)]}' { "log": [ { "commit": "f5098b6bae761e346ebcd9da7f95622c04733cff", "tree": "43974d1fd62a5cdccbab2632ac1740721eea4ce1", "parents": [ "4235cb24ec1e8e96843f3671ba4da2a6ccca2c7b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 14:45:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 14:45:48 2026 -0700" }, "message": "Linux 7.2-rc5\n" }, { "commit": "4235cb24ec1e8e96843f3671ba4da2a6ccca2c7b", "tree": "9572f57056ea3d1870ae1611a845c0f302d245be", "parents": [ "72841e8e8345ebf1005095149cc08eb6e2889a54", "749d7aa0377aae32af8c0a4ad43371e7bf830ab5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 12:22:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 12:22:57 2026 -0700" }, "message": "Merge tag \u0027vfs-7.2-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().\n\n ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching\n which FUSE relies on for servers that don\u0027t negotiate FUSE_POSIX_ACL.\n The helper replaced it with ACL_NOT_CACHED, silently re-enabling the\n cache, and as fuse doesn\u0027t invalidate the cache for such servers a\n properly timed get_acl() returned stale ACLs. Comes with a fuse\n selftest reproducing this.\n\n - pidfs:\n\n - Preserve PIDFD_THREAD when a thread pidfd is reopened via\n open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which\n do_dentry_open() strips after the flags have been validated, so\n the reopened pidfd silently became a process pidfd. Comes with a\n selftest.\n\n - Add a pidfs_dentry_open() helper so the regular pidfd allocation\n path and the file handle path share the code that forces O_RDWR\n and reapplies the pidfd flags that do_dentry_open() strips.\n\n - Handle FS_IOC32_GETVERSION in the compat ioctl path.\n\n - Make pidfs_ino_lock static.\n\n - iomap:\n\n - Fix the block range calculation in ifs_clear_range_dirty() so a\n partial clear doesn\u0027t drop the dirty state of blocks the range\n only partially covers.\n\n - Support invalidating partial folios so a partial truncate or hole\n punch with blocksize \u003c foliosize doesn\u0027t leave stale dirty bits\n behind.\n\n - Only set did_zero when iomap_zero_iter() actually zeroed\n something.\n\n - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against\n zero-length ranges where the unsigned last-block calculation\n underflows and bitmap_set() writes far beyond the ifs-\u003estate\n allocation.\n\n - Don\u0027t merge ioends with different io_private values as the merge\n could leak or corrupt the private data of the individual ioends.\n\n - exec:\n\n - Raise bprm-\u003ehave_execfd only once the binfmt_misc interpreter has\n actually been opened. The flag was set as soon as a matching \u0027O\u0027\n or \u0027C\u0027 entry was found. If the interpreter open failed with\n ENOEXEC the exec fell through to the next binary format with\n have_execfd raised but no executable staged and begin_new_exec()\n NULL derefed past the point of no return.\n\n - Fix an unsigned loop counter wrap in transfer_args_to_stack() on\n nommu. An overlong argument or environment string pushes bprm-\u003ep\n below PAGE_SIZE, the stop index becomes zero, and the loop never\n terminates, wrapping its counter and copying garbage from in\n front of the page array into the new process stack.\n\n - Make binfmt_elf_fdpic only honour the first PT_INTERP like\n binfmt_elf does. Each additional PT_INTERP overwrote the previous\n interpreter, leaking the name allocation and the interpreter file\n reference together with the write denial open_exec() took,\n leaving the file unwritable for as long as the system runs.\n\n - overlayfs:\n\n - Compare the full escaped xattr prefix including the trailing dot.\n An xattr like \"trusted.overlay.overlayfoo\" was misclassified as\n an escaped overlay xattr.\n\n - Check read access to the copy_file_range() source with the\n source\u0027s mounter credentials.\n\n - super: Thawing a filesystem whose block device was frozen with\n bdev_freeze() deadlocked. Dropping the last block layer freeze\n reference from under s_umount ends up in fs_bdev_thaw() which\n reacquires s_umount on the same task. Pin the superblock with an\n active reference instead and call bdev_thaw() without holding\n s_umount.\n\n - procfs: Return EACCES instead of success when the ptrace access check\n for namespace links fails.\n\n - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for\n block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().\n\n - Push the memcg gating of -\u003enr_cached_objects() down into the btrfs\n and shmem callbacks instead of skipping every callback during\n non-root memcg reclaim. The blanket check short-circuited XFS whose\n inode reclaim hook is intentionally driven from per-memcg contexts to\n free memcg-charged slab.\n\n - eventpoll: Pin files while checking reverse paths.\n\n Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close\n could free and recycle the file under the check which then took and\n dropped the f_lock of whatever live file now occupies that slot.\n\n* tag \u0027vfs-7.2-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)\n super: fix emergency thaw deadlock on frozen block devices\n pidfs: make pidfs_ino_lock static\n eventpoll: pin files while checking reverse paths\n fs: push nr_cached_objects memcg gating into individual filesystems\n afs: Fix afs_edit_dir_remove() to get, not find, block 0\n iomap: prevent ioend merge when io_private differs\n iomap: add comments for ifs_clear/set_range_dirty()\n iomap: fix out-of-bounds bitmap_set() with zero-length range\n iomap: fix incorrect did_zero setting in iomap_zero_iter()\n iomap: support invalidating partial folios\n iomap: correct the range of a partial dirty clear\n fs/super: fix emergency thaw double-unlock of s_umount\n pidfs: handle FS_IOC32_GETVERSION in compat ioctl\n ovl: check access to copy_file_range source with src mounter creds\n proc: Fix broken error paths for namespace links\n pidfs: add pidfs_dentry_open() helper\n selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()\n pidfs: preserve thread pidfds reopened by file handle\n ovl: fix trusted xattr escape prefix matching\n selftests/fuse: add ACL_DONT_CACHE regression test\n ...\n" }, { "commit": "72841e8e8345ebf1005095149cc08eb6e2889a54", "tree": "9b64ea6248a71929a82fc813ce7fc711f0a0b635", "parents": [ "e6bfeebfe1ada9ebe33daddc35a291be1c98f709", "6389eaf11d6cd3a66d10d0a5ea9cd91f242ccba2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 12:13:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 12:13:42 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"Just a couple of small bits for the SpacemiT driver - one small fix,\n and a new compatible in the DT binding\"\n\n* tag \u0027spi-fix-v7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: spacemit: add K3 SPI compatible\n spi: spacemit: Correct TX FIFO slot calculation\n" }, { "commit": "e6bfeebfe1ada9ebe33daddc35a291be1c98f709", "tree": "df2ccca0516a1e70929371df311b39d99af273c0", "parents": [ "09b2124a472d93e74f5c4430ae15d1f9e364e81d", "a45cc646a3aa83eb4ab4c7ed2685785ea51dc5e6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 11:52:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 11:52:30 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"One driver specific fix where one of the MediaTek drivers duplicated\n some core code buggily, and a core fix for an ordering issue on\n startup where we could end up configuring a voltage outside of\n constraints due to the order in which we applied constraints\"\n\n* tag \u0027regulator-fix-v7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: core: clamp voltage constraints before applying apply_uV\n regulator: mt6358: use regmap helper to read fixed LDO calibration\n" }, { "commit": "09b2124a472d93e74f5c4430ae15d1f9e364e81d", "tree": "931fef09c45f3b898224c74ffa7587a16660ca5f", "parents": [ "516e2cb01086bb448cfbac58da583bf15d3e7051", "6e8c279f93dba93f42be7c9c6995bc8e318ba2e4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 10:47:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 10:47:58 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc driver fixes from Greg KH:\n \"Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that\n resolve a bunch of different reported issues. Included in here are:\n\n - rust_binder error message reporting fix\n\n - stratix10-svc firmware driver fixes\n\n - mei driver fix\n\n - intel_th hardware tracing driver fix\n\n - comedi driver fix\n\n - uio_hv_generic driver fix\n\n - ntsync selftest fix\n\n - nsm misc driver fix\n\n - some MAINTAINER file updates\n\n All of these have been in linux-next for over a week with no reported\n issues\"\n\n* tag \u0027char-misc-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n MAINTAINERS: Update wine-devel list address\n rust_binder: only print failure if error has source\n intel_th: fix MSC output device reference leak\n misc: nsm: pin the module while the device is open\n mei: bus: access mei_device under device_lock on cleanup\n misc: nsm: only unlock nsm_dev on post-lock error paths\n selftests: ntsync: correct CONFIG_NTSYNC name\n comedi: comedi_parport: deal with premature interrupt\n uio_hv_generic: Bind to FCopy device by default\n MAINTAINERS: Add Greg Kroah-Hartman to GPIB\n firmware: stratix10-svc: fix teardown order in remove to prevent race\n firmware: stratix10-svc: handle NO_RESPONSE in async poll\n firmware: stratix10-svc: fix FCS SMC call kernel-doc\n firmware: stratix10-svc: fix memory leaks and list corruption bugs\n" }, { "commit": "516e2cb01086bb448cfbac58da583bf15d3e7051", "tree": "da7ee295d8c553742eb10cbf2b75187fae809402", "parents": [ "3d0a01cad2cdf06511c89d594f96f46a1887959e", "0e95ff792ae0aa6fbad9455943e9e1e4062670e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 10:30:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 10:30:37 2026 -0700" }, "message": "Merge tag \u0027staging-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are two small staging driver fixes for 7.2-rc5. They both resolve\n some reported bugs in the rtl8723bs staging driver and have been in\n linux-next for over a week with no reported issues\"\n\n* tag \u0027staging-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()\n staging: rtl8723bs: fix inverted HT40 secondary channel offset\n" }, { "commit": "3d0a01cad2cdf06511c89d594f96f46a1887959e", "tree": "a59de6ff636bc81db20d87045796d355d3f5769b", "parents": [ "79ba9db003f7a58cdd690e809c7f298380dc5082", "af071d9e07e57cfff239e8d09d2f3b05ebc9c667" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 10:25:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 10:25:14 2026 -0700" }, "message": "Merge tag \u0027tty-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull serial driver fixes from Greg KH:\n \"Here are two small serial driver fixes for 7.2-rc5. They are:\n\n - sc16is7xx get_direction() callback fix, which resolves a\n user-triggerable warning in the driver\n\n - NULL pointer dereference on some platforms using the 8250_mid\n serial driver\n\n Both have been in linux-next for over a week with no reported issues\"\n\n* tag \u0027tty-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n serial: sc16is7xx: implement gpio get_direction() callback\n serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms\n" }, { "commit": "79ba9db003f7a58cdd690e809c7f298380dc5082", "tree": "336b076a93e7b9b6bca202a9c211ab773998dbd2", "parents": [ "864be1277d3e6bfb1201def9a32d46f542d8debd", "b6061b6cca72d6a20f5eccd72b8da78c2e460861" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 09:25:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 09:25:57 2026 -0700" }, "message": "Merge tag \u0027usb-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are some small USB fixes and new device quirks and ids:\n\n - usb storage quirk added\n\n - new usb serial device ids added\n\n - usb-serial device name leak and other bug fixes\n\n - small xhci driver fixes\n\n - normal batch of typec driver fixes for reported issues\n\n - usb-atm much-reported-by-syzbot fix for firmware download races\n\n - sysfs BOS device removal race fix\n\n - lots of usb gadget driver fixes for reported issues\n\n - other small USB driver fixes for other reported problems\n\n All of these have been in linux-next this past week, many of them much\n longer\"\n\n* tag \u0027usb-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits)\n usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path\n USB: serial: io_edgeport: cap received transmit credits\n USB: serial: option: add TDTECH MT5710-CN\n USB: serial: io_ti: reject oversized boot-mode firmware\n USB: serial: mxuport: validate firmware header size\n usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect\n usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling\n usb: typec: ucsi: Add duplicate detection to nvidia registration path\n usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware\n usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback\n usb: chipidea: fix usage_count leak when autosuspend_delay is negative\n usb: core: sysfs: add lock to bos_descriptors_read()\n usb: musb: omap2430: Do not put borrowed of_node in probe\n usb: core: port: Deattach Type-C connector on component unbind\n USB: storage: add NO_ATA_1X quirk for Longmai USB Key\n USB: serial: ftdi_sio: add support for E+H FXA291\n USB: serial: keyspan_pda: fix data loss on receive throttling\n usb: gadget: printer: fix infinite loop in printer_read()\n usb: gadget: f_midi: cancel pending IN work before freeing the midi object\n usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown\n ...\n" }, { "commit": "864be1277d3e6bfb1201def9a32d46f542d8debd", "tree": "7e386001bdfa9898d90a2a9a05967123fd17b5e8", "parents": [ "86d1022b2c4fd33e069305df1b1394b13096d8a7", "2c2b322acdcc78575b8d6afa64a085cf92e03c12" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 09:15:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 09:15:59 2026 -0700" }, "message": "Merge tag \u0027trace-v7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Move rb_desc-\u003enr_page_va before updating dynamic array\n\n The rb_descr-\u003epage_va is a dynamic array counted by nr_page_va. But\n the updating of the page_va[] is done before the nr_page_va is\n incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an\n overflow.\n\n Move the increment of the counted by value before the array element\n is updated.\n\n - Propagate errors from remote event bulk updates\n\n The return value of trace_remote_enable_event() was not being checked\n by remote_events_dir_enable_write() where it would silently fail.\n Have it check the return value and propagate that back up to user\n space.\n\n - Fix resource leak on mmiotrace trace_pipe close\n\n The mmiotrace tracer was created in 2008 before the trace_pipe had a\n close callback to allow tracers to do clean up from trace_pipe open.\n The trace_pipe close cleanup callback was added in 2009 but the\n mmiotrace tracer was not updated. It had a hack to do the cleanup in\n the read call, where it may leak if user space did not read the\n entire buffer.\n\n Add a callback to mmiotrace trace_pipe close do to the cleanup\n properly.\n\n - Fix a possible NULL pointer dereference in the mmiotrace tracer\n\n If the mmio_pipe_open() fails to find a PCI device, it will set the\n hiter-\u003edev pointer to NULL. The read function will blindly\n dereference that pointer. Fix the read call to check to see if that\n pointer is populated before dereferencing it.\n\n - Fix union collision of module and refcnt for dynamic events\n\n In \u0027struct trace_event_call\u0027, the \u0027module\u0027 pointer and the \u0027refcnt\u0027\n atomic variable share the same memory space in a union. The filter on\n module logic only checked if the \u0027module\u0027 was set to determine if the\n event belonged to the module. As dynamic events are always builtin,\n it doesn\u0027t need the \u0027module\u0027 field of the structure and used a\n refcount. But the module filtering logic would then mistaken these\n dynamic events as a module and call module_name(event-\u003emodule) on it.\n\n Add a check to see if the event is a dynamic event and if so, do not\n check it for being part of the given module.\n\n - Reset the top level buffer in selftests before running instances\n\n The ftracetest selftest initializes each instance before executing\n the tests. But it does not reset the top level buffer. Dynamic events\n are only added and removed by the top level so any left over dynamic\n events will not be removed by the reset in the instances.\n\n Left over dynamic events can cause the tests to incorrectly fail.\n Reset the top level buffer before running the instances.\n\n - Make the context_switch counter 64 bit\n\n The code to read user space for a system call trace event or for a\n trace_marker will disable migration, enable preemption, read user\n space into a per CPU buffer, disable preemption and enable migration\n again. It checks if the per CPU context switch counter to see if it\n changed, and if it did not, it would know that the per CPU buffer was\n not touched by another task.\n\n But the save counter was 32 bit and it would compare it to the 64 bit\n context_switch variable. A long running system could have the\n context_switch variable greater that 1\u003c\u003c32 in which case the compare\n will always fail. The compare will promote the 32 bit int saved value\n to 64 bit and compare it to the full 64 bit counter. Since the top 32\n bits of the saved value was zero, it would never match.\n\n - Fix a use-after-free of the event_enable trigger\n\n The event_enable trigger allows for enabling one event when another\n event is triggered. When the trigger is removed, it must go through a\n synchronization phase to make sure it is not triggered again. The\n trigger itself is delayed by the \"bulk delay\" logic that was recently\n added. But the code that frees the event_enable data used to rely on\n the trigger code to do the synchronization. Now that the code uses\n the call RCU functions (and a workqueue), that delay no longer is\n there.\n\n Add a callback private_data_free() function that allows triggers to\n clean up data after the synchronization phase has completed.\n\n - Move the module_ref counter into the delay callback\n\n Since an event of the event_enable trigger can enable an event for a\n module, it ups the module ref count for that event\u0027s module. This\n prevents the event from trying to enable an event that no longer\n exists and cause a use-after-free bug.\n\n The ref counter was set back down when the trigger was removed but\n not after thy synchronization phase. This could lead to the module\n data being accessed after module was unloaded.\n\n Move the module ref decrement into the private_data_free() callback\n of the event_enable trigger.\n\n - Add mutex to protect parser in ftrace filtering\n\n The set_ftrace_filter file uses a parsing descriptor that is\n allocated at open and modified by writes. If multiple threads were to\n write to the descriptor at the same time, it can corrupt the parser.\n\n Add a mutex around the modifications of the parser descriptor.\n\n - Fix possible corruption in perf syscall tracing\n\n The perf system call trace events can now read user space. To do so,\n the reads of user space enable preemption and disables it again.\n During this time that preemption is enabled, the task can migrate.\n The perf event list head is assigned via a per CPU pointer. It is\n done before the user space part is called. If the user space reading\n migrates the task to another CPU, then the head pointer is no longer\n valid.\n\n Re-assign the head pointer after the reading of user space to keep it\n using the correct data.\n\n* tag \u0027trace-v7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: perf: Fix stale head for perf syscall tracing\n ftrace: Add global mutex to serialize trace_parser access\n tracing: Delay module ref count for \"enable_event\" trigger\n tracing: Fix use-after-free freeing trigger private data\n tracing: Fix context switch counter truncation\n selftests/ftrace: Reset triggers at top level before instance loop\n tracing: Fix union collision of module and refcnt for dynamic events\n tracing: Fix mmiotrace possible NULL dereferencing of hiter-\u003edev\n tracing: Fix resource leak on mmiotrace trace_pipe close\n tracing: Propagate errors from remote event bulk updates\n tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()\n" }, { "commit": "86d1022b2c4fd33e069305df1b1394b13096d8a7", "tree": "34a4fef6846e5273ff16c5ee267a3c53246003b6", "parents": [ "3f97818796aa6d6bcdb50b189554562fc475e4bf", "41e116ad01d8a704883187743b52d57e11bc3ef0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 08:59:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 08:59:55 2026 -0700" }, "message": "Merge tag \u0027m68knommu-fixes-on-top-off-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu\n\nPull m68knommu fix from Greg Ungerer:\n\n - fix broken local SoC IO accesses for ColdFire\n\n* tag \u0027m68knommu-fixes-on-top-off-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:\n m68k: coldfire: fix breakage of missed IO access update\n" }, { "commit": "3f97818796aa6d6bcdb50b189554562fc475e4bf", "tree": "b3bb80654a5cf3edd3f4a3d7b104b70f93277f32", "parents": [ "a6671109d6075df31d493cd979ebe6156d5ffe41", "4a9ec5ec9555ad62dc5b81a37ac946025c2ea002" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 08:52:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 08:52:38 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-07-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Disable jump/lookup tables in the x86 boot decompressor code\n a bit more widely, because newer versions of LLVM started\n optimizing it a bit better and introduced run-time relocations\n in PIE code (Nathan Chancellor)\n\n* tag \u0027x86-urgent-2026-07-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/boot/compressed: Disable jump tables\n" }, { "commit": "a6671109d6075df31d493cd979ebe6156d5ffe41", "tree": "51513683ea8dbc55464b0ef2f6bca5b9e34dda34", "parents": [ "3dab139d4795f688e4f243e40c7474df00d329d9", "35551efb155e3b83445a6c3f66cb498d5efc182c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 08:47:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 26 08:47:01 2026 -0700" }, "message": "Merge tag \u0027smp-urgent-2026-07-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull SMP debug fixes from Ingo Molnar:\n\n - SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou)\n\n* tag \u0027smp-urgent-2026-07-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n smp: Make CSD lock acquisition atomic for debug mode\n smp: Avoid invalid per-CPU CSD lookup with CSD lock debug\n" }, { "commit": "749d7aa0377aae32af8c0a4ad43371e7bf830ab5", "tree": "315066c8db21bb4986da675538a52525b9bf06ed", "parents": [ "c1d04c1bce98f9dd984a9c6657278a7761854c9c" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Jul 23 11:37:05 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jul 26 17:08:52 2026 +0200" }, "message": "super: fix emergency thaw deadlock on frozen block devices\n\ndo_thaw_all_callback() calls bdev_thaw() while holding sb-\u003es_umount\nexclusively. If the block device was frozen via bdev_freeze() dropping\nthe last block layer freeze reference calls fs_bdev_thaw() which\nreacquires s_umount:\n\n do_thaw_all_callback(sb)\n super_lock_excl(sb) # holds sb-\u003es_umount\n bdev_thaw(sb-\u003es_bdev)\n mutex_lock(\u0026bdev-\u003ebd_fsfreeze_mutex)\n # bd_fsfreeze_count drops 1 -\u003e 0\n bd_holder_ops-\u003ethaw \u003d\u003d fs_bdev_thaw\n get_bdev_super(bdev)\n bdev_super_lock(bdev, true)\n super_lock(sb, true)\n down_write(\u0026sb-\u003es_umount) # same task: deadlock\n\nThe emergency thaw worker deadlocks against itself holding both\ns_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,\nfreeze, or thaw of that filesystem and block device.\n\n [ 81.878470] sysrq: Show Blocked State\n [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000\n [ 81.884876] Workqueue: events do_thaw_all\n [ 81.886656] Call Trace:\n [ 81.887759] \u003cTASK\u003e\n [ 81.888763] __schedule+0x579/0x1420\n [ 81.890372] schedule+0x3a/0x100\n [ 81.891794] schedule_preempt_disabled+0x15/0x30\n [ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900\n [ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10\n [ 81.896528] down_write+0xbd/0xc0\n [ 81.897505] super_lock+0x91/0x180\n [ 81.898457] ? __mutex_lock+0xa99/0x1140\n [ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400\n [ 81.902069] bdev_super_lock+0x5b/0x150\n [ 81.903132] get_bdev_super+0x10/0x60\n [ 81.904042] fs_bdev_thaw+0x23/0xf0\n [ 81.904755] bdev_thaw+0x82/0x100\n [ 81.905484] do_thaw_all_callback+0x2c/0x50\n [ 81.906298] __iterate_supers+0x5d/0x130\n [ 81.907067] do_thaw_all+0x20/0x40\n [ 81.907739] process_one_work+0x206/0x5e0\n [ 81.908545] worker_thread+0x1e2/0x3c0\n [ 81.909339] ? __pfx_worker_thread+0x10/0x10\n [ 81.910171] kthread+0xf4/0x130\n [ 81.910799] ? __pfx_kthread+0x10/0x10\n [ 81.911528] ret_from_fork+0x2e2/0x3b0\n [ 81.912259] ? __pfx_kthread+0x10/0x10\n [ 81.913010] ret_from_fork_asm+0x1a/0x30\n [ 81.913806] \u003c/TASK\u003e\n\nbdev_super_lock() even documents the violated requirement with\nlockdep_assert_not_held(\u0026sb-\u003es_umount).\n\nAcquiring bd_fsfreeze_mutex under s_umount also inverts the\nbd_fsfreeze_mutex vs. s_umount ordering established by\nbdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer\nfreeze even when the recursive path isn\u0027t hit.\n\nFix this by not holding s_umount around the bdev_thaw() loop at all. Pin\nthe superblock with an active reference instead as\nfilesystems_freeze_callback() does. The active reference keeps the\nsuperblock from being shut down and so -\u003es_bdev stays valid without\nholding s_umount. The block-layer-held freeze is dropped by\nfs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as\na regular unfreeze would and thaw_super_locked() handles\nfilesystem-level freezes as before.\n\nThe emergency thaw path has deadlocked like this in one form or\nanother for a long long time but the current exclusively-held\nshape dates back to commit [1] where thaw_bdev() already ended in\nthaw_super() with s_umount held by do_thaw_all_callback().\n\nFixes: 08fdc8a0138a (\"buffer.c: call thaw_super during emergency thaw\") [1]\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260723-work-super-emergency_thaw-v1-1-7c315c600245@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "3dab139d4795f688e4f243e40c7474df00d329d9", "tree": "a1a5e86f6d9e9ea1c74d6d04541f9be9e3c12d17", "parents": [ "ef9ce800df95726978490534f9e2c14ca71858e8", "880c43b185ca52239e75bc546cc4f4d9154d0fed" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 10:15:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 10:15:23 2026 -0700" }, "message": "Merge tag \u0027rust-fixes-7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - \u0027zerocopy\u0027 crates: update to v0.8.54 to fix a modpost error under\n \u0027CONFIG_CC_OPTIMIZE_FOR_SIZE\u003dy\u0027.\n\n There are actually two updates in the PR: the one to v0.8.52 is\n fairly large and was originally not intended for a fixes PR, but the\n actual fix landed in the v0.8.54 one. Thus I included both here.\n\n The v0.8.52 update includes two things upstream added for us:\n \u0027--cfg no_fp_fmt_parse\u0027 to avoid a local workaround, and the new\n \u0027most_traits\u0027 feature.\n\n The good news is that, after these updates, the delta with upstream\n is now trivial: only an identifier prefix change and the SPDX\n parentheses.\n\n - Fix an objtool warning by adding one more \u0027noreturn\u0027 function for\n Rust 1.99.0 (expected 2026-10-01).\n\n - Clean up new \u0027semicolon_in_expressions_from_macros\u0027 lint errors for\n Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it\n will be a hard error at some point in the future anyway, so clean it\n up now.\n\n - Locally allow new \u0027suspicious_runtime_symbol_definitions\u0027 lint for\n Rust 1.98.0 (expected 2026-08-20).\n\n - Globally allow \u0027clippy::unwrap_or_default\u0027 lint since it relies on\n optimizations -- under \u0027CONFIG_CC_OPTIMIZE_FOR_SIZE\u003dy\u0027 it does not\n work well.\n\n \u0027kernel\u0027 crate:\n\n - \u0027time\u0027 module: fix \u0027Delta::as_micros_ceil()\u0027 to round negative values\n correctly\"\n\n* tag \u0027rust-fixes-7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: time: fix as_micros_ceil() to round correctly for negative Delta\n rust: device: avoid trailing ; in printing macros\n objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0\n rust: zerocopy: update to v0.8.54\n rust: zerocopy: update to v0.8.52\n rust: allow `clippy::unwrap_or_default` globally\n rust: allow `suspicious_runtime_symbol_definitions` lint for Rust \u003e\u003d 1.98\n" }, { "commit": "ef9ce800df95726978490534f9e2c14ca71858e8", "tree": "d1d32678fc0c0a115fe21eb38fd93d2667196da7", "parents": [ "d99d2a953ad8d29e6b777f6770f10668a636842a", "fac520e43a60230b24026f462a2b63e4d170566e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 09:05:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 09:05:02 2026 -0700" }, "message": "Merge tag \u0027perf-tools-fixes-for-v7.2-1-2026-07-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools\n\nPull perf tools fixes from Arnaldo Carvalho de Melo:\n\n - Update header copies of kernel headers, including const.h, fs.h,\n perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp,\n msr-index.h, drm.h and socket.h\n\n - Add some build files related to BPF skels to .gitignore\n\n* tag \u0027perf-tools-fixes-for-v7.2-1-2026-07-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:\n tools headers: Sync KVM headers with the kernel sources\n tools headers: Sync UAPI linux/fs.h with the kernel sources\n perf beauty: Update copy of linux/socket.h with the kernel sources\n tools headers: Sync UAPI drm/drm.h with kernel sources\n tools arch x86: Sync the msr-index.h copy with the kernel sources\n tools headers x86 cpufeatures: Sync with the kernel sources\n tools headers: Sync linux/gfp_types.h with the kernel sources\n tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources\n tools headers UAPI: Sync linux/const.h with the kernel sources\n perf bench bpf: Add missing .gitignore file\n" }, { "commit": "d99d2a953ad8d29e6b777f6770f10668a636842a", "tree": "4405e2c414040ad1f6810f5d44fae6fa9f65f949", "parents": [ "3fb11702e4b2fe9eaaed7369bbe7e63177cc04a6", "d52a13adbb8ccbab99cd3bad36804e87d8b5c052" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 08:14:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 08:14:13 2026 -0700" }, "message": "Merge tag \u0027firewire-fixes-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394\n\nPull firewire fix from Takashi Sakamoto:\n \"Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394.\n\n The driver failed to reassemble a complete datagram when it was stored\n across multiple buffer ranges in the list. Ruoyu Wang reported and\n fixed it\"\n\n* tag \u0027firewire-fixes-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:\n firewire: net: Fix fragmented datagram reassembly\n" }, { "commit": "3fb11702e4b2fe9eaaed7369bbe7e63177cc04a6", "tree": "5e3079f7c22fbfa43bac3329cf1e949fd14e2e8d", "parents": [ "0ce37745d4bfbc493f718169c3974898ffec8ee7", "91a70492c03040d51b36f595530d6491d5d6c541" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 08:10:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 25 08:10:13 2026 -0700" }, "message": "Merge tag \u0027loongarch-fixes-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n\n - fix build warnings and errors\n\n - move jump_label_init() before parse_early_param()\n\n - retrieve CPU package ID from PPTT when available\n\n - fix some bugs kgdb, BPF JIT and laptop platform driver bugs\n\n* tag \u0027loongarch-fixes-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n platform/loongarch: laptop: Explicitly reset bl_powered state when suspend\n platform/loongarch: laptop: Stop setting acpi_device_class()\n LoongArch: BPF: Fix memory leak in bpf_jit_free()\n LoongArch: BPF: Zero-extend signed ALU32 div/mod results\n LoongArch: Fix oops during single-step debugging\n LoongArch: Fix address space mismatch in kexec command line lookup\n LoongArch: Retrieve CPU package ID from PPTT when available\n LoongArch: Move jump_label_init() before parse_early_param()\n LoongArch: Fix build errors due to wrong instructions for 32BIT\n LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT\n" }, { "commit": "0ce37745d4bfbc493f718169c3974898ffec8ee7", "tree": "c5c6ce1ae2a2fe201155cc041cd6b3a57ab3915b", "parents": [ "73387b89d99f7b588870c5a98eb6a89689c65a1a", "093fbffe03f5c1bb9c10a9e5aa65b23250844403" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 20:02:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 20:02:58 2026 -0700" }, "message": "Merge tag \u0027block-7.2-20260724\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Fix a ublk recovery hang, where END_USER_RECOVERY without a\n successful START_USER_RECOVERY could be satisfied by a stale\n completion latch\n\n - Fix a stack out-of-bounds read in the CDROMVOLCTRL ioctl\n\n - MAINTAINERS email address update for Roger Pau Monne\n\n* tag \u0027block-7.2-20260724\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n MAINTAINERS: update my email address\n cdrom: fix stack out-of-bounds read in CDROMVOLCTRL\n ublk: wait on ublk_dev_ready() instead of ub-\u003ecompletion\n" }, { "commit": "73387b89d99f7b588870c5a98eb6a89689c65a1a", "tree": "68178e7fe8e754264d75193f227c2c185662890c", "parents": [ "8e371eff3f72afde801c36007fa15fc7dd5314f3", "e366c15e1610ef11d0717ecd875ae63050282676" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 19:58:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 19:58:03 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.2-20260724\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix a missing ERESTARTSYS conversion in the read paths, which got\n messed up back when some code consolidation was done for read\n multishot support\n\n - zcrx UAPI rename, dropping the abbreviated \"notif\" naming in favor of\n \"event\" for consistency and to be less ambiguous for users. This was\n added for 7.2, so let\u0027s rename it while we still can. No functional\n or code changes, just a strict rename\n\n* tag \u0027io_uring-7.2-20260724\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/zcrx: rename notif to event\n io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS\n io_uring/zcrx: drop \"notif\" from stats struct names\n io_uring/rw: fix missing ERESTARTSYS conversion in read paths\n" }, { "commit": "2c2b322acdcc78575b8d6afa64a085cf92e03c12", "tree": "95165df24d89146bd1584e2f48ce2a3c69f1ac19", "parents": [ "7720b63bcef3f54c7fe288774b720a227d54a306" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 19:32:10 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 22:57:56 2026 -0400" }, "message": "tracing: perf: Fix stale head for perf syscall tracing\n\nThe code that can read the user space parameters of a system call may\nenable preemption and migrate. The head of the per CPU perf events list\nmay be pointing to the wrong CPU event if the code migrates the task.\n\nReassign the head pointer if the system call event called the code that\nmay have caused a migration.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260724193210.03fae1d6@gandalf.local.home\nReported-by: Sashiko \u003c\u003e\nLink: https://sashiko.dev/#/patchset/20260717173252.3431565-1-usama.arif%40linux.dev\nFixes: edca33a56297d (\"tracing: Fix failure to read user space from system call trace events\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "7720b63bcef3f54c7fe288774b720a227d54a306", "tree": "fe503daa5f959394629e2491c4e908c93b8fa162", "parents": [ "e091351b38818ef620d27f44f4bfd625f13afbff" ], "author": { "name": "Tengda Wu", "email": "wutengda@huaweicloud.com", "time": "Sat Jul 25 02:47:21 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 22:56:43 2026 -0400" }, "message": "ftrace: Add global mutex to serialize trace_parser access\n\nIn ftrace, the trace_parser structure is allocated and initialized when\na trace file is opened, and is subsequently used across write and release\nhandlers to parse user input.\n\nThe affected handler paths and their specific functions are:\n - Open paths: ftrace_regex_open(), ftrace_graph_open()\n - Write paths: ftrace_regex_write(), ftrace_graph_write()\n - Release paths: ftrace_regex_release(), ftrace_graph_release()\n\nIf userspace opens a trace file descriptor and shares it across multiple\nthreads, concurrent write calls will race on the parser\u0027s internal state,\nspecifically the \u0027idx\u0027, \u0027cont\u0027, and \u0027buffer\u0027 fields, leading to corrupted\ninput or undefined behavior.\n\nFix this by adding a global mutex, parser_lock, to serialize all access\nto trace_parser across write and release paths, preventing concurrent\ncorruption of parser state.\n\nFixes: e704eff3ff51 (\"ftrace: Have set_graph_function handle multiple functions in one write\")\nFixes: 689fd8b65d66 (\"tracing: trace parser support for function and graph\")\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260725024721.1983675-1-wutengda@huaweicloud.com\nSigned-off-by: Tengda Wu \u003cwutengda@huaweicloud.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "8e371eff3f72afde801c36007fa15fc7dd5314f3", "tree": "88d7ab17996ba49b81e65fd4d4db1c6316572c9d", "parents": [ "ae453eef925945a02bb558bff9debbee352e33e9", "5e1b924808568e89c5cb132ecebe1824bd91af0c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 19:50:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 19:50:05 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc4-smb3-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n \"This contains eight ksmbd fixes covering POSIX ACL handling, SMB\n signing enforcement, DACL parsing and construction hardening, session\n lifetime handling, and validation of malformed transform and\n compressed SMB2 requests:\n\n - preserve inherited POSIX ACL mask when creating objects.\n\n - enforce the session signing requirement for plaintext SMB requests.\n\n - harden DACL/ACE processing against size overflows, incomplete ACE\n copies, and undersized SIDs.\n\n - defer teardown of a previous session until NTLM authentication\n succeeds.\n\n - reject undersized encryption-transform and decompressed SMB2\n requests before they can reach normal SMB2 request processing\"\n\n* tag \u0027v7.2-rc4-smb3-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: reject undersized decompressed SMB2 requests\n ksmbd: validate minimum PDU size for transform requests\n ksmbd: defer destroy_previous_session() until after NTLM authentication\n ksmbd: validate ACE size against SID sub-authorities\n ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL\n ksmbd: bound DACL dedup walk to copied ACEs\n ksmbd: enforce signing required by the session\n ksmbd: preserve VFS inherited POSIX ACL mask\n" }, { "commit": "ae453eef925945a02bb558bff9debbee352e33e9", "tree": "a071743445037e2fe2bad72664932a51a55a0d42", "parents": [ "e2a936998ab25cf7272847356390041c3143b498", "2d66a033864e27ab8d5e44cb36f31d9d2413bee4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 19:31:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 19:31:12 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Eduard Zingerman:\n\n - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed\n sk_psock-\u003ecork for the local temporary message and freeing it again\n (Chengfeng Ye)\n\n - Reject passing scalar NULL to nonnull arg of a global subprog.\n\n Previously the verifier did not account for the cases directly\n passing scalars to a global subprog, e.g.: \u0027global_func(0);\u0027 would\n pass even if \u0027global_func\u0027 argument was marked nonnull (Amery Hung)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()\n selftests/bpf: Test passing scalar NULL to nonnull global subprog\n bpf: Reject passing scalar NULL to nonnull arg of a global subprog\n" }, { "commit": "e091351b38818ef620d27f44f4bfd625f13afbff", "tree": "0855b12d43d2869674bc7ecbf08864998dcda7df", "parents": [ "79097812153b826fc156a2930ec8a90ed9edf4a2" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 13:24:15 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 18:49:51 2026 -0400" }, "message": "tracing: Delay module ref count for \"enable_event\" trigger\n\nTriggers are now delayed from freeing, but can still be triggered until\nafter the RCU grace period has ended. The freeing of the enable_event data\nis put into the private_data_free() callback, but the put of the module\nrefcount is done immediately.\n\nIt is possible that if a module is removed that has an event that would\nenable (or disable) it is still active, it can read the data of the module\nafter it is removed causing a use-after-free bug.\n\nMove the trace_event_put_ref() that releases the module into the delayed\ncallback so that the module can not be removed until any reference to its\nevents are finished.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260724132415.1b5005db@gandalf.local.home\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nLink: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com\nFixes: 61d445af0a7c (\"tracing: Add bulk garbage collection of freeing event_trigger_data\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "79097812153b826fc156a2930ec8a90ed9edf4a2", "tree": "73f21cf34165e7976584dfb2e80d6bba01a056b1", "parents": [ "8f76afb9b114bee1c1251e0e52553e9dc7c59f20" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Fri Jul 24 04:05:17 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 18:49:51 2026 -0400" }, "message": "tracing: Fix use-after-free freeing trigger private data\n\nCommit 61d445af0a7c (\"tracing: Add bulk garbage collection of freeing\nevent_trigger_data\") moved the kfree() of event_trigger_data to a kthread\nthat runs tracepoint_synchronize_unregister() before freeing. That removed\nthe synchronization the trigger .free callbacks used to get implicitly and\ninline from trigger_data_free().\n\nevent_hist_trigger_free(), event_hist_trigger_named_free() and\nevent_enable_trigger_free() free their satellite data (hist_data, cmd_ops,\nenable_data) right after trigger_data_free() returns. With the\nsynchronization now deferred to the kthread, a concurrent tracepoint\nhandler can still reach that data through the list_del_rcu()\u0027d trigger,\ncausing a use-after-free.\n\nThe histogram teardown must stay synchronous: remove_hist_vars() and\nunregister_field_var_hists() have to detach a synthetic event from the\nhistogram before the trigger-removal write returns, otherwise a following\ncommand races in and the synthetic-event removal fails with -EBUSY, as the\ntrigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait\nwith the correct barrier - tracepoint_synchronize_unregister(), matching\nthe free kthread - before freeing.\n\nThe enable trigger has no such synchronous requirement, and a blocking\nsynchronize there would re-serialize the path that commit deliberately\ndeferred. Give it an optional private_data_free() callback that the free\nkthread runs after its grace period, and free enable_data from there.\n\nLink: https://patch.msgid.link/20260724030523.19081-1-devnexen@gmail.com\nSuggested-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSuggested-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nFixes: 61d445af0a7c (\"tracing: Add bulk garbage collection of freeing event_trigger_data\")\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "2d66a033864e27ab8d5e44cb36f31d9d2413bee4", "tree": "35f879802309278eae279582b67f828814c334c4", "parents": [ "55c7bd2ddee50fd37b3b4c0b7a76bb0fd565f38b" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Fri Jul 24 18:38:56 2026 +0800" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Jul 24 15:04:11 2026 -0700" }, "message": "bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()\n\ntcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which\ndrops and reacquires the socket lock. Its error path tries to decide\nwhether msg_tx names the local temporary message by comparing it with\nthe current value of psock-\u003ecork.\n\nThis comparison is unsafe when two threads send on the same socket:\n\n Thread A Thread B\n msg_tx \u003d psock-\u003ecork\n sk_msg_alloc() fails\n sk_stream_wait_memory()\n releases the socket lock acquires the socket lock\n completes the cork\n psock-\u003ecork \u003d NULL\n frees the cork\n reacquires the socket lock\n msg_tx !\u003d psock-\u003ecork\n sk_msg_free(msg_tx)\n\nThe stale cork is therefore mistaken for the local temporary message\nand freed again. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50\n Read of size 4 at addr ffff88810c908800 by task poc/90\n Call Trace:\n sk_msg_free+0x49/0x50\n tcp_bpf_sendmsg+0x14f5/0x1cc0\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 89:\n __kasan_kmalloc+0x8f/0xa0\n tcp_bpf_sendmsg+0x16b3/0x1cc0\n Freed by task 91:\n __kasan_slab_free+0x43/0x70\n kfree+0x131/0x3c0\n tcp_bpf_sendmsg+0xec3/0x1cc0\n\nmsg_tx can only name the stack-local tmp or the shared cork. Check for\ntmp directly so a changed psock-\u003ecork cannot turn a shared message into\nan apparent local one.\n\nFixes: 604326b41a6f (\"bpf, sockmap: convert to generic sk_msg interface\")\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nReviewed-by: Jakub Sitnicki \u003cjakub@cloudflare.com\u003e\nLink: https://lore.kernel.org/bpf/87fr18lmzo.fsf%40cloudflare.com/\nLink: https://lore.kernel.org/netdev/20260719161630.2901208-1-nicoyip.dev%40gmail.com/ [v1]\nLink: https://patch.msgid.link/20260724103856.3399001-1-nicoyip.dev@gmail.com\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "e2a936998ab25cf7272847356390041c3143b498", "tree": "9ebc19e3dcf018ae4bc4b91f91e5273932780473", "parents": [ "dad0a87d79ff3e7e4ef35ebd588fe4f115329964", "6c33542c01eac1ac4d5595c1ba2dace0e27e842d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 14:11:53 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 14:11:53 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-07-25\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly drm pull request, small and scattered seems to be the new\n normal, the ttm change is probably the largest, with xe being the\n most. Alex was out this week so amdgpu is smaller and only has some\n urgent fixes.\n\n MAINTAINERS:\n - update mailmap address\n\n ttm:\n - backup pages using correct order\n\n gpusvm:\n - fix mm leak on eviction\n - properly zero page array in mm scanning\n\n tests:\n - fix dma mask errors in tests\n\n panel:\n - fix dependency issues\n - ilitek-ili9881c - fix probing\n\n i915:\n - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight\n\n xe:\n - Skip invalidation for purgeable state updates\n - Add drm_dev guards when detaching CCS read / write buffers\n - Alloc per domain unique i2c id\n - Fix SVM leak on resv obj alloc failure in xe_vm_create\n\n amdgpu:\n - Fix a backport mistake for dm_gpureset_toggle_interrupts()\n - Fix a failure on flip-done timeouts for mode1 reset\n\n appletbdrm:\n - fix issue in damage handling\n\n amdxdna:\n - fix command timeout race\n\n imagination:\n - fix gpu vm locking\n\n vc4:\n - prevent trusted bo from being mapped again\n - prevent timer rearm on shutdown\n\n v3d:\n - fix NULL deref in unbind\n - idle AXI before clock disable on suspend\n - use proper GMP access for newer hw\n\n vmwgfx:\n - validate shader array size\n\n ethosu:\n - fix length calculations\n - handle internal chaining buffers\n\n gma500:\n - return errors from HDMI i2c reads\"\n\n* tag \u0027drm-fixes-2026-07-25\u0027 of https://gitlab.freedesktop.org/drm/kernel: (31 commits)\n drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()\n drm/amd/display: Fix flip-done timeouts on mode1 reset\n Revert \"drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION\"\n drm/vc4: Shut down BO cache timer before teardown\n drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem\n drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()\n drm/xe/i2c: Allow per domain unique id\n drm/gma500: return errors from Oaktrail HDMI I2C reads\n drm/vc4: hvs/v3d: Fix null dereference in unbind\n drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A\n drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER\n drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T\n drm/panel: ilitek-ili9881c: do not fail probe if iovcc is absent\n drm/v3d: Idle AXI transactions before disabling the clock on suspend\n drm/v3d: Reach the GMP through the hub registers on V3D 7.x\n mailmap: Update Maíra Canal\u0027s email address\n drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION\n drm/pagemap: Clear driver-provided PFNs from migration PFN array\n drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\n accel: ethosu: Handle U85 internal chaining buffer\n ...\n" }, { "commit": "dad0a87d79ff3e7e4ef35ebd588fe4f115329964", "tree": "b8f300e11060a7c917865a6ca80b74c12b7cc18b", "parents": [ "981f4a2baaf15a15fd4a22d311f15d066e28833b", "5b602344a49e039e792ce5a8923bcc61412ee134" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 13:22:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 13:22:41 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.2-rc5\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"A bunch of assorted fixes with the majority being hardening against\n malformed input and invalid data scenarios that don\u0027t happen in real\n deployments but can be utilized to trigger use-after-free and similar\n issues, some error path leak fixups and two patches from Max to avoid\n a potential hang in __ceph_get_caps() and unintended nesting of\n current-\u003ejournal_info while handling replies from the MDS.\n\n All marked for stable\"\n\n* tag \u0027ceph-for-7.2-rc5\u0027 of https://github.com/ceph/ceph-client:\n ceph: avoid fs reclaim while using current-\u003ejournal_info\n ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*\n ceph: fix hanging __ceph_get_caps() with stale mds_wanted\n rbd: Reset positive result codes to zero in object map update path\n libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n ceph: fix refcount leak in ceph_readdir()\n libceph: guard missing CRUSH type name lookup\n libceph: remove debugfs files before client teardown\n libceph: bound get_version reply decode to front len\n ceph: fix writeback_count leak in write_folio_nounlock()\n libceph: fix two unsafe bare decodes in decode_lockers()\n ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n libceph: Reject monmaps advertising zero monitors\n libceph: reject zero bucket types in crush_decode\n libceph: Fix multiplication overflow in decode_new_up_state_weight()\n" }, { "commit": "981f4a2baaf15a15fd4a22d311f15d066e28833b", "tree": "5cb4e55628152c4a0ebe2edc8f0bf4b909dfd08e", "parents": [ "0c452fbdf41374ff418cb069e59d141eb73f374a", "6fe4e4b8259e1330945b5f3c9476e08473b8e0e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 13:12:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 13:12:43 2026 -0700" }, "message": "Merge tag \u0027fscrypt-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fscrypt/linux\n\nPull fscrypt fixes from Eric Biggers:\n \"A couple fixes for AI-detected bugs\"\n\n* tag \u0027fscrypt-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fscrypt/linux:\n fscrypt: Avoid dynamic allocation in fscrypt_get_devices()\n fscrypt: Add missing superblock check in find_or_insert_direct_key()\n" }, { "commit": "6c33542c01eac1ac4d5595c1ba2dace0e27e842d", "tree": "ac0135f858e356b0cf49fa48c92360f8fbf41019", "parents": [ "e24b02df4e9a1a78b2dbbf6ab21ebf24918f5c6a", "fbbaca9e208733652828ea98d00f09f260a7770e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 25 06:04:56 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 25 06:05:19 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-v7.2-2026-07-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/superm1/linux into drm-fixes\n\namd-drm-fixes-v7.2-2026-07-04:\n\n- Fix a backport mistake for dm_gpureset_toggle_interrupts()\n- Fix a failure on flip-done timeouts for mode1 reset\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Mario Limonciello \u003csuperm1@kernel.org\u003e\nLink: https://patch.msgid.link/5d5964a3-fb85-4a3c-9252-a43c93fe935d@kernel.org\n" }, { "commit": "0c452fbdf41374ff418cb069e59d141eb73f374a", "tree": "b59bd868744235eb49ecebf52d720b9b61873f64", "parents": [ "a93212b3d1f517859ec8f540cd8d587155edafc8", "f73a8edc2ccc6ec72c37d5c578e7592d2e1f9922" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 11:50:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 11:50:48 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"It\u0027s a bit all over the place, as I was hoping to fix a decade-old bug\n in our seccomp handling on syscall entry and ended up collecting other\n fixes in the meantime. You\u0027ll see the failed attempt (+revert) here\n but I didn\u0027t want to hold off on the others any longer. Hopefully\n we\u0027ll get that one squashed next week...\n\n - Fix early_ioremap() of unaligned ACPI tables\n\n - Remove bogus information from data abort diagnostics\n\n - Fix kprobes recursion during single-step\n\n - Fix incorrect constant in ESR address size fault macro\n\n - Fix OOB page-table walk in memory hot-unplug notifier\n\n - Fix OOB access to the linear map when retrieving an unaligned huge pte\n\n - Fix MPAM register reset values\n\n - Fix MPAM NULL dereference on teardown\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: make huge_ptep_get handled unaligned addresses\n arm64/mm: Check the requested PFN range during memory removal\n arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()\n arm64: kprobes: Allow reentering kprobes while single-stepping\n arm64: kprobes: Only handle faults originating from XOL slot\n drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()\n Revert \"arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates\"\n arm64: mm: When logging data aborts only decode Xs when ISV\u003d1\n arm64: fixmap: Allow 256K early_ioremap() at any offset\n arm_mpam: guard MBWU state before adding it to garbage\n arm_mpam: Fix MPAMCFG_MBW_PBM register setting\n arm_mpam: Fix software reset values of MPAMCFG_PRI\n arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates\n" }, { "commit": "a93212b3d1f517859ec8f540cd8d587155edafc8", "tree": "471dca2874e4b03236b75ed13d6e17e5d28145ee", "parents": [ "86ba24c41adcf1d6e63827a828a9b5120a86917d", "754f8efe45f87e3a9c6871b645b2f9d46d1b407b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 11:47:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 11:47:24 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Will Deacon:\n \"Joerg\u0027s away at the moment so I\u0027ve been looking after the IOMMU tree\n in his absence. In the process of doing that, I\u0027ve hoovered up a\n handful of fixes for the AMD and Intel drivers which address a\n combination of the usual out-of-bounds/locking/leak bugs as well as\n some logical issues around SVA and command completion.\n\n AMD:\n\n - Fix lockdep splat from nested domain allocation\n\n - Fix nested domain leak\n\n - Fix broken synchronisation of command completion\n\n - Fix OOB write in \"ivrs_acpihid\" command-line parsing\n\n VT-d:\n\n - Prevent SVA for IOMMUs with non-coherent page-table walker\n\n - Fix OOB write in PMU driver\"\n\n* tag \u0027iommu-fixes-v7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()\n iommu/amd: Bound the early ACPI HID map\n iommu/vt-d: Disallow SVA if page walk is not coherent\n iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()\n iommu/amd: Fix nested domain leak\n iommu/amd: Fix IRQ unsafe locking in gdom allocation\n" }, { "commit": "8f76afb9b114bee1c1251e0e52553e9dc7c59f20", "tree": "7fc5e54d58cf9a959460b60b9a58c8a6bf29d801", "parents": [ "1a087033a6bad73b4140020b40e819b0933aafc3" ], "author": { "name": "Usama Arif", "email": "usama.arif@linux.dev", "time": "Fri Jul 17 10:32:52 2026 -0700" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 13:43:18 2026 -0400" }, "message": "tracing: Fix context switch counter truncation\n\ntrace_user_fault_read() samples nr_context_switches_cpu() before enabling\npreemption and retries the user copy if the counter changes. The helper\nreturns unsigned long long because rq-\u003enr_switches is u64, but the saved\nvalue is unsigned int.\n\nOnce a CPU has performed 2^32 context switches, assigning the counter to\ncnt discards its upper bits. The comparison after the copy promotes cnt\nback to unsigned long long, but the lost bits remain zero, so it reports a\nchange even when the task was never scheduled out. Every retry then fails\nthe same way until the 100-try guard warns and the user copy is abandoned.\n\nThis affects long-running systems and workloads with high context-switch\nrates. A CPU switching 1,000 times per second takes about 50 days.\n\nStore the sampled count in unsigned long long so the full value is\npreserved.\n\nCc: stable@vger.kernel.org\nFixes: 64cf7d058a00 (\"tracing: Have trace_marker use per-cpu data to read user space\")\nLink: https://patch.msgid.link/20260717173252.3431565-1-usama.arif@linux.dev\nReported-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Usama Arif \u003cusama.arif@linux.dev\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "1a087033a6bad73b4140020b40e819b0933aafc3", "tree": "3404854a0407fcd55d1d7322e1cc181fbddd563c", "parents": [ "b4eb07bde606c2096b24252be589e735eff6d413" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Jul 17 11:51:59 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 13:43:18 2026 -0400" }, "message": "selftests/ftrace: Reset triggers at top level before instance loop\n\nWhen running instance tests, \u0027ftracetest\u0027 creates a new ftrace instance\nand runs the tests inside it. Before starting each test, it executes\n\u0027initialize_system()\u0027 to reset the ftrace state to initial-state.\n\nHowever, since \u0027initialize_system()\u0027 is executed in the context of the\ninstance directory, it only cleans up triggers and filters of that\ninstance.\nAny triggers or dynamic events left behind in the top-level instance by\nprevious failed top-level tests, are left completely untouched. These\ntop-level leftovers can cause subsequent instance-based tests to fail\nor even crash the kernel.\n\nFix this by executing \u0027initialize_system()\u0027 in the top-level tracing\ndirectory once before entering the instance loop.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/178425671889.84440.9477850701738666404.stgit@devnote2\nFixes: b5b77be812de (\"selftests: ftrace: Allow some tests to be run in a tracing instance\")\nAssisted-by: Antigravity:gemini-3.5-flash\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b4eb07bde606c2096b24252be589e735eff6d413", "tree": "434f147f5da10ecde3491c8c559fb26ffbf0d293", "parents": [ "144f29e85702234b23d2a62abf723e6a17eb5427" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Jul 17 11:51:49 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 13:43:17 2026 -0400" }, "message": "tracing: Fix union collision of module and refcnt for dynamic events\n\nIn \u0027struct trace_event_call\u0027, the \u0027module\u0027 pointer and the \u0027refcnt\u0027\natomic variable share the same memory space in a union. For dynamic\nevents, the union member is \u0027refcnt\u0027, which acts as an active\nreference counter.\n\nWhen a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or\nwprobe) has a non-zero reference count (e.g. due to active event\ntriggers or perf attachments), its \u0027call-\u003emodule\u0027 evaluates to a\nsmall non-zero integer instead of NULL.\n\nWhen filtering or setting events for a specific module (e.g., writing\n\u0027:mod:\u003cmodule\u003e\u0027 to \u0027set_event\u0027), the code in\n\u0027__ftrace_set_clr_event_nolock()\u0027 and \u0027update_event_fields()\u0027 reads\n\u0027call-\u003emodule\u0027 directly without checking whether the event is dynamic.\nThis causes the kernel to treat the small integer (refcnt) as a\n\u0027struct module\u0027 pointer, leading to a NULL/invalid pointer dereference\n(Oops) when dereferencing the module name.\n\nFix this by ensuring that the \u0027TRACE_EVENT_FL_DYNAMIC\u0027 flag is checked\nbefore treating \u0027call-\u003emodule\u0027 as a valid pointer in these code paths.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/178425670947.84440.11344393611899824907.stgit@devnote2\nFixes: 4c86bc531e60 (\"tracing: Add :mod: command to enabled module events\")\nAssisted-by: Antigravity:gemini-3.5-flash\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "144f29e85702234b23d2a62abf723e6a17eb5427", "tree": "9221093b890a14cfed2b2a1180d9aa3c7e2335c2", "parents": [ "c1d87e724ae55e781b7cc7ccafb34d9e668582b2" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Jul 21 21:11:43 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 24 13:43:09 2026 -0400" }, "message": "tracing: Fix mmiotrace possible NULL dereferencing of hiter-\u003edev\n\nIf the mmio_pipe_open() fails to find a PCI device, the hiter-\u003edev\nwill be assigned to NULL. The mmiotrace read() function dereferences the\nhiter-\u003edev if hiter exists.\n\nChange the test of the read to not only check hiter being NULL, but also\nthe hiter-\u003edev before dereferencing it.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260721211143.36dbd559@gandalf.local.home\nFixes: f984b51e0779 (\"ftrace: add mmiotrace plugin\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nLink: https://sashiko.dev/#/patchset/20260715143604.14481-1-gaikwad.dcg%40gmail.com\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "fbbaca9e208733652828ea98d00f09f260a7770e", "tree": "ac0135f858e356b0cf49fa48c92360f8fbf41019", "parents": [ "82730dba0cf9d9524af0ceeb7eb6b5c3ab1bdb87" ], "author": { "name": "Leo Li", "email": "sunpeng.li@amd.com", "time": "Thu Jul 23 09:44:50 2026 -0400" }, "committer": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Fri Jul 24 09:30:17 2026 -0500" }, "message": "drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()\n\nThis line was lost when cping from amd-staging-drm-next to drm-fixes.\nSo add it back.\n\nCc: stable@vger.kernel.org\nFixes: 8382cd234981 (\"drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock\")\nReported-by: Lu Yao \u003cyaolu@kylinos.cn\u003e\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nLink: https://patch.msgid.link/20260723134450.13838-1-sunpeng.li@amd.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\n" }, { "commit": "86ba24c41adcf1d6e63827a828a9b5120a86917d", "tree": "a9b57767ec68715160abc465b56f775379c67551", "parents": [ "48a5a7ab8d6ab7090564339e039c421f315de912", "5ff172f6c94d282d83cb88bdfec5f647ad9c6105" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 07:28:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 24 07:28:35 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fixes from Vlastimil Babka:\n\n - Prevent unbounded recursion in free path with memory allocation\n profiling, which has caused a stack overflow on a Meta production\n host due to a 125-deep __free_slab\u003c-\u003ekfree recursion (Harry Yoo)\n\n - Fix type-based partitioning confusing sparse which does not know\n __builtin_infer_alloc_token() (Marco Elver)\n\n - Fix a potential memory leak in bulk freeing path on NUMA machines\n (Shengming Hu)\n\n* tag \u0027slab-for-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n slab: silence sparse warning with type-based partitioning\n mm/slab: prevent unbounded recursion in free path with new kmalloc type\n lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()\n mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT\n mm/slab: fix a memory leak due to bootstrapping sheaves twice\n mm/slub: fix lost local objects when bulk remote free batch fills\n" }, { "commit": "82730dba0cf9d9524af0ceeb7eb6b5c3ab1bdb87", "tree": "159669c513ee46f1d3a09786a8fb42a5bd8b3fff", "parents": [ "e24b02df4e9a1a78b2dbbf6ab21ebf24918f5c6a" ], "author": { "name": "Leo Li", "email": "sunpeng.li@amd.com", "time": "Thu Jul 23 14:01:59 2026 -0400" }, "committer": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Fri Jul 24 09:26:42 2026 -0500" }, "message": "drm/amd/display: Fix flip-done timeouts on mode1 reset\n\nThe vblank on/off callbacks mixed use of amdgpu_irq_get/put() and\namdgpu_dm_crtc_set_vupdate_irq() to enable and disable IRQs.\n\nWith get/put, base driver will callback into DC to disable IRQs when\nrefcount \u003d\u003d 0. With set_vupdate_irq(), DC is called directly to disable\nIRQs, bypassing base driver\u0027s refcount tracking.\n\nDuring gpu reset, base driver can restore IRQs via\namdgpu_irq_gpu_reset_resume_helper() \u003e amdgpu_irq_update(). So if\nget/put() is not used (i.e. refcount \u003d\u003d 0), then vupdate_irq will be\ndisabled.\n\nThis is problematic if DRM requests vblank on before amdgpu_irq_update()\nis called: drm_vblank_on() \u003e set_vupdate_irq() enables vupdate_irq, but\nthe refcount is still 0. gpu_reset_resume_helper() \u003e irq_update() then\nimmediately disables it, thus leading to flip done timeouts.\n\nThis is made worse on DCN since VUPDATE_NO_LOCK is the only IRQ enabled.\nPrior to 8382cd234981, a combination of GRPH_FLIP and VSTARTUP IRQs were\nused, and they used get/put(). This explains why 8382cd234981 exposed\nthis issue.\n\nFix by using get/put() instead of set_vupdate_irq(). DCE is unchanged,\nsince it relies on unbalanced enable/disable calls based on VRR status,\nand hence requires direct set_vupdate_irq(). Plus, it also uses\nGRPH_FLIP and VLINE IRQs, which are properly tracked by get/put().\n\nCc: stable@vger.kernel.org\nFixes: 8382cd234981 (\"drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock\")\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nLink: https://patch.msgid.link/20260723180159.52121-1-sunpeng.li@amd.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\n" }, { "commit": "b6061b6cca72d6a20f5eccd72b8da78c2e460861", "tree": "33da6483aa7e407fef5759954a315da4496bb7f1", "parents": [ "fb0bf289f5d529336ef490c8273e88a8a8b29f69", "faaddd811c5099f11a5f52e68a6b31a5898cda4f" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 15:36:52 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 15:36:52 2026 +0200" }, "message": "Merge tag \u0027usb-serial-7.2-rc4\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus\n\nJohan writes:\n\nUSB serial fixes for 7.2-rc4\n\nHere are some fixes for 7.2:\n\n - fix data loss on keyspan_pda throttle\n - fix memory corruption with malicious edgeport devices\n - fix memory corruption with corrupt io_ti firmware\n - fix OOB read with corrupt mxuport firmware\n\nIncluded are also some new ftdi and modem device ids.\n\nAll have been in linux-next with no reported issues.\n\n* tag \u0027usb-serial-7.2-rc4\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:\n USB: serial: io_edgeport: cap received transmit credits\n USB: serial: option: add TDTECH MT5710-CN\n USB: serial: io_ti: reject oversized boot-mode firmware\n USB: serial: mxuport: validate firmware header size\n USB: serial: ftdi_sio: add support for E+H FXA291\n USB: serial: keyspan_pda: fix data loss on receive throttling\n" }, { "commit": "91a70492c03040d51b36f595530d6491d5d6c541", "tree": "1ec9f1efd3e216a5a088602435f0dd447668bbc9", "parents": [ "cf4dd800e49d35d48ebd63d511a6e200f39176f7" ], "author": { "name": "Zixing Liu", "email": "liushuyu@aosc.io", "time": "Fri Jul 24 16:33:14 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Jul 24 16:33:14 2026 +0800" }, "message": "platform/loongarch: laptop: Explicitly reset bl_powered state when suspend\n\nOn EAECIS NL60R with EC firmware version 1.11, resuming from S3 has a\nvery high chance (\u003e90%) of causing the EC to lose the previous backlight\npower state. When this happens, the laptop resumes normally from S3, but\nthe backlight remains off (when shining on the screen with a flash light,\nwe can see the screen contents are updating normally).\n\nSince there is no generic way to query the EC\u0027s backlight state on\nLoongson laptop platforms, assume the worst-case scenario and restart\nthe backlight power inside the kernel each time the system resumes.\n\nCc: stable@vger.kernel.org\nFixes: 53c762b47f72 (\"platform/loongarch: laptop: Add backlight power control support\")\nTested-by: Yao Zi \u003cme@ziyao.cc\u003e\nTested-by: Xi Ruoyao \u003cxry111@xry111.site\u003e\nSigned-off-by: Zixing Liu \u003cliushuyu@aosc.io\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "cf4dd800e49d35d48ebd63d511a6e200f39176f7", "tree": "59ac3b6f92b06d23b5b5cf964b1455252037c889", "parents": [ "47e20d4b3da97ef3881d1e55e43545c22424f3fc" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Jul 24 16:33:14 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Jul 24 16:33:14 2026 +0800" }, "message": "platform/loongarch: laptop: Stop setting acpi_device_class()\n\nThe driver populates acpi_device_class() which is never read afterward,\nso make it stop doing that and drop the symbol defined specifically for\nthis purpose.\n\nNo intentional functional impact.\n\nThis change will facilitate the removal of \"device_class\" from \"struct\nacpi_device_pnp\" in the future.\n\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "47e20d4b3da97ef3881d1e55e43545c22424f3fc", "tree": "5d585d6c34051d468601158cccb6603cbc758485", "parents": [ "dacd348b8a993373576fe2ee2d8b114740ba57a6" ], "author": { "name": "Pu Lehui", "email": "pulehui@huawei.com", "time": "Fri Jul 24 16:33:08 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Jul 24 16:33:08 2026 +0800" }, "message": "LoongArch: BPF: Fix memory leak in bpf_jit_free()\n\nWhen bpf_int_jit_compile() is called for subprograms, it returns early\nduring the first pass (!prog-\u003eis_func || extra_pass is false), keeping\nctx-\u003eoffset alive for the subsequent extra pass.\n\nIf JIT compilation fails for a later subprogram, the BPF core aborts and\ncalls bpf_jit_free() to clean up the first subprogram. However,\nbpf_jit_free() fails to free jit_data-\u003ectx.offset, which causes a memory\nleak of the JIT context offsets array.\n\nSo fix this by adding the missing kvfree(jit_data-\u003ectx.offset) in\nbpf_jit_free().\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nFixes: 4ab17e762b34 (\"LoongArch: BPF: Use BPF prog pack allocator\")\nAcked-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Pu Lehui \u003cpulehui@huawei.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "c1d04c1bce98f9dd984a9c6657278a7761854c9c", "tree": "d4d8865e30c4babeb4a43467b65c961aef6bf166", "parents": [ "8b7e8245e2293078f657521236ac92c045552e5a" ], "author": { "name": "Mateusz Guzik", "email": "mjguzik@gmail.com", "time": "Thu Jul 23 18:01:13 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Jul 24 10:30:58 2026 +0200" }, "message": "pidfs: make pidfs_ino_lock static\n\nFixes: 87caaeef7995 (\"pidfs: implement ino allocation without the pidmap lock\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202607231547.ehCQxi0L-lkp@intel.com/\n\nSigned-off-by: Mateusz Guzik \u003cmjguzik@gmail.com\u003e\nLink: https://patch.msgid.link/20260723160114.291515-1-mjguzik@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "e24b02df4e9a1a78b2dbbf6ab21ebf24918f5c6a", "tree": "d2ec5faa819564d7676690c8c65ccf8c303d196c", "parents": [ "20277937f9a11e05f485caa2fc9b3440f9f0f823", "1ff399c4cd132a24c73e5e237a11cb9d6b68dff1" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 24 18:30:23 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 24 18:30:29 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-07-24\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\ndrm-misc-fixes for v7.2-rc5:\n- Improve damage handling in appletbdrm.\n- Fix harmful fragmenting of MM by backing up TTM pages at native\n page order.\n- Fix timeout handling in amdxdna.\n- Fix imagination locking for map/unmap operations.\n- Fix mm leak in gpusvm eviction.\n- Properly zero page array in gpusvm mm scanning.\n- Prevent trusted shader bo\u0027s from being mapped again in vc4.\n- Validate shader array size in vmwgfx.\n- Fix length calculation bugs in ethosu.\n- Better error handling during pagemap migration.\n- Improve v3d suspend.\n- Kconfig updates for some panels.\n- Handle missing iovcc in ili9881c panel.\n- Fix vc4 unbind.\n- Add i2c error handling in gma500.\n- Fix kunit tests on pp64le and s390x.\n- Prevent rearming vc4 timer on shutdown.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patch.msgid.link/07284633-6b9b-40f9-8949-b1516a42a34c@linux.intel.com\n" }, { "commit": "1ff399c4cd132a24c73e5e237a11cb9d6b68dff1", "tree": "2ce7d810d19b2292f643b4825f75668911c424f6", "parents": [ "6273dd3ffb54ec581855b82ae77331b66028249c" ], "author": { "name": "Maarten Lankhorst", "email": "dev@lankhorst.se", "time": "Fri Jul 24 08:02:14 2026 +0200" }, "committer": { "name": "Maarten Lankhorst", "email": "dev@lankhorst.se", "time": "Fri Jul 24 08:02:14 2026 +0200" }, "message": "Revert \"drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION\"\n\nThis reverts commit 04b177544a040cbafab760d6b766381c6b22e0a8.\n\nThe original author requested it to be reverted, as it conflicts with\nchanges in the -next branch for MM:\n\n\"I\u0027m not sure who is doing the drm-misc-fixes PR, but if you are can\nyou omit this patch: https://patchwork.freedesktop.org/series/170865/\n\nI guess this conflicts with MM changes in their next tree and it easy\nenough on our side to do this slightly differently to avoid a conflict\nso going to post revert + a different change. If this is already sent nbd.\"\n\nSigned-off-by: Maarten Lankhorst \u003cdev@lankhorst.se\u003e\n" }, { "commit": "55c7bd2ddee50fd37b3b4c0b7a76bb0fd565f38b", "tree": "a80308884b5fe7d14b54e19a60e43f219a06359f", "parents": [ "289e680c89ae8a0bb629fa8308313f5c8c6c76a3" ], "author": { "name": "Amery Hung", "email": "ameryhung@gmail.com", "time": "Thu Jul 23 15:18:15 2026 -0700" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Thu Jul 23 16:09:08 2026 -0700" }, "message": "selftests/bpf: Test passing scalar NULL to nonnull global subprog\n\nMake sure the verifier reject passing a hardcoded NULL to an\n__arg_nonnull argument.\n\nSigned-off-by: Amery Hung \u003cameryhung@gmail.com\u003e\nLink: https://patch.msgid.link/20260723221815.367797-2-ameryhung@gmail.com\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "289e680c89ae8a0bb629fa8308313f5c8c6c76a3", "tree": "fec61c0877579c40642732193780ef8b9556ca97", "parents": [ "94515f3a7d4256a5062176b7d6ed0471938cd51a" ], "author": { "name": "Amery Hung", "email": "ameryhung@gmail.com", "time": "Thu Jul 23 15:18:14 2026 -0700" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Thu Jul 23 16:09:07 2026 -0700" }, "message": "bpf: Reject passing scalar NULL to nonnull arg of a global subprog\n\nA global subprogram argument tagged __arg_nonnull is set up as a\nnon-nullable PTR_TO_MEM. However the verifier does not check against a\nscalar NULL, leading to real NULL pointer dereference. Reject it as\nwell.\n\nFixes: 94e1c70a3452 (\"bpf: support \u0027arg:xxx\u0027 btf_decl_tag-based hints for global subprog args\")\nSigned-off-by: Amery Hung \u003cameryhung@gmail.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://patch.msgid.link/20260723221815.367797-1-ameryhung@gmail.com\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "6273dd3ffb54ec581855b82ae77331b66028249c", "tree": "8b9234294c14a454af2c887fa70bc8bfe55a25c6", "parents": [ "b04a248cfa6cfa1e7dc9ce91cb1eb88b1a70dd69" ], "author": { "name": "Linmao Li", "email": "lilinmao@kylinos.cn", "time": "Mon Jul 20 16:44:26 2026 +0800" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Jul 23 20:07:23 2026 -0300" }, "message": "drm/vc4: Shut down BO cache timer before teardown\n\nThe BO cache timer callback schedules time_work, and time_work can rearm\nthe timer through vc4_bo_cache_free_old().\n\nvc4_bo_cache_destroy() deletes the timer and then cancels the work, which\ndoes not break that cycle: the work being cancelled can rearm the timer,\nand the timer then queues work again after teardown.\n\nUse timer_shutdown_sync() instead, so the timer cannot be rearmed and the\ncycle ends with cancel_work_sync().\n\nFixes: c826a6e10644 (\"drm/vc4: Add a BO cache.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Linmao Li \u003clilinmao@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260720084426.1632508-1-lilinmao@kylinos.cn\nReviewed-by: Maíra Canal \u003cmcanal@igalia.com\u003e\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "20277937f9a11e05f485caa2fc9b3440f9f0f823", "tree": "6a95e2535b9b1baf67b5f30d461b61434a85943a", "parents": [ "394586aa7e7233c7fbae7fef31b0115fa3d66b5f", "d2c6800ad1802bed72a6de1416536737f114f1d6" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 24 09:00:03 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 24 09:00:08 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-07-23\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nDriver Changes:\n- Skip invalidation for purgeable state updates (Arvind)\n- Add drm_dev guards when detaching CCS read / write buffers (Satyanarayana)\n- Alloc per domain unique i2c id (Raag)\n- Fix SVM leak on resv obj alloc failure in xe_vm_create (Shuicheng)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nLink: https://patch.msgid.link/amJ5-WUA_OS_RBAp@fedora\n" }, { "commit": "394586aa7e7233c7fbae7fef31b0115fa3d66b5f", "tree": "d923d5f5ac49a5d916871c648b5e97ceaf5fdc53", "parents": [ "1590cf0329716306e948a8fc29f1d3ee87d3989f", "a411ea4a87162898d2a0547fdfb721ddb7626be3" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 24 08:46:54 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 24 08:47:07 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-07-23\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight (Suraj)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/amJDXaBKC9uUgRFt@intel.com\n" }, { "commit": "48a5a7ab8d6ab7090564339e039c421f315de912", "tree": "37ef7ff404bd46f287f9b9cbe72c51e168e7bd43", "parents": [ "d326f83e819c53aa05c40d64f5805d6237b6aa1b", "c2f2e83e3bbc5483730fd4ee903182761f1ae50f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 23 13:49:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 23 13:49:54 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n - Fix leak in cifs_close_deferred_file()\n - Fix resolving MacOS symlinks\n - Fix stale file size in readdir\n - Update git branches in MAINTAINERS file\n - Fix bounds check in cifs_filldir\n - Fix checks in parse_dfs_referrals()\n - Fix DFS referral checks for malformed packet\n\n* tag \u0027v7.2-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths\n cifs: prevent readdir from changing file size due to stale directory metadata\n smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target\n Add missing git branch info for cifs and ksmbd to MAINTAINERS file\n smb: client: bound dirent name against end of SMB response in cifs_filldir\n smb: client: validate DFS referral PathConsumed\n" }, { "commit": "d326f83e819c53aa05c40d64f5805d6237b6aa1b", "tree": "f3505e4347ebd0244f580e11093033ad7b885f36", "parents": [ "4539944e515183668109bdf4d0c3d7d228383d88", "6a8da869fa338e008533dd6385a0eb35dee6acf4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 23 12:58:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 23 12:58:08 2026 -0700" }, "message": "Merge tag \u0027net-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Lots of fixes, double the count even for the \u0027new normal\u0027. Largely due\n to my time off followed by a networking conference which distracted\n most maintainers (less so the AI generators).\n\n Including fixes from Bluetooth and WiFi.\n\n Current release - regressions:\n\n - wifi: mt76: fix MAC address for non OF pcie cards\n\n Current release - new code bugs:\n\n - mptcp: fix BUILD_BUG_ON on legacy ARM config\n\n - wifi: cfg80211: guard optional PMSR nominal time\n\n Previous releases - regressions:\n\n - qrtr: ns: raise node count limit to 512, we arbitrarily picked\n 256 as a limit, turns out it was too low for real world deployments\n\n - vhost-net: fix TX stall when vhost owns virtio-net header\n\n - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN\n\n - wifi: ath12k: fix low MLO RX throughput on WCN7850\n\n Previous releases - always broken:\n\n - number of random AI fixes for SCTP, RDS and TIPC protocols\n\n - more AI-looking fixes for WiFi drivers\n\n - number of fixes for missing pointer reloading after skb pull\n\n - reject BPF redirect use from qdisc qevent block\n\n - tcp: initialize standalone TCP-AO response padding\n\n - vsock/virtio: collapse receive queue under memory pressure to avoid\n client OOMing the host with tiny messages\n\n - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,\n make sure the ICMP response routing follows the routing policy\n\n - gro: fix double aggregation of flush-marked skbs\n\n - ovpn: fix various refcount bugs\n\n - tls: device: push pending open record on splice EOF\n\n - eth: mlx5:\n - use sender devcom for MPV master-up\n - fix MCIA register buffer overflow on 32 dword reads\"\n\n* tag \u0027net-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits)\n drop_monitor: perform u64_stats updates under IRQ-disabled section\n drop_monitor: fix size calculations for 64-bit attributes\n net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD\n mptcp: fix BUILD_BUG_ON on legacy ARM config\n selftests: mptcp: userspace_pm: fix undefined variable port\n mptcp: fix stale skb-\u003esk reference on subflow close\n mptcp: pm: userspace: fix use-after-free in get_local_id\n mptcp: decrement subflows counter on failed passive join\n mac802154: hold an interface reference across the scan worker\n sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing\n phonet: check register_netdevice_notifier() error in phonet_device_init()\n phonet: pep: fix use-after-free in pep_get_sb()\n bnge/bng_re: fix ring ID widths\n tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()\n net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()\n mctp: check register_netdevice_notifier() error in mctp_device_init()\n ptp: netc: explicitly clear TMR_OFF during initialization\n rds: tcp: unregister sysctl before tearing down listen socket\n ipv6: Change allocation flags to match rcu_read_lock section requirements\n net: slip: serialize receive against buffer reallocation\n ...\n" }, { "commit": "5b602344a49e039e792ce5a8923bcc61412ee134", "tree": "c09efd5b47744b0d35f3ea3c74df263583870019", "parents": [ "cee38bbf5556a8e0a232ccae41649580827d7806" ], "author": { "name": "Max Kellermann", "email": "max.kellermann@ionos.com", "time": "Wed Jul 22 13:49:31 2026 +0200" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:42 2026 +0200" }, "message": "ceph: avoid fs reclaim while using current-\u003ejournal_info\n\nhandle_reply() stores a `ceph_mds_request` pointer in\n`current-\u003ejournal_info` while filling the inode and dentry cache from\nan MDS reply.\n\nAn allocation in this section can enter direct reclaim and prune\ndentries from another filesystem. If this dirties an ext4 inode, ext4\nstarts a JBD2 transaction. JBD2 interprets the Ceph request in\n`current-\u003ejournal_info` as a journal handle and dereferences the\nrequest\u0027s `r_tid` as `h_transaction`, causing a kernel crash, e.g.:\n\n Unable to handle kernel paging request at virtual address 00000000077b4818\n [...]\n Internal error: Oops: 0000000096000004 [#1] SMP\n Modules linked in:\n CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE\n [...]\n Workqueue: ceph-msgr ceph_con_workfn\n pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n pc : jbd2__journal_start+0x2c/0x208\n lr : __ext4_journal_start_sb+0x100/0x178\n [...]\n Call trace:\n jbd2__journal_start+0x2c/0x208 (P)\n __ext4_journal_start_sb+0x100/0x178\n ext4_dirty_inode+0x3c/0x90\n __mark_inode_dirty+0x58/0x400\n iput.part.0+0x2b0/0x370\n iput+0x18/0x30\n dentry_unlink_inode+0xc0/0x158\n __dentry_kill+0x80/0x250\n shrink_dentry_list+0x90/0x130\n prune_dcache_sb+0x60/0x98\n super_cache_scan+0xe8/0x190\n do_shrink_slab+0x174/0x388\n shrink_slab+0xd8/0x4c0\n shrink_node+0x31c/0x908\n do_try_to_free_pages+0xd0/0x508\n try_to_free_pages+0x11c/0x238\n __alloc_frozen_pages_noprof+0x4d0/0xdd0\n __folio_alloc_noprof+0x18/0x70\n __filemap_get_folio+0x248/0x440\n ceph_readdir_prepopulate+0x570/0x9e8\n mds_dispatch+0x1424/0x1ba0\n ceph_con_process_message+0x74/0xa0\n ceph_con_v1_try_read+0x3a0/0x1510\n ceph_con_workfn+0x260/0x460\n\nEnter a scoped NOFS allocation context and leave it after clearing\n`journal_info`. This prevents filesystem reclaim from recursing into\nanother filesystem while the field contains Ceph-private data.\n\nCc: stable@vger.kernel.org\nFixes: 315f24088048 (\"ceph: fix security xattr deadlock\")\nSigned-off-by: Max Kellermann \u003cmax.kellermann@ionos.com\u003e\nReviewed-by: Viacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nReviewed-by: Xiubo Li \u003cxiubo.li@clyso.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "cee38bbf5556a8e0a232ccae41649580827d7806", "tree": "1274e4b25ebe3a8b5340a2b8d9de5733dd30c3b0", "parents": [ "50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6" ], "author": { "name": "Max Kellermann", "email": "max.kellermann@ionos.com", "time": "Tue Jul 21 08:20:46 2026 +0200" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:42 2026 +0200" }, "message": "ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*\n\nThese permission checks were already missing in the initial\nimpementation of these ioctls. This Ceph allows any user who owns a\nfile descriptor to manipulate the layout of any file, even if they\ndon\u0027t have write permissions.\n\nIt might be a good idea to guard other ioctls with permission checks\nas well or even disallow regular users (even if they own the file) to\nmanipulate layout settings completely, as this may be abused to DoS\nthe Ceph servers, but right now, I find it most urgent to have setter\nchecks at all.\n\nCc: stable@vger.kernel.org\nFixes: 8f4e91dee2a2 (\"ceph: ioctls\")\nSigned-off-by: Max Kellermann \u003cmax.kellermann@ionos.com\u003e\nReviewed-by: Xiubo Li \u003cxiubo.li@clyso.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6", "tree": "23ce551235ad3d707b341009a4749615ba0fb630", "parents": [ "a6c4250b81bd30beae94e1b7a4b26fa1193ad2e4" ], "author": { "name": "Max Kellermann", "email": "max.kellermann@ionos.com", "time": "Mon Jul 06 17:06:59 2026 +0200" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:42 2026 +0200" }, "message": "ceph: fix hanging __ceph_get_caps() with stale mds_wanted\n\nA reader can hang forever in __ceph_get_caps() when the client no\nlonger holds `FILE_RD`, but local cap state still says that the\ncapability is already wanted (via `mds_wanted`).\n\nOne way to trigger this is through MDS cap revocation. If another\nclient performs a conflicting operation, the MDS can revoke `FILE_RD`\nfrom the reader; the next read then has to reacquire `FILE_RD`. If\nthe cap update that should request `FILE_RD` never reaches the MDS\nafter `cap-\u003emds_wanted` was raised, the reader is left holding only\nnon-file caps while local `mds_wanted` still includes the file read\ncaps.\n\nIn that state, try_get_cap_refs() sees `need \u003c\u003d mds_wanted` and\nreturns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap\nupdate that was supposed to request `FILE_RD never reaches the MDS\nafter `cap-\u003emds_wanted was` raised, no further request is sent and the\nwaiter can sleep indefinitely until unrelated cap traffic happens to\nwake it up.\n\nThe ordering issue is that `cap-\u003emds_wanted` is updated in\n__prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually\nqueued for send. That makes one field serve two different meanings at\nonce: what this client wants, and what the client believes the MDS\nalready knows it wants.\n\nA proper fix would be to split those states and track whether a cap\nupdate is actually in flight or has been observed by the MDS.\nHowever, simply moving the `cap-\u003emds_wanted assignment` later would\nnot be sufficient: queueing the message in the messenger does not\nguarantee that the MDS processed that specific wanted set, and\nreconnect or message loss can still invalidate that assumption.\nFixing that properly would require a larger rework of the cap state\nmachine.\n\nTo allow simpler backports to stable kernels, this patch implements a\nsimpler workaround:\n\n- stop waiting forever in __ceph_get_caps(); after a bounded wait,\n fall back to the renew path\n\n- make ceph_renew_caps() issue a synchronous `OPEN` request whenever\n the inode still does not actually hold the wanted caps, instead of\n only calling ceph_check_caps()\n\nThe extra issued-vs-wanted check in ceph_renew_caps() is necessary\nbecause the previous test only checked whether the inode still had any\nreal caps at all. That is not enough after revocation: the client can\nstill hold something like `pLs` and yet be missing `FILE_RD`\ncompletely. In that case, falling back to ceph_check_caps() is not\nsufficient, because it still trusts `cap-\u003emds_wanted` and may resend\nnothing. By requiring `(issued \u0026 wanted) \u003d\u003d wanted` before taking the\nasynchronous path, the code only uses ceph_check_caps() when the\n`wanted caps` are already actually issued. Otherwise, it sends the\nsynchronous `OPEN` renew.\n\nThis preserves the existing asynchronous fast path when the wanted\ncaps are already issued, avoids changing cap-state semantics, and\nfixes the hang by guaranteeing that a stalled waiter eventually\nretries through a path that does not rely on the stale `mds_wanted`\nstate.\n\n[ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to\n mds_client.h, formatting ]\n\nCc: stable@vger.kernel.org\nFixes: 0a454bdd501a (\"ceph: reorganize __send_cap for less spinlock abuse\")\nSigned-off-by: Max Kellermann \u003cmax.kellermann@ionos.com\u003e\nReviewed-by: Alex Markuze \u003camarkuze@redhat.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "a6c4250b81bd30beae94e1b7a4b26fa1193ad2e4", "tree": "a8bb6db8db655d75b6bb6a886ee6601804ed2162", "parents": [ "9f00f9cf2be293efe899db67dc5272e3a9c62717" ], "author": { "name": "Raphael Zimmer", "email": "raphael.zimmer@tu-ilmenau.de", "time": "Thu Jul 09 13:26:20 2026 +0200" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:42 2026 +0200" }, "message": "rbd: Reset positive result codes to zero in object map update path\n\nIn a reply message to an RBD request, a positive result code indicates\na data payload, which is not allowed for writes. While\nrbd_osd_req_callback() already resets a positive result code for writes\nto zero, rbd_object_map_callback() does not. This allows a corrupted\nreply to an object map update to trigger the rbd_assert(*result \u003c 0) in\n__rbd_obj_handle_request(). This happens, because\nrbd_object_map_callback() calls rbd_obj_handle_request() -\u003e\n__rbd_obj_handle_request() and passes this positive result code. From\n__rbd_obj_handle_request(), rbd_obj_advance_write() is called, which\nleaves the positive result code unchanged and returns true. Therefore,\nthe if(done \u0026\u0026 *result) branch is executed in __rbd_obj_handle_request()\nand the assertion triggers.\n\nThis patch fixes the issue by adjusting the logic in the\nrbd_object_map_callback() path. A positive result code for an object map\nupdate is now reset to zero (similar to rbd_osd_req_callback()), and the\nmessage is subsequently handled the same way as if the result code was\nzero from the beginning. Additionally, a WARN_ON_ONCE() is added for\nthis case.\n\nCc: stable@vger.kernel.org\nFixes: 22e8bd51bb04 (\"rbd: support for object-map and fast-diff\")\nSigned-off-by: Raphael Zimmer \u003craphael.zimmer@tu-ilmenau.de\u003e\nReviewed-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "9f00f9cf2be293efe899db67dc5272e3a9c62717", "tree": "a0b5f3b35f6b593bad8f8b96ca8d2adff5c8c815", "parents": [ "937d61f86d377a3aa578adae7a3dfcecdddf9d89" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Mon Jun 08 21:40:09 2026 -0700" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:42 2026 +0200" }, "message": "libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n Write of size 4 ... by task exploit\n kasan_report (mm/kasan/report.c:595)\n ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n calc_target (net/ceph/osd_client.c:1638)\n __submit_request (net/ceph/osd_client.c:2394)\n ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n ceph_osdc_call (net/ceph/osd_client.c:5164)\n rbd_dev_image_probe (drivers/block/rbd.c:6899)\n do_rbd_add (drivers/block/rbd.c:7138)\n ...\n kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ]\n\nCc: stable@vger.kernel.org\nFixes: a303bb0e5834 (\"libceph: introduce and switch to decode_pg_mapping()\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nReviewed-by: Alex Markuze \u003camarkuze@redhat.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "937d61f86d377a3aa578adae7a3dfcecdddf9d89", "tree": "f1b559ff3681d430481e15fddca5bba68ae7f6fb", "parents": [ "c3e64079d8b9663e3998d0caac9aba915b6b93ae" ], "author": { "name": "Shuangpeng Bai", "email": "shuangpeng.kernel@gmail.com", "time": "Mon Jun 29 13:14:22 2026 -0400" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au-\u003ebuf-\u003evec.iov_base and\nau-\u003ebuf-\u003evec.iov_len in struct ceph_auth_handshake. These\ncached values are then used by the messenger connect code when\nsending the authorizer.\n\nceph_x_update_authorizer() can rebuild the authorizer when a newer\nservice ticket is available. If the rebuilt authorizer no longer\nfits in the existing buffer, ceph_x_build_authorizer() drops its\nreference to au-\u003ebuf and allocates a new one. If this is the final\nreference, ceph_buffer_put() frees the old ceph_buffer and its\nvec.iov_base, but auth-\u003eauthorizer_buf still points at that freed\nmemory.\n\nA subsequent msgr1 reconnect can therefore queue the stale pointer\nand trigger a KASAN slab-use-after-free in _copy_from_iter() while\ntcp_sendmsg() copies the authorizer.\n\nRefresh auth-\u003eauthorizer_buf and auth-\u003eauthorizer_buf_len after a\nsuccessful authorizer rebuild so the messenger sends the current\nbuffer.\n\nCc: stable@vger.kernel.org\nFixes: 0bed9b5c523d (\"libceph: add update_authorizer auth method\")\nCloses: https://lore.kernel.org/all/E378850E-106C-427B-A241-970EB2D054D7@gmail.com/\nSigned-off-by: Shuangpeng Bai \u003cshuangpeng.kernel@gmail.com\u003e\nReviewed-by: Alex Markuze \u003camarkuze@redhat.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "c3e64079d8b9663e3998d0caac9aba915b6b93ae", "tree": "a320dfdc4b912f10bdc914902f9fe6a7da2b32de", "parents": [ "bbeae12fda3384a90fbebc8a19ba9d33f85b5361" ], "author": { "name": "WenTao Liang", "email": "vulab@iscas.ac.cn", "time": "Thu Jun 11 22:40:07 2026 +0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "ceph: fix refcount leak in ceph_readdir()\n\nThe ceph_readdir() function allocates a ceph_mds_request via\nceph_mdsc_create_request() and stores it in dfi-\u003elast_readdir. In\nthe directory entry processing loop, if the entry\u0027s offset is less\nthan ctx-\u003epos or if the inode pointer is unexpectedly NULL, the\nfunction returns -EIO without releasing the reference held by\ndfi-\u003elast_readdir, causing a refcount leak.\n\nFix this by adding ceph_mdsc_put_request(dfi-\u003elast_readdir) before\nreturning on these error paths. Also set dfi-\u003elast_readdir to NULL\nfor safety, matching the cleanup done at the normal exit.\n\nCc: stable@vger.kernel.org\nFixes: af9ffa6df7e3 (\"ceph: add support to readdir for encrypted names\")\nSigned-off-by: WenTao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Viacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nReviewed-by: Alex Markuze \u003camarkuze@redhat.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "bbeae12fda3384a90fbebc8a19ba9d33f85b5361", "tree": "9bd83cc7093c19cf89618073d3df9daa14f4b652", "parents": [ "e4c804726c4afce3ba648b982d564f6af2cfa328" ], "author": { "name": "Zhao Zhang", "email": "zzhan461@ucr.edu", "time": "Fri Jun 19 15:40:03 2026 +0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "libceph: guard missing CRUSH type name lookup\n\nLocalized read selection can walk a parent bucket whose name exists in\nthe CRUSH map while its type has no matching entry in type_names.\nget_immediate_parent() then dereferences a NULL type_cn and passes an\ninvalid pointer into strcmp(), causing a null-ptr-deref.\n\nSkip such malformed parent buckets unless both the bucket name and type\nname metadata are present. This keeps malformed hierarchy data from\ncrashing locality lookup and safely falls back to \"not local\".\n\n[ idryomov: add WARN_ON_ONCE ]\n\nCc: stable@vger.kernel.org\nFixes: 117d96a04f00 (\"libceph: support for balanced and localized reads\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nAssisted-by: Codex:GPT-5.4\nSigned-off-by: Zhao Zhang \u003czzhan461@ucr.edu\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReviewed-by: Viacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "e4c804726c4afce3ba648b982d564f6af2cfa328", "tree": "dfc52088fcf8d9b05e910bb8127b15f3814f1fbd", "parents": [ "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0" ], "author": { "name": "Douya Le", "email": "ldy3087146292@gmail.com", "time": "Mon Jun 15 14:31:06 2026 +0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "libceph: remove debugfs files before client teardown\n\nceph_destroy_client() tears down the monitor client before removing\nthe per-client debugfs files. A concurrent read of the monmap debugfs\nfile can enter monmap_show() after ceph_monc_stop() has freed\nmonc-\u003emonmap, triggering a use-after-free.\n\nRemove the debugfs files before stopping the OSD and monitor clients.\ndebugfs_remove() drains active handlers and prevents new accesses, so\nthe debugfs callbacks can no longer race the rest of client teardown.\n\nCc: stable@vger.kernel.org\nFixes: 76aa844d5b2f (\"ceph: debugfs\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nAssisted-by: Codex:GPT-5.4\nSigned-off-by: Douya Le \u003cldy3087146292@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReviewed-by: Viacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0", "tree": "037172b66463501c1465e584ac81bf1371abd83f", "parents": [ "cbf59617cd715219e84c50d106a3d0e1e8ba054e" ], "author": { "name": "Douya Le", "email": "ldy3087146292@gmail.com", "time": "Sun Jun 07 17:35:49 2026 +0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "libceph: bound get_version reply decode to front len\n\nhandle_get_version_reply() uses msg-\u003efront_alloc_len as the decode\nboundary for MON_GET_VERSION_REPLY. That is the size of the reused\nreply buffer, not the number of bytes actually received.\n\nA truncated reply can therefore pass ceph_decode_need() and decode the\nsecond u64 from stale tail bytes left in the buffer by an earlier\nmessage, causing an uninitialized memory read.\n\nUse msg-\u003efront.iov_len as the receive-side decode boundary, matching\nother libceph reply handlers and limiting decoding to the bytes that\nwere actually read from the wire.\n\nCc: stable@vger.kernel.org\nFixes: 513a8243d67f (\"libceph: mon_get_version request infrastructure\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nAssisted-by: Codex:GPT-5.4\nSigned-off-by: Douya Le \u003cldy3087146292@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReviewed-by: Viacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "cbf59617cd715219e84c50d106a3d0e1e8ba054e", "tree": "2375cb25532725085903e18c22aa3e3f2786960d", "parents": [ "a109a556115271ca7896dcda7b4b7e45e156c227" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Thu Jun 04 02:19:51 2026 +0000" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "ceph: fix writeback_count leak in write_folio_nounlock()\n\nwrite_folio_nounlock() increments fsc-\u003ewriteback_count to track\nin-flight writeback operations. On several error paths where the\nfunction returns early (folio lookup failure, snapshot context\nallocation failure, and writepages submission failure), the function\nreturns without calling atomic_long_dec_return() to decrement the\ncounter.\n\nEach leaked increment keeps the counter above zero, which can prevent\nthe filesystem from cleanly unmounting or suspending writes.\n\nAdd atomic_long_dec_return() calls on all error paths that currently\nreturn without decrementing the counter.\n\nCc: stable@vger.kernel.org\nFixes: d55207717ded (\"ceph: add encryption support to writepage and writepages\")\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "a109a556115271ca7896dcda7b4b7e45e156c227", "tree": "6ec6b8d44b9820f7f5f7e7ded3640a0688cd46bf", "parents": [ "4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02" ], "author": { "name": "Pavitra Jha", "email": "jhapavitra98@gmail.com", "time": "Tue Jun 02 00:17:35 2026 -0400" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "libceph: fix two unsafe bare decodes in decode_lockers()\n\ndecode_lockers() in cls_lock_client.c contains two bare decode operations\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds\nreads:\n\n1. ceph_decode_32(p) at the num_lockers field has no preceding bounds\n check. ceph_start_decoding() accepts struct_len\u003d0 as valid -- the\n internal ceph_decode_need(p, end, 0, bad) always passes -- so when an\n OSD sends struct_len\u003d0, ceph_start_decoding() returns success with\n p \u003d\u003d end. The immediately following bare ceph_decode_32(p) then reads\n 4 bytes past the validated buffer boundary. The garbage value is\n passed directly to kzalloc_objs() as the locker count.\n\n The sibling function decode_watchers() in osd_client.c already uses\n ceph_decode_32_safe() after its own ceph_start_decoding() call.\n decode_lockers() was the only site using the bare variant.\n\n2. ceph_decode_8(p) after the decode_locker() loop has no preceding\n bounds check. If an OSD crafts num_lockers such that the loop\n advances p exactly to end, the subsequent bare ceph_decode_8(p) reads\n one byte past the validated buffer boundary. The result is passed\n directly into *type, which is used as a lock type discriminator by\n callers, giving an OSD-controlled one-byte OOB read with direct\n influence over the lock type field.\n\nFix both by replacing bare operations with their safe variants:\n ceph_decode_32(p) -\u003e ceph_decode_32_safe(p, end, *num_lockers,\n err_inval)\n ceph_decode_8(p) -\u003e ceph_decode_8_safe(p, end, *type,\n err_free_lockers)\n\nThe goto targets differ intentionally:\n err_inval: is a new label returning -EINVAL directly. It is used for\n the pre-allocation failure path where *lockers is not yet allocated\n and must not be passed to ceph_free_lockers().\n\n err_free_lockers: is the existing label. It is used for the\n post-allocation failure path where *lockers is allocated and must\n be freed.\n\nret is set to -EINVAL before ceph_decode_8_safe() so that\nerr_free_lockers returns the correct error code on bounds violation.\nWithout this, err_free_lockers would return a stale ret value (0 from\nthe successful decode_locker() loop), silently swallowing the error.\n\n-EINVAL is correct for both failure paths. The data received from the\nOSD is structurally malformed. -ENOMEM would misrepresent the failure\nclass to callers and to stable@ backporters triaging error paths.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).\n\n[ idryomov: trim changelog, formatting ]\n\nCc: stable@vger.kernel.org\nFixes: d4ed4a530562 (\"libceph: support for lock.lock_info\")\nSigned-off-by: Pavitra Jha \u003cjhapavitra98@gmail.com\u003e\nReviewed-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02", "tree": "b14e73191e97a3e1875cf3f089947df941a72bdb", "parents": [ "40480eee361ed9676b3f844d532ac28b47251634" ], "author": { "name": "Bryam Vargas", "email": "hexlabsecurity@proton.me", "time": "Fri May 29 00:37:24 2026 +0000" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:41 2026 +0200" }, "message": "ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n\nceph_handle_caps() reads snap_trace_len from the wire-format\nceph_mds_caps header and uses it unconditionally to build a fake\nend pointer (snaptrace + snaptrace_len) that is later handed to\nceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:\n\n snaptrace \u003d h + 1;\n snaptrace_len \u003d le32_to_cpu(h-\u003esnap_trace_len);\n p \u003d snaptrace + snaptrace_len;\n ...\n case CEPH_CAP_OP_IMPORT:\n if (snaptrace_len) {\n ...\n if (ceph_update_snap_trace(mdsc, snaptrace,\n snaptrace + snaptrace_len,\n false, \u0026realm)) { ... }\n\nceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm\nfrom snaptrace using ceph_decode_need(\u0026p, e, sizeof(*ri), bad)\nwith the attacker-supplied fake end e \u003d\u003d snaptrace + snaptrace_len.\nWith snaptrace_len \u003d\u003d 0xFFFFFFFF the bound check is trivially\nsatisfied, ri \u003d p reads sizeof(struct ceph_mds_snap_realm) past\nthe legitimate msg-\u003efront buffer, and ri-\u003enum_snaps /\nri-\u003enum_prior_parent_snaps then drive further out-of-bounds\nreads of the encoded snap arrays.\n\nThe eleven msg_version \u003e\u003d 2 .. msg_version \u003e\u003d 12 decoder blocks\nabove the op switch each catch this OOB through their\nceph_decode_*_safe() / ceph_decode_need() helpers, but they sit\nbehind a hdr.version-gated if, so a malicious or compromised\nMDS that sets msg-\u003ehdr.version \u003d 1 reaches the IMPORT path with\nno version-gated decoder having validated snap_trace_len. The\nshape has been present since ceph_handle_caps() was introduced.\n\nValidate snap_trace_len against the message front buffer before\nconsuming it, using the canonical ceph_decode_need() / ceph_has_room()\nhelper. The helper bounds the length with subtraction (n \u003c\u003d end - p,\nguarded by end \u003e\u003d p) rather than pointer addition, so it is wrap-safe\nfor the attacker-controlled u32 length on 32-bit builds where\np + snap_trace_len could overflow the address space. This matches the\nrest of the ceph decode path (e.g. the pool_ns_len check a few lines\nbelow), and the existing goto bad cleanup already covers this exit\npath.\n\nCc: stable@vger.kernel.org\nFixes: a8599bd821d0 (\"ceph: capability management\")\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "40480eee361ed9676b3f844d532ac28b47251634", "tree": "425fd7ae8aacb9f85a5a4d44a26608027d680258", "parents": [ "05f90284223381005d6bcddab3fda4a97f9c3401" ], "author": { "name": "Raphael Zimmer", "email": "raphael.zimmer@tu-ilmenau.de", "time": "Fri May 29 09:42:57 2026 +0200" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:40 2026 +0200" }, "message": "libceph: Reject monmaps advertising zero monitors\n\nA message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a\nmonitor to the client. This monmap contains information about the\nexisting monitors in the cluster. Currently, a monmap indicating that\nthere are zero monitors in the cluster is treated as valid. However, it\nis impossible to have zero monitors in the cluster and still receive a\nvalid monmap from a monitor. Therefore, such a monmap must be corrupted\nand should be treated as invalid. Furthermore, a monmap with a monitor\ncount of zero can subsequently crash the client when attempting to open\na session with a monitor in __open_session(). This happens because the\n\"BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1)\" assertion in pick_new_mon() is\ntriggered.\n\nThis patch extends a check in ceph_monmap_decode() to also reject\narriving mon_maps with num_mon \u003d\u003d 0 rather than only with\nnum_mon \u003e CEPH_MAX_MON.\n\n[ idryomov: drop \"log output for unusual values of num_mon\" part ]\n\nCc: stable@vger.kernel.org\nSigned-off-by: Raphael Zimmer \u003craphael.zimmer@tu-ilmenau.de\u003e\nReviewed-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "05f90284223381005d6bcddab3fda4a97f9c3401", "tree": "5bd240603c85e9c1999345b7f9317f51593cef56", "parents": [ "98917a499ec7064c14fc56d180a4fd636fc2784c" ], "author": { "name": "Douya Le", "email": "ldy3087146292@gmail.com", "time": "Fri May 29 16:11:44 2026 +0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:40 2026 +0200" }, "message": "libceph: reject zero bucket types in crush_decode\n\nCRUSH bucket type 0 is reserved for devices. The mapper relies on\nthat invariant and uses type 0 to identify leaf devices.\n\nIf crush_decode() accepts a bucket with type 0, a malformed CRUSH map\ncan make the mapper treat a negative bucket ID as a device and pass it\nto is_out(), which then indexes the OSD weight array with a negative\nvalue.\n\nReject zero bucket types while decoding the CRUSH map so the invalid\nstate never reaches the mapper.\n\nCc: stable@vger.kernel.org\nFixes: f24e9980eb86 (\"ceph: OSD client\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nAssisted-by: Codex:GPT-5.4\nSigned-off-by: Douya Le \u003cldy3087146292@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReviewed-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "98917a499ec7064c14fc56d180a4fd636fc2784c", "tree": "b15b3d4d8aae42db150494587e84a8ec8784c6e2", "parents": [ "1590cf0329716306e948a8fc29f1d3ee87d3989f" ], "author": { "name": "Raphael Zimmer", "email": "raphael.zimmer@tu-ilmenau.de", "time": "Wed May 27 16:06:17 2026 +0200" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Jul 23 20:29:40 2026 +0200" }, "message": "libceph: Fix multiplication overflow in decode_new_up_state_weight()\n\nIf a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted\nosdmap, out-of-bounds memory accesses may occur in\ndecode_new_up_state_weight(). This happens because the bounds check for\nthe new_state part is based on calculating its length depending on a len\nvalue read from the incoming message. This calculation may overflow\nleading to an incorrect bounds check. Subsequently, out-of-bounds reads\nmay occur when decoding this part.\n\nThis patch switches the multiplication to use check_mul_overflow() to\nabort processing the osdmap if an overflow occurred. Therefore,\nosdmaps/messages containing large values for len that result in a\nmultiplication overflow are treated as invalid.\n\n[ idryomov: rename new_state_len -\u003e new_state_item_size, formatting ]\n\nCc: stable@vger.kernel.org\nFixes: 930c53286977 (\"libceph: apply new_state before new_up_client on incrementals\")\nSigned-off-by: Raphael Zimmer \u003craphael.zimmer@tu-ilmenau.de\u003e\nReviewed-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "6a8da869fa338e008533dd6385a0eb35dee6acf4", "tree": "fbb9ba05adfee82280aafd2d27c891dcc6e3ce81", "parents": [ "5e9c8baee0329fbefe7c67aea945e2a07f15e98b", "fd098a23bf8fda7eae48db9b06e7c34fc4d228fa" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:03 2026 -0700" }, "message": "Merge branch \u0027drop_monitor-take-care-of-32bit-kernels\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndrop_monitor: take care of 32bit kernels\n\nThis series fixes two drop_monitor issues on 32-bit architectures:\n\n- Patch 1 uses nla_total_size_64bit() for PC and TIMESTAMP attributes to\n account for alignment padding added by nla_put_u64_64bit(), avoiding\n potential skb_over_panic() crashes.\n\n- Patch 2 moves u64_stats updates before spin_unlock_irqrestore(), ensuring\n local interrupts are disabled to prevent seqcount corruption from nested\n interrupts in probe context.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260722141743.3266924-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd098a23bf8fda7eae48db9b06e7c34fc4d228fa", "tree": "fbb9ba05adfee82280aafd2d27c891dcc6e3ce81", "parents": [ "7089f7ab99c89f443c92d8fcc585e63f2727f0b3" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jul 22 14:17:43 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:01 2026 -0700" }, "message": "drop_monitor: perform u64_stats updates under IRQ-disabled section\n\nIn net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),\nu64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were\ncalled after spin_unlock_irqrestore(\u0026...drop_queue.lock, flags), when local\nIRQs had already been re-enabled.\n\nTracepoint probes can execute in IRQ or softirq context. On 32-bit\narchitectures, u64_stats_update_begin() disables preemption but not interrupts,\nrelying on seqcount writes. If a nested interrupt occurs on the same CPU during\nthe 64-bit stats update, the reentrant seqcount update can corrupt the\nseqcount state or stats value.\n\nFix this by performing the 64-bit per-CPU stats update before releasing\ndrop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain\ndisabled during the u64_stats update.\n\nFixes: e9feb58020f9 (\"drop_monitor: Expose tail drop counter\")\nFixes: 5e58109b1ea4 (\"drop_monitor: Add support for packet alert mode for hardware drops\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260722141743.3266924-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7089f7ab99c89f443c92d8fcc585e63f2727f0b3", "tree": "badd342b1c0a7a457ba8c8343d549b74e49738d0", "parents": [ "5e9c8baee0329fbefe7c67aea945e2a07f15e98b" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jul 22 14:17:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:01 2026 -0700" }, "message": "drop_monitor: fix size calculations for 64-bit attributes\n\nnet_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use\nnla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and\nNET_DM_ATTR_TIMESTAMP).\n\nOn 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS,\nnla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for\n64-bit alignment.\n\nHowever, net_dm_packet_report_size() and net_dm_hw_packet_report_size()\nused nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)),\nbudgeting 12 bytes instead of up to 16 bytes.\n\nThis under-estimation of SKB size can lead to an skb_over_panic() when\n__nla_reserve() or skb_put() is subsequently called.\n\nFix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations.\n\nFixes: ca30707dee2b (\"drop_monitor: Add packet alert mode\")\nFixes: 5e58109b1ea4 (\"drop_monitor: Add support for packet alert mode for hardware drops\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260722141743.3266924-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e9c8baee0329fbefe7c67aea945e2a07f15e98b", "tree": "617ce3f8766920e56029663c1cbfce334f3ebd52", "parents": [ "1d4da823b75e5774161951764cbad75cb6e6a75f" ], "author": { "name": "Yehyeong Lee", "email": "yhlee@isslab.korea.ac.kr", "time": "Wed Jul 22 21:28:17 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:59:27 2026 -0700" }, "message": "net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD\n\nnet_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code\nthe NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload\nbefore overwriting it with skb_copy_bits().\n\nskb_put() reserves nla_total_size(payload_len), i.e. the header plus the\nNLA_ALIGN() padding, but only payload_len bytes are copied in. When\npayload_len is not a multiple of 4 the 1-3 padding bytes are never\ninitialized and are leaked to user space inside the netlink message.\n\nKMSAN confirms the leak for the software path when the packet payload\nlength is not 4-byte aligned:\n\n BUG: KMSAN: kernel-infoleak in _copy_to_iter\n _copy_to_iter\n __skb_datagram_iter\n skb_copy_datagram_iter\n netlink_recvmsg\n sock_recvmsg\n __sys_recvfrom\n Uninit was created at:\n kmem_cache_alloc_node_noprof\n __alloc_skb\n net_dm_packet_work\n Bytes 173-175 of 176 are uninitialized\n\nUse __nla_reserve(), which sets up the attribute header and zeroes the\npadding, instead of open coding the attribute construction.\n\nFixes: ca30707dee2b (\"drop_monitor: Add packet alert mode\")\nFixes: 5e58109b1ea4 (\"drop_monitor: Add support for packet alert mode for hardware drops\")\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nLink: https://patch.msgid.link/20260722122817.5548-1-yhlee@isslab.korea.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d4da823b75e5774161951764cbad75cb6e6a75f", "tree": "fdbe4543535b4b67c1475aff224f3f2882ef0537", "parents": [ "234e5e898b713bc0b3a631b6f002897f43d046c8", "133cca19d75b9264bc2bbcdf2c3b80e3da207649" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:43 2026 -0700" }, "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-2-rc5\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.2-rc5\n\nHere are various unrelated fixes:\n\n- Patch 1: decrement extra subflows counter in case of errors with\n passive MP_JOIN. A fix for v5.7.\n\n- Patch 2: fix use-after-free in userspace_pm_get_local_id. A fix for\n v5.19.\n\n- Patch 3: fix stale skb-\u003esk reference on subflow close, in case of\n concurrent read operation. A fix for v6.19.\n\n- Patch 4: wait on the correct port in the userspace_pm.sh selftest. A\n fix for v6.19.\n\n- Patch 5: fix a BUILD_BUG_ON on legacy ARM config. A fix for v7.1.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-0-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "133cca19d75b9264bc2bbcdf2c3b80e3da207649", "tree": "fdbe4543535b4b67c1475aff224f3f2882ef0537", "parents": [ "e3213292c4fd69ba442c6ed4693f91a92b753140" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Wed Jul 22 00:14:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: fix BUILD_BUG_ON on legacy ARM config\n\nThe 0-day bot managed to find kernel configs that cause build failures,\ne.g. when using the StrongARM SA1100 target (ARMv4).\n\nOn such legacy ARM architecture, all structures are apparently aligned\nto 32 bits, causing build issue here. Indeed, on such architecture,\n\u0027flags\u0027 size is not equivalent to sizeof(u16) as expected, but to\nsizeof(u32).\n\nInstead, use memset(). It was not used before to ensure a simple clear\noperation was used by the compiler. But at the end, it shouldn\u0027t matter,\nand the compiler should optimise this to the same operation with or\nwithout memset() when -O above 0 is used. So let\u0027s switch to memset() to\nfix this issue, and reduce this complexity.\n\nFixes: 5e939544f9d2 (\"mptcp: fix uninit-value in mptcp_established_options\")\nCc: stable@vger.kernel.org\nSuggested-by: Frank Ranner \u003cfrank.ranner@intel.com\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605312026.Srgsz7Tp-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202607031100.upQfRZTM-lkp@intel.com/\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-5-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e3213292c4fd69ba442c6ed4693f91a92b753140", "tree": "f345b83f7701ef06785d58f658687e4067ef73d0", "parents": [ "bd7aae448f6ee9d82599a4474664de1e6e91a535" ], "author": { "name": "Geliang Tang", "email": "tanggeliang@kylinos.cn", "time": "Wed Jul 22 00:14:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "selftests: mptcp: userspace_pm: fix undefined variable port\n\nIn make_connection(), the variable \"port\" is used but never defined.\nThis leads to an empty argument being passed to wait_local_port_listen(),\ncausing \"printf: : invalid number\" errors:\n\n # INFO: Init\n # 01 Created network namespaces ns1, ns2 [ OK ]\n # INFO: Make connections\n # ./../lib.sh: line 651: printf: : invalid number\n # 02 Established IPv4 MPTCP Connection ns2 \u003d\u003e ns1 [ OK ]\n # INFO: Connection info: 10.0.1.2:59516 -\u003e 10.0.1.1:50002\n # ./../lib.sh: line 651: printf: : invalid number\n # 03 Established IPv6 MPTCP Connection ns2 \u003d\u003e ns1 [ OK ]\n\nFix it by using the correctly defined variable \"app_port\", which holds the\nappropriate port number for the connection.\n\nFixes: 39348f5f2f13 (\"selftests: mptcp: wait for port instead of sleep\")\nCc: stable@vger.kernel.org\nSigned-off-by: Geliang Tang \u003ctanggeliang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-4-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bd7aae448f6ee9d82599a4474664de1e6e91a535", "tree": "87fd06feade549ff5b90d9a64b7950c6f9e93dc8", "parents": [ "9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9" ], "author": { "name": "Kalpan Jani", "email": "kalpan.jani@mpiricsoftware.com", "time": "Wed Jul 22 00:14:40 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: fix stale skb-\u003esk reference on subflow close\n\nThe backlog list is updated by mptcp_data_ready() under\nmptcp_data_lock(). The cleanup of backlog references to a closing\nsubflow, however, was performed in mptcp_close_ssk(), before\n__mptcp_close_ssk() acquires the ssk lock, and while holding neither\nthe ssk lock nor mptcp_data_lock().\n\nBecause that traversal ran without mptcp_data_lock(), concurrent softirq\nRX processing on another CPU (subflow_data_ready() -\u003e mptcp_data_ready()\n-\u003e __mptcp_add_backlog(), under mptcp_data_lock()) could add a backlog\nentry referencing the ssk while the cleanup loop was in progress. Such\nan entry could be missed by the cleanup, or the concurrent list update\ncould corrupt the traversal, leaving skb-\u003esk pointing at the ssk after\nit is freed.\n\nA later mptcp_backlog_purge() then dereferences the stale pointer,\ntriggering a warning in inet_sock_destruct() (ssk-\u003esk_rmem_alloc !\u003d 0)\nfollowed by a use-after-free in mptcp_backlog_purge().\n\nFix this by moving the backlog cleanup into __mptcp_close_ssk(), after\nsubflow-\u003eclosing is set to 1 and while the ssk lock is still held,\nserialized under mptcp_data_lock(). The cleanup runs only on the push\npath (MPTCP_CF_PUSH), where backlog references accumulate; on other\nteardown paths the caller already handles cleanup.\n\nWith subflow-\u003eclosing set and mptcp_data_lock() held across the purge,\nany concurrent mptcp_data_ready() either completes its enqueue before\nthe purge runs and is caught, or observes closing\u003d1 and bails out. Once\nmptcp_data_unlock() is reached, no new skb referencing the ssk can be\nenqueued, so the cleanup is exhaustive.\n\nRemove the unprotected traversal from mptcp_close_ssk() entirely.\n\nFixes: ee458a3f314e (\"mptcp: introduce mptcp-level backlog\")\nCc: stable@vger.kernel.org\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReported-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nCloses: https://github.com/multipath-tcp/mptcp_net-next/issues/621\nSigned-off-by: Kalpan Jani \u003ckalpan.jani@mpiricsoftware.com\u003e\nAcked-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-3-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9", "tree": "3d851bdb197d478d4d3d8177ab2c1896671e1821", "parents": [ "f3ca0ee2cc308e33896536789cbc5f3a12ca7b30" ], "author": { "name": "Geliang Tang", "email": "tanggeliang@kylinos.cn", "time": "Wed Jul 22 00:14:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: pm: userspace: fix use-after-free in get_local_id\n\nIn mptcp_pm_userspace_get_local_id(), the address entry is looked up under\nspinlock, but its id is read after dropping the lock. A concurrent deletion\ncan free the entry between the unlock and the read, leading to UAF.\n\nThe race window is narrow. It was reproduced only with a locally\nconstructed stress test that repeatedly overlaps an MP_JOIN SYN with a\nMPTCP_PM_CMD_SUBFLOW_DESTROY request.\n\nHowever, the KASAN report below confirms that the race is reachable:\n\n [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0\n ...\n [ 666.319401] Call Trace:\n [ 666.319405] \u003cIRQ\u003e\n [ 666.319408] dump_stack_lvl+0x53/0x70\n [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0\n [ 666.319418] print_report+0xbe/0x2b0\n [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319423] kasan_report+0xce/0x100\n [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319433] mptcp_pm_get_local_id+0x371/0x440\n ...\n [ 666.319821] Allocated by task 45539:\n [ 666.319844] kasan_save_stack+0x33/0x60\n [ 666.319855] kasan_save_track+0x14/0x30\n [ 666.319858] __kasan_kmalloc+0x8f/0xa0\n [ 666.319863] __kmalloc_noprof+0x1e7/0x520\n [ 666.319867] sock_kmalloc+0xdf/0x130\n [ 666.319885] sock_kmemdup+0x1b/0x40\n [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500\n [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610\n ...\n [ 666.319967] Freed by task 45560:\n [ 666.319988] kasan_save_stack+0x33/0x60\n [ 666.319991] kasan_save_track+0x14/0x30\n [ 666.319994] kasan_save_free_info+0x3b/0x60\n [ 666.319998] __kasan_slab_free+0x43/0x70\n [ 666.320000] kfree+0x166/0x440\n [ 666.320003] sock_kfree_s+0x1d/0x50\n [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200\n [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0\n\nFix by copying the id into a local variable while still holding the lock,\nand use -1 as a \"not found\" sentinel.\n\nFixes: f012d796a6de (\"mptcp: check addrs list in userspace_pm_get_local_id\")\nCc: stable@vger.kernel.org\nSigned-off-by: Geliang Tang \u003ctanggeliang@kylinos.cn\u003e\nTested-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-2-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f3ca0ee2cc308e33896536789cbc5f3a12ca7b30", "tree": "6ed6a04506189cba88aff8d4f7850f89386a1c7d", "parents": [ "234e5e898b713bc0b3a631b6f002897f43d046c8" ], "author": { "name": "Chenguang Zhao", "email": "zhaochenguang@kylinos.cn", "time": "Wed Jul 22 00:14:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: decrement subflows counter on failed passive join\n\nmptcp_pm_allow_new_subflow() increments extra_subflows before\n__mptcp_finish_join() on the passive MP_JOIN path.\n\nIn case of race conditions, the subflow is dropped without calling\nmptcp_close_ssk(), so the counter is not rolled back.\n\nCall mptcp_pm_close_subflow() when the join completion fails to\ndecrement the subflows counter.\n\nFixes: 10f6d46c943d (\"mptcp: fix race between MP_JOIN and close\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chenguang Zhao \u003czhaochenguang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-1-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "234e5e898b713bc0b3a631b6f002897f43d046c8", "tree": "b416ca77899021979c74b2c3d78d2d0f4abed90f", "parents": [ "9b2854f86f0b56e9027d68e7a3fc909d1a9b566f" ], "author": { "name": "Ibrahim Hashimov", "email": "security@auditcode.ai", "time": "Tue Jul 21 23:12:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:37:46 2026 -0700" }, "message": "mac802154: hold an interface reference across the scan worker\n\nmac802154_scan_worker() captures the scanning sub-interface under RCU\nand then keeps dereferencing sdata-\u003edev after rcu_read_unlock() and\noutside the rtnl -- in the failure traces, in\nmac802154_transmit_beacon_req() (skb-\u003edev \u003d sdata-\u003edev), and in the\nend_scan cleanup. Nothing keeps that netdev alive across the worker\niteration.\n\nA concurrent DEL_INTERFACE or PHY removal can unregister the interface\nonce the worker drops the rtnl between its two drv_set_channel()\nsections. unregister_netdevice() frees the netdev asynchronously from\nnetdev_run_todo() with the rtnl already dropped, so neither holding the\nrtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker\niteration from dereferencing the freed netdev -- a KASAN\nslab-use-after-free, reachable by racing TRIGGER_SCAN against\nDEL_INTERFACE (both CAP_NET_ADMIN).\n\nPin the netdev with netdev_hold() while the RCU read lock is still held,\nand release it at every worker exit.\n\nFixes: 57588c71177f (\"mac802154: Handle passive scanning\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ibrahim Hashimov \u003csecurity@auditcode.ai\u003e\nLink: https://patch.msgid.link/20260721211228.34578-1-security@auditcode.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9b2854f86f0b56e9027d68e7a3fc909d1a9b566f", "tree": "9d8edf124075510f367841cec3a4730d0ee63fb1", "parents": [ "d1ff66b66151c14b084e88040512a064b1c1e493" ], "author": { "name": "Jun Yang", "email": "junvyyang@tencent.com", "time": "Tue Jul 21 21:14:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:30:31 2026 -0700" }, "message": "sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf-\u003etransport (\u003d\u003d chunk-\u003etransport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet\u0027s source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-\u003etransport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf-\u003etransport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf-\u003etransport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (-\u003eipaddr, -\u003estate) and plants the dangling pointer into\nasoc-\u003epeer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport.\n\nFixes: 42e30bf3463c (\"[SCTP]: Handle the wildcard ADD-IP Address parameter\")\nCc: stable@kernel.org\nSigned-off-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/tencent_73762ED1DF08CC9D5F5F61954B01350CFE0A@qq.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d1ff66b66151c14b084e88040512a064b1c1e493", "tree": "28518904cf215b0baa7b2cc54bedd04d5b580236", "parents": [ "0f71f852a96af9685858ce59fda34ecbf85c283d" ], "author": { "name": "Minhong He", "email": "heminhong@kylinos.cn", "time": "Tue Jul 21 17:39:56 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:28:50 2026 -0700" }, "message": "phonet: check register_netdevice_notifier() error in phonet_device_init()\n\nphonet_device_init() registers a netdevice notifier before calling\nphonet_netlink_register(), but does not check whether notifier\nregistration succeeded. On failure, netlink setup still proceeds and\ninit may return success without the notifier in place.\n\nAlso, the existing phonet_netlink_register() failure path called\nphonet_device_exit(), which runs rtnl_unregister_all() even though\nrtnl_register_many() already unwound any partial registration. Calling\nthe full exit helper on a partial init is not correct.\n\nCheck each registration error, including proc_create_net(), and unwind\nonly the steps that have succeeded so far, in reverse order.\n\nSigned-off-by: Minhong He \u003cheminhong@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260721093956.162617-1-heminhong@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0f71f852a96af9685858ce59fda34ecbf85c283d", "tree": "6256457ebb1b470c4264fd4fc52c0bba53b38560", "parents": [ "b9e558976bb968162c35ddccdb076a77fc906993" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Jul 21 01:58:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:27:08 2026 -0700" }, "message": "phonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn\u0027t consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one.\n\nFixes: 9641458d3ec4 (\"Phonet: Pipe End Point for Phonet Pipes protocol\")\nCc: stable@vger.kernel.org\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260721-phonet_get_sb_uaf-v1-1-95fd7881cc4e@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b9e558976bb968162c35ddccdb076a77fc906993", "tree": "7e92d71d8695da996bea8b2a695d4f510570a0dd", "parents": [ "47f42ff521b4eeb46e82f9a46a4783a99f7570d7" ], "author": { "name": "Vikas Gupta", "email": "vikas.gupta@broadcom.com", "time": "Tue Jul 21 12:07:31 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:24:12 2026 -0700" }, "message": "bnge/bng_re: fix ring ID widths\n\nFirmware requires more than 16 bits to address TX ring IDs for its\ninternal QP management. Widen the associated HSI ring ID fields to\n32 bits. The values firmware assigns remain within 24 bits, bounded\nby the hardware doorbell XID field.\n\nThe fw_ring_id field belongs to bnge_ring_struct, a common struct\nshared by all ring types, so widening it to u32 applies uniformly\nacross TX, RX, CP, and NQ rings but firmware assigns values within\n16-bit range for all ring types except TX, which requires the wider\nfield.\n\nNote that, Thor Ultra hardware has not yet been deployed and no\nfirmware has been released to field, so backward compatibility\nis not a concern.\n\nFixes: 42d1c54d6248 (\"bnge/bng_re: Add a new HSI\")\nSigned-off-by: Vikas Gupta \u003cvikas.gupta@broadcom.com\u003e\nReviewed-by: Siva Reddy Kallam \u003csiva.kallam@broadcom.com\u003e\nReviewed-by: Dharmender Garg \u003cdharmender.garg@broadcom.com\u003e\nReviewed-by: Yendapally Reddy Dhananjaya Reddy \u003cyendapally.reddy@broadcom.com\u003e\nLink: https://patch.msgid.link/20260721063731.2622500-1-vikas.gupta@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "47f42ff521b4eeb46e82f9a46a4783a99f7570d7", "tree": "c76579e951c78d59f68a851b890a0ceca2b40a76", "parents": [ "d73a2e81f3cf6d870ef59a94f7e30880f4ee56e3" ], "author": { "name": "Cen Zhang (Microsoft)", "email": "blbllhy@gmail.com", "time": "Mon Jul 20 17:41:03 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:11:48 2026 -0700" }, "message": "tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()\n\nIn tipc_recvmsg(), the copy length is computed as:\n\n copy \u003d min_t(int, dlen - offset, buflen);\n\nbuflen is size_t but min_t(int, ...) casts it to int. When buflen\nexceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it\nwraps negative, wins the comparison, and the negative copy length\npropagates to simple_copy_to_iter() where int-to-size_t promotion\nmakes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the\nsame pattern.\n\n Kernel panic - not syncing: kernel: panic_on_warn set ...\n RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)\n Call Trace:\n __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)\n skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)\n tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)\n io_recvmsg+0x47e/0xda0\n\nFix by changing min_t(int, ...) to min_t(size_t, ...) in both\nfunctions. The result is always \u003c\u003d (dlen - offset), which is bounded\nby TIPC maximum message size (0x1ffff bytes), so the implicit\nnarrowing on assignment to int copy is always safe.\n\nFixes: e9f8b10101c6 (\"tipc: refactor function tipc_sk_recvmsg()\")\nFixes: ec8a09fbbeff (\"tipc: refactor function tipc_sk_recv_stream()\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nSigned-off-by: Cen Zhang (Microsoft) \u003cblbllhy@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260720214103.47732-1-blbllhy@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d73a2e81f3cf6d870ef59a94f7e30880f4ee56e3", "tree": "5bdc5ec8380779e5751ac9c54db92910955fe94d", "parents": [ "649ea07fc25a17aa51bff710baac1ab161022a7c", "f7e6287ccd3abeed9e638b581dc3fdf742106ba3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:04:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:04:17 2026 -0700" }, "message": "Merge tag \u0027ovpn-net-20260720\u0027 of https://github.com/OpenVPN/ovpn-net-next\n\nAntonio Quartulli says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIncluded fixes:\n* ensure keepalive timestamps are computed using monotonic source\n* avoid UAF in unlock_ovpn() when iterating over release_list\n* fix memleak in selftest tool\n* ensure reference to peer is acquired before scheduling worker\n (which may drop the not-yet-taken ref)\n* fix refcount leak in case of concurrent TX and RX TCP error\n* fix potential refcount unbalance in case of sock release in\n P2P mode\n\n* tag \u0027ovpn-net-20260720\u0027 of https://github.com/OpenVPN/ovpn-net-next:\n ovpn: use monotonic clock for peer keepalive timeouts\n ovpn: fix use after free in unlock_ovpn()\n selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()\n ovpn: hold peer before scheduling keepalive work\n ovpn: fix peer refcount leak in TCP error paths\n ovpn: avoid putting unrelated P2P peer on socket release\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260720144131.3657121-1-antonio@openvpn.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "649ea07fc25a17aa51bff710baac1ab161022a7c", "tree": "87387ec121b47c93ba257ffc9dbb81c8b610117d", "parents": [ "d9a33cadc70a94c1582f65e6042e81027cd200c6" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Mon Jul 20 13:22:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:02:59 2026 -0700" }, "message": "net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()\n\nDerive the hardware QoS channel from opt-\u003eparent instead of opt-\u003ehandle\nin airoha_tc_setup_qdisc_ets(). The ETS qdisc handle is either\nuser-specified or auto-allocated by qdisc_alloc_handle() and bears no\nrelation to the HTB leaf classid that identifies the hardware channel.\nHTB derives the channel from TC_H_MIN(opt-\u003eclassid), and ETS is always\nattached as a child of an HTB leaf, so its opt-\u003eparent matches that\nclassid. Using opt-\u003ehandle instead can cause two ETS qdiscs on different\nHTB leaves to collide on the same hardware channel, corrupting scheduler\nconfiguration and stats.\n\nFixes: 20bf7d07c956 (\"net: airoha: Add sched ETS offload support\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260720-airoha-ets-handle-fix-v2-1-6f7129ddc06f@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c1d87e724ae55e781b7cc7ccafb34d9e668582b2", "tree": "b45308acf81c86c21291a7e8b0e62aa684878253", "parents": [ "655111f878a455f724e20122929cf2afa52b76e4" ], "author": { "name": "deepakraog", "email": "gaikwad.dcg@gmail.com", "time": "Wed Jul 15 20:06:04 2026 +0530" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Jul 23 12:30:07 2026 -0400" }, "message": "tracing: Fix resource leak on mmiotrace trace_pipe close\n\nThe mmiotrace tracer was added May 12th 2008. At that time, resources\ncreated in pipe_open() could not be freed because there was not\npipe_close function pointer of the tracer. The pipe_close function pointer\nwas added in December 7th, 2009, but the mmiotrace tracer was not updated.\n\nmmio_pipe_open() allocates a header_iter and takes a pci_dev reference\nwhen trace_pipe is opened. mmio_close() frees them, but it was only\nwired to the tracer\u0027s .close callback.\n\ntracing_release_pipe() invokes .pipe_close, not .close, when the\ntrace_pipe file is released. As a result, closing trace_pipe with the\nmmiotrace tracer active leaked the header_iter allocation and left a\nstale pci_dev reference.\n\nSet .pipe_close to mmio_close, matching how function_graph wires both\ncallbacks to the same handler.\n\nNote, if the trace_pipe is read to completion, it will clean up the\nresources, but if one were to run:\n\n # head -n 1 /sys/kernel/tracing/trace_pipe\n VERSION 20070824\n\nOver and over again, it would trigger a massive leak.\n\nCc: stable@vger.kernel.org\nFixes: c521efd1700a8 (\"tracing: Add pipe_close interface)\nLink: https://patch.msgid.link/20260715143604.14481-1-gaikwad.dcg@gmail.com\nSigned-off-by: deepakraog \u003cgaikwad.dcg@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "655111f878a455f724e20122929cf2afa52b76e4", "tree": "72f4d63cc3afbb0eec24f28909431804c938224a", "parents": [ "94b83ff0c0a69e42f403b59918529fbca2a89daf" ], "author": { "name": "Jackie Liu", "email": "liuyun01@kylinos.cn", "time": "Wed Jul 15 15:44:55 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Jul 23 12:30:07 2026 -0400" }, "message": "tracing: Propagate errors from remote event bulk updates\n\nremote_events_dir_enable_write() ignores the return value from\ntrace_remote_enable_event(). If a remote rejects an event state change,\nthe write therefore reports success even though the affected event remains\nin its previous state.\n\nKeep trying all events, but retain and return the first error. This matches\n__ftrace_set_clr_event_nolock(), which permits partial updates while\nnotifying userspace when an operation fails.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260715074455.3897-1-liu.yun@linux.dev\nFixes: 775cb093bc50 (\"tracing: Add events/ root files to trace remotes\")\nAssisted-by: Codex:gpt-5.6-sol\nSigned-off-by: Jackie Liu \u003cliuyun01@kylinos.cn\u003e\nReviewed-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d9a33cadc70a94c1582f65e6042e81027cd200c6", "tree": "da4c9b3839676e4c7f350248e864c97d26e36e77", "parents": [ "c3f2fc231a39e29fe9f0adc14a3ecc3c1260d3c5" ], "author": { "name": "Minhong He", "email": "heminhong@kylinos.cn", "time": "Mon Jul 20 15:25:18 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:17:36 2026 -0700" }, "message": "mctp: check register_netdevice_notifier() error in mctp_device_init()\n\nmctp_device_init() handles errors from rtnl_af_register() and\nrtnl_register_many(), but ignores the return value of\nregister_netdevice_notifier(). If notifier registration fails, init can\nstill return success while the module is only partially initialized.\n\nCheck the notifier registration error and fail module init early.\n\nFixes: 583be982d934 (\"mctp: Add device handling and netlink interface\")\nSigned-off-by: Minhong He \u003cheminhong@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260720072518.112614-1-heminhong@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c3f2fc231a39e29fe9f0adc14a3ecc3c1260d3c5", "tree": "c835b85181a334b203c942f0be6be5722e9b76f9", "parents": [ "167e54c703ccd4fa028feb568b0d1002020cff86" ], "author": { "name": "Clark Wang", "email": "xiaoning.wang@nxp.com", "time": "Mon Jul 20 09:25:08 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:16:14 2026 -0700" }, "message": "ptp: netc: explicitly clear TMR_OFF during initialization\n\nThe NETC timer does not support function level reset, so TMR_OFF_L/H\nregisters are not cleared by pcie_flr(). If TMR_OFF was set to a\nnon-zero value in a previous binding, it will persist across driver\nrebind and cause inaccurate PTP time.\n\nThere is also a hardware issue: after a warm reset or soft reset,\nTMR_OFF_L/H registers appear to be cleared to zero, but the timer clock\ndomain internally retains the stale value. When the timer is re-enabled,\nTMR_CUR_TIME continues to track the old offset until TMR_OFF is written\nexplicitly. This can cause incorrect PTP timestamps and even PTP clock\nsynchronization failures.\n\nPer the recommendation from the IP team, explicitly write 0 to TMR_OFF\nin netc_timer_init() to flush the internally cached value and ensure\nTMR_CUR_TIME follows the freshly initialized counter.\n\nFixes: 87a201d59963 (\"ptp: netc: add NETC V4 Timer PTP driver support\")\nSigned-off-by: Clark Wang \u003cxiaoning.wang@nxp.com\u003e\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260720012508.23227-1-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "167e54c703ccd4fa028feb568b0d1002020cff86", "tree": "9b0a07bc981d59df701e889ecb09572cbd219857", "parents": [ "313a123e1fca8827bb463db1f4bb211309764563" ], "author": { "name": "Cen Zhang (Microsoft)", "email": "blbllhy@gmail.com", "time": "Sun Jul 19 17:03:57 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:15:20 2026 -0700" }, "message": "rds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn-\u003erds_tcp_listen_sock-\u003esk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\n\nKASAN reports the race as:\n\n BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\n rds_tcp_skbuf_handler net/rds/tcp.c:721\n proc_sys_call_handler fs/proc/proc_sysctl.c\n vfs_write fs/read_write.c\n __x64_sys_pwrite64 fs/read_write.c\n\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer.\n\nFixes: 7f5611cbc487 (\"rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current-\u003ensproxy\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nLink: https://lore.kernel.org/all/20260719203718.9680-1-blbllhy@gmail.com\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nSigned-off-by: Cen Zhang (Microsoft) \u003cblbllhy@gmail.com\u003e\nLink: https://patch.msgid.link/20260719210357.10179-1-blbllhy@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "313a123e1fca8827bb463db1f4bb211309764563", "tree": "3df73ba2fa8bbc912b9542b716592972b8791028", "parents": [ "ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d" ], "author": { "name": "Nikola Z. Ivanov", "email": "zlatistiv@gmail.com", "time": "Sun Jul 19 13:57:59 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:13:13 2026 -0700" }, "message": "ipv6: Change allocation flags to match rcu_read_lock section requirements\n\nSince the call to __ip6_del_rt_siblings has been converted under\nrcu read lock and it only has one call point\nwe should no longer block or yield.\n\nOur stack trace from the syzbot reproducer looks as follows:\n\n__ip6_del_rt_siblings\n rtnl_notify (Here we pass gfp_any() -\u003e GFP_KERNEL)\n nlmsg_notify\n nlmsg_multicast\n nlmsg_multicast_filtered\n netlink_broadcast_filtered (GFP_KERNEL passed from earlier)\n\nnetlink_broadcast_filtered can yield if GFP_KERNEL\nis passed, which we do not want to happen.\n\nFix this by changing the allocation flag of rtnl_notify.\n\nAlso change the flag passed to nlmsg_new. Even though it\nis not related to the syzbot generated bug it still falls\nunder the same requirements.\n\nReported-by: syzbot+84d4a405ed798b40c96d@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d84d4a405ed798b40c96d\nFixes: bd11ff421d36 (\"ipv6: Get rid of RTNL for SIOCDELRT and RTM_DELROUTE.\")\nSigned-off-by: Nikola Z. Ivanov \u003czlatistiv@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260719105759.558050-1-zlatistiv@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d", "tree": "d586b6a6f169463a837280fdeefed542c38e9d3b", "parents": [ "7fd55911fdb13d280133a10f41cc214df1021fc2" ], "author": { "name": "Sungmin Kang", "email": "726ksm@gmail.com", "time": "Sat Jul 18 16:36:30 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:06:48 2026 -0700" }, "message": "net: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl-\u003elock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl-\u003elock\nwhile consuming each receive batch.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sungmin Kang \u003c726ksm@gmail.com\u003e\nLink: https://patch.msgid.link/20260718073631.1674-1-726ksm@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7fd55911fdb13d280133a10f41cc214df1021fc2", "tree": "3934c3bb26dbe258b9c448e0919440222e5703b9", "parents": [ "440e274da4d1b93c7df2cb0ce893c3009dd4db55", "237f1f7653b8729169af11fae79f01b90d00b87e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:51 2026 -0700" }, "message": "Merge branch \u0027intel-wired-lan-driver-updates-2026-07-17-ice-idpf-iavf\u0027\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-07-17 (ice, idpf) [part]\n\nFor ice:\nVincent Chen fixes issue preventing VF creation when switchdev is not\nenabled in the configuration.\n\nMarcin corrects iteration value for profile association that was\ntruncating profiles.\n\nKarol bypasses, unnecessary, waiting on sideband queue PTP writes which\ncan cause failures with phc_ctl program.\n\nSergey adds READ_ONCE() to access of PHC time to prevent torn read on\n32-bit systems.\n\nPaul adds a check for uninitialized PTP state before attempting to\nrebuild it and restricts check of TxTime to be for PF VSI only.\n\nAlex adds bounds check on PTYPE to prevent possible out-of-bounds write.\n\nFor idpf:\nEmil defers setting of adapter max_vports value to prevent inadvertent\nuse if interim allocation errors are encountered.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260717185340.3595286-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "237f1f7653b8729169af11fae79f01b90d00b87e", "tree": "3934c3bb26dbe258b9c448e0919440222e5703b9", "parents": [ "59abb87159c53605c063f6e2ceb215b5eba43ee6" ], "author": { "name": "Emil Tantilov", "email": "emil.s.tantilov@intel.com", "time": "Fri Jul 17 11:53:34 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "idpf: fix max_vport related crash on allocation error during init\n\nSet adapter-\u003emax_vports only after successful allocation of vports, netdevs\nand vport_config buffers. This fixes possible crashes on reset or rmmod,\nfollowing failed allocation on init\n\n[ 305.981402] idpf 0000:83:00.0: enabling device (0100 -\u003e 0102)\n[ 305.994464] idpf 0000:83:00.0: Device HW Reset initiated\n[ 320.416872] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 320.416918] #PF: supervisor read access in kernel mode\n[ 320.416942] #PF: error_code(0x0000) - not-present page\n[ 320.416963] PGD 2099657067 P4D 0\n[ 320.416983] Oops: Oops: 0000 [#1] SMP NOPTI\n...\n[ 320.417093] RIP: 0010:idpf_remove+0x118/0x200 [idpf]\n[ 320.417130] Code: 8b bb 98 09 00 00 e8 17 0f 5b e5 48 8b bb e8 08 00 00 e8 0b 0f 5b e5 66 83 bb 28 06 00 00 00 48 8b bb 20 06 00 00 74 49 31 ed \u003c48\u003e 8b 04 ef 48 85 c0 74 2f 48 8b 78 20 e8 66 58 91 e5 48 8b 83 20\n[ 320.417183] RSP: 0018:ff7322212903fdb8 EFLAGS: 00010246\n[ 320.417205] RAX: 0000000000000000 RBX: ff4463de40300000 RCX: ff7322212903fd4c\n[ 320.417228] RDX: 0000000000000001 RSI: ffffffffa7f7d100 RDI: 0000000000000000\n[ 320.417250] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n[ 320.417272] R10: 0000000000000001 R11: ff4463de3a638f58 R12: ff4463be89ac7000\n[ 320.417294] R13: ff4463be89ac7198 R14: ff4463be94fc7198 R15: ffffffffc0f10f20\n[ 320.417317] FS: 00007f963c0e6740(0000) GS:ff4463fdd65d8000(0000) knlGS:0000000000000000\n[ 320.417342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 320.417362] CR2: 0000000000000000 CR3: 00000020ba674002 CR4: 0000000000773ef0\n[ 320.417385] PKRU: 55555554\n[ 320.417398] Call Trace:\n[ 320.417412] \u003cTASK\u003e\n[ 320.417429] pci_device_remove+0x42/0xb0\n[ 320.417459] device_release_driver_internal+0x1a9/0x210\n[ 320.417492] driver_detach+0x4b/0x90\n[ 320.417516] bus_remove_driver+0x70/0x100\n[ 320.417539] pci_unregister_driver+0x2e/0xb0\n[ 320.417564] __do_sys_delete_module.constprop.0+0x190/0x2f0\n[ 320.417592] ? kmem_cache_free+0x31e/0x550\n[ 320.417619] ? lockdep_hardirqs_on_prepare+0xde/0x190\n[ 320.417644] ? do_syscall_64+0x38/0x6b0\n[ 320.417665] do_syscall_64+0xc8/0x6b0\n[ 320.417683] ? clear_bhb_loop+0x30/0x80\n[ 320.417706] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 320.417727] RIP: 0033:0x7f963bb30beb\n\nFixes: 0fe45467a104 (\"idpf: add create vport and netdev configuration\")\nReviewed-by: Madhu Chittim \u003cmadhu.chittim@intel.com\u003e\nSigned-off-by: Emil Tantilov \u003cemil.s.tantilov@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Samuel Salin \u003cSamuel.salin@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-13-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "59abb87159c53605c063f6e2ceb215b5eba43ee6", "tree": "19e7db766dd54d6172067b014197a05dc9f77b13", "parents": [ "144539bbfd3cea1ab0fb6f5216d6004c1f4f029b" ], "author": { "name": "Aleksandr Loktionov", "email": "aleksandr.loktionov@intel.com", "time": "Fri Jul 17 11:53:33 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: reject out-of-range ptype in ice_parser_profile_init\n\nset_bit(rslt-\u003eptype, prof-\u003eptypes) operates on a DECLARE_BITMAP of\nICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF from\nproviding ptype \u003e\u003d 1024 through VIRTCHNL, resulting in a write past\nthe end of the bitmap and a kernel page fault.\n\nReproduced with a custom kernel module injecting a crafted\nVIRTCHNL_OP_ADD_RSS_CFG on E810-C QSFP (8086:1592),\nFW 4.91 0x800214af 1.3909.0, ICE COMMS DDP 1.3.53.0,\nkernel 7.1.0-rc1.\n\ncrash_parser: ice_parser_profile_init @ ffffffffc0d61b60\ncrash_parser: setting ptype\u003d0xffff (max valid\u003d1023)\ncrash_parser: calling ice_parser_profile_init -- expect OOB crash!\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nOops: Oops: 0002 [#1] SMP NOPTI\nCPU: 56 UID: 0 PID: 165011 Comm: insmod Kdump: loaded Tainted: G S U OE 7.1.0-rc1 #1\nHardware name: Intel Corporation S2600BPB/S2600BPB\nRIP: 0010:ice_parser_profile_init+0x2d/0x1d0 [ice]\nCall Trace:\n \u003cTASK\u003e\n ? __pfx_ice_parser_profile_init+0x10/0x10 [ice]\n crash_init+0x127/0xff0 [crash_parser]\n do_one_initcall+0x45/0x310\n do_init_module+0x64/0x270\n init_module_from_file+0xcc/0xf0\n idempotent_init_module+0x17b/0x280\n __x64_sys_finit_module+0x6e/0xe0\n\nBail out early with -EINVAL when ptype is out of range.\n\nFixes: e312b3a1e209 (\"ice: add API for parser profile initialization\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Marcin Szycik \u003cmarcin.szycik@linux.intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-12-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "144539bbfd3cea1ab0fb6f5216d6004c1f4f029b", "tree": "e198e94cbd3af97f95d52ece23d64a00f941a92f", "parents": [ "f6a7e00b81e35ef1325234925f2fe1e53b466f92" ], "author": { "name": "Paul Greenwalt", "email": "paul.greenwalt@intel.com", "time": "Fri Jul 17 11:53:32 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: prevent tstamp ring allocation for non-PF VSI types\n\nThe pf-\u003etxtime_txqs bitmap tracks which Tx queues have ETF (Earliest\nTxTime First) offload enabled. This bitmap is indexed by queue number\nand is set by ice_offload_txtime(), which only operates on PF VSI\nqueues.\n\nHowever, ice_is_txtime_ena() does not check the VSI type before\nconsulting the bitmap. When ETF offload is enabled on PF Tx queue 0,\nbit 0 is set in pf-\u003etxtime_txqs. During a subsequent PCI reset\nrebuild, the CTRL VSI\u0027s Tx queue 0 is reconfigured and\nice_is_txtime_ena() is called for that ring. Since it only checks\npf-\u003etxtime_txqs by queue index without distinguishing VSI type, it\nfinds bit 0 set and returns true, matching the PF VSI\u0027s ETF queue,\nnot the CTRL VSI\u0027s. This causes ice_vsi_cfg_txq() to spuriously\nallocate a tstamp_ring for the CTRL VSI ring.\n\nSince CTRL VSI rings have no associated netdev, ice_clean_tx_ring()\ntakes an early return at the !netdev check before reaching\nice_free_tx_tstamp_ring(), leaking the allocation. Each PCI reset\nleaks one 64-byte tstamp_ring.\n\nFix this by restricting ice_is_txtime_ena() to return true only for\nPF VSI rings, since txtime_txqs is only meaningful for PF VSI queues.\n\nFixes: ccde82e90946 (\"ice: add E830 Earliest TxTime First Offload support\")\nSigned-off-by: Paul Greenwalt \u003cpaul.greenwalt@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-11-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f6a7e00b81e35ef1325234925f2fe1e53b466f92", "tree": "2cbf27a57529dc92efc2a47f601da7c5b453695f", "parents": [ "2915681b89f817677ab9f1166d95b595bc144f5f" ], "author": { "name": "Paul Greenwalt", "email": "paul.greenwalt@intel.com", "time": "Fri Jul 17 11:53:31 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: fix PTP Call Trace during PTP release\n\nIf a PF reset occurs when the PTP state is ICE_PTP_UNINIT, then\nice_ptp_rebuild() will update the state to ICE_PTP_ERROR. This will\nresult in the following PTP release call trace during driver unload:\n\n kernel BUG at lib/list_debug.c:52!\n ice_ptp_release+0x332/0x3c0 [ice]\n ice_deinit_features.part.0+0x10e/0x120 [ice]\n ice_remove+0x100/0x220 [ice]\n\nThis was observed when passing PF1 through to a VM. ice_ptp_init()\nfails because ctrl_pf is NULL and sets the state to ICE_PTP_UNINIT.\n\nFix by detecting the ICE_PTP_UNINIT state in ice_ptp_rebuild() and\nreturning without error, preventing the invalid state transition to\nICE_PTP_ERROR. The only valid path to ICE_PTP_ERROR is from\nICE_PTP_RESETTING after a failed rebuild.\n\nFixes: 8293e4cb2ff5 (\"ice: introduce PTP state machine\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Greenwalt \u003cpaul.greenwalt@intel.com\u003e\nSigned-off-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-10-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2915681b89f817677ab9f1166d95b595bc144f5f", "tree": "259eccb0ea9891d51ef36fc8e7815998f248de30", "parents": [ "d6da9b7d48599db078aea6144997a381f8d90d45" ], "author": { "name": "Sergey Temerkhanov", "email": "sergey.temerkhanov@intel.com", "time": "Fri Jul 17 11:53:30 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: use READ_ONCE() to access cached PHC time\n\nptp.cached_phc_time is a 64-bit value updated by a periodic work item\non one CPU and read locklessly on another. On 32-bit or non-atomic\narchitectures this can result in a torn read. Use READ_ONCE() to\nenforce a single atomic load.\n\nFixes: 77a781155a65 (\"ice: enable receive hardware timestamping\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sergey Temerkhanov \u003csergey.temerkhanov@intel.com\u003e\nSigned-off-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-9-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "d6da9b7d48599db078aea6144997a381f8d90d45" }