52e2", "00c257948900fae69dae2a055b378edf09aacf6e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 09:25:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 09:25:58 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n\n - Fix compile warning with gcc-16.1\n\n - Intel VT-d: Simplify calculate_psi_aligned_address()\n\n - MAINTAINERS updates\n\n* tag \u0027iommu-fixes-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n MAINTAINERS: Add my employer to my entries\n MAINTAINERS: Add Vasant Hegde to reviewers of AMD IOMMU\n iommu, debugobjects: avoid gcc-16.1 section mismatch warnings\n iommu/vt-d: Simplify calculate_psi_aligned_address()\n" }, { "commit": "7b5544596021351f22ac01d5586c71cbeebb52e2", "tree": "e16c570d9ec671896ca4b6c872e16931a983bdd4", "parents": [ "e6f4f084ecd876a333c4cf13d0229217dbfcd8e8", "2c142b63c8ee982cdfdba49a616027c266294838" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 08:55:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 08:55:41 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of recent small fixes and quirks.\n\n We still see a bit more changes than wished, but most of them are\n device-specific ones that are pretty safe to apply, while a core fix\n is a typical UAF fix for PCM core that was recently caught by fuzzer;\n so overall nothing looks really worrisome.\n\n Core:\n - Fix a UAF in PCM OSS proc interface\n\n HD-audio:\n - Fix memory leaks in CS35L56 driver\n - Various device-specific quirks for Realtek and CS420x codecs\n\n USB-audio:\n - Quirk for TAE1160 USB Audio\n - Fix for Scarlett2 Gen4 direct monitor gain\n\n ASoC:\n - Fixes for QCom q6asm-dai, Intel bytcht_es8316, and simple-mux codec\n\n FireWire:\n - Fix for Motu DSP event queue protection\"\n\n* tag \u0027sound-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: codecs: simple-mux: Fix enum control bounds check\n ALSA: usb-audio: Add iface reset and delay quirk for TAE1160 USB Audio\n ALSA: hda/cs420x: Add CS4208 fixup for iMac16,1\n ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1\n ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP\n ASoC: qcom: q6asm-dai: use pointer type with kzalloc_obj()\n ASoC: qcom: q6asm-dai: remove unnecessary braces\n ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params\n ASoC: qcom: q6asm-dai: close stream only when running\n ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks\n ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors\n ALSA: hda/realtek: Limit mic boost on Positivo DN140\n ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417\n ALSA: pcm: oss: Fix setup list UAF on proc write error\n ALSA: hda: cs35l56: Fix system name string leaks\n ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Lenovo Yoga Slim 7 14AGP11\n ALSA: hda/realtek: Fix incorrect comment for ALC299_FIXUP_PREDATOR_SPK\n ALSA: firewire-motu: Protect register DSP event queue positions\n" }, { "commit": "e6f4f084ecd876a333c4cf13d0229217dbfcd8e8", "tree": "1562d2b608fe4d11aaaaa10d13db2bcdda1ca8c8", "parents": [ "8fde5d1d47f69db6082dfa34500c27f8485389a5", "c0a8899e02ddebd51e2589835182c239c2e224ae" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 08:51:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 29 08:51:46 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026052801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Benjamin Tissoires:\n\n - buffer overflow fix for lenovo (Kean) and wacom (Lee Jones) drivers\n\n - segfaults prevention in lenovo-go driver when used with an emulated\n device (Louis Clinckx)\n\n - cleanup of resources in u2fzero (Myeonghun Pak)\n\n - a quirk for a USB mouse and a cleanup in hid.h (hlleng and Liu Kai)\n\n* tag \u0027hid-for-linus-2026052801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n HID: wacom: Fix OOB write in wacom_hid_set_device_mode()\n HID: lenovo-go: drop dead NULL check on to_usb_interface()\n HID: lenovo-go: reject non-USB transports in probe\n HID: lenovo: Fix buffer over-read and unaligned access in X12 Tab raw_event handler\n HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse\n HID: remove duplicate hid_warn_ratelimited definition\n HID: u2fzero: free allocated URB on probe errors\n" }, { "commit": "f78073e84c800ae146ce62447e7a685a5ceeb92d", "tree": "39935a82011fcf6d51582876d8c5c615da0218e2", "parents": [ "a0d8f7ac03e387634c5a7efe3dc162f7d605e2cd" ], "author": { "name": "Laurent Pinchart", "email": "laurent.pinchart+renesas@ideasonboard.com", "time": "Thu May 07 00:56:50 2026 +0300" }, "committer": { "name": "Hans Verkuil", "email": "hverkuil+cisco@kernel.org", "time": "Fri May 29 13:32:05 2026 +0200" }, "message": "Revert \"media: renesas: vsp1: brx: Fix format propagation\"\n\nThis reverts commit 937f3e6b51f1cea079be9ba642665f2bf8bcc31f.\n\nThe change to format propagation in the BRx broke configuration of the\nDRM pipeline. Revert it to fix the regression.\n\nThe original commit was meant to fix a v4l2-compliance failure, with no\nknown userspace applications being affected beside test tools. Reverting\nis the simplest option, a more comprehensive fix can be developed (and\ntested more thoroughly) later.\n\nReported-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nCloses: https://lore.kernel.org/linux-media/CA+V-a8t481xuwava0nb7uY9CUPqFWZ_8EP0xrK3BgumP7HDcLg@mail.gmail.com\nFixes: 937f3e6b51f1 (\"media: renesas: vsp1: brx: Fix format propagation\")\nTested-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e # On RZ/T2H\nReviewed-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nLink: https://patch.msgid.link/20260506215650.1897177-3-laurent.pinchart+renesas@ideasonboard.com\nSigned-off-by: Laurent Pinchart \u003claurent.pinchart+renesas@ideasonboard.com\u003e\nSigned-off-by: Hans Verkuil \u003chverkuil+cisco@kernel.org\u003e\n" }, { "commit": "a0d8f7ac03e387634c5a7efe3dc162f7d605e2cd", "tree": "0871f717167710f89f2e686f73de9d69ccc4f8d4", "parents": [ "646ebdd3105809d84ed04aa9e92e47e89cc44502" ], "author": { "name": "Laurent Pinchart", "email": "laurent.pinchart+renesas@ideasonboard.com", "time": "Thu May 07 00:56:49 2026 +0300" }, "committer": { "name": "Hans Verkuil", "email": "hverkuil+cisco@kernel.org", "time": "Fri May 29 13:32:05 2026 +0200" }, "message": "Revert \"media: renesas: vsp1: Initialize format on all pads\"\n\nThis reverts commit 133ac42af0a1b389e8b7b3dc7c1cc8c30ff162b6.\n\nThe change to format initialization, along with the change to format\npropagation in the BRx in commit 937f3e6b51f1 (\"media: renesas: vsp1:\nbrx: Fix format propagation\"), broke configuration of the DRM pipeline.\nRevert it to fix the regression.\n\nThe original commit was meant to fix a v4l2-compliance failure, with no\nknown userspace applications being affected beside test tools. Reverting\nis the simplest option, a more comprehensive fix can be developed (and\ntested more thoroughly) later.\n\nFixes: 133ac42af0a1 (\"media: renesas: vsp1: Initialize format on all pads\")\nTested-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e # On RZ/T2H\nReviewed-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nLink: https://patch.msgid.link/20260506215650.1897177-2-laurent.pinchart+renesas@ideasonboard.com\nSigned-off-by: Laurent Pinchart \u003claurent.pinchart+renesas@ideasonboard.com\u003e\nSigned-off-by: Hans Verkuil \u003chverkuil+cisco@kernel.org\u003e\n" }, { "commit": "83726330748981372bde86ed5411d7b306612991", "tree": "87029019646bfa2378cd2527d41250ce1468976d", "parents": [ "adae9996c04fea3b1791099b6d79e1df76d50849" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 29 00:01:44 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri May 29 10:04:00 2026 +0100" }, "message": "KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor\n\nZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2\n(which traps) or ZCR_EL1 (which does not trap). KVM handles both in\ndifferent way:\n\n- on ZCR_EL2 trap, ZCR_EL2.LEN is immediately capped at the VM\u0027s own\n VL limit. This has the potential to break existing SW that relies\n on the full LEN field to be stateful.\n\n- on ZCR_EL1 access, we do absolutely nothing.\n\nOn restoring the SVE context for an L2 guest, we directly restore the\nguest hypervisor\u0027s view of ZCR_EL2 into the physical ZCR_EL2. If the\nguest\u0027s view of the register was updated using the ZCR_EL2 accessor,\nthe value has already been sanitised (with the caveat mentioned above).\n\nBut if the guest used ZCR_EL1, the raw value is written into the HW,\nand the L2 guest can now access VLs that it shouldn\u0027t.\n\nFix all the above by moving the VL capping to the restore points,\nensuring that:\n\n- the HW is always programmed with a capped value, irrespective of\n the accessor being used,\n\n- the ZCR_EL2.LEN field is always completely stateful, irrespective\n of the accessor being used.\n\nAdditionally, move ZCR_EL2 to be a sanitised register, ensuring that\nonly the LEN field is actually stateful. This requires some creative\nconstruction of the RES0 mask, as the sysreg generation script does\nnot yet generate RAZ/WI fields.\n\nFixes: b3d29a823099 (\"KVM: arm64: nv: Handle ZCR_EL2 traps\")\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260529-kvm-arm64-fix-zcr-len-nv-v2-1-86cad51992bd@kernel.org\n[maz: rewrote commit message, tidy up access_zcr_el2()]\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\n" }, { "commit": "6851161feb01cea41358c9ec304bd2f981fc8505", "tree": "b9dc80ff7b6975bd80415718f48f608957e5a905", "parents": [ "c16f74dc1d75d0e2e7670076d5375deda110ebeb" ], "author": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Fri May 29 10:23:25 2026 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Fri May 29 10:23:25 2026 +0200" }, "message": "Revert \"esp: fix page frag reference leak on skb_to_sgvec failure\"\n\nThis reverts commit 2982e599fff6faa21c8df147d96fc7af6c1a2f24.\n\nThe patch does not fully fix the issue and the Author does\nnot match the \u0027Signed-off-by:\u0027 tag, so revert it for now.\n\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "5ab62dd3687bcc2cc542b99385aabac5c996db6f", "tree": "eecadb300b76ea23b1b950f9fa216a721392987f", "parents": [ "ead6680f354f83966c796fc7f9463a3171789616" ], "author": { "name": "Rajat Gupta", "email": "rajat.gupta@oss.qualcomm.com", "time": "Wed May 20 22:11:21 2026 -0700" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Fri May 29 08:30:47 2026 +0200" }, "message": "drm: prevent integer overflows in dumb buffer creation helpers\n\nFix integer overflow issues in the dumb buffer creation path:\n\n1. drm_mode_create_dumb() does not bound width, height, or bpp\n before passing them to driver callbacks. Downstream helpers\n (e.g. drm_gem_dma_dumb_create_internal) perform pitch/size\n alignment in u32 arithmetic that can overflow for extreme\n values. Add hard limits: width and height \u003c 8192, bpp \u003c\u003d 32.\n No legitimate software rendering use case exceeds these.\n\n2. drm_mode_align_dumb() uses roundup(pitch, hw_pitch_align)\n without checking for overflow. If pitch is near U32_MAX,\n roundup() wraps to a small value, making subsequent\n check_mul_overflow() pass with a much smaller pitch than\n intended. Add an overflow check after roundup.\n\n3. drm_mode_align_dumb() uses ALIGN(size, hw_size_align) which\n only works correctly for power-of-two alignment values.\n Replace with roundup() which works for any alignment.\n\nSuggested-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nSigned-off-by: Rajat Gupta \u003crajat.gupta@oss.qualcomm.com\u003e\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\n" }, { "commit": "e81d3b59f7288a7ffa81175586c2148dfa9d7dd9", "tree": "b17d9648f249669c7b52f87f441b889dfd75130a", "parents": [ "4ab97280e89db6674708e31abed902dc55e393c5", "1c824497d8acd3187d585d6187cedc1897dcc871" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 29 11:55:08 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 29 11:55:26 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.1-2026-05-28\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.1-2026-05-28:\n\namdgpu:\n- GEM_OP warning fix\n- GEM_OP locking fix\n- Userq fixes\n- DCN 2.1 refclk fix\n- SI fix\n- HMM fixes\n\namdkfd:\n- svm_range_set_attr locking fix\n- CRIU restore fix\n- KFD debugger fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260528211843.893681-1-alexander.deucher@amd.com\n" }, { "commit": "4ab97280e89db6674708e31abed902dc55e393c5", "tree": "7f37d2bd7f42db4d6f23d38b7f2491556f46e599", "parents": [ "96c85df77f12d309d41257f051a7c2357d26dc97", "f657a6a3ba4c20bc01f5be3752d53498ee1bfe35" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 29 11:28:52 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 29 11:28:58 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-28\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- Restore IDLEDLY regiter on engine reset (Bala)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ahhBUt8fDqjB-mQq@intel.com\n" }, { "commit": "96c85df77f12d309d41257f051a7c2357d26dc97", "tree": "75473851f9a7c9ec9b0c1a0b40d24a8fe780b36a", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d", "3549a9649dc7c5fc586ab12f675279283cdcb2a7" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 29 11:12:48 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 29 11:12:49 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-05-27\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Fix potential UAF in TTM object purge (Janusz Krzysztofik)\n- Use polling when irqs are unavailable [aux] (Michał Grzelak)\n- Fix HDR pre-CSC LUT programming loop [color] (Pranay Samala)\n- Block DC states on vblank enable when Panel Replay supported [psr] (Jouni Högander)\n- Use DC_OFF wake reference to block DC6 on vblank enable [psr] (Jouni Högander)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/ahajfPMJE_qKzig5@linux\n" }, { "commit": "422b5233b607476ac7176bfa2a101b9a103d7653", "tree": "770a91964972cfd04ad25d6ea27ea0cb84cb5687", "parents": [ "2412591cfe66e681374c5265e691695cd913d099" ], "author": { "name": "Frank Wunderlich", "email": "frank-w@public-files.de", "time": "Tue May 26 17:32:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 18:09:03 2026 -0700" }, "message": "net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration\n\nCommit 8871389da151 introduces common pcs dts properties which writes\nrx\u003dnormal,tx\u003dnormal polarity to register SGMSYS_QPHY_WRAP_CTRL of switch.\nThis is initialized with tx-bit set and so change inverts polarity\ncompared to before.\n\nIt looks like mt7531 has tx polarity inverted in hardware and set tx-bit\nby default to restore the normal polarity.\n\nThe MT7531 datasheet quite clearly states:\nRegister 000050EC QPHY_WRAP_CTRL -- QPHY wrapper control\nReset value: 0x00000501\n\nBIT 1 RX_BIT_POLARITY -- RX bit polarity control\n 1\u0027b0: normal\n 1\u0027b1: inverted\n\nBIT 0 TX_BIT_POLARITY -- TX bit polarity control (TX default inversed\nin MT7531)\n 1\u0027b0: normal\n 1\u0027b1: inverted\n\nTill this patch the register write was only called when mediatek,pnswap\nproperty was set which cannot be done for switch because the fw-node param\nwas always NULL from switch driver in the mtk_pcs_lynxi_create call.\n\nDo not configure switch side like it\u0027s done before.\n\nFixes: 8871389da151 (\"net: pcs: pcs-mtk-lynxi: deprecate \"mediatek,pnswap\"\")\nSigned-off-by: Frank Wunderlich \u003cfrank-w@public-files.de\u003e\nReviewed-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nLink: https://patch.msgid.link/20260526153239.30194-1-linux@fw-web.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2412591cfe66e681374c5265e691695cd913d099", "tree": "1f91903eb3be142e4c54b77f098dbbbd55d5e5d3", "parents": [ "f14fe6395a8b3d961a61e138ad7b36ba3626dd4e", "cdf88b35e06f1b385f7f6228060ae541d44fbb72" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 17:02:54 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 17:02:55 2026 -0700" }, "message": "Merge tag \u0027for-net-2026-05-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - hci_core: Rework hci_dev_do_reset() to use hci_sync functions\n - hci_conn: Fix memory leak in hci_le_big_terminate()\n - hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n - hci_sync: Reset device counters in hci_dev_close_sync()\n - hci_sync: fix UAF in hci_le_create_cis_sync\n - L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n - L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn\n - L2CAP: use chan timer to close channels in cleanup_listen()\n - L2CAP: clear chan-\u003eident on ECRED reconfiguration success\n - ISO: fix UAF in iso_recv_frame\n - ISO: serialize iso_sock_clear_timer with socket lock\n - HIDP: fix missing length checks in hidp_input_report()\n - 6lowpan: check skb_clone() return value in send_mcast_pkt()\n - btusb: Allow firmware re-download when version matches\n - hci_qca: Use 100 ms SSR delay for rampatch and NVM loading\n\n* tag \u0027for-net-2026-05-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()\n Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions\n Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n Bluetooth: ISO: fix UAF in iso_recv_frame\n Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\n Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading\n Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync\n Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()\n Bluetooth: btusb: Allow firmware re-download when version matches\n Bluetooth: HIDP: fix missing length checks in hidp_input_report()\n Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()\n Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn\n Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260528131839.462344-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f14fe6395a8b3d961a61e138ad7b36ba3626dd4e", "tree": "8ceb3246932a734cb62b7c0d2d2aef8dcfe42270", "parents": [ "ab4ac5a93b1b76aa6b12cadcba30450868d21a6f" ], "author": { "name": "Zhenghang Xiao", "email": "kipreyyy@gmail.com", "time": "Wed May 27 11:24:11 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 16:36:08 2026 -0700" }, "message": "sctp: fix race between sctp_wait_for_connect and peeloff\n\nsctp_wait_for_connect() drops and re-acquires the socket lock while\nwaiting for the association to reach ESTABLISHED state. During this\nwindow, another thread can peeloff the association to a new socket via\ngetsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc-\u003ebase.sk. After\nre-acquiring the old socket lock, sctp_wait_for_connect() returns\nsuccess without noticing the migration — the caller then accesses\nthe association under the wrong lock in sctp_datamsg_from_user().\n\nAdd the same sk !\u003d asoc-\u003ebase.sk check that sctp_wait_for_sndbuf()\nalready has, returning an error if the association was migrated while\nwe slept.\n\nFixes: 668c9beb9020 (\"sctp: implement assign_number for sctp_stream_interleave\")\nSigned-off-by: Zhenghang Xiao \u003ckipreyyy@gmail.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20260527032411.60959-1-kipreyyy@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab4ac5a93b1b76aa6b12cadcba30450868d21a6f", "tree": "b19f7f767091dc36ff861907752ada81a3c8a841", "parents": [ "3e20009988e2470063824c58b19d1c80816cc46d", "5b05aa36ee24297d7296ca58dfd8c448d0e4cda3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 16:33:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 16:33:45 2026 -0700" }, "message": "Merge branch \u0027net-mana-fix-null-dereferences-during-teardown-after-attach-failure\u0027\n\nDipayaan Roy says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mana: Fix NULL dereferences during teardown after attach failure\n\nWhen mana_attach() fails (e.g. during queue allocation), the error\ncleanup frees apc-\u003etx_qp and apc-\u003erxqs and sets them to NULL. Multiple\nsubsequent teardown paths can then dereference these NULL pointers,\ncausing kernel panics.\n\nPatch 1 adds NULL guards in the low-level teardown functions\n(mana_fence_rqs, mana_destroy_vport, mana_dealloc_queues) so they are\nsafe to call regardless of queue initialization state. This covers all\ncallers: mana_remove(), mana_change_mtu() recovery, and internal error\npaths in mana_alloc_queues().\n\nPatch 2 adds an early exit in mana_detach() for already-detached ports,\nmaking it safe for non-close callers. This allows the queue reset\nhandler to safely retry mana_attach() without redundant teardown.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260525081129.1230035-1-dipayanroy@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5b05aa36ee24297d7296ca58dfd8c448d0e4cda3", "tree": "b19f7f767091dc36ff861907752ada81a3c8a841", "parents": [ "17bfe0a8c014ee1d542ad352cd6a0a505361664a" ], "author": { "name": "Dipayaan Roy", "email": "dipayanroy@linux.microsoft.com", "time": "Mon May 25 01:08:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 16:33:42 2026 -0700" }, "message": "net: mana: Skip redundant detach on already-detached port\n\nWhen mana_per_port_queue_reset_work_handler() runs after a previous\ndetach succeeded but attach failed, the port is left in a detached\nstate with apc-\u003etx_qp and apc-\u003erxqs already freed. Calling\nmana_detach() again unconditionally leads to NULL pointer dereferences\nduring queue teardown.\n\nAdd an early exit in mana_detach() when the port is already in\ndetached state (!netif_device_present) for non-close callers, making\nit safe to call idempotently. This allows the queue reset handler and\nother recovery paths to simply retry mana_attach() without redundant\nteardown.\n\nFixes: 3b194343c250 (\"net: mana: Implement ndo_tx_timeout and serialize queue resets per port.\")\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dipayaan Roy \u003cdipayanroy@linux.microsoft.com\u003e\nLink: https://patch.msgid.link/20260525081129.1230035-3-dipayanroy@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "17bfe0a8c014ee1d542ad352cd6a0a505361664a", "tree": "1e6f9954f5ea87257f48a1f5a0ddbd1b5689f98b", "parents": [ "3e20009988e2470063824c58b19d1c80816cc46d" ], "author": { "name": "Dipayaan Roy", "email": "dipayanroy@linux.microsoft.com", "time": "Mon May 25 01:08:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 28 16:33:42 2026 -0700" }, "message": "net: mana: Add NULL guards in teardown path to prevent panic on attach failure\n\nWhen queue allocation fails partway through, the error cleanup frees\nand NULLs apc-\u003etx_qp and apc-\u003erxqs. Multiple teardown paths such as\nmana_remove(), mana_change_mtu() recovery, and internal error handling\nin mana_alloc_queues() can subsequently call into functions that\ndereference these pointers without NULL checks:\n\n- mana_chn_setxdp() dereferences apc-\u003erxqs[0], causing a NULL pointer\n dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26).\n- mana_destroy_vport() iterates apc-\u003erxqs without a NULL check.\n- mana_fence_rqs() iterates apc-\u003erxqs without a NULL check.\n- mana_dealloc_queues() iterates apc-\u003etx_qp without a NULL check.\n\nAdd NULL guards for apc-\u003erxqs in mana_fence_rqs(),\nmana_destroy_vport(), and before the mana_chn_setxdp() call. Add a\nNULL guard for apc-\u003etx_qp in mana_dealloc_queues() to skip TX queue\ndraining when TX queues were never allocated or already freed.\n\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dipayaan Roy \u003cdipayanroy@linux.microsoft.com\u003e\nLink: https://patch.msgid.link/20260525081129.1230035-2-dipayanroy@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8fde5d1d47f69db6082dfa34500c27f8485389a5", "tree": "1129ef7171b21f82dcea44d8fc1fc9fd714468df", "parents": [ "de85416e95c9cc9b18a3710e2554630f842b8334", "3109f9f38800841e46769e95e1ba11f1f8c7b230" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 13:45:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 13:45:10 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n \"Fix three issues in the ACPI button driver: a possible crash due to a\n button press after unloading the driver (introduced during the 6.15\n development cycle), function keys breakage on Toshiba Tecra X40 due to\n missing ACPI events (introduced during the 7.0 development cycle), and\n a missing probe rollback path item that has not been added by mistake\n during a recent update\"\n\n* tag \u0027acpi-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: button: Add missing device class clearing on probe failures\n ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time\n ACPI: button: Fix ACPI GPE handler leak during removal\n" }, { "commit": "de85416e95c9cc9b18a3710e2554630f842b8334", "tree": "793cc70d1e2d64462934fe967e13686ecdc8fbb8", "parents": [ "3e20009988e2470063824c58b19d1c80816cc46d", "df488cac6140aa04ae52af9b4507d8f99a3762be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 13:30:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 13:30:28 2026 -0700" }, "message": "Merge tag \u0027pm-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fix from Rafael Wysocki:\n \"Fix a possible amd-pstate-ut cpufreq driver crash introduced by a\n recent update (K Prateek Nayak)\"\n\n* tag \u0027pm-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch\n" }, { "commit": "3e20009988e2470063824c58b19d1c80816cc46d", "tree": "6a5f11ee6ca53470424990c29832bf4e31df18f5", "parents": [ "b0f908d785e19d53f0c41cb5d83639b038d2e489", "8d26955ea5a4697c1e21a3869ceb36b90389b051" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 13:13:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 13:13:48 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"This is again significantly bigger than the same point into the\n previous cycle, but at least smaller than last week.\n\n I\u0027m not aware of any pending regression for the current cycle.\n\n Including fixes from netfilter.\n\n Current release - regressions:\n\n - netfilter: walk fib6_siblings under RCU\n\n Previous releases - regressions:\n\n - netlink: fix sending unassigned nsid after assigned one\n\n - bridge: fix sleep in atomic context in netlink path\n\n - sched: fix ethx:ingress -\u003e ethy:egress -\u003e ethx:ingress mirred loop\n\n - ipv4: fix net-\u003eipv4.sysctl_local_reserved_ports UaF\n\n - eth: tun: free page on short-frame rejection in tun_xdp_one()\n\n Previous releases - always broken:\n\n - skbuff: fix missing zerocopy reference in pskb_carve helpers\n\n - handshake: drain pending requests at net namespace exit\n\n - ethtool:\n - rss: avoid modifying the RSS context response\n - module: avoid leaking a netdev ref on module flash errors\n - coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES\n\n - netfilter: fix dst corruption in same register operation\n\n - nfc: hci: fix out-of-bounds read in HCP header parsing\n\n - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n\n - eth:\n - vti: use ip6_tnl.net in vti6_changelink().\n - vxlan: do not reuse cached ip_hdr() value after\n skb_tunnel_check_pmtu()\"\n\n* tag \u0027net-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits)\n dpll: zl3073x: make frequency monitor a per-device attribute\n dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work\n dpll: export __dpll_device_change_ntf() for use under dpll_lock\n net/handshake: Drain pending requests at net namespace exit\n net/handshake: Verify file-reference balance in submit paths\n net/handshake: Close the submit-side sock_hold race\n net/handshake: hand off the pinned file reference to accept_doit\n net/handshake: Take a long-lived file reference at submit\n net/handshake: Pass negative errno through handshake_complete()\n nvme-tcp: store negative errno in queue-\u003etls_err\n net/handshake: Use spin_lock_bh for hn_lock\n net: skbuff: fix missing zerocopy reference in pskb_carve helpers\n net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path\n net: hibmcge: disable Relaxed Ordering to fix RX packet corruption\n selftests/tc-testing: Add netem test case exercising loops\n selftests/tc-testing: Add mirred test cases exercising loops\n net/sched: act_mirred: Fix return code in early mirred redirect error paths\n net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow\n net/sched: Fix ethx:ingress -\u003e ethy:egress -\u003e ethx:ingress mirred loop\n net/sched: fix packet loop on netem when duplicate is on\n ...\n" }, { "commit": "b0f908d785e19d53f0c41cb5d83639b038d2e489", "tree": "09e93b11d2387899a2cbc1e166d65cfa1dbadfc5", "parents": [ "43a1e3744548e6fd85873e6fb43e293eb4010694", "9500077678230e36d22bf16d2b9539c13e59a801" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 12:36:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 12:36:39 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix interrupt handling in gpio-mxc\n\n - fix scoped_guard() usage in gpio-adnp\n\n - don\u0027t accept partial writes in gpio-virtuser debugfs interface as\n they can\u0027t really work correctly\n\n - fix resource leaks in gpio-rockchip\n\n - fix locking issues in remove path in shared GPIO management\n\n - undo the vote of a GPIO shared proxy virtual device on GPIO release\n\n* tag \u0027gpio-fixes-for-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: rockchip: teardown bugs and resource leaks\n gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled()\n gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()\n gpio: shared: fix lockdep false positive by removing unneeded lock\n gpio: shared: fix deadlock on shared proxy\u0027s parent removal\n gpio: adnp: fix flow control regression caused by scoped_guard()\n gpio: shared: undo the vote of the proxy on GPIO free\n gpio: mxc: fix irq_high handling\n" }, { "commit": "43a1e3744548e6fd85873e6fb43e293eb4010694", "tree": "1718e70a9e68a7b3a3ba412f238df2365ffa6cb8", "parents": [ "eb3f4b7426cfd2b79d65b7d37155480b32259a11" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 11:45:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 28 11:45:41 2026 -0700" }, "message": "security/keys: fix missed RCU read section on lookup\n\nNicholas Carlini reports that the keyring code calls assoc_array_find()\nin find_key_to_update() without holding the RCU read lock, while the\nassoc_array_gc() code really is designed around removing the node from\nthe tree and then freeing it after an RCU grace-period.\n\nThe regular key handling doesn\u0027t see this because holding the keyring\nsemaphore hides any lifetime issues, but the persistent key handling\nuses a different model.\n\nInstead of extending the keyring locking, just do the simple RCU locking\nthat the assoc_array was designed for.\n\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nCc: Paul Moore \u003cpaul@paul-moore.com\u003e\nCc: James Morris James Morris \u003cjmorris@namei.org\u003e\nCc: Serge E. Hallyn \u003cserge@hallyn.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c0a8899e02ddebd51e2589835182c239c2e224ae", "tree": "2606c735ac516b452f4d353a8c0502af3f59121c", "parents": [ "da7f96a68c39de9eb1c351a261e7fbf716375c91" ], "author": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Wed May 27 17:05:26 2026 +0100" }, "committer": { "name": "Benjamin Tissoires", "email": "bentiss@kernel.org", "time": "Thu May 28 17:43:16 2026 +0200" }, "message": "HID: wacom: Fix OOB write in wacom_hid_set_device_mode()\n\nwacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE\nusage is always located in the first field (field[0]) of the feature report.\nHowever, a device can specify HID_DG_INPUTMODE in a different field.\n\nIf HID_DG_INPUTMODE is in a field other than the first one and the first\nfield has a report_count smaller than the usage_index of HID_DG_INPUTMODE,\nthis leads to an out-of-bounds write to r-\u003efield[0]-\u003evalue.\n\nFix this by storing the field index of HID_DG_INPUTMODE in \u0027struct\nhid_data\u0027 during feature mapping. In wacom_hid_set_device_mode(), use\nthis stored field index to access the correct field and add bounds\nchecks to ensure both the field index and the value index are within\nvalid ranges before writing.\n\nCc: stable@vger.kernel.org\nFixes: 5ae6e89f7409 (\"HID: wacom: implement the finger part of the HID generic handling\")\nTested-by: Ping Cheng \u003cping.cheng@wacom.com\u003e\nReviewed-by: Ping Cheng \u003cping.cheng@wacom.com\u003e\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\nSigned-off-by: Benjamin Tissoires \u003cbentiss@kernel.org\u003e\n" }, { "commit": "ead6680f354f83966c796fc7f9463a3171789616", "tree": "707f14bd2f8fb92403f511962e3e69b658caad3e", "parents": [ "44e151be23deb788d9f6124de93823faf6e04e99" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Sat May 23 19:14:46 2026 +0100" }, "committer": { "name": "Sumit Semwal", "email": "sumit.semwal@linaro.org", "time": "Thu May 28 20:05:43 2026 +0530" }, "message": "dma-buf: fix UAF in dma_buf_fd() tracepoint\n\nOnce FD_ADD() returns, the fd is live in the file descriptor table\nand a thread sharing that table can close() it before DMA_BUF_TRACE()\nruns. The close drops the last reference, __fput() frees the dma_buf,\nand the tracepoint then dereferences dmabuf to take dmabuf-\u003ename_lock\n-- slab-use-after-free.\n\nSplit FD_ADD() back into get_unused_fd_flags() + fd_install() and\nemit the tracepoint between them. While the fdtable slot is reserved\nwith a NULL file pointer, a racing close() returns -EBADF without\nentering __fput(), so the dma_buf stays alive across the trace. Same\napproach as commit 2d76319c4cbb (\"dma-buf: fix UAF in dma_buf_put()\ntracepoint\").\n\nThis undoes the FD_ADD() conversion done in commit 34dfce523c90\n(\"dma: convert dma_buf_fd() to FD_ADD()\"); FD_ADD() has no place to\nhook the tracepoint safely.\n\nReported-by: syzbot+7f4987d0afb97dd090cb@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d7f4987d0afb97dd090cb\nFixes: 281a22631423 (\"dma-buf: add some tracepoints to debug.\")\nCc: stable@vger.kernel.org # 7.0.x\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Sumit Semwal \u003csumit.semwal@linaro.org\u003e\nLink: https://patch.msgid.link/20260523181446.69525-1-devnexen@gmail.com\n" }, { "commit": "006c66d1d52f1905e6ccfb615cf27235e4e6e745", "tree": "738d69db699cd757b439467038650ded0aa12bc1", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Thu May 28 12:32:04 2026 +0700" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 28 15:15:46 2026 +0100" }, "message": "regmap: reject volatile update_bits() in cache-only mode\n\nPrevent _regmap_update_bits() from accessing hardware when the register\nmap is in cache-only mode.\n\nUnlike regmap_raw_read() and _regmap_read(), the volatile\n_regmap_update_bits() fast path bypasses the cache_only check. This can\nresult in unexpected hardware accesses while the device is suspended.\n\nReturn -EBUSY to ensure behavior is consistent with other cache-only\naccess paths.\n\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nLink: https://patch.msgid.link/20260528053204.46783-1-phucduc.bui@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "175db11786bde9061db526bf1ac5107d915f5163", "tree": "696cca7b9dc333473ae87162f02612ee8c424e4f", "parents": [ "5d6919055dec134de3c40167a490f33c74c12581" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Sat May 16 04:34:14 2026 +0900" }, "committer": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Thu May 28 06:51:30 2026 -0700" }, "message": "Disable -Wattribute-alias for clang-23 and newer\n\nClang recently added support for -Wattribute-alias [1], which results in\nthe same warnings that necessitated commit bee20031772a (\"disable\n-Wattribute-alias warning for SYSCALL_DEFINEx()\") for GCC.\n\n kernel/time/itimer.c:325:1: error: alias and aliasee have different types \u0027long (unsigned int)\u0027 and \u0027long (typeof (__builtin_choose_expr((__builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0LL)) || __builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0ULL))), 0LL, 0L)))\u0027 (aka \u0027long (long)\u0027) [-Werror,-Wattribute-alias]\n 325 | SYSCALL_DEFINE1(alarm, unsigned int, seconds)\n | ^\n include/linux/syscalls.h:225:36: note: expanded from macro \u0027SYSCALL_DEFINE1\u0027\n 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)\n | ^\n include/linux/syscalls.h:236:2: note: expanded from macro \u0027SYSCALL_DEFINEx\u0027\n 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__)\n | ^\n include/linux/syscalls.h:251:18: note: expanded from macro \u0027__SYSCALL_DEFINEx\u0027\n 251 | __attribute__((alias(__stringify(__se_sys##name)))); \\\n | ^\n kernel/time/itimer.c:325:1: note: aliasee is declared here\n include/linux/syscalls.h:225:36: note: expanded from macro \u0027SYSCALL_DEFINE1\u0027\n 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)\n | ^\n include/linux/syscalls.h:236:2: note: expanded from macro \u0027SYSCALL_DEFINEx\u0027\n 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__)\n | ^\n include/linux/syscalls.h:255:18: note: expanded from macro \u0027__SYSCALL_DEFINEx\u0027\n 255 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \\\n | ^\n \u003cscratch space\u003e:16:1: note: expanded from here\n 16 | __se_sys_alarm\n | ^\n\nDisable the warnings in the same way for clang-23 and newer. Disable the\nwarning about unknown warning options to avoid breaking the build for\nversions of clang-23 that do not have -Wattribute-alias, such as ones\ndeployed by vendors like Android or CI systems or when bisecting LLVM\nbetween llvmorg-23-init and release/23.x.\n\nCc: stable@vger.kernel.org\nCloses: https://github.com/ClangBuiltLinux/linux/issues/2163\nLink: https://github.com/llvm/llvm-project/commit/40da6920a0d71d49dfa2392b09153600b0759f5e [1]\nLink: https://patch.msgid.link/20260515-syscall-disable-attribute-alias-for-clang-v1-1-9a9d95d41df6@kernel.org\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\n" }, { "commit": "9500077678230e36d22bf16d2b9539c13e59a801", "tree": "0578b17e20bc9d2212ccd7a9671d1e4fd4756905", "parents": [ "3e46c18d5d87f063a93ae0fe7662fbf6660459d5" ], "author": { "name": "Marco Scardovi", "email": "scardracs@disroot.org", "time": "Tue May 26 19:02:46 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu May 28 15:23:40 2026 +0200" }, "message": "gpio: rockchip: teardown bugs and resource leaks\n\nAddress several teardown issues and resource leaks in the driver\u0027s remove\npath and error handling:\n\n1. Debounce clock reference leak: The debounce clock (bank-\u003edb_clk) is\n obtained using of_clk_get() which increments the clock\u0027s reference\n count, but clk_put() is never called. Register a devm action to\n cleanly release it on unbind. Note that of_clk_get(..., 1) remains\n necessary over devm_clk_get() because the DT binding does not define\n clock-names, precluding name-based lookup.\n\n2. Unregistered chained IRQ handler: The chained IRQ handler is not\n disconnected in remove(). If a stray interrupt fires after the driver\n is removed, the kernel attempts to execute a stale handler, leading\n to a panic. Fix this by clearing the handler in remove().\n\n3. IRQ domain leak: The linear IRQ domain and its generic chips are\n allocated manually during probe but never removed. Remove the IRQ\n domain during driver teardown to free the associated generic chips\n and mappings.\n\nFixes: 936ee2675eee (\"gpio/rockchip: add driver for rockchip gpio\")\nAssisted-by: Antigravity:gemini-3.5-flash\nSigned-off-by: Marco Scardovi \u003cscardracs@disroot.org\u003e\nLink: https://patch.msgid.link/20260526171050.12785-3-scardracs@disroot.org\n[Bartosz: don\u0027t emit an error message on devres allocation failure]\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "3e46c18d5d87f063a93ae0fe7662fbf6660459d5", "tree": "aea6d6ee7211112545004c6edbc555313b83aa9f", "parents": [ "8a122b5e72cc0043705f0d524bcd15f0c0b3ec15" ], "author": { "name": "Marco Scardovi", "email": "scardracs@disroot.org", "time": "Tue May 26 19:02:45 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu May 28 15:23:40 2026 +0200" }, "message": "gpio: rockchip: convert bank-\u003eclk to devm_clk_get_enabled()\n\nThe bank-\u003eclk was previously obtained via of_clk_get() and manually\nprepared/enabled. However, it was missing a corresponding clk_put() in\nboth the error paths and the remove function, leading to a reference leak.\n\nConvert the allocation to devm_clk_get_enabled(), which also properly\npropagates failures from clk_prepare_enable() that were previously ignored.\n\nThe GPIO bank device uses the same OF node as the previous of_clk_get()\ncall, so devm_clk_get_enabled(dev, NULL) correctly resolves the same\nclock provider entry.\n\nFix the reference leak and simplify the code by removing the manual\nclk_disable_unprepare() calls in the probe error paths and in the\nremove function.\n\nFixes: 936ee2675eee (\"gpio/rockchip: add driver for rockchip gpio\")\nAssisted-by: Antigravity:gemini-3.5-flash\nSigned-off-by: Marco Scardovi \u003cscardracs@disroot.org\u003e\nLink: https://patch.msgid.link/20260526171050.12785-2-scardracs@disroot.org\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "8a122b5e72cc0043705f0d524bcd15f0c0b3ec15", "tree": "648a44d6abc1142c1afdc427b779dd4358a88900", "parents": [ "9d7697fabbc72428f981c01ddbe0a6be0ce8b6fa" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Mon May 25 10:15:16 2026 +0300" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu May 28 15:23:40 2026 +0200" }, "message": "gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()\n\nIf *ppos is non-zero (user-space write split over multiple calls to\nwrite()) then simple_write_to_buffer() won\u0027t initialize the start of the\nbuffer. Really, non-zero values for *ppos aren\u0027t going to work at all.\nCheck for that and return -EINVAL at the start of the function.\n\nFixes: 91581c4b3f29 (\"gpio: virtuser: new virtual testing driver for the GPIO API\")\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nLink: https://patch.msgid.link/ahP3BJWWy-m_qI0X@stanley.mountain\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "9d7697fabbc72428f981c01ddbe0a6be0ce8b6fa", "tree": "493fe2323a5bb8d48157d86eb8f8750437c9b785", "parents": [ "a1b836607304f71051f9f9dcccf8b5097b86a1fb" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Fri May 22 11:12:37 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu May 28 15:23:40 2026 +0200" }, "message": "gpio: shared: fix lockdep false positive by removing unneeded lock\n\nBy the time gpio_device_teardown_shared() is called, the parent device\nis gone from the global list of GPIO devices and all outstanding SRCU\nread-side critical sections have completed. That means that no\nconcurrent gpio_find_and_request() can call\ngpio_shared_add_proxy_lookup() for this device at this time. There\u0027s\nalso no risk of the parent device being re-bound to the driver before\nthe unbinding completes (including the child devices).\n\nLockdep produces a false-positive report about a possible circular\ndependency as it doesn\u0027t know the ordering guarantee. Not taking the\nref-\u003elock in gpio_device_teardown_shared() silences it and is safe to do.\n\nCc: stable@vger.kernel.org\nFixes: ea513dd3c066 (\"gpio: shared: make locking more fine-grained\")\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20260522-gpio-shared-deadlock-v1-2-76bca088f8c0@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "a1b836607304f71051f9f9dcccf8b5097b86a1fb", "tree": "eacaa15e6b3bf0c42c5a56a64428a1a28ef9ee57", "parents": [ "a5c627d90809b793fc053849b3a00609db305776" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Fri May 22 11:12:36 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu May 28 15:23:39 2026 +0200" }, "message": "gpio: shared: fix deadlock on shared proxy\u0027s parent removal\n\nCommit 710abda58055 (\"gpio: shared: call gpio_chip::of_xlate() if set\")\nused the mutex embedded in struct gpio_shared_entry to protect the\noffset field which now can be modified after assignment. The critical\nsection however is too wide and introduced a potential deadlock on the\nremoval of the shared GPIO proxy\u0027s parent.\n\nMake the critical section shorter - only protect the offset when it\u0027s\nbeing read.\n\nWhile at it: mention the fact that the entry lock is now also used to\nprotect against concurrent access to the offset field in the structure\u0027s\ndocumentation.\n\nCc: stable@vger.kernel.org\nFixes: 710abda58055 (\"gpio: shared: call gpio_chip::of_xlate() if set\")\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20260522-gpio-shared-deadlock-v1-1-76bca088f8c0@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "a5c627d90809b793fc053849b3a00609db305776", "tree": "6264ce9cd19dc1db0ea6b0ab5dde52231011155b", "parents": [ "bbec30f7e19d9a1c604da7164b8057ccee590e72" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Fri May 22 09:35:27 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu May 28 15:23:39 2026 +0200" }, "message": "gpio: adnp: fix flow control regression caused by scoped_guard()\n\nscoped_guard() is implemented as a for loop. Using it to protect code\nusing the continue statement changes the flow as we now only break out\nof the hidden loop inside scoped_guard(), not the original for loop. Use\na regular code block instead.\n\nFixes: c7fe19ed3973 (\"gpio: adnp: use lock guards for the I2C lock\")\nReported-by: David Lechner \u003cdlechner@baylibre.com\u003e\nCloses: https://lore.kernel.org/all/cde2abb2-4cc8-4fc9-b34a-0c5d2b95779f@baylibre.com/\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20260522073527.9812-1-bartosz.golaszewski@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "bbec30f7e19d9a1c604da7164b8057ccee590e72", "tree": "01dabc0c8d4a742a7d9a0266579dc91cd1e3eec7", "parents": [ "dac917ed5aead741004db8d0d5151dd577802df8" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Fri May 22 09:49:35 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu May 28 15:23:39 2026 +0200" }, "message": "gpio: shared: undo the vote of the proxy on GPIO free\n\nWhen the user of a shared GPIO managed by gpio-shared-proxy calls\ngpiod_put() to release it, we never undo the potential \"vote\" for\ndriving the shared line \"high\". In the free() callback, check if this\nproxy voted for \"high\" and - if so - decrease the number of votes and\npotentially revert the value to low if this is the last user.\n\nCc: stable@vger.kernel.org\nFixes: e992d54c6f97 (\"gpio: shared-proxy: implement the shared GPIO proxy driver\")\nCloses: https://sashiko.dev/#/patchset/20260513-gpio-shared-dynamic-voting-v1-1-8e1c49961b7d%40oss.qualcomm.com\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20260522-gpio-shared-free-vote-v3-1-8a4fddc6bedb@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "cdf88b35e06f1b385f7f6228060ae541d44fbb72", "tree": "a50b271f0435e9194ba1d2fd4e1d416e5225d55d", "parents": [ "525daaea459fc215f432de1b8debbd9144bf97b0" ], "author": { "name": "Heitor Alves de Siqueira", "email": "halves@igalia.com", "time": "Tue May 26 10:50:59 2026 -0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu May 28 08:52:21 2026 -0400" }, "message": "Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()\n\nBefore resetting or closing the device, protocol counters should also be\nzeroed.\n\nFixes: d0b137062b2d (\"Bluetooth: hci_sync: Rework init stages\")\nSigned-off-by: Heitor Alves de Siqueira \u003chalves@igalia.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "525daaea459fc215f432de1b8debbd9144bf97b0", "tree": "8d69068986506793426f55e5901ca6b7ba46cca0", "parents": [ "40b87657200cfae93e48904fd9c9c8fc3e192cae" ], "author": { "name": "Heitor Alves de Siqueira", "email": "halves@igalia.com", "time": "Tue May 26 10:50:58 2026 -0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu May 28 08:52:21 2026 -0400" }, "message": "Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n\nSince hci_dev_close_sync() can now be called during the reset path, we\nshould also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts\nwhile the hdev workqueue is being drained.\n\nFixes: 877afadad2dc (\"Bluetooth: When HCI work queue is drained, only queue chained work\")\nSigned-off-by: Heitor Alves de Siqueira \u003chalves@igalia.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "40b87657200cfae93e48904fd9c9c8fc3e192cae", "tree": "8490949f76f27d1b5edddda0edbbdbe59d9733a3", "parents": [ "4b5f8e608749b7e8fa386c6e4301cf9272595859" ], "author": { "name": "Heitor Alves de Siqueira", "email": "halves@igalia.com", "time": "Tue May 26 10:50:57 2026 -0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu May 28 08:52:21 2026 -0400" }, "message": "Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions\n\nThe current HCI reset function in hci_core.c duplicates most of the work\ndone by hci_dev_close_sync(), and doesn\u0027t handle LE, advertising or\ndiscovery.\n\nInstead of porting these to hci_dev_do_reset(), directly call the\nclose/open functions from hci_sync to reset the hdev. MGMT now notifies\nwhen a user performs a reset.\n\nSuggested-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Heitor Alves de Siqueira \u003chalves@igalia.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4b5f8e608749b7e8fa386c6e4301cf9272595859", "tree": "964d6e9ea14ac8437efa2d3924b63b1f8aeff92b", "parents": [ "47f23a259517abbdb8032c057a1e8a6bf3734878" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Wed May 27 04:59:18 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu May 28 08:52:21 2026 -0400" }, "message": "Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n\niso_sock_close() calls iso_sock_clear_timer() before acquiring\nlock_sock(sk).\n\niso_sock_clear_timer() reads iso_pi(sk)-\u003econn twice without the\nsocket lock held:\n\n if (!iso_pi(sk)-\u003econn)\n return;\n cancel_delayed_work(\u0026iso_pi(sk)-\u003econn-\u003etimeout_work);\n\nConcurrently, iso_conn_del() executes under lock_sock(sk) and calls\niso_chan_del(), which sets iso_pi(sk)-\u003econn to NULL and may result in\nthe final reference to the connection being dropped:\n\n CPU0 CPU1\n ---- ----\n iso_sock_clear_timer()\n if (conn !\u003d NULL) ... lock_sock(sk)\n iso_chan_del()\n iso_pi(sk)-\u003econn \u003d NULL\n cancel_delayed_work(conn) /* NULL deref or UAF */\n\niso_pi(sk)-\u003econn is not stable across the unlock window, causing a\nNULL pointer dereference or use-after-free.\n\nSerialize iso_sock_clear_timer() with the socket lock by moving it\ninside lock_sock()/release_sock(), matching the pattern used in\niso_conn_del() and all other call sites.\n\nFixes: ccf74f2390d60a2f9a75ef496d2564abb478f46a (\"Bluetooth: Add BTPROTO_ISO socket type\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "47f23a259517abbdb8032c057a1e8a6bf3734878", "tree": "fb80ad20f4ea11865777bd03fc7b36f7c17f4120", "parents": [ "41c2713b204e6cb6a94587bc6bf6935107df5479" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Wed May 27 04:59:17 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu May 28 08:52:21 2026 -0400" }, "message": "Bluetooth: ISO: fix UAF in iso_recv_frame\n\niso_recv_frame reads conn-\u003esk under iso_conn_lock but releases the lock\nbefore using sk, with no reference held. A concurrent iso_sock_kill()\ncan free sk in that window, causing use-after-free on sk-\u003esk_state and\nsock_queue_rcv_skb().\n\nFix by replacing the bare pointer read with iso_sock_hold(conn), which\ncalls sock_hold() while the spinlock is held, atomically elevating the\nrefcount before the lock drops. Add a drop_put label so sock_put() is\ncalled on all exit paths where the hold succeeded.\n\nFixes: ccf74f2390d60a2f9a75ef496d2564abb478f46a (\"Bluetooth: Add BTPROTO_ISO socket type\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "41c2713b204e6cb6a94587bc6bf6935107df5479", "tree": "cbbc609498b8b4ea5d94157276bc52455b85029c", "parents": [ "00e1950716c6ed67d74777b2db286b0fa23b4be9" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon May 11 12:09:42 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu May 28 08:52:20 2026 -0400" }, "message": "Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n\nIf dcid is received for an already-assigned destination CID the spec\nrequires that both channels to be discarded, but calling l2cap_chan_del\nmay invalidate the tmp cursor created by list_for_each_entry_safe and\nin fact it is the wrong procedure as the chan-\u003edcid may be assigned\npreviously it really needs to be disconnected.\n\nCalling l2cap_chan_clone directly may still lead to l2cap_chan_del so\ninstead schedule l2cap_chan_timeout with delay 0 to close the channel\nasynchronously.\n\nFixes: 15f02b910562 (\"Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "00e1950716c6ed67d74777b2db286b0fa23b4be9", "tree": "3a85cdcfc974bba5649c7f9e7c0bfc41cc98a36a", "parents": [ "fa21e86caba2347e89eb65af926205a36a097c53" ], "author": { "name": "Zhenghang Xiao", "email": "kipreyyy@gmail.com", "time": "Tue May 26 18:51:52 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu May 28 08:52:13 2026 -0400" }, "message": "Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\n\nl2cap_ecred_reconf_rsp() returns early on success without clearing\nchan-\u003eident. Every other L2CAP response handler (l2cap_ecred_conn_rsp,\nl2cap_le_connect_rsp, l2cap_config_rsp) clears chan-\u003eident after a\nsuccessful transaction to prevent the channel from matching subsequent\nresponses with the recycled ident value.\n\nA remote attacker that completed a reconfiguration as the peer can\nreplay a failure response with the stale ident, causing the kernel to\nmatch and destroy the already-established channel via\nl2cap_chan_del(chan, ECONNRESET).\n\nClear chan-\u003eident for all matching channels on success, and harden the\nfailure path by using l2cap_chan_hold_unless_zero() consistent with\nother L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident).\n\nFixes: 15f02b910562 (\"Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode\")\nSigned-off-by: Zhenghang Xiao \u003ckipreyyy@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "79378db6a86c7014cce40b65252e6c18f5b8bcc2", "tree": "74dcdd5a8cf386a8c421031ffacbb011f8f53496", "parents": [ "60474437af5fe12abd20607766c809e0ad4e7245" ], "author": { "name": "Santhosh Kumar K", "email": "s-k6@ti.com", "time": "Wed May 27 23:07:36 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 28 13:49:00 2026 +0100" }, "message": "spi: spi-mem: avoid mutating op template in spi_mem_supports_op()\n\nspi_mem_supports_op() accepts a const struct spi_mem_op pointer but\ncasts away const internally to call spi_mem_adjust_op_freq(). This\nmutates the caller\u0027s op template, which causes stale max_freq values\nwhen callers reuse persistent templates - subsequent calls won\u0027t\nre-apply the device frequency cap since spi_mem_adjust_op_freq()\nskips non-zero values.\n\nFix by operating on a stack-local copy instead.\n\nFixes: a4f8e70d75dd (\"spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op()\")\nCc: Tianyu Xu \u003cxtydtc@gmail.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Santhosh Kumar K \u003cs-k6@ti.com\u003e\nReviewed-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nLink: https://patch.msgid.link/20260527173736.2243004-1-s-k6@ti.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "8d26955ea5a4697c1e21a3869ceb36b90389b051", "tree": "73e9886a6a81b34fdaad06db622cfaff62948c3a", "parents": [ "1af2af707f772f7f7ae7853ebe6d2695354fe85e", "c1224569cef038b040db0459510cd7948ecd467b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 28 14:05:31 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 28 14:05:31 2026 +0200" }, "message": "Merge branch \u0027dpll-zl3073x-various-fixes\u0027\n\nIvan Vecera says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndpll: zl3073x: various fixes\n\nThree fixes for the zl3073x DPLL driver.\n\nPatch 1 exports __dpll_device_change_ntf() for use by drivers that\nneed to send device change notifications from within callbacks\nalready running under dpll_lock.\n\nPatch 2 replaces the change_work workqueue mechanism with direct\ncalls to __dpll_device_change_ntf(), eliminating a race condition\nwhere the work handler could dereference a freed dpll_dev pointer\nduring device teardown.\n\nPatch 3 moves the freq_monitor flag from per-DPLL to per-device\nscope to match the hardware behavior where frequency measurement\nregisters are shared across all DPLL channels.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260526074525.1451008-1-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c1224569cef038b040db0459510cd7948ecd467b", "tree": "73e9886a6a81b34fdaad06db622cfaff62948c3a", "parents": [ "d733f519f6443540f8359461a34e3b0042099bbe" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Tue May 26 09:45:25 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 28 14:05:29 2026 +0200" }, "message": "dpll: zl3073x: make frequency monitor a per-device attribute\n\nThe frequency monitoring feature uses shared hardware registers\nthat measure input reference frequencies independently of\nindividual DPLL channels. However, the freq_monitor flag was\nincorrectly placed in the per-DPLL structure, causing each\nchannel to track its own enable/disable state independently.\n\nSince the DPLL core calls measured_freq_get() only for the first\npin registration, the measured_freq_check() in the periodic worker\nwas gated by the per-DPLL freq_monitor flag of whichever channel\nhappens to be checked. If the first DPLL channel had frequency\nmonitoring disabled while another had it enabled, measurements\nwere never reported.\n\nMove freq_monitor from struct zl3073x_dpll to struct zl3073x_dev\nso all DPLL channels share a single flag, matching the hardware\nbehavior. Update freq_monitor_set() to notify other DPLL devices\nabout the change (like phase_offset_avg_factor_set() already does)\nand remove the mode-dependent guard in zl3073x_dpll_changes_check()\nsince all input pin monitoring (pin state, phase offset, FFO, and\nmeasured frequency) works correctly in all DPLL modes.\n\nFixes: bfc923b642874 (\"dpll: zl3073x: implement frequency monitoring\")\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nLink: https://patch.msgid.link/20260526074525.1451008-4-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d733f519f6443540f8359461a34e3b0042099bbe", "tree": "c351ece34456fd0d2e3301203b44d73d02020e1f", "parents": [ "20040b2a3cb992f84d3db4c086b909eb9b906b31" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Tue May 26 09:45:24 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 28 14:05:29 2026 +0200" }, "message": "dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work\n\nThe change_work was introduced to send device change notifications\nfrom DPLL device callbacks without deadlocking on dpll_lock, since\nthe callbacks are already invoked under that lock. Now that\n__dpll_device_change_ntf() is exported for callers that already\nhold dpll_lock, use it directly and remove the change_work\ninfrastructure entirely.\n\nThis eliminates a race condition where change_work could be\nre-scheduled after cancel_work_sync() during device teardown,\npotentially causing the handler to dereference a freed or NULL\ndpll_dev pointer.\n\nFixes: 9363b4837659 (\"dpll: zl3073x: Allow to configure phase offset averaging factor\")\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nLink: https://patch.msgid.link/20260526074525.1451008-3-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "20040b2a3cb992f84d3db4c086b909eb9b906b31", "tree": "bbdd2f13f00d2ea4f637d1bcb70892e703ba6828", "parents": [ "1af2af707f772f7f7ae7853ebe6d2695354fe85e" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Tue May 26 09:45:23 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 28 14:05:29 2026 +0200" }, "message": "dpll: export __dpll_device_change_ntf() for use under dpll_lock\n\nExport __dpll_device_change_ntf() so that drivers can send device\nchange notifications from within device callbacks, which are already\ncalled under dpll_lock. Using dpll_device_change_ntf() in that\ncontext would deadlock.\n\nAdd lockdep_assert_held() to catch misuse without the lock held.\n\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@nvidia.com\u003e\nLink: https://patch.msgid.link/20260526074525.1451008-2-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "00c257948900fae69dae2a055b378edf09aacf6e", "tree": "c8ada504e87d1f66f81aacad404e8739cb6b298b", "parents": [ "2e4eed207cb4ba513e4a1fdcecbb3732e98f4914" ], "author": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Thu May 28 09:53:18 2026 +0200" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Thu May 28 13:52:54 2026 +0200" }, "message": "MAINTAINERS: Add my employer to my entries\n\nAMD pays for my IOMMU maintainer work, so mention that in the\nMAINTAINERS file as well.\n\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "2e4eed207cb4ba513e4a1fdcecbb3732e98f4914", "tree": "7b9130f37f00825b4722c98b4553ece215817e66", "parents": [ "4c9ad387aa2d6785299722e54224d34764edaeb3" ], "author": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Thu May 28 09:53:17 2026 +0200" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Thu May 28 13:52:53 2026 +0200" }, "message": "MAINTAINERS: Add Vasant Hegde to reviewers of AMD IOMMU\n\nVasant has a long history of providing valuable feedback and testing\nresults for the AMD IOMMU code. Still, too often he gets not Cc\u0027ed on\ncode changes, so make his reviewer status official.\n\nAcked-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "2c142b63c8ee982cdfdba49a616027c266294838", "tree": "bd716f665d677cd3acba6e8b3de67c5e127116fa", "parents": [ "14912d497188283f5a0aa5daaa161e52f79c7f34", "f63ad68e18d774a5d15cd7e405ead63f6b322679" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu May 28 13:48:04 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu May 28 13:48:04 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc5\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nThis round of fixes is mostly Sirini\u0027s Qualcomm cleanups that have been\nin review for a while, we also have a couple of small fixes from Cássio.\n" }, { "commit": "1af2af707f772f7f7ae7853ebe6d2695354fe85e", "tree": "f4a1f3a0b6f1292240edfa6921793afa3621a964", "parents": [ "98d0912e9f841e5529a5b89a972805f34cb1c69d", "ea5fe6a73ca57e5150b8a38b341aef2636eb72f0" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 28 13:35:47 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 28 13:47:27 2026 +0200" }, "message": "Merge branch \u0027net-handshake-anchor-request-lifetime-to-a-pinned-file-reference\u0027\n\nChuck Lever says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/handshake: anchor request lifetime to a pinned file reference\n\nhandshake_nl_accept_doit() has accumulated four follow-on fixes\nsince 3b3009ea8abb (\"net/handshake: Create a NETLINK service for\nhandling handshake requests\"): 7ea9c1ec66bc, 7798b59409c3,\nfe67b063f687, and dabac51b8102. Each was a local refcount or\nNULL-check correction; none moved where the file reference is\nowned, and the same code keeps producing the same class of bug.\nReworking the ownership is what breaks the pattern.\n\nFor the duration of a request, sock-\u003efile has no single owner.\nSubmit publishes the request without taking a file reference;\naccept_doit acquires one inside the handler, after the request\nhas already left the pending list. The consumer can drop its\nown reference at any time, including the moment between\nhandshake_req_next() popping the request and accept_doit\nreaching get_file(). The submit-side sock_hold() pins only\nstruct sock; struct socket and sock-\u003efile remain under the\nconsumer\u0027s control via the file descriptor.\n\nThis series places the file reference under unambiguous\nownership. handshake_req_submit() pins it on the request and\ncompletion or cancel drops it (patches 4-5); the submit-side\nsock_hold() then becomes redundant, and dropping it also closes\na publish-before-pin race the late sock_hold itself opened\n(patch 6). The handshake_complete() API and its consumers move\nto a uniform negative-errno sign convention (patch 3), with the\nmatching sign correction in nvme-tcp (patch 2). Patch 1\nhardens hn_lock for BH context, the netns-exit drain fix\nbuilds on the new file-pin infrastructure (patch 8), and new\nKUnit file-count assertions verify the refcount contract\n(patch 7).\n\nThree things in this restructuring want a careful look. In\nhandshake_complete(), the fput() of the request\u0027s file\nreference has to come after hp_done() -- fput() can transitively\nrun handshake_sk_destruct() and free the request, so the patch\nstashes hr_file in a local first. handshake_sk_destruct()\nitself is kept on purpose: it owns rhashtable removal and\nkfree, and remains the backstop if a consumer path bypasses\nhandshake_complete() entirely. Third, handshake_req_next() now\nreturns its request with an extra get_file() held under\nhn_lock; accept_doit must consume that reference (FD_PREPARE on\nsuccess, explicit fput on the fdf.err path), and any future\ncaller has to honor the same contract.\n\nv2: https://patch.msgid.link/20260521-handshake-file-pin-v2-0-b9dadc472840@oracle.com\nv1: https://patch.msgid.link/20260518-handshake-file-pin-v1-0-4bbcb7e62fda@oracle.com\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260525-handshake-file-pin-v3-0-66c616906ead@oracle.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" } ], "next": "ea5fe6a73ca57e5150b8a38b341aef2636eb72f0" }