)]}' { "log": [ { "commit": "c03c1a14507dfaf8b856c2608f9ac216021fc222", "tree": "30fd2ef82912c26cf3a58ad0ba6afc375fa851ac", "parents": [ "f909e534f5e34feb2ea2701d54df63e21aa506fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 13:14:58 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 13:14:58 2026 -1000" }, "message": "Linux 7.3\n" }, { "commit": "f909e534f5e34feb2ea2701d54df63e21aa506fc", "tree": "168f9e0c5ce0a46d0f28a8695539f124863081e7", "parents": [ "8486d357129126e27fb5d4e02622566bafc77035", "ec6b083915e8146e147314a5f4f1285d07b57bfc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 09:06:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 09:06:02 2026 -1000" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"All fixes in drivers (or the tape ULD) and one core fix to bsg (the\n block ioctl equivalent of sg_io).\n\n The biggest is the race in auth updates fix in iscsi configfs, but the\n next biggest one is in bsg but the generic pieces of that are mostly\n threading reply_len\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies\n scsi: libsas: Fix SMP IO deadlock during HA resume\n scsi: libiscsi: Validate the task named by a management response\n scsi: libiscsi: Validate the ITT reflected in a Reject PDU\n scsi: libiscsi: Reject a negative task index from parse_pdu_itt\n scsi: target: iscsi: Fix race in discovery auth updates\n scsi: target: Disable interrupts while holding delayed_cmd_lock\n scsi: st: Fix use-after-free race between st_remove() and st_open()\n scsi: st: Save the visited block for the partition the drive is in\n scsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n" }, { "commit": "8486d357129126e27fb5d4e02622566bafc77035", "tree": "92d175a11316eefd55dc2878a1a315345dbec9dd", "parents": [ "3d679a244e0deb65d31cb02f1d1dcb790fcfcae2", "b0f0c761ed3fa10754dc9295db85374a173123b7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:59:16 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:59:16 2026 -1000" }, "message": "Merge tag \u0027spi-fix-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A small collection of driver specific fixes, all quite important if\n you have the relevant hardware\"\n\n* tag \u0027spi-fix-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()\n spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible\n spi: imx: fix slab corruption from undersized DMA bounce buffers\n spi: tegra114: assert CS GPIO for every transfer in a message\n" }, { "commit": "3d679a244e0deb65d31cb02f1d1dcb790fcfcae2", "tree": "999347cc0270dbcb800ae0242cbd6eb1fac17558", "parents": [ "72732cbee632b1be22b636813c9be3df55c72bd9", "d5a821f66047c2effd06147b84775f9b2ce0f4aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:36:29 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:36:29 2026 -1000" }, "message": "Merge tag \u0027regmap-fix-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fixes from Mark Brown:\n \"The main thing here is a fix for lockdep warnings with MMIO regmaps\n that use a raw spinlock and a cache, some other lockdep fixes we\u0027d\n done for the benefit of the maple tree on sleeping buses meant that we\n were doing allocations for those MMIO regmaps under a raw spinlock.\n\n While fixing that Michael Reeves also noticed that the debugfs files\n were briefly available without the cache structures backing them.\n\n There\u0027s also a fix for interrupt freeing on error in regmap-irq which\n had been hanging around because it\u0027s not super urgent\"\n\n* tag \u0027regmap-fix-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: Drop map lock during cache init and exit\n regmap: Remove debugfs before cache teardown\n regmap: irq: Free the irqdomain we create\n" }, { "commit": "72732cbee632b1be22b636813c9be3df55c72bd9", "tree": "29bd27c0ee67aa4b8cd62525cf6006c86a2df6ff", "parents": [ "a0ff06b3a7bd3aa0cd99d0294e60b3ed28c9bfac", "d33373c565af9c8a28776af02bd20ba6e5724211" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:16:56 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:16:56 2026 -1000" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fixes from Andi Shyti:\n \"Three independent clock management fixes, plus one for a simple\n reset mask blunder in the qcom-cci interrupt handler\"\n\n* tag \u0027i2c-fixes-7.3-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: xiic: restore non-managed runtime PM to fix clk WARN flood\n i2c: qcom-cci: Fix HALT_ACK reset request being dropped\n i2c: qcom-geni: Restore the source-clock selection policy\n i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()\n" }, { "commit": "a0ff06b3a7bd3aa0cd99d0294e60b3ed28c9bfac", "tree": "b1d35d8f38785f0def4b3486dac5dc2b108c05c6", "parents": [ "53cbbb09c1b87425cd7184f81ecdb830aa3b0b87", "7f9f2d6abc40f79e802b4063859eda343043b85c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:13:58 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 08:13:58 2026 -1000" }, "message": "Merge tag \u0027firewire-fixes-7.3-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394\n\nPull firewire fix from Takashi Sakamoto:\n \"Fix a regression introduced in v6.19. It affects cancellation of the\n timer for split transaction timeout when handling a response. The\n issue is unlikely to occur in practice\"\n\n* tag \u0027firewire-fixes-7.3-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:\n firewire: core: fix race condition in split transaction handling\n" }, { "commit": "53cbbb09c1b87425cd7184f81ecdb830aa3b0b87", "tree": "7f6d8e6c7a63807b5b200afb2732b5d21b13bcda", "parents": [ "23a38e7bb2f9ad99c317a9f4e4c349054de9dfff", "41d1119e2f8577b4bd01d31321c6761af9140ce7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:48:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:48:22 2026 -1000" }, "message": "Merge tag \u0027x86-core-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86/core update from Ingo Molnar:\n\n - Emit the FineIBT paranoid \"cs\" prefix as a byte,\n to work around a GNU toolchain build warning (Kees Cook)\n\n* tag \u0027x86-core-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte\n" }, { "commit": "23a38e7bb2f9ad99c317a9f4e4c349054de9dfff", "tree": "928b802eea8bb1e8db8deee4a2d5917a55e94a6d", "parents": [ "88328f850d956d267d11e2ee225ee1eaa902b8e0", "4505a262deae7df06e33617dfc104d5541eec91d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:38:37 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:38:37 2026 -1000" }, "message": "Merge tag \u0027x86-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Fix kCFI decoding bug on CONFIG_FINEIBT\u003dy kernels running in\n kCFI mode (Kees Cook)\n\n* tag \u0027x86-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/kcfi: Decode the kCFI check from the trap address\n" }, { "commit": "88328f850d956d267d11e2ee225ee1eaa902b8e0", "tree": "eec2fbdc247b6e304abd5c885073ebd17a8aa44f", "parents": [ "8573787061f1a59fd73fc683c3c5cfd6bd07ea9f", "2f93bcb3f9aaf6ceee1aec0a97d4fe386d48e781" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:35:30 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:35:30 2026 -1000" }, "message": "Merge tag \u0027sched-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix __sched_setscheduler() class change race causing\n lost reschedules, exposed by recent RCU changes (K Prateek Nayak)\n\n - Fix s64 multiplication overflow in place_entity()\u0027s vlag\n scaling code that can corrupt an entity\u0027s placement (Hui Su)\n\n* tag \u0027sched-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/fair: Avoid overflow in place_entity()\n sched/core: Call wakeup_preempt() for queued tasks during class change\n" }, { "commit": "8573787061f1a59fd73fc683c3c5cfd6bd07ea9f", "tree": "8f82933ebd509f02a84349d3eadf371869bd868a", "parents": [ "cf20e7f96ae688dd8611dd6dce8cb4a036fecc72", "e4c7c401c6b9174c0c893084fdaa6a84bd2520d7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:20:03 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:20:03 2026 -1000" }, "message": "Merge tag \u0027perf-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix x86 Intel uncore driver bug on Diamond Rapids CPUs\n that erroneously always-cleared the invert bit (Guixiong Wei)\n\n - Fix accounting bug in the perf mlock \u0027gift\u0027 code causing\n unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)\n\n - Fix perf_pmu_migrate_context() bug leaving events behind during\n CPU hot-unplug (Haris Okanovic)\n\n - Update cgroup time when rotating multiplexed events, to fix\n time_running \u0026 scaled counts accounting bug (Antoine Huret)\n\n* tag \u0027perf-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Update cgroup time when rotating multiplexed events\n perf: Fix perf_pmu_migrate_context() leaving events behind\n perf: Track the perf mlock gift separately\n perf/x86/intel/uncore: Fix DMR CXL CM invert filter\n" }, { "commit": "cf20e7f96ae688dd8611dd6dce8cb4a036fecc72", "tree": "6a82bded6a6e5af0e548c18b5e61db4f73b7ab5d", "parents": [ "32c52ec87d6245ee2d12ed5dd509e40062939b50", "7cbaa0f4579f48e92639c6abb761fdef8fbade47" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:03:51 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 18 07:03:51 2026 -1000" }, "message": "Merge tag \u0027locking-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Fix FUT_OFF_MMSHARED futex hashing bug that can cause\n missed wakeups or spurious wakeups on futex-waiting\n tasks (Jann Horn)\n\n - Fix lockdep context tracking bug in the deferred hrtimer\n rearming entry code, which causes a lockdep chain leak\n that will eventually turn lockdep off (Mikhail Gavrilov)\n\n* tag \u0027locking-urgent-2026-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n entry: Account the deferred hrtimer rearm as hardirq context for lockdep\n futex: Fix mm reuse handling for FUT_OFF_MMSHARED\n" }, { "commit": "7f9f2d6abc40f79e802b4063859eda343043b85c", "tree": "ec97bb1d948997b86fd40d4da78e20e0ac2c09cd", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Takashi Sakamoto", "email": "o-takashi@sakamocchi.jp", "time": "Sun Oct 18 11:55:04 2026 +0900" }, "committer": { "name": "Takashi Sakamoto", "email": "o-takashi@sakamocchi.jp", "time": "Sun Oct 18 11:59:35 2026 +0900" }, "message": "firewire: core: fix race condition in split transaction handling\n\nFor a split transaction, either fw_core_handle_response() or\nsplit_transaction_timeout_callback() may manipulate the same transaction\nentry in the pending transaction list. The return value of timer_delete()\nis used to determine which function handles the entry. If the transaction\nis a split transaction and timer_delete() returns zero, the timeout\ncallback may already be running. In this case, the response handler must\nleave the entry in the list for the timeout callback to remove.\n\nA previous code refactoring broke this behavior, introducing a race\ncondition in which both functions could process the same transaction.\nThis could lead to a use-after-free on the transaction initiator side.\n\nFix the regression by ensuring that the response handler does not process\nthe transaction when timer_delete() returns zero. The timeout callback is\nresponsible for removing the entry from the pending transaction list.\n\nFixes: fa2dc2710076 (\"firewire: core: code refactoring to find and pop transaction entry\")\nLink: https://lore.kernel.org/r/20261018025504.290598-1-o-takashi@sakamocchi.jp\nSigned-off-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\n" }, { "commit": "32c52ec87d6245ee2d12ed5dd509e40062939b50", "tree": "93d8ecd4a5c26580d1ebeef20b3684afdad2a6ad", "parents": [ "58161ead29e50d70a317ea26b472e0c7508e69da" ], "author": { "name": "Lukas Zobernig", "email": "lukas.zobernig@gmail.com", "time": "Fri Oct 16 15:04:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 17 06:36:20 2026 -1000" }, "message": "x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()\n\nCommit 45e1dccc0653 (\"x86/insn: Simplify for_each_insn_prefix()\") made\nfor_each_insn_prefix() declare its own loop counter named idx.\nget_seg_reg_override_idx() keeps its result in a local of the same name,\nso the assignments in the loop body now write the loop counter:\n\n - the function always returns INAT_SEG_REG_DEFAULT, so FS and GS\n overrides are ignored;\n\n - a CS override sets the counter to INAT_SEG_REG_CS (2), the increment\n makes it 3, and prefixes.bytes[3] holds the last prefix, 0x2e again,\n so the loop never terminates.\n\nThe UMIP emulation reaches this from the #GP handler for user space: an\nSGDT, SIDT or SMSW with a memory operand and a CS prefix leaves the task\nspinning in the kernel, never returning to user space, with a SIGKILL\nthat is never delivered. Any user can thus tie up CPUs until reboot.\nWith an FS or GS prefix, the emulated result is written to the wrong\naddress.\n\nRename the internal macro iterator variable.\n\n[ Lukas\u0027 original patch renamed the use site, I changed it to rename the\n iterator in the macro instead, but left Lukas\u0027 commit message and\n authorship - Linus ]\n\nFixes: 45e1dccc0653 (\"x86/insn: Simplify for_each_insn_prefix()\")\nSigned-off-by: Lukas Zobernig \u003clukas.zobernig@gmail.com\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nAcked-by: Borislav Petkov \u003cbp@alien8.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "58161ead29e50d70a317ea26b472e0c7508e69da", "tree": "27cbca12d4ee7f8317a3b4f257163c5e95fd5e0f", "parents": [ "a3bb7a0184fbf9fed14aacb9773fe9f6f2097c1b", "f91a4ac69629e1479745e82100863157e6967ec0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 15:33:36 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 15:33:36 2026 -1000" }, "message": "Merge tag \u0027drm-fixes-2026-10-17\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Last set of fixes, mostly amdgpu, some i915 and xe.\n\n I think the dma-buf revert is probably the most important: while it is\n technically correct the fallout from it means we shouldn\u0027t enable\n DMABUF_DEBUG like that yet, and fix the fallout first.\n\n Summary:\n\n MAINTAINERS update\n\n dma-buf:\n - revert dma-debug y on debug kernel due to msm interaction\n\n core:\n - fix drm_exec prelocked object interaction\n\n i915:\n - Fix ARL-S host bridge detection\n - Add sanity checks for malformed DMC firmware\n\n xe:\n - OA uAPI fix\n - shrinker fix\n - fix eviction of object with no bo resource\n - fix LRU for external objects\n\n amdgpu:\n - UVD fix\n - TTM sched entity fixes\n - SMU 14 fix\n - Userptr leak fixes\n - Runpm ref count fix\n - CRIU fix\n - UserQ fixes\n - USB4 fix\n - SDMA 3 fix\n\n virtio-gpu:\n - revert double setting blend property\n - reset device before deleting vqs on freeze\n\n vc4:\n - fix hdmi audio runtime_pm interaction\n\n amdxdna:\n - fix Kconfig invalid configuration\n\n rocket:\n - fix error path for failed init\n - fix core unbinding and scheduler lookup paths\n\n panthor:\n - fix immortalis configuration\"\n\n* tag \u0027drm-fixes-2026-10-17\u0027 of https://gitlab.freedesktop.org/drm/kernel: (31 commits)\n drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang\n drm/amdgpu: keep the eviction fence until the last handle is closed\n drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions\n drm/amdgpu/userq: actually validate userq BOs\n drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES\n drm/amdgpu: free the userptr ranges when a CS fails after parser_bos\n drm/amdgpu: don\u0027t drop the runtime PM reference twice in amdgpu_gpr\n drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl\n drm/amd/pm: add zero fan stop temperature support on smu 14.0.2\n drm/amdgpu: destroy mutex when tearing down ttm buffer entity\n drm/amdgpu: fix sched entity leak in ttm buffer entity init\n drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set\n drm/panthor: fix immortalis condition\n drm/i915/cx0_phy: Fix ARL-S host bridge detection\n drm/i915/dmc: Add sanity check for DMC load address\n drm/i915/dmc: Harden DMC firmware payload parsing\n drm/exec: don\u0027t immediately add prelocked obj to array of locked objs\n drm/virtio: Reset device before deleting virtqueues on freeze\n drm/xe: Bump LRU for external objects on exec and rebind\n drm/xe/oa: Zero OA buffer at allocation\n ...\n" }, { "commit": "a3bb7a0184fbf9fed14aacb9773fe9f6f2097c1b", "tree": "8f60a216ed201c926d2bf42b798cdfdb3dd827ca", "parents": [ "4766082b791b515953d87f7a24c2ea857e6c10b0", "8e8cd9a4c6dc006e9bd51b8ad0079fb4576b48d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 15:29:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 15:29:02 2026 -1000" }, "message": "Merge tag \u0027sound-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Here are the (hopefully) last bits for 7.3.\n\n At this time, all changes are small and device-specific ASoC fixes.\n Not super-urgent, but should be fairly safe to take\"\n\n* tag \u0027sound-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: amd: yc: disable MSI on resume\n ASoC: nau8822: Fix the 128x oversampling switch bits\n ASoC: wm8978: Fix the 128x oversampling switch bits\n ASoC: max98371: Fix the Speaker DHT Min Volume bits\n ASoC: pcm3168a: Fix the DAC zero flag polarity bit\n ASoC: cs42l52: Fix the NG Type Switch bit\n ASoC: cs42l56: Put the Limiter Cushion control on the limiter register\n ASoC: stm32: spdifrx: fix synchronization state check\n ASoC: Intel: avs: Reset the stream unless it is already prepared\n ASoC: SOF: sof-client: Use event-handler mutex consistently\n ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\n" }, { "commit": "4766082b791b515953d87f7a24c2ea857e6c10b0", "tree": "8f58e53986bd34f85a0a8b4fd9e22bb755d0f712", "parents": [ "9d586910e3d858fb25d061b7bf3f9642eca89213", "e8df1d194c39b7a5159d570798941851f70a8668" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:51:21 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:51:21 2026 -1000" }, "message": "Merge tag \u0027pci-v7.3-fixes-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe,\n which falsely advertise it; removal of unrelated delays in v7.2\n caused post-FLR state restoration to fail, resulting in a VFIO\n passthrough regression (Alexander Gruhlke)\n\n -Don\u0027t treat ~0 as \u0027device is ready\u0027 in pci_dev_wait(); with RRS SV, a\n device may respond with RRS (resulting in data of 0x0001) or may not\n respond at all (typically resulting in ~0 data). A v6.12 change\n treated ~0 as \u0027ready\u0027, resulting in a regression with Intel and\n Samsung NVMe SSDs (Alexander Gruhlke)\n\n* tag \u0027pci-v7.3-fixes-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI: Don\u0027t treat ~0 as ready in pci_dev_wait() with RRS SV\n PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe\n" }, { "commit": "9d586910e3d858fb25d061b7bf3f9642eca89213", "tree": "3e8edd38686cab5c8460fc6d57d568be205185c5", "parents": [ "e2c278bc37b52222e53d5f88971ffcfacd6c97be", "54e1e89a97924f5f1b57d93350e27993468300b0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:37:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:37:20 2026 -1000" }, "message": "Merge tag \u0027printk-for-7.3-hotfix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux\n\nPull printk fixes from Petr Mladek:\n\n - Switch NBCON consoles to the emergency mode in emergency_restart() to\n see messages even in this shutdown code path\n\n - Postpone the start of printk kthreads after smp_init(). It prevents\n boot stalls on some HW\n\n - Typo fix in a previous hot-fix patch\n\n* tag \u0027printk-for-7.3-hotfix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:\n printk: Postpone kthread startup\n printk: fix kernel-doc name for nbcon_write_context_is_braille\n nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()\n" }, { "commit": "e2c278bc37b52222e53d5f88971ffcfacd6c97be", "tree": "c6c593dd9043713e4ed1918ddfdf080ccc9e61de", "parents": [ "2d2fe9fd50b57fc2563f4b7bd2fe83906f79c81a", "c47a7b11bcb3d45e29723afcf6336866476b1d08" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:27:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:27:22 2026 -1000" }, "message": "Merge tag \u0027trace-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix NULL dereference when copying histogram field variable\n\n If event_hist_trigger_parse() creates an action that uses one of\n pseudo fields for its keys, the hist_data field element will have a\n NULL for its field member. When looking to match that key, the lookup\n uses key_field-\u003efield-\u003ename which will dereference a NULL pointer.\n Instead use the helper function that handles such cases:\n expr_field_str().\n\n - Take the trace_types_lock when dropping the buffer_meta reference\n\n The tracing_buffer_meta_open() error return drops the trace_array\n reference with __trace_array_put() instead of trace_array_put() where\n the former doesn\u0027t take the lock and the latter does.\n\n - Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta\n\n These files are created for every possible CPU. But it only contains\n data for CPUs that have come online. If one is read for a CPU that\n hasn\u0027t come online yet, it triggers a NULL pointer dereference.\n\n Have reading of CPUs that have not come on line yet return -ENODEV.\n\n - Fix an out-of-bounds shift in the log2 histogram modifier\n\n Histograms can take a log2 modifier to have the buckets defined by\n log2 increments. If a shift is greater than ULONG_MAX or above 2^63,\n the key falls into a lower order bucket.\n\n Use order_base_2() instead of \"ilog2(n - 1) + 1\" to have all\n overflowed keys go into the top bucket.\n\n - Fix the persistent ring buffer rb_meta_subbuf_idx() accounting\n\n The algorithm for finding the index of a sub-buffer in a persistent\n ring buffer buffer did not take into account the meta data at the\n beginning of the buffer causing the wrong index to be returned.\n\n As rb_subbufs_from_meta() does the proper accounting to find the\n first sub-buffer, use that function instead of repeating the logic\n (incorrectly) and make the calculations based off of that.\n\n - Fix the symbol name checks for the remote buffer code\n\n The remote ring buffer has a build time check to make sure its not\n using any code that will not be in the hypervisor. For various\n architectures, there has been false positive reports from this\n checker.\n\n Fix them.\n\n - Fix false warning in ring_buffer_map_get_reader()\n\n There is a WARN_ON() after rb_get_reader_page() if no reader is\n returned. But there are legitimate cases where this can happen.\n Remove the WARN_ON() and also a check that covers one of the\n legitimate cases that tries to exit out early. There\u0027s no need for\n the check if it just simply allows the return of NULL from\n rb_get_reader_page().\n\n - Fix the ignored return value from resize_buffer_duplicate_size()\n\n Some clean up of the code in tracing_snapshot_write() removed\n checking the return value of resize_buffer_duplicate_size() and if\n that failed it would not be detected.\n\n - Fix the histogram timestamps for buffered events\n\n The histogram timestamps are taken from the events that are recorded.\n It currently reads ring_buffer_event_time_stamp() but if the event is\n buffered it does not read it properly. Use tracing_event_time_stamp()\n which handles both buffered and normal events.\n\n - Do not initialize tracefs if tracing is disabled at boot\n\n If tracing fails to allocate or some other error is detected,\n tracing_disabled is set. Do not initialize tracefs in this case as it\n may expect data to be initialized but is not.\n\n - Free eventfs inode after an RCU grace period\n\n Currently eventfs_inodes are freed after a SRCU grace period as the\n iterations in the code use SRCU. There are locations that the inode\n may still be accessed from the VFS that uses RCU which does not have\n the same synchronization as SRCU. Add an RCU wait before free eventfs\n inodes.\n\n - Do not fail persistent and remote buffers under memory pressure\n\n As persistent and remote buffers have their own pre-allocated memory,\n there\u0027s no reason to check how much memory is available before\n created them. By checking the memory pressure, these buffers may fail\n to be created even though their memory is already present.\n\n - Account for subbuffer size when checking how much memory is available\n\n Before allocating a ring buffer, the size is checked against the\n current memory pressure of the system. But it assumes every\n sub-buffer is of page size. This is no longer the case. Use the\n actual sub-buffer size when calculating how much memory will be used.\n\n - Reject non-stack fields for synthetic stacktrace fields\n\n Stack traces are special fields and the checks currently do not do\n enough to make sure that the fields being processed as stack traces\n are indeed stack traces. Update the logic to properly detect what is\n or is not a stack trace.\n\n - Fix a crash in print_graph_function_event()\n\n When a tracer does not define static or default flags the\n tr-\u003ecurrent_trace_flags is set to NULL. If the ring buffer is not\n cleared when switching tracers, the previous tracers events could be\n read. The function_graph entries will dereference the\n tr-\u003ecurrent_trace_flags and cause a crash.\n\n Set the tr-\u003ecurrent_trace_flags to a empty set of flags to prevent it\n from being NULL.\n\n - Separate tracing filter predicate count from allocation\n\n The amount allocated for the predicate program is the number of\n predicates defined plus two for adding \"true\" and \"false\" at the end.\n The nr_preds is incremented by two to accommodate the booleans but is\n then used as the limit check for number of predicates. This is\n incorrect as it is now two higher than what is expected.\n\n Use a separate variable for the size of the predicate array.\n\n - Fix the filter operator stack check\n\n The operator stack increments the pointer and then writes the content\n onto the stack. The check for overflow compared the current pointer\n to see if it was greater than the stack size before doing so. This is\n an off by 2 error as the write will be at the size - 1 and the\n compare is done before the increment. Adjust the check accordingly.\n\n* tag \u0027trace-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Check operator stack capacity before pushing\n tracing: Keep the predicate limit separate from program capacity\n tracing: Fix crash in print_graph_function_event()\n tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\n ring-buffer: Use subbuf_order in available memory estimation\n ring-buffer: Skip si_mem_available() for persistent and remote buffers\n eventfs: Free the eventfs_inode after an rcu grace period too\n tracing: Do not initialize tracefs work if tracing is disabled\n tracing: Fix hist trigger timestamps for buffered events\n tracing: Fix ignored return value of resize_buffer_duplicate_size()\n ring-buffer: Fix false warning in ring_buffer_map_get_reader()\n tracing: Fix simple_ring_buffer undef check on sparc64\n tracing: Fix simple_ring_buffer undef check on parisc\n tracing: Fix empty symbol names in simple_ring_buffer undef check\n ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()\n tracing: Fix the shift out of bounds in the log2 histogram modifier\n ring-buffer: Do not show buffer_meta for CPUs without a buffer\n tracing: Take trace_types_lock when dropping the buffer_meta reference\n tracing: Fix NULL dereference when copying keys for a field variable\n" }, { "commit": "2d2fe9fd50b57fc2563f4b7bd2fe83906f79c81a", "tree": "a4ea253d53f8907b35a38d7490d8fdc65840eb46", "parents": [ "70dd4ee72eb2d5793c62e71c14e3aba78e5a4e56", "66c658033d842bb75f81f20aaa4a378fe47be1a1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:25:25 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 14:25:25 2026 -1000" }, "message": "Merge tag \u0027probes-fixes-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull probes fix from Masami Hiramatsu:\n\n - error out if BTF is required but unavailable\n\n Fix to return an error instead of NULL if BTF is not available when\n user specify \u0027$args*\u0027 meta fetch argument for probe events.\n\n* tag \u0027probes-fixes-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: probes: error if BTF is required but unavailable\n" }, { "commit": "e8df1d194c39b7a5159d570798941851f70a8668", "tree": "e20c3ff3e6059261a83185c4050dba0f633e1c02", "parents": [ "0f8b5d90d179b9639be1dbeff59d6d971e6b0527" ], "author": { "name": "Alexander Gruhlke", "email": "gruhlke@mailbox.org", "time": "Sun Oct 11 21:01:45 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri Oct 16 12:11:15 2026 -0500" }, "message": "PCI: Don\u0027t treat ~0 as ready in pci_dev_wait() with RRS SV\n\nWith RRS Software Visibility, pci_dev_wait() considers a device ready as\nsoon as reading the Vendor ID doesn\u0027t return the RRS value. Devices aren\u0027t\nrequired to respond with RRS while they aren\u0027t ready, so the read may\nreturn ~0 and pci_dev_wait() stops waiting too early. This was seen with\nIntel [8086:0a54] and Samsung [144d:a80c] NVMe SSDs.\n\nAlso wait while the Vendor ID reads ~0. A VF\u0027s Vendor ID always reads ~0,\nso check its Command register instead, as is done without RRS SV.\n\nFixes: d591f6804e7e (\"PCI: Wait for device readiness with Configuration RRS\")\nLink: https://lore.kernel.org/r/20250611101442.387378-1-hui.wang@canonical.com\nSuggested-by: Lukas Wunner \u003clukas@wunner.de\u003e\nAssisted-by: Claude:claude-opus-5-5\nSigned-off-by: Alexander Gruhlke \u003cgruhlke@mailbox.org\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nReviewed-by: Lukas Wunner \u003clukas@wunner.de\u003e\nLink: https://patch.msgid.link/20261011190145.23621-3-gruhlke@mailbox.org\n" }, { "commit": "0f8b5d90d179b9639be1dbeff59d6d971e6b0527", "tree": "fe4db1fd04330f244710f33be733bbf656b18750", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Alexander Gruhlke", "email": "gruhlke@mailbox.org", "time": "Sun Oct 11 21:01:44 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri Oct 16 12:05:18 2026 -0500" }, "message": "PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe\n\nThe Samsung 990 PRO [144d:a80c] advertises Immediate Readiness, so\npcie_flr() doesn\u0027t wait after FLR, but the drive returns ~0 for up to 7 ms.\nSince commit 10baa9b4df40 (\"PCI: Drop unnecessary retries when restoring\nBARs\"), the config restore after FLR is lost, which breaks VFIO passthrough\nof the drive. Firmware 8B2QJXD7 responds right after FLR, but older\nfirmware such as 1B2QJXD7 doesn\u0027t, and the firmware version isn\u0027t visible\nhere.\n\n[bhelgaas: The Samsung 990 EVO Plus [144d:a80d] with 2B2QKXG7 firmware\nseems to have the same problem.]\n\nIgnore Immediate Readiness on these devices, so pcie_flr() waits.\n\nFixes: 10baa9b4df40 (\"PCI: Drop unnecessary retries when restoring BARs\")\nLink: https://bbs.archlinux.org/viewtopic.php?id\u003d314833\nLink: https://bbs.archlinux.org/viewtopic.php?pid\u003d2312085#p2312085\nSuggested-by: Lukas Wunner \u003clukas@wunner.de\u003e\nAssisted-by: Claude:claude-opus-5-5\nSigned-off-by: Alexander Gruhlke \u003cgruhlke@mailbox.org\u003e\n[bhelgaas: squashed in Samsung 990 EVO Plus from\nhttps://lore.kernel.org/all/20261016102042.641801-1-gruhlke@mailbox.org]\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nReviewed-by: Lukas Wunner \u003clukas@wunner.de\u003e\nLink: https://patch.msgid.link/20261011190145.23621-2-gruhlke@mailbox.org\nLink: https://patch.msgid.link/20261016102042.641801-1-gruhlke@mailbox.org\n" }, { "commit": "54e1e89a97924f5f1b57d93350e27993468300b0", "tree": "78e89613badc3a5b5c8dbe75586357316652dc44", "parents": [ "22430ae5d90ab288b0ee2ad99ae941f4a666b694", "5f339c46f153184570f16c8e789c9709b14cbe8b" ], "author": { "name": "Petr Mladek", "email": "pmladek@suse.com", "time": "Fri Oct 16 17:38:25 2026 +0200" }, "committer": { "name": "Petr Mladek", "email": "pmladek@suse.com", "time": "Fri Oct 16 17:38:25 2026 +0200" }, "message": "Merge branch \u0027for-7.3-hotfix\u0027 into for-linus\n" }, { "commit": "70dd4ee72eb2d5793c62e71c14e3aba78e5a4e56", "tree": "95314ea0249b78bf3778b8a422f097ac128ce1cb", "parents": [ "7b441fe5a6c6455cb91fdf8330abc752e7e247df", "c5895eadf287116434b7b01d67b92e8146f7ff61" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 08:21:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 08:21:06 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - AMD: Clear S4 wake bits when firmware has _AEI, this is important for\n some AMD systems.\n\n - Do not accumulate sunxi npins across probe() attempts with deferred\n probe. (desc-\u003enpins just went ++ and ++...)\n\n - Qualcomm patch galore: split QUP functions on the Nord pin\n controller, fix an OF module alias on IPQ5210 so the module\n modprobes, fix two groups on the IPQ5018, make direction changes\n exclusive on the SPMI-GPIO, and fix the interrupt target width on\n four different SoCs.\n\n* tag \u0027pinctrl-v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: sunxi: dt: do not accumulate npins across probe attempts\n pinctrl: amd: Clear S4 wake bits when firmware has _AEI\n pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12\n pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions\n pinctrl: qcom: spmi-gpio: make direction changes exclusive\n pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13\n pinctrl: qcom: qcs8300: Fix intr_target_width\n pinctrl: qcom: maili: Fix intr_target_width\n pinctrl: qcom: hawi: Fix intr_target_width\n pinctrl: qcom: nord: fix GPIO interrupt target width\n pinctrl: qcom: ipq5210: Publish the OF module alias\n pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions\n" }, { "commit": "7b441fe5a6c6455cb91fdf8330abc752e7e247df", "tree": "fc274b62c797f3e2b3e951dc80020dccab64ba3c", "parents": [ "586a28a179864ffe425e31087584b2ba07385fe0", "dbd674ccf30f66f5eccf637964a93910df8dbf84" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 08:17:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 08:17:30 2026 -0700" }, "message": "Merge tag \u0027pwrseq-fixes-for-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull power sequencing fix from Bartosz Golaszewski:\n\n - with the PCIe code reworked to power the endpoint via pwrctl before\n it starts the link training, we can now remove the workaround for\n WLAN power which instead started causing an issue with endpoint\n enumeration\n\n* tag \u0027pwrseq-fixes-for-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n power: sequencing: qcom-wcn: power off WLAN at probe\n" }, { "commit": "586a28a179864ffe425e31087584b2ba07385fe0", "tree": "7ca34a31dae67a33e7305176344b1b8f8ec248e5", "parents": [ "1dbb7422053fa0f4fb5f9acc3931617fc0091939", "205cccd06e545694754e1bf8d626ea96e742cd8a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 08:14:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 08:14:37 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - gracefully handle unsupported fwnode-only, no-device GPIO lookup for\n shared pins\n\n - mark the GPIO controller as sleeping in gpio-nct6694\n\n - fix a GPIO device reference leak in kunit tests\n\n - fix memory leak in error path in gpiod_set_array_value_complex()\n\n - fix races in GPIO controller and its associated irqchip setup in\n gpio-mxc\n\n - use atomic bitops where races can occur in gpio-mxc\n\n - fix build failure in gpio tools\n\n* tag \u0027gpio-fixes-for-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: mxc: fix race between gpiochip registration and IRQ domain setup\n gpio: mxc: fix wakeup_pads bit operations\n gpio: mxc: fix both_edges bit operations\n gpio: mxc: fix race between chained IRQ handler install and probe completion\n gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths\n gpio: kunit: fix GPIO device reference leak with __free()\n gpio: shared: gracefully handle no-device lookup of shared GPIOs\n gpio: shared: fix use-after-free bug when adding shared proxies\n tools: gpio: fix building from the top level with O\u003d\n gpio: nct6694: Mark the GPIO controller as sleeping\n" }, { "commit": "5f339c46f153184570f16c8e789c9709b14cbe8b", "tree": "61a61f7aadd28a4afd8be226fa18b7280b508992", "parents": [ "19ed235c1adcaf40f05997dfe8b96eb209effd35" ], "author": { "name": "John Ogness", "email": "john.ogness@linutronix.de", "time": "Fri Oct 16 11:00:34 2026 +0206" }, "committer": { "name": "Petr Mladek", "email": "pmladek@suse.com", "time": "Fri Oct 16 17:07:29 2026 +0200" }, "message": "printk: Postpone kthread startup\n\nThere have been various bug reports related to SMP systems hanging\non boot. The reports vary but seem to have some overlap with regard\nto missed IPI\u0027s during SMP setup. The reports also show that\nreverting NBCON console usage allows the bugs to disappear.\n\nThe NBCON kthreads for console printing are started very early\nduring boot using early_initcall(). Since these kthreads are\nasynchronously enabling/disabling interrupts during early boot, they\nmay be interfering with early SMP setup on some hardware platforms.\n\nStarting the console printing kthreads later has shown to avoid the\nhanging on systems that could previously reproduce the issue.\n\nPostpone kthread starting until after all arch initcalls have\ncompleted.\n\nReported-by: Derek Barbosa \u003cdebarbos@redhat.com\u003e\nCloses: https://lore.kernel.org/linux-rt-users/arPmYPbFLf2EldIl@debarbos-thinkpadt14gen5.rmtusma.csb\nFixes: 76f258bf3f2a (\"printk: nbcon: Introduce printer kthreads\")\nSigned-off-by: John Ogness \u003cjohn.ogness@linutronix.de\u003e\nTested-by: Derek Barbosa \u003cdebarbos@redhat.com\u003e\nLink: https://patch.msgid.link/20261016085441.857695-1-john.ogness@linutronix.de\nSigned-off-by: Petr Mladek \u003cpmladek@suse.com\u003e\n" }, { "commit": "1dbb7422053fa0f4fb5f9acc3931617fc0091939", "tree": "d45fbfba7e085a79fd93fa45113e72570be455f5", "parents": [ "519abe8d9acba75678a2bc91a2f6c855b9d1c54e", "214897acc8c2e5d6b63189d23ccaed6fa2af45a9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 07:53:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 07:53:16 2026 -0700" }, "message": "Merge tag \u0027vfs-7.3-rc8.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Fix a range of use-after-frees during rcu pathwalk caused by non-rcu\n frees.\n\n Whatever -\u003epermission(), -\u003ed_revalidate(), -\u003eget_link(), -\u003ed_hash()\n and -\u003ed_compare() read in rcu mode has to be freed after a grace\n period. umount(2) hides most of it because namespace_unlock() waits\n for one, but a chdir() out of a lazily unmounted directory or the\n close() of the last file on it drops the last reference without.\n\n * ext4_get_link() reads the sbi and the extent status counters for a\n symlink stored in a data block. Both are freed after a grace\n period now.\n\n * The unicode map of casefolded ext4, f2fs and tmpfs was freed under\n generic_ci_d_hash() and generic_ci_d_compare().\n\n * ntfs3 with nocase freed its sbi and mount options under its dentry\n hash and compare. A remount freed the old options right away too.\n\n * eventfs freed an eventfs_inode after an SRCU grace period only\n while tracefs_d_revalidate() reads it under rcu_read_lock().\n\n * afs and 9p are only saved by the grace period their private bdi\n gets in bdi_unregister(). They stop depending on it.\n\n * create_ipc_ns() leaked the mqueue mount and its superblock on a\n late failure. A long-term mount needs kern_unmount().\n\n - Don\u0027t let idle threads pin the initramfs.\n\n The idle threads of the secondary cpus are forked from PID 1 with a\n private copy of its fs_struct, aren\u0027t on the task list so\n pivot_root() never moves them and never exit. So the initramfs stayed\n pinned forever on every machine with more than one cpu, 70 to 150 MB\n in the reports. They share init_fs now like init_task does.\n\n - A mount that copy_tree() leaves out can\u0027t take over a lock.\n\n copy_tree() drops mounts of mount namespace files from the copies it\n makes for unshare(CLONE_NEWNS) and propagation without looking at\n MNT_LOCKED. So root in a user namespace could bind a child\u0027s\n /proc/\u003cpid\u003e/ns/mnt beneath a locked cover, let it take the lock over,\n unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with\n EPERM now and the move beneath a locked mount is refused up front.\n\n - Revert \"namei: don\u0027t reveal overmounted entries in refwalk\" from the\n rc7 fixes. The bug class is bigger than that patch.\n\n - namei: lookup_fast_for_open() checked -\u003ed_inode while\n traverse_mounts() checks the type in d_flags, which is set second, so\n a refwalk racing the instantiation could fail an O_CREAT open with\n ENOENT. Use d_is_negative() in both places.\n\n - Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()\n that mnt_get_count()\u0027s own barrier made redundant.\n\n - fsnotify: a mark added while fsnotify_destroy_marks() walks the\n connector could be missed and the connector detached, so an fdinfo\n read called igrab(NULL). New marks are refused during teardown.\n\n - pipe: a failed second fasync enable on an O_RDWR FIFO removed the\n existing reader entry and cleared FASYNC while the writer entry\n stayed, a use-after-free in send_sigio() later.\n\n - watch_queue: post_one_notification() could see nr_notes before the\n note pool behind it and dereference a NULL array. An unprivileged\n user can trigger that with a key watch. Publish nr_notes last.\n\n - pid_namespace: zap_pid_ns_processes() waits without bound for a\n tracer outside the namespace to reap its zombies and neither wait was\n freezable, so every suspend attempt failed.\n\n - exit: is_child_subreaper and has_child_subreaper shared a word with\n other bitfields written without a common lock, so racing prctl()s\n lost a bit. They are separate bools now.\n\n - autofs: a notification write that failed on a pipe the daemon had\n already replaced put the superblock into catatonic mode again and\n closed the replacement. Only do that for the current pipe.\n\n - ovl: reject a lowerdir ending with an unescaped backslash with EINVAL\n instead of a confusing ENOENT later.\n\n - ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks\n the recovery participant list.\n\n - samples/pidfd: fix the userprogs typo that kept pidfd-metadata from\n being built.\n\n* tag \u0027vfs-7.3-rc8.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)\n Revert \"namei: don\u0027t reveal overmounted entries in refwalk\"\n selftests/filesystems: test that a mntns file can\u0027t take over a lock\n fs: let idle threads share init_fs\n namespace: a mount that copy_tree() leaves out can\u0027t take over a lock\n namei: test for a negative dentry the way traverse_mounts() does\n fs: pass flags to copy_fs()\n ovl: reject lowerdir ending with unescaped backslash\n fsnotify: prevent mark additions during connector teardown\n pid_namespace: make zap_pid_ns_processes() freezable\n fs: drop the smp_mb()s that mnt_get_count() made redundant\n autofs: ignore notification errors from a replaced pipe\n ntfs3: free replaced mount options after a grace period\n ntfs3: free the sbi after a grace period\n unicode: free the map after a grace period\n ipc: drop the mqueue mount with kern_unmount() on setup failure\n eventfs: free the eventfs_inode after an rcu grace period too\n 9p: free the session after a grace period\n watch_queue: Fix note pool publication race in watch_queue_set_size()\n afs: free the super info after a grace period\n pipe: preserve existing fasync readers on writer setup failure\n ...\n" }, { "commit": "519abe8d9acba75678a2bc91a2f6c855b9d1c54e", "tree": "22edffaa20b91b3eb55917ef206c2ba1f6da0aff", "parents": [ "90201351a862182bdabfc1ad1c97b1e1b6ed5931" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Thu Oct 15 22:24:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 07:50:11 2026 -0700" }, "message": "MAINTAINERS: remove myself\n\nAfter 14 years at Oracle and 23 years working on Linux, I\u0027ve decided to\nstep back for a while.\n\nSigned-off-by: \"Darrick J. Wong\" \u003cdjwong@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "90201351a862182bdabfc1ad1c97b1e1b6ed5931", "tree": "8d20397920525277158d829082f569aa0b3b75c5", "parents": [ "2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e" ], "author": { "name": "Toke Høiland-Jørgensen", "email": "toke@toke.dk", "time": "Fri Oct 16 10:50:11 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 16 04:46:43 2026 -0700" }, "message": "wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"\n\nThis reverts commit 93ce8ea70451e800601bc9444aa33043de15d67b.\n\nMehmet reported that the offending commit breaks his AR9271 USB adapter\nwhich uses zero-length replies to commands that don\u0027t return a value.\nRevert the whole thing to restore the functionality.\n\nCc: stable@vger.kernel.org # the offending commit is in 6.12.113\nReported-by: Mehmet Fide \u003cmehmet.fide@gmail.com\u003e\nSigned-off-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "214897acc8c2e5d6b63189d23ccaed6fa2af45a9", "tree": "179d769790b0dc008e40bdcc305b53081c9d42ce", "parents": [ "906f04fb1ebfed7b00ef33faa98499fc4f0e609d" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 16 10:50:57 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 16 10:50:57 2026 +0200" }, "message": "Revert \"namei: don\u0027t reveal overmounted entries in refwalk\"\n\nThis reverts commit 8189ab688f5a2c745dc90b63374da02f213d6994.\n\nThis bug class is bigger than can be fixed with this simple patch.\nBack out of it and give us some time to fix this properly.\n\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "f91a4ac69629e1479745e82100863157e6967ec0", "tree": "53e4463e45b92d387fc61ef78c4bef509e6b46fa", "parents": [ "7669e0b1b92a8296a3dace4f2cc49fec0dd83fd3", "752480ad62964edf0254e151110d3e53a7cb37de" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 18:37:20 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 18:37:24 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-10-15\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-10-15:\n\namdgpu:\n- UVD fix\n- TTM sched entity fixes\n- SMU 14 fix\n- Userptr leak fixes\n- Runpm ref count fix\n- CRIU fix\n- UserQ fixes\n- USB4 fix\n- SDMA 3 fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20261015221002.1728931-1-alexander.deucher@amd.com\n" }, { "commit": "7669e0b1b92a8296a3dace4f2cc49fec0dd83fd3", "tree": "ac78cdfb57ba9b37222f3d570627259a72c803a8", "parents": [ "2963ea57b061c4df37ab72637a4bcf320ee40353", "d2ce8fcd778ee6d92748c92d23a56d4416c29d86" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 18:36:52 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 18:36:56 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-10-15\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nAn OA uAPI fix by zeroing OA buffer at allocation,\nand other 3 small fixes around eviction and shrinker.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/atDNMV-Aohu6s0gE@intel.com\n" }, { "commit": "e4c7c401c6b9174c0c893084fdaa6a84bd2520d7", "tree": "4cced236a2c14d1d7332096c51e82dd219275528", "parents": [ "e76b36b4be7160eaa14b416681e548b125702395" ], "author": { "name": "Antoine Huret", "email": "antoine.huret@bull.com", "time": "Thu Oct 15 14:55:56 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Oct 16 09:49:01 2026 +0200" }, "message": "perf: Update cgroup time when rotating multiplexed events\n\nSince commit bd2756811766 (\"perf: Rewrite core context handling\"),\nperf_rotate_context() only updates the context time before scheduling\nout the flexible events. It no longer updates the cgroup time, which\nctx_sched_out() used to do.\n\nCgroup events take their times from the per-cpu cgroup clock, so\nbetween two cgroup switches the rotations see a frozen clock. The\nevents rotated out lose the running time they accumulated, and the next\nupdate, usually a read, credits the whole interval to the events that\nhappen to be on the PMU at that moment.\n\nAs a result, the time_running of multiplexed cgroup events is wrong,\nand so are their scaled counts, as long as no other cgroup runs on the\nCPU, e.g. a busy job alone on its CPUs. Counting cycles over one second\nof a busy loop in a cgroup gives from half to several times the max\nfrequency of the CPU.\n\nUpdate the cgroup time before rotating the CPU context, as was done\nbefore the rewrite.\n\nFixes: bd2756811766 (\"perf: Rewrite core context handling\")\nCloses: https://lore.kernel.org/r/PR3PR07MB69223331EED5BEBE150375B7849C2@PR3PR07MB6922.eurprd07.prod.outlook.com/\nAssisted-by: Claude:claude-opus-5-5\nSigned-off-by: Antoine Huret \u003cantoine.huret@bull.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261015-perf-cgroup-rotation-time-v1-1-93e177dfee5d@bull.com\n" }, { "commit": "e76b36b4be7160eaa14b416681e548b125702395", "tree": "57ebcad86ffa8e675454182126f8556e8d10557e", "parents": [ "78436f3882fb8d848c823bf8cf754988202c5ca5" ], "author": { "name": "Haris Okanovic", "email": "harisokn@amazon.com", "time": "Tue Oct 13 13:56:00 2026 -0500" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Oct 16 09:49:01 2026 +0200" }, "message": "perf: Fix perf_pmu_migrate_context() leaving events behind\n\n__perf_pmu_remove() walks the group leaders of a CPU and PMU with\nperf_event_groups_for_cpu_pmu(), removing each one as it goes.\nperf_remove_from_context() takes the leader out of the groups rbtree,\nafter which rb_next() on that node returns NULL, prematurely ending the\nwalk. Other groups stay behind in the source context.\n\nOn CPU hotplug, they are then torn down with the dying CPU. They keep\nrunning until teardown, while the PMU\u0027s interrupt and migrated events\nare on a new CPU, which drivers rely on never happening.\n\nWalk ctx-\u003eevent_list instead and pick out the PMU\u0027s events by their\npmu_ctx.\n\nFixes: bd2756811766 (\"perf: Rewrite core context handling\")\nSigned-off-by: Haris Okanovic \u003charisokn@amazon.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20261013185603.1347265-2-harisokn@amazon.com\n" }, { "commit": "78436f3882fb8d848c823bf8cf754988202c5ca5", "tree": "e00447e5af556f93ca97e1fe7b7bb4a4df6820a8", "parents": [ "cf1f186e08dadb5abc4410d10fe3ada7ebf801ae" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Sat Oct 03 17:29:07 2026 +0100" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Oct 16 09:49:01 2026 +0200" }, "message": "perf: Track the perf mlock gift separately\n\nThe locked_vm field in struct user_struct was originally introduced by\ncommit 789f90fcf6b0 (\"perf_counter: per user mlock gift\") to provide an\nmlock-like budget for perf measured against mm-\u003epinned_vm (since 2011).\n\nperf grants each user a \u0027gift\u0027 of perf_event_mlock_kb * online CPUs of\nbuffer pages which is charged to user-\u003elocked_vm without any RLIMIT_MEMLOCK\ncheck.\n\nOnly pages beyond the gift are checked against RLIMIT_MEMLOCK, per-mm, via\nmm-\u003epinned_vm, which makes it different from the standard mlock() check,\nwhich is per-mm and made against RLIMIT_MEMLOCK.\n\nHowever, since this was introduced, a number of other components have\nutilised this field where a shared resource needed to be limited against\nRLIMIT_MEMLOCK.\n\nThe other users are currently MSG_ZEROCOPY, io_uring, AF_XDP, iommufd,\ns390 KVM zPCI and most recently, secretmem in commit 97d34aa65c29\n(\"mm/secretmem: properly account locked pages\").\n\nThis field is shared between all of these, but because the gift is not\nchecked against RLIMIT_MEMLOCK, user-\u003elocked_vm alone can exceed it - 16\nCPUs * 516 KiB is already more than the default 8 MiB - after which every\nother user of the field fails unconditionally.\n\nThis was reported by a user who saw secretmem failing while running a\nsimultaneous perf record.\n\nResolve the issue by simply giving perf its own field separate from the\nrest.\n\nBPF used user-\u003elocked_vm up until commit 80ee81e0403c (\"bpf: Eliminate\nrlimit-based memory accounting infra for bpf maps\") which landed in 5.11.\n\nThus also eliminate the now-defunct ifdef for CONFIG_BPF_SYSCALL for\nuser-\u003elocked_vm.\n\nThis issue exists between all of the components which use user-\u003elocked_vm\nand perf, however secretmem is the first user who has caused a report over\nmany years and has been backported, so target the fix at that.\n\nFixes: 97d34aa65c29 (\"mm/secretmem: properly account locked pages\")\nCloses: https://lore.kernel.org/20261002175651.811343-1-ameer.hamza@truenas.com\nReported-by: Ameer Hamza \u003cameer.hamza@truenas.com\u003e\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261003-perf-locked-vm-fix-v1-1-d214dcaf0d76@kernel.org\n" }, { "commit": "2f93bcb3f9aaf6ceee1aec0a97d4fe386d48e781", "tree": "25e6c36f8cc90a0e885b93a8b262995db2017e32", "parents": [ "118a2cf4ced60777a2408001e2b4838fed1cea55" ], "author": { "name": "Hui Su", "email": "sh_def@163.com", "time": "Mon Sep 28 21:47:54 2026 +0900" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Oct 16 09:49:00 2026 +0200" }, "message": "sched/fair: Avoid overflow in place_entity()\n\nplace_entity() inflates an entity\u0027s virtual lag with\n\n lag * (load + weight) / load\n\nCommit 4823725d9d1d (\"sched/fair: Increase weight bits for avg_vruntime\")\nreplaced the scaled-down weights used in this calculation with\navg_vruntime_weight(), removing the arithmetic headroom provided by\nscale_load_down().\n\nThe multiplication can overflow s64 before the division even when the\nfinal quotient is representable. A task\u0027s hierarchical effective weight\ncan be as small as 2 after avg_vruntime_weight() scaling under group\nscheduling, while entity_lag() bounds |vlag| by\n\n calc_delta_fair(cfs_rq_max_slice(cfs_rq) + TICK_NSEC, se)\n\nFor example, with HZ\u003d1000, NICE_0_LOAD\u003d1048576, and the minimum scaled\nhierarchical weight scale_load(2)\u003d2048, this bound is 891289600. With 114\nmaximum-weight entities, the runqueue load is 10361604096. The\nintermediate product is:\n\n 891289600 * (10361604096 + 2)\n \u003d 9235189971864780800\n \u003e S64_MAX\n\nThe signed overflow corrupts the entity\u0027s placement.\n\nRewrite\n\n lag * (load + weight) / load\n\nas\n\n lag + lag * weight / load\n\nThe two expressions are equivalent, but the latter avoids multiplying the\nvirtual lag by the total runqueue weight. entity_lag() bounds vlag against\nthe entity\u0027s effective weight, so the remaining lag * weight product stays\nbounded. rescale_entity() preserves this scale across h_load changes and\nalready relies on the same product when rescaling vlag.\n\nKeep the original zero-load warning semantics by multiplying lag by weight\nafter replacing the divisor with one.\n\nFixes: 4823725d9d1d (\"sched/fair: Increase weight bits for avg_vruntime\")\nSigned-off-by: Hui Su \u003csh_def@163.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20260928124754.1692077-1-sh_def@163.com\n" }, { "commit": "cf1f186e08dadb5abc4410d10fe3ada7ebf801ae", "tree": "7661d0ba5e3b73e76e96754dcb371d6dee560d32", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Guixiong Wei", "email": "weiguixiong@bytedance.com", "time": "Thu Oct 08 13:19:54 2026 +0800" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Oct 16 09:49:00 2026 +0200" }, "message": "perf/x86/intel/uncore: Fix DMR CXL CM invert filter\n\nThe DMR CXL CM PMU places its invert filter at config bit 21 and its\n9-bit threshold at bits 23-31. However, dmr_uncore_cxlcm uses\nGENERIC_PMON_RAW_EVENT_MASK, which covers the threshold through the\ngeneric bit 23 invert field and bits 24-31 threshold field, but does not\ninclude the relocated invert bit. As a result, uncore_pmu_event_init()\nsilently clears bit 21 and inv\u003d1 programs the same configuration as\ninv\u003d0.\n\nAdd bit 21 to a DMR CXL CM-specific event mask so the requested invert\nfilter reaches hardware.\n\nFixes: 6daf2c35b835 (\"perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids\")\nSigned-off-by: Guixiong Wei \u003cweiguixiong@bytedance.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Zide Chen \u003czide.chen@intel.com\u003e\nLink: https://patch.msgid.link/20261008051953.6293-2-weiguixiong@bytedance.com\n" }, { "commit": "2963ea57b061c4df37ab72637a4bcf320ee40353", "tree": "9ca063c52216c44adfda24873e25973df0968ed3", "parents": [ "70db8dea2aac43dd4f9a7ec2365d8c950efaa07d", "c347fef5f8f8927985bd67835331ce4cf7ff43a4" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 12:10:27 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 12:10:38 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-10-15\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA revert for the blend mode property patch being applied twice and a\npatch to reset the device when frozen in virtio, a power state fix for\nvc4, a Kconfig fix for amdxdna, an error handling, reference counting,\nand a null pointer dereference fix for rocket, a revert for dma-buf for\na commit introducing a dangling reference, a locking fix for exec, and a\nfix for panthor to handle 10-core GPUs.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@kernel.org\u003e\nLink: https://patch.msgid.link/atCZfcTvshZx6mcA@houat\n" }, { "commit": "70db8dea2aac43dd4f9a7ec2365d8c950efaa07d", "tree": "3651133b431bf35b97e0a92a68dcdafd6ed6f5fc", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907", "6a8bf59de3ef47ff51face6ea826395a1098baa0" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 10:51:58 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 16 10:51:59 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-10-15\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Fix ARL-S host bridge detection\n- Add sanity checks for malformed DMC firmware\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nLink: https://patch.msgid.link/atBtrhSxjkB7bVwm@jlahtine-mobl\n" }, { "commit": "2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e", "tree": "cfef5c403236af2a8cf96c9d2ae24687e42ee56e", "parents": [ "62f482ff73bf3ae88b0c899115527752cf9cbf13", "59f522f5a0ece96ce051a27d15533667a1d0dee8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 15:10:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 15:10:26 2026 -0700" }, "message": "Merge tag \u0027soc-fixes-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"A small number of last minute bug fixes came up since LPC.\n Most of these are for devicetree files:\n\n - Tegra264 needs fan descriptions to keep the system from overheating\n\n - A cleanup on TI DRA7 caused a regression on PCI support and needs a\n fixup\n\n - The beaglev-fire board can no longer probe the mcp3564 sensor after\n a an inconsistent update in 7.1\n\n - A few fixes address compile time dtc warnings on tegra\n\n The other three patches are all addressing minor problems\n in tegra drivers and the sama5 defconfig\"\n\n* tag \u0027soc-fixes-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n ARM: configs: sama5: enable current Microchip KSZ DSA symbols\n soc/tegra: pmc: Fix uninitialised clock rate\n riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts\n ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition\n soc/tegra: fuse: Add missing newline to APBMISC error message\n arm64: tegra: Add PCIe root ports on Tegra264\n arm64: tegra: Reorder reg and reg-names to match bindings\n arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit\n arm64: tegra: Add PWM controllers on Tegra264\n" }, { "commit": "c47a7b11bcb3d45e29723afcf6336866476b1d08", "tree": "96d4c839922f89cd69b9c987d0b16dab0cf95b77", "parents": [ "803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445" ], "author": { "name": "Taeyang Lee", "email": "0wn@theori.io", "time": "Fri Oct 16 02:19:55 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:07:15 2026 -0400" }, "message": "tracing: Check operator stack capacity before pushing\n\npredicate_parse() uses the first operator stack entry before processing\nany opening parentheses. A push then increments top before writing.\nThe existing check still permits that write when top already points to\nthe last allocated entry, which can access beyond the operator stack.\n\nReject the push when top reaches the last allocated entry.\n\nCc: stable@vger.kernel.org\nFixes: 39f7c41c908b (\"tracing/filters: Enable filtering a cpumask field by another cpumask\")\nLink: https://patch.msgid.link/atELO9L0I9kg5CpC@Taeyangs-MacBook-Pro.local\nSigned-off-by: Taeyang Lee \u003c0wn@theori.io\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445", "tree": "12ef2694dc024bbdf40160c9b84972bf16fea0c8", "parents": [ "3cc117514d69067a94d6c7479730dce41e678f50" ], "author": { "name": "Taeyang Lee", "email": "0wn@theori.io", "time": "Fri Oct 16 02:19:05 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:07:06 2026 -0400" }, "message": "tracing: Keep the predicate limit separate from program capacity\n\npredicate_parse() adds two to nr_preds to reserve the terminal TRUE\nand FALSE entries. It also uses that increased value as the limit for\nparsed predicates. If the initial count is smaller than the number\nactually parsed, the program can fill the allocation and subsequent\naccesses can go past its end.\n\nKeep nr_preds as the predicate limit and use a separate value for the\nallocation size. This leaves space for both terminal entries and a\nzeroed entry when parsing stops at the limit.\n\nCc: stable@vger.kernel.org\nFixes: 39f7c41c908b (\"tracing/filters: Enable filtering a cpumask field by another cpumask\")\nLink: https://patch.msgid.link/atELCd1XjKVhrkFL@Taeyangs-MacBook-Pro.local\nSigned-off-by: Taeyang Lee \u003c0wn@theori.io\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "3cc117514d69067a94d6c7479730dce41e678f50", "tree": "be228edd94656578c470d9ec63695291d4b63c9a", "parents": [ "a244c241593b5b38a08f0df2cb43c26574efbdcb" ], "author": { "name": "Hao Ge", "email": "hao.ge@linux.dev", "time": "Thu Oct 15 21:06:58 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:03:48 2026 -0400" }, "message": "tracing: Fix crash in print_graph_function_event()\n\ntracing_set_tracer() assigns the flags of the newly selected tracer\nwith:\n\n\ttr-\u003ecurrent_trace_flags \u003d t-\u003eflags ? : t-\u003etracer-\u003eflags;\n\nIf the new tracer defines neither static flags nor default flags, like\nhwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy\nfor it, and both operands are NULL, so tr-\u003ecurrent_trace_flags ends up\nbeing NULL as well.\n\nThe ring buffer is not cleared when switching tracers: it is reset\ninside tracer_init(), after current_trace_flags was already assigned.\nIf the buffer still holds function_graph entries of the previous\ntracer, printing one of them dereferences the NULL pointer. This was\nhit by cat trace during an ftrace stress test:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n RIP: 0010:print_graph_function_event+0xe/0x20\n Call Trace:\n s_show+0x4d/0x110\n seq_read_iter+0x2d4/0x490\n seq_read+0x130/0x170\n vfs_read+0xb5/0x370\n ksys_read+0x6d/0xe0\n do_syscall_64+0xbc/0x450\n\nThe snapshot buffer is not reset at all, so this can be reproduced\nwithout a race:\n\n echo function_graph \u003e /sys/kernel/tracing/current_tracer\n echo 1 \u003e /sys/kernel/tracing/snapshot\n echo hwlat \u003e /sys/kernel/tracing/current_tracer\n cat /sys/kernel/tracing/snapshot\n\nRather than teaching every user of tr-\u003ecurrent_trace_flags about this\ncorner case, make sure it is never NULL: when the newly selected\ntracer has no flags at all, tracing_set_tracer() falls back to a\nstatic empty no_tracer_flags. run_tracer_selftest() can hit the same\ncase, so the same fallback is added there too. The existing users\nalready handle opts \u003d\u003d NULL, so these tracers keep behaving as before.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261015130658.221198-1-hao.ge@linux.dev\nFixes: e29aa918a928 (\"tracing: Have function graph tracer define options per instance\")\nSuggested-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Hao Ge \u003chao.ge@linux.dev\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b0f0c761ed3fa10754dc9295db85374a173123b7", "tree": "9326f59d8a86885dc2f2091d4e4480c3844a5db8", "parents": [ "4eac392e48fc0ddc6d5ac10d57aac7245c17d0d9" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Oct 09 12:16:36 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 22:37:15 2026 +0100" }, "message": "spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()\n\nBoth fsl_lpspi_dma_transfer() and fsl_lpspi_pio_transfer() only return\nnegative error values in case of error or 0 in case of success.\n\nDirectly return ret, there is no need to check for positive error values\nand return them as 0.\n\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nLink: https://patch.msgid.link/20261009-spi-fsl-lpspi-more-cleanups-v1-2-2d4549d5205e@pengutronix.de\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "4eac392e48fc0ddc6d5ac10d57aac7245c17d0d9", "tree": "fe415f2d8187f9ae16c9f9d2f7a6260eca0124f8", "parents": [ "59eb22641f0c526dd064390b11cff99ae87c2858" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Oct 09 12:16:35 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 22:37:15 2026 +0100" }, "message": "spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible\n\nInstead of passing a spi_controller pointer to functions and using\nspi_controller_get_devdata() to get the struct fsl_lpspi_data pointer,\ndirectly pass a struct fsl_lpspi_data pointer.\n\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nLink: https://patch.msgid.link/20261009-spi-fsl-lpspi-more-cleanups-v1-1-2d4549d5205e@pengutronix.de\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "59eb22641f0c526dd064390b11cff99ae87c2858", "tree": "e00bad447f6b723f90928c8a656cae2f7283cc28", "parents": [ "8980bc573ae2d2b9d86d76aeb86c76e1597070bf" ], "author": { "name": "Richard Leitner", "email": "richard.leitner@linux.dev", "time": "Thu Oct 15 22:58:00 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 22:26:02 2026 +0100" }, "message": "spi: imx: fix slab corruption from undersized DMA bounce buffers\n\nSince commit faa8e404ad8e (\"spi: imx: support dynamic burst length for\nECSPI DMA mode\"), the driver allocates its private DMA TX/RX buffers\nwith kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but\nmaps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e.\nrounded up to the cache line size. As a result, the DMA API operates on\nmemory beyond the end of the allocation.\n\nThis was observed on a custom i.MX8MP platform with an mcp251xfd CAN\ncontroller under heavy RPMSG load, as a series of refcount_t warnings\ntriggered from rpmsg_recv_done() in virtio_rpmsg_bus:\n\n refcount_t: addition on 0; use-after-free.\n refcount_t: underflow; use-after-free.\n refcount_t: saturated; leaking memory.\n\nLeading finally to an \"Unable to handle kernel paging request\" oops.\nReproducing this problem took between 30 minutes and roughly 30 hours\nunder the same workload.\n\nHardware watchpoints on the refcount of a struct rpmsg_endpoint showed\nit was overwritten from 2 to 1 by __pi_memcpy_generic() in the\nirq/155-spi2.0 thread. Additionally it was found that a \"normal\"\nrpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In\nthe error case the same sequence took about 215µs +/-10µs. Based on\nthis, an LLM was used to identify the size mismatch fixed here.\n\nAllocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover\nthe full mapped length, and use the same length for\ndma_sync_single_for_cpu() to stay consistent with map and unmap.\n\nWith this patch applied, the same workload ran for more than 200 hours\nwithout the problem reproducing.\n\nAssisted-by: LLM\nFixes: faa8e404ad8e (\"spi: imx: support dynamic burst length for ECSPI DMA mode\")\nCc: stable@vger.kernel.org\nSigned-off-by: Richard Leitner \u003crichard.leitner@linux.dev\u003e\nLink: https://patch.msgid.link/20261015-fix-spi-imx-dma-v1-1-e28259671392@linux.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "d33373c565af9c8a28776af02bd20ba6e5724211", "tree": "895e37ca5a00521301c2c25f4efd27a0a44a516e", "parents": [ "195f3d74b5de98969dc4fad956393bb00787efd1" ], "author": { "name": "Abdurrahman Hussain", "email": "abdurrahman@nexthop.ai", "time": "Wed Oct 14 16:56:55 2026 -0700" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Thu Oct 15 22:34:34 2026 +0200" }, "message": "i2c: xiic: restore non-managed runtime PM to fix clk WARN flood\n\nThe devres conversion replaced manual pm_runtime_enable()/disable() with\ndevm_pm_runtime_set_active_enabled() and dropped the remove-time runtime\nPM teardown. The managed release tears runtime PM down in the wrong\norder: it calls pm_runtime_dont_use_autosuspend() before\npm_runtime_disable(), i.e. while runtime PM is still enabled, and devres\nis LIFO so the devm_clk_get_enabled() release runs afterwards.\n\nAt remove(), pm_runtime_put_sync() leaves the device active with the\nautosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()\nsuspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the\nclock. The later devm_clk_get_enabled() release clk_disable_unprepare()s\nthe already-disabled clock, so clk_core_disable() WARNs (\"clkN already\ndisabled\") on every teardown.\n\nDrop the managed helper and restore the non-managed runtime PM setup and\nteardown, so runtime PM is enabled once in probe and disabled once in\nremove and the clock enable count stays balanced.\n\nOrder the remove teardown so runtime PM is disabled before the usage\ncount is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()\ninstead of pm_runtime_put_sync(). Dropping the count first with autosuspend\nstill enabled arms the autosuspend timer, and a preemption before\npm_runtime_disable() lets it expire, suspend the device and clk_disable()\nthe clock, which the devm release then disables again - the same WARN.\n\nRestore the non-managed IRQ request as well. The probe error paths now\nunwind runtime PM by hand via goto, and a devm-registered handler is only\nfreed later during devres unwind, so it would stay live across the manual\nteardown (and across any future failing step added after it). Request the\nIRQ with request_threaded_irq() and free it explicitly in the probe error\npath and in remove. The probe error path also clears use_autosuspend, to\nmatch the teardown in remove().\n\nFixes: 50c63491ff26 (\"i2c: xiic: switch to devres managed APIs\")\nSigned-off-by: Abdurrahman Hussain \u003cabdurrahman@nexthop.ai\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v7.1+\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20261014-i2c-xiic-restore-runtime-pm-teardown-v8-1-40668c270069@nexthop.ai\n" }, { "commit": "62f482ff73bf3ae88b0c899115527752cf9cbf13", "tree": "df74c3cd5e3a39aa67089279ae21bc60a0f94cf5", "parents": [ "045958acaa75205b31578cb22c4345e28dd2e4bf", "4bcfe29021993cb167fd9bbdb849f7d7247a166f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 12:24:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 12:24:14 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull IOMMU fixes from Joerg Roedel:\n \"AMD IOMMU:\n\n - Revert an interrupt remapping check removal that caused GPU\n regressions on some platforms\n\n Generic page tables:\n\n - Fix KUnit builds with distributed Clang ThinLTO by preserving\n compiler flags, preventing x86-64 code generation from arm64\n bitcode\"\n\n* tag \u0027iommu-fixes-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommupt/kunit: Use if_changed_rule for the kunit\n Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"\n" }, { "commit": "752480ad62964edf0254e151110d3e53a7cb37de", "tree": "6558326d264888a67e83e855502259d05aef3f78", "parents": [ "3c44cbcec5eb370713bbd2c315ed7c34d8ccec2b" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Wed Oct 07 00:02:52 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:46:58 2026 -0400" }, "message": "drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang\n\nSDMA can randomly hang on Polaris 10. Hard to reproduce,\nbut has been occurring sporadically in the Mesa CI\non the RADV Polaris 10 job even when Mesa isn\u0027t using\nthe SDMA engine.\n\nWhen Mesa actually uses the SDMA on Polaris, the hang\nbecomes more frequent and the reproduction rate goes up\nsignificantly in the CI system.\n\nWe don\u0027t know why the hangs occur, but it seems\nthat inserting a single NOP packet before each\nPOLL_REGMEM and FENCE packet works around it.\nAt the moment it\u0027s unclear which GPUs are affected,\nso let\u0027s apply this to SDMA 3.x for now.\n\nNote that this issue is not documented or acknowledged by AMD.\n\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c343a27ed90823d08de125f7c447d96d056b75d9)\nCc: stable@vger.kernel.org\n" }, { "commit": "3c44cbcec5eb370713bbd2c315ed7c34d8ccec2b", "tree": "86d71abb54cea86689b0680089fc7338754b1794", "parents": [ "55a67aa89342545b89f469dea6f29bfb6fac6f3d" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Mon Oct 12 12:24:03 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:46:49 2026 -0400" }, "message": "drm/amdgpu: keep the eviction fence until the last handle is closed\n\namdgpu_gem_object_close() detaches the user queue eviction fence from\nthe BO before it checks bo_va-\u003eref_count, so closing any handle of a BO\nremoves the fence, even when the file still has another handle to the\nBO and the bo_va with its GPU mappings stays. The BO can then be evicted\nwithout suspending the user queues of the file, which keep accessing it\nthrough mappings that are only marked for update.\n\nSeen on navi31 with a SDMA user queue: a BO opened twice in the same\nfile (GEM_FLINK + GEM_OPEN) loses its eviction fence when the second\nhandle is closed (traced attach/detach of the fence):\n\n attach bo\u003dffff8c78a6c84c00\n GEM_CLOSE handle\u003d7\n detach bo\u003dffff8c78a6c84c00\n\nwhile handle 6 and the mapping are still in use.\n\nOnly detach the fence when the last reference to the bo_va goes away,\nmatching amdgpu_gem_object_open(), which attaches it only when the\nbo_va is created. With this the fence stays until the file is closed.\n\nFixes: 31f7efcdca4d (\"drm/amdgpu: enable eviction fence\")\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 8387982f03d4026b7dc11b0b5e3118298eee4d6a)\nCc: stable@vger.kernel.org\n" }, { "commit": "55a67aa89342545b89f469dea6f29bfb6fac6f3d", "tree": "79a2155d16eb9c73c7f134abe8cafc370a4d2b34", "parents": [ "32d0771ef4ca69c30a1db3aefa34dd177cd2a047" ], "author": { "name": "Srinivasan Shanmugam", "email": "srinivasan.shanmugam@amd.com", "time": "Thu Sep 17 11:44:33 2026 +0530" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:46:40 2026 -0400" }, "message": "drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions\n\nallocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both\nuse ASSERT(stream-\u003esink) before dereferencing stream-\u003esink-\u003elink. ASSERT\nis compiled out in production builds, so a NULL stream-\u003esink causes a\nNULL pointer dereference.\n\nlink_set_dpms_off() already guards two earlier accesses to stream-\u003esink\nwith explicit NULL checks, confirming that stream-\u003esink can legitimately\nbe NULL. The subsequent call to deallocate_usb4_bandwidth() had no\nequivalent guard.\n\nReplace the ASSERT() calls with proper NULL checks that return false\nearly, and add a matching stream-\u003esink guard at the call site in\nlink_set_dpms_off() consistent with the surrounding pattern.\n\nv2: Keep the existing ASSERT() calls for diagnostics (to report\n unexpected NULL sink), and add explicit NULL checks that return false\n before dereferencing stream-\u003esink. Also add a matching stream-\u003esink\n guard at the deallocation call site in link_set_dpms_off(). (Alex)\n\nFixes: 8fa813b7fd1e (\"drm/amd/display: Remove sink usage from DPMS\")\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCc: Nicholas Kazlauskas \u003cnicholas.kazlauskas@amd.com\u003e\nCc: Dominik Kaszewski \u003cdominik.kaszewski@amd.com\u003e\nCc: George Zhang \u003cgeorge.zhang@amd.com\u003e\nCc: Aurabindo Pillai \u003caurabindo.pillai@amd.com\u003e\nCc: Roman Li \u003cRoman.Li@amd.com\u003e\nCc: Ivan Lipski \u003civan.lipski@amd.com\u003e\nCc: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nCc: Alex Hung \u003calex.hung@amd.com\u003e\nCc: Tom Chung \u003cchiahsuan.chung@amd.com\u003e\nSigned-off-by: Srinivasan Shanmugam \u003csrinivasan.shanmugam@amd.com\u003e\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nReviewed-by: Roman Li \u003croman.li@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 98029a0ce61feb52c563f65349dd9b25f672e355)\nCc: stable@vger.kernel.org\n" }, { "commit": "32d0771ef4ca69c30a1db3aefa34dd177cd2a047", "tree": "aafe7a2c17184065a9d02758f3011340b97c3f84", "parents": [ "d65a459dbc9a6c3b051e22c96f73598e34b31bfc" ], "author": { "name": "Benjamin Cheng", "email": "benjamin.cheng@amd.com", "time": "Fri Oct 09 09:31:42 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:46:31 2026 -0400" }, "message": "drm/amdgpu/userq: actually validate userq BOs\n\nThis was supposed to loop over the individual evicted list, as the\nkernel and always_valid evicted lists were already handled in\namdgpu_vm_validate.\n\nWithout this, BOs that were created and evicted before a userq was made\nwould never end up in an eviction fence rearm.\n\nAlso add the missing ref to the BO before drm_exec locks and refs it.\n\nFixes: 4cdbba5a16aa (\"drm/amdgpu: restructure VM state machine v4\")\nSigned-off-by: Benjamin Cheng \u003cbenjamin.cheng@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 18decfc9e8cc0fa70b6de9944cc27a37729edfbd)\nCc: stable@vger.kernel.org\n" }, { "commit": "d65a459dbc9a6c3b051e22c96f73598e34b31bfc", "tree": "42ef68fb6611c7fb4a7f880b7d44b951810b2e3e", "parents": [ "1b4da805a0ba354a549ce07459c871c17dd94fe0" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Mon Oct 12 09:28:33 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:46:18 2026 -0400" }, "message": "drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES\n\nThe uapi documents drm_amdgpu_gem_list_handles_entry.alignment as\n\"physical start_addr alignment in bytes\", and GEM_OP\nGET_GEM_CREATE_INFO returns the same value in bytes, but\nGEM_LIST_HANDLES returns tbo.page_alignment, which is in pages. For a BO\ncreated with a 64 KiB alignment on navi31:\n\n GET_GEM_CREATE_INFO: alignment\u003d65536\n GEM_LIST_HANDLES: alignment\u003d16\n\nso a user such as CRIU that recreates BOs from this list uses the wrong\nalignment. Convert it to bytes.\n\nFixes: f9db1fc52ceb (\"drm/amdgpu: Add ioctl to get all gem handles for a process\")\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit aa4493ae949c13e79aba0731394dd7a7e431342b)\nCc: stable@vger.kernel.org\n" }, { "commit": "1b4da805a0ba354a549ce07459c871c17dd94fe0", "tree": "d8b3370996e019019e67efff758d5dcc715a5713", "parents": [ "de9f6bcdb44f0e410031002e2f103826ea6b6259" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Fri Oct 09 16:05:05 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:46:09 2026 -0400" }, "message": "drm/amdgpu: free the userptr ranges when a CS fails after parser_bos\n\namdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of\nthe BO list and looks up the user pages. Those ranges are only freed when\namdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks\nthem under the notifier lock. If amdgpu_cs_patch_jobs(),\namdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of\namdgpu_cs_submit() fails, nothing frees them: neither\namdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e-\u003erange.\n\nEach such CS then leaks the range, its hmm_pfns array (8 bytes per page\nof the userptr BO) and the BO reference the range holds. An IB on a ring\nthat patches the CS in place (e.g. VCN) with an unmapped va_start fails\nin amdgpu_cs_patch_ibs() and takes this path.\n\nFree the ranges on those error paths. Ranges amdgpu_cs_submit() already\ndropped are NULL, so freeing them again is a no-op.\n\nFixes: fec8fdb54e8f (\"drm/amdgpu: fix userptr HMM range handling v2\")\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)\nCc: stable@vger.kernel.org\n" }, { "commit": "de9f6bcdb44f0e410031002e2f103826ea6b6259", "tree": "74a3305897bec10727c5685f7df18212f04aeb8f", "parents": [ "3c516a5646285442e1cd71dff2584b77eb4fc421" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Fri Oct 09 13:21:33 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:46:01 2026 -0400" }, "message": "drm/amdgpu: don\u0027t drop the runtime PM reference twice in amdgpu_gpr\n\namdgpu_debugfs_gpr_read() drops its runtime PM reference right after\nreading the wave registers. When copying them to userspace fails, it\njumps to the err label, which drops the reference a second time. A read\ninto a bad buffer on Navi31 either steals a reference somebody else\nholds (power/runtime_usage goes from 1 to 0) or underflows the count:\n\n amdgpu 0000:03:00.0: Runtime PM usage count underflow!\n\nThe registers are already in the kernel buffer at that point, so finish\nthe hardware access first and copy the buffer with a single\ncopy_to_user() instead of the put_user() loop with its own error path.\n\nFixes: 9eee152aab56 (\"drm/amdgpu/debugfs: fix ref count leak when pm_runtime_get_sync fails\")\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)\nCc: stable@vger.kernel.org\n" }, { "commit": "3c516a5646285442e1cd71dff2584b77eb4fc421", "tree": "3691a522da9966f9676029802e4e92dfc18f7148", "parents": [ "a2eae9f4fa1b07f8e6e61b48931228da051943f0" ], "author": { "name": "Perry Yuan", "email": "perry.yuan@amd.com", "time": "Thu Sep 10 17:13:39 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:45:54 2026 -0400" }, "message": "drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl\n\nWhen amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns\n-ENOMEM right away and skips the cleanup every other error path goes\nthrough. The GEM object, the bo-\u003eparent reference on the VM root and the\nMMU notifier registration are all left behind.\n\nUse release_object here, not user_pages_done, range is still NULL at\nthis point.\n\nFixes: e095b55155ef (\"drm/amdgpu: use user provided hmm_range buffer in amdgpu_ttm_tt_get_user_pages\")\nSigned-off-by: Perry Yuan \u003cperry.yuan@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)\nCc: stable@vger.kernel.org\n" }, { "commit": "a2eae9f4fa1b07f8e6e61b48931228da051943f0", "tree": "7e4eea52b3d26fc80e0b46c2738015ae3669a068", "parents": [ "5b0a459f990be2faba33229fd93f10f23745fab2" ], "author": { "name": "Kenneth Feng", "email": "kenneth.feng@amd.com", "time": "Thu Oct 08 20:28:09 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:45:47 2026 -0400" }, "message": "drm/amd/pm: add zero fan stop temperature support on smu 14.0.2\n\nadd zero fan stop temperature support on smu 14.0.2\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5905\nSigned-off-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nReviewed-by: Kevin Wang \u003ckevin.wang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f990c94a2633d0ead477eb1b174e254a6d292e66)\nCc: stable@vger.kernel.org\n" }, { "commit": "5b0a459f990be2faba33229fd93f10f23745fab2", "tree": "c2f8901045c566b245e33b421d96ec70bb9c368d", "parents": [ "b5629f4a0869f4b01cfbfdf27f2c349d68c5d9d4" ], "author": { "name": "Perry Yuan", "email": "perry.yuan@amd.com", "time": "Thu Sep 10 16:58:17 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:45:38 2026 -0400" }, "message": "drm/amdgpu: destroy mutex when tearing down ttm buffer entity\n\nPair mutex_init() with mutex_destroy() on the GART window allocation\nfailure path and in amdgpu_ttm_buffer_entity_fini(). This is a no-op\nwithout CONFIG_DEBUG_MUTEXES, but it keeps lockdep from seeing a live\nmutex after the entity is freed or re-initialized.\n\nSigned-off-by: Perry Yuan \u003cperry.yuan@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 03ac40aeed034a0a0d5824ad26f8fbe1f6463698)\nCc: stable@vger.kernel.org\n" }, { "commit": "b5629f4a0869f4b01cfbfdf27f2c349d68c5d9d4", "tree": "785e4bf33182b5939ebd2ab7e956c67d001e0704", "parents": [ "800ea86e83e137395eba54103e5c459c2bc9965f" ], "author": { "name": "Perry Yuan", "email": "perry.yuan@amd.com", "time": "Thu Sep 10 16:57:31 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:45:31 2026 -0400" }, "message": "drm/amdgpu: fix sched entity leak in ttm buffer entity init\n\namdgpu_ttm_buffer_entity_init() checks num_gart_windows after\ndrm_sched_entity_init() has already attached the entity to a\nscheduler run-queue. Returning -EINVAL from that check leaks the\nentity.\n\nMove the ARRAY_SIZE() check before any resources are acquired.\n\nFixes: 2c3725572561 (\"drm/amdgpu: statically assign gart windows to ttm entities\")\nSigned-off-by: Perry Yuan \u003cperry.yuan@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 4000d1cdd1eacd3422267d6c8b4f1c9333b0317e)\nCc: stable@vger.kernel.org\n" }, { "commit": "800ea86e83e137395eba54103e5c459c2bc9965f", "tree": "e0c1ff7469a6ffd1de30d27768abf7c19885b559", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Tue Oct 06 23:16:07 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 15 12:45:17 2026 -0400" }, "message": "drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set\n\nThe PASS_MASK is for a different register not for UVD_FW_START.\nIt was a mistake to check this flag. It should be enough to check\nthat the register is non-zero.\n\nFixes: 889a2cfd889c (\"drm/amdgpu/uvd3.1: Don\u0027t validate the firmware when already validated\")\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://patch.msgid.link/20261006211607.75407-1-timur.kristof@gmail.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 9dee462c83259ca769aa1bf82228adee9831685c)\nCc: stable@vger.kernel.org\n" }, { "commit": "045958acaa75205b31578cb22c4345e28dd2e4bf", "tree": "c636ec9f65dc39c4fd24cb119170e70cb81a2c11", "parents": [ "9aa622dbaab8addcbe6f65f17c7b4d613d270f05", "aa07285705f8d5bac464eb1c5b7412f8e88b91e1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 08:20:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 08:20:20 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"This is considerably smaller than in recent history, mostly due to\n reduced capacity and increased backlog. Also we actively redirected\n more stuff towards next. I\u0027m not aware of any pending regression.\n\n Current release - regressions:\n\n - eth: move netops initialization to fix crash\n\n Previous releases - regressions:\n\n - sched: fix use-after-free in __tcf_action_put()\n\n - rds: fix uninitialized trans dereference in CM event handler\n\n Previous releases - always broken:\n\n - vsock: treat TCP_CLOSING as once-established\n\n - netlink: avoid hashing the network namespace pointer\n\n - eth: mlx5: HWS, release L2 to L3 tunnel reformats to their own pool\"\n\n* tag \u0027net-7.3-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (23 commits)\n net: stmmac: dwmac1000: clear the RGMII status interrupt\n net/sched: fix use-after-free in __tcf_action_put()\n calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n MAINTAINERS: add Gustavo Luiz Duarte as netconsole reviewer\n net: bcmgenet: unshare the skb before writing the control block\n microchip: lan865x: move setting of netops to fix crash\n net: ti: icssm-prueth: Move setting of netops to fix crash\n net: ethernet: aeroflex: move setting of netops to fix crash\n net: ethoc: move setting of netops to fix crash\n net: au1000: move setting of netops to fix crash\n net: mv643xx: move setting of netops to fix crash\n net: ethernet: adi: Move setting of netops to fix crash\n net: ethernet: actions: Move setting of netops to fix crash\n net: hisilicon: hip04_eth: Move setting of netops to fix crash\n net: hisilicon: hisi_femac: Move setting of netops to fix crash\n netlink: avoid hashing the network namespace pointer\n net/mlx5: HWS, fix flow meter offset within its bulk\n net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool\n netlink: reset skb headers before unicast and multicast filtering\n sctp: revalidate output stream after association connect wait\n ...\n" }, { "commit": "9aa622dbaab8addcbe6f65f17c7b4d613d270f05", "tree": "c83eec5d42516a43b6160e5f1c35c2053f49cb50", "parents": [ "6a66840a68683d9361a9b31faf3bd8104428ad29", "c8f4cfe1cf93bce924e27f2abead7a4c4a487505" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 08:12:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 08:12:47 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"Even more x86 fixes:\n\n - Avoid a false positive panic in the #PF handler, if the kernel\n triggers a page fault within the asynchronous page fault handler\n before the flags are reset.\n\n This can happen for example because of a perf NMI.\n\n - Always reset a vCPU\u0027s MMU pointer back to the root MMU when loading\n nested guest state fails during RSM or KVM_SET_NESTED_STATE.\n\n Otherwise KVM tries to run a non-nested guest with a nested MMU,\n which can result in a NULL pointer dereference attempting to get\n the nested MMU\u0027s pgd (EPTP or nested CR3)\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry\n x86/kvm: Don\u0027t consume async #PF flags on a kernel #PF in NMI context\n" }, { "commit": "6a66840a68683d9361a9b31faf3bd8104428ad29", "tree": "0033c284126c9ba3445b06bdb52281f9cd864d77", "parents": [ "9fee1f650a0a9ea6fa7c0b26244a778dd92542d5", "dbc393f6f009a2bf7e4a22ef2d70b53f533f20f4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 08:06:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 15 08:06:26 2026 -0700" }, "message": "Merge tag \u0027hyperv-fixes-signed-20261015\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux\n\nPull Hyper-V fixes from Wei Liu:\n\n - Typo and comment fixes (Hemanth Selam, Jiangshan Yi)\n\n - Update maintainers list (Wei Liu, Long Li)\n\n - Two Hyper-V PCI driver fixes (Naman Jain, Sahil Chandna)\n\n - Small fixes for core Hyper-V code (Hardik Garg, Michael Kelley,\n Waiman Long)\n\n* tag \u0027hyperv-fixes-signed-20261015\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:\n MAINTAINERS: drop KY from Hyper-V maintainers list\n PCI: hv: Warn when wait_for_response() waits indefinitely\n PCI: hv: Probe vPCI buses asynchronously\n MAINTAINERS: remove myself from the Hyper-V entries\n mshv_vtl: Check per-CPU register page before mmap\n tools/hv: fix typo \"retrive\" in comment\n Drivers: hv: vmbus: fix typo \"substract\" in comment\n Drivers: hv: Don\u0027t reset VMBus connection state on error/exit paths\n x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()\n x86/hyperv: Fix stale comments after stimer message mode removal\n Drivers: hv: Avoid infinite retry loop in init_vp_index()\n" }, { "commit": "8e8cd9a4c6dc006e9bd51b8ad0079fb4576b48d3", "tree": "f8d73e909c386c2b7813fa077c193ea227c3ce02", "parents": [ "07c75552f7fe636a0695baae506a7d72fabd3be4", "2a31b5378c6db9c4a8d399e5d10d32cd4b732bef" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 15 16:57:14 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 15 16:57:14 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.3-rc7\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.3\n\nThere\u0027s a relatively large block of fixes for errors in register field\ndefinitions here, resulting from an audit done after review of a prior\nseries. The fixes themselves are very small and can be directly checked\nagainst the datasheets. Other than that we\u0027ve got some driver specific\nfixes, the AMD fix is a little large but fixes a clear issue and won\u0027t\naffect other systems.\n" }, { "commit": "aa07285705f8d5bac464eb1c5b7412f8e88b91e1", "tree": "a5c9b5d202307c41937f9f9f86c27c9b8a332c8e", "parents": [ "7b16eb911091aae237a8673da94e4dfb9cd21d54" ], "author": { "name": "Igor Velkov", "email": "iav@iav.lv", "time": "Fri Oct 09 23:17:09 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 14:57:52 2026 +0200" }, "message": "net: stmmac: dwmac1000: clear the RGMII status interrupt\n\nSince commit 2e2c878a3141 (\"net: stmmac: remove SGMII/RGMII/SMII\ninterrupt handling\") nothing on the RGMII path reads GMAC_RGSMIIIS, so\nRGSMIIIS stays pending behind GMAC_INT_MASK from the first link change\non. stmmac_resume() resets the MAC in stmmac_hw_setup(); the reset sets\nGMAC_INT_MASK to 0 until dwmac1000_core_init() writes the mask again,\nand the pending status storms the line:\n\n dwmac_dma_interrupt: unexpected status 04000000\n\nA register dump at the first message on ODROID-HC4 showed it:\n\n core int_status 00000001 int_mask 00000000 pmt 00000000 rgsmiiis 0000000d\n\nWhen the resume thread runs on the CPU that takes the MAC interrupt,\nthe storm starves it: a soft lockup, then a watchdog reset or a hang.\n\nRead GMAC_RGSMIIIS in dwmac1000_irq_status() when the status is not\nmasked, as the driver did before 2e2c878a3141; the read clears it.\n\nWake-on-LAN resume from s2idle with the resume thread and the MAC\ninterrupt on one CPU: Helios64 (dwmac-rk), 7.3-rc6, soft-locked in 3 of\n3 resumes without a fix and in 0 of 10 with this patch; it ran with an\nout-of-tree dwmac-rk change that keeps the GMAC powered across suspend.\nODROID-HC4 (dwmac-meson8b): 0 of 10 with this patch, 2 of 2 without a\nfix on a 7.3-rc5 build. irq_rgmii_n went up by one per resume.\n\nFixes: 2e2c878a3141 (\"net: stmmac: remove SGMII/RGMII/SMII interrupt handling\")\nAssisted-by: LLM\nSigned-off-by: Igor Velkov \u003ciav@iav.lv\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261009201709.1917585-1-iav@iav.lv\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a244c241593b5b38a08f0df2cb43c26574efbdcb", "tree": "177b494c829dd5b5b2ce026362fea071385aaf15", "parents": [ "13d530f2daeda9493f4d07ddc5ca13e21318fbeb" ], "author": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Tue Oct 13 11:24:48 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 08:52:44 2026 -0400" }, "message": "tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\n\nIn check_synth_field(), when a synthetic event field is a stacktrace\n(field-\u003eis_stack) and the histogram field is not a \"long[\" stacktrace\narray, validation falls through to the generic size and signedness\ncomparison.\n\nBecause parse_synth_field() sets a stacktrace field\u0027s type to\n\"__data_loc unsigned long[]\", its size is sizeof(u64) and\nsynth_field_signed() marks it as signed. Consequently, any 8-byte\nsigned scalar histogram field passes the fallback check, and its scalar\nvalue is subsequently dereferenced as a kernel stacktrace pointer in\nget_field_size() and trace_stack().\n\nFurthermore, checking strstr(hist_field-\u003etype, \"long[\") is insufficient\nbecause tracepoint fields defined with __bitmask() or __rel_bitmask()\nalso have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned\nlong[]\", whilst create_hist_field() treats them as 4-byte scalar values\nwithout HIST_FIELD_FL_STACKTRACE.\n\nPropagate HIST_FIELD_FL_STACKTRACE to variable references and field\nvariables (whilst excluding variable aliases from per-element\nstacktrace capture), and reject any mismatch between\nHIST_FIELD_FL_STACKTRACE and field-\u003eis_stack in check_synth_field().\n\nCc: stable@vger.kernel.org\nFixes: 00cf3d672a9d (\"tracing: Allow synthetic events to pass around stacktraces\")\nLink: https://patch.msgid.link/20261013112449.1006088-1-lee@kernel.org\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "13d530f2daeda9493f4d07ddc5ca13e21318fbeb", "tree": "f7cc9925bf1b501375bc794ede56fbe88c2a150a", "parents": [ "c9fc60c18b6d42efdea0cd88ca132b2f452157c3" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Tue Oct 13 11:20:47 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 08:52:26 2026 -0400" }, "message": "ring-buffer: Use subbuf_order in available memory estimation\n\nTo avoid failing in the middle of an allocation of a ring-buffer,\n__rb_allocate_pages() looks at the available memory estimation with\nsi_mem_available(). Use the subbuffer order with this estimation to fail\nearly if necessary for ring-buffers with an order \u003e 0.\n\nLink: https://patch.msgid.link/20261013102047.1488347-3-vdonnefort@google.com\nFixes: f9b94daa542a (\"ring-buffer: Set new size of the ring buffer sub page\")\nReviewed-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "205cccd06e545694754e1bf8d626ea96e742cd8a", "tree": "5824855c62344c2cbf2b4634d18c3d268f0bbc18", "parents": [ "170aeff46fb54f41545c85a72aec525aebc79d44" ], "author": { "name": "Peng Fan", "email": "peng.fan@nxp.com", "time": "Tue Oct 13 14:01:12 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:21:15 2026 +0200" }, "message": "gpio: mxc: fix race between gpiochip registration and IRQ domain setup\n\ndevm_gpiochip_add_data() makes the GPIO chip visible to consumers\nimmediately. Since the chip sets .to_irq \u003d mxc_gpio_to_irq, which calls\nirq_find_mapping(port-\u003edomain, offset), any to_irq() call between\ngpiochip registration and IRQ domain creation will operate on a NULL\ndomain.\n\nFix by moving devm_gpiochip_add_data() after the IRQ domain and generic\nirq chip are fully initialized, ensuring port-\u003edomain and the irq chip\nhandlers are ready before the chip becomes visible to consumers.\n\nFixes: d37a65bb4663 (\"gpio/mxc: Move Freescale MXC gpio driver to drivers/gpio\")\nSigned-off-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nReviewed-by: Andy Shevchenko \u003candy@kernel.org\u003e\nLink: https://patch.msgid.link/20261013-gpio-mxc-cleanup-v7-4-c4d769587d3e@nxp.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "170aeff46fb54f41545c85a72aec525aebc79d44", "tree": "0bf54dede4afb3e542428816253829ba9b271c97", "parents": [ "b7719c575dec69146f6d537fd616b27083c0cf45" ], "author": { "name": "Peng Fan", "email": "peng.fan@nxp.com", "time": "Tue Oct 13 14:01:11 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:21:15 2026 +0200" }, "message": "gpio: mxc: fix wakeup_pads bit operations\n\ngpio_set_wake_irq() can be called concurrently for different pins on\nthe same port. The writer-vs-writer race is the concern: two concurrent\ngpio_set_wake_irq() calls for different pins on the same port both do\na non-atomic read-modify-write on the same wakeup_pads word. The old\n|\u003d and \u0026\u003d compile to separate load/modify/store instructions that can\ninterleave, losing one CPU\u0027s update.\n\nassign_bit() uses an atomic RMW instruction, so concurrent writers to\ndifferent bits in the same word are safe.\n\nThe reader side (for_each_set_bit in noirq_suspend, wakeup_pads \u003e 0)\nruns in noirq context where no concurrent writer can execute, so\nreader atomicity is not needed.\n\nwakeup_pads is a u32, while assign_bit() operates on unsigned long\npointers. On 64-bit platforms, this causes an 8-byte read-modify-write\non a 4-byte field, corrupting the adjacent is_pad_wakeup. So change\nwakeup_pads to unsigned long and reorder to avoid wasting words.\n\nAnd fix the enable/disable path unconditionally sets/clears the\nwakeup_pads bit even when enable_irq_wake()/disable_irq_wake() fails.\nOnly update the bit on success.\n\nFixes: f60c9eac54af (\"gpio: mxc: enable pad wakeup on i.MX8x platforms\")\nAssisted-by: LLM\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nReviewed-by: Andy Shevchenko \u003candy@kernel.org\u003e\nLink: https://patch.msgid.link/20261013-gpio-mxc-cleanup-v7-3-c4d769587d3e@nxp.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "b7719c575dec69146f6d537fd616b27083c0cf45", "tree": "04c3b888c46c54f693a44abd26b1d00d3e674934", "parents": [ "38d44f78f041ffe60c8e2443b99434a199e7541d" ], "author": { "name": "Peng Fan", "email": "peng.fan@nxp.com", "time": "Tue Oct 13 14:01:10 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:21:15 2026 +0200" }, "message": "gpio: mxc: fix both_edges bit operations\n\ngpio_set_irq_type() can be called concurrently for different pins on\nthe same port. The IRQ core serializes per irq descriptor, but\ndifferent pins have different descriptors, so on SMP systems two\nconcurrent gpio_set_irq_type() calls for pins on the same port run\nwithout mutual exclusion.\n\nThe read-modify-write of port-\u003eboth_edges is performed outside the\nport-wide scoped_guard(gpio_generic_lock_irqsave) section, so\nconcurrent updates for different pins can overwrite each other,\ncausing missed interrupts or stuck IRQ lines on dual-edge triggered\npins.\n\nThe original uniprocessor MXC SoCs were not affected; the race\nbecame reachable on multi-core i.MX7 and i.MX8 SoCs that reuse this\ndriver.\n\nConvert both_edges from u32 to unsigned long and use set_bit(),\nclear_bit(), and test_bit() to make the modifications atomic.\n\nFixes: 910862ec092c (\"mxc: emulate GPIO interrupt on both-edges\")\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candy@kernel.org\u003e\nLink: https://patch.msgid.link/20261013-gpio-mxc-cleanup-v7-2-c4d769587d3e@nxp.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "38d44f78f041ffe60c8e2443b99434a199e7541d", "tree": "3926ab88b612eedfad4690264bdd55cc67618e4f", "parents": [ "c28846ca1ac6134881114d272314623c8433e372" ], "author": { "name": "Peng Fan", "email": "peng.fan@nxp.com", "time": "Tue Oct 13 14:01:09 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:21:14 2026 +0200" }, "message": "gpio: mxc: fix race between chained IRQ handler install and probe completion\n\nmxc_update_irq_chained_handler() is called before the IRQ domain, the\ngeneric IRQ chip, and the port list entry are set up. If an interrupt\narrives in that window:\n\n - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with\n port-\u003edomain still NULL.\n - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not\n been added to the list yet.\n\nAdditionally, if any of the subsequent probe steps\n(gpio_generic_chip_init(), devm_gpiochip_add_data(),\nirq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error\npaths never unregister the chained handler, leaving a dangling handler\nthat points at freed memory.\n\nMove the handler installation after all its dependencies are ready and\nafter list_add_tail(), so the handler is never live while the data\nstructures it touches are incomplete, and is never installed if probe\nfails.\n\nFixes: 5f6d1998adeb (\"gpio: mxc: release the parent IRQ in runtime suspend\")\nAssisted-by: LLM\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candy@kernel.org\u003e\nLink: https://patch.msgid.link/20261013-gpio-mxc-cleanup-v7-1-c4d769587d3e@nxp.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "c28846ca1ac6134881114d272314623c8433e372", "tree": "700fdfa29f1141060c7afd087f7a398e8cda9adc", "parents": [ "851bb4a42991666f515040e95e6f40191da9e899" ], "author": { "name": "Kent Gibson", "email": "warthog618@gmail.com", "time": "Thu Oct 15 10:57:49 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:10:38 2026 +0200" }, "message": "gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths\n\nA drive-by review by Sashiko reports that, after a failed call to\ngpiochip_set_multiple(), gpiod_set_array_value() returns abruptly,\nbypassing the freeing of possibly alloced bitmaps, potentially leaking\nmemory. It is an unlikely error path, but is possible.\n\nDefer the return code check until after the bitmap_free() block.\n\nFixes: 9b407312755f (\"gpiolib: rework the wrapper around gpio_chip::set_multiple()\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nLink: https://lore.kernel.org/linux-gpio/sashiko-outbox-168233@kernel.org/\nSigned-off-by: Kent Gibson \u003cwarthog618@gmail.com\u003e\nLink: https://patch.msgid.link/20261015025749.47039-1-warthog618@gmail.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "851bb4a42991666f515040e95e6f40191da9e899", "tree": "4ccfce6d31710c97104a921e1b74733e99811434", "parents": [ "cf73c3fc03c43a8a86fd487c62390b4744eff9ec" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 10:44:02 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:06:25 2026 +0200" }, "message": "gpio: kunit: fix GPIO device reference leak with __free()\n\nKUnit aborts the test thread immediately using kthread_exit() so the\nvariable annotated with __free() never really goes out of scope and the\nassociated callback is not called. Schedule a kunit action instead.\n\nFixes: a05cfd98c5ec (\"gpio: kunit: add test cases for software node hogs\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20261013-gpio-kunit-plat-lookup-v3-0-3907f913e964%40oss.qualcomm.com?part\u003d1\nLink: https://patch.msgid.link/20261014-gpio-kunit-autofree-leak-fix-v1-1-5bfa7be0eb1f@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "cf73c3fc03c43a8a86fd487c62390b4744eff9ec", "tree": "616377c34214ed77d89e80430f80ac4b56955980", "parents": [ "bd22f7e63509fa758cf500d9af3e88a3d3df96be" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 11:38:26 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:05:28 2026 +0200" }, "message": "gpio: shared: gracefully handle no-device lookup of shared GPIOs\n\nWe use platform lookup tables for shared GPIOs. This mechanism needs a\nstruct device to work so fwnode-based lookup with no device associated\ncurrently causes a NULL-pointer deference.\n\nAdding this functionality will require a larger rework and it has never\nworked anyway so add a check that allows the kernel to gracefully handle\nthis situation with an error ahead of implementing that functionality as\na new feature.\n\nCc: stable@vger.kernel.org\nReported-by: Abel Vesa \u003cabelvesa@kernel.org\u003e\nFixes: a060b8c511ab (\"gpiolib: implement low-level, shared GPIO support\")\nLink: https://patch.msgid.link/20261014-gpio-shared-fwnode-lookup-v4-2-2253ad645fd6@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "bd22f7e63509fa758cf500d9af3e88a3d3df96be", "tree": "505df023c37021db22c425508ab9b37005ba70ca", "parents": [ "52336337f1a01ad803c7f3ddb23f40222e9ad58d" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 11:38:25 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Oct 15 14:05:28 2026 +0200" }, "message": "gpio: shared: fix use-after-free bug when adding shared proxies\n\nThe GPIO lookup table can stay alive for longer than the kobject whose\nname string\u0027s address we\u0027re assigning to lookup-\u003edev_id. Fix a potential\nUAF by duplicating the string.\n\nCc: stable@vger.kernel.org\nFixes: a060b8c511ab (\"gpiolib: implement low-level, shared GPIO support\")\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20261014-gpio-shared-fwnode-lookup-v4-1-2253ad645fd6@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "7b16eb911091aae237a8673da94e4dfb9cd21d54", "tree": "28a883138c74cdd361842c3eca476fca2f0c8dad", "parents": [ "8070ed578b6b9134e045627fb745c887a806d46e" ], "author": { "name": "Jérémy Jean", "email": "Jeremy.Jean@oss.cyber.gouv.fr", "time": "Thu Oct 08 18:13:49 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 13:00:02 2026 +0200" }, "message": "net/sched: fix use-after-free in __tcf_action_put()\n\n__tcf_action_put() decrements the reference count before decrementing the\nbinding count. Another thread can free the action between these operations,\ncausing the binding-count update to access freed memory. KASAN reports it\nas:\n\n BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340\n Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64\n\nHold the action IDR mutex across both counter updates and IDR removal,\nkeeping cleanup outside the lock.\n\nFixes: 16af6067392c (\"net: sched: implement reference counted action release\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261008181348.527035-2-Jeremy.Jean@oss.cyber.gouv.fr\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8070ed578b6b9134e045627fb745c887a806d46e", "tree": "7c40e55a654e8e4da7ad78420ce5c6c8f866e39f", "parents": [ "1c1e8c24d537ba6133f08f523a2b8c626da4e966" ], "author": { "name": "Joas Antonio dos Santos", "email": "joasantonio108@gmail.com", "time": "Fri Oct 09 12:59:19 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 12:50:03 2026 +0200" }, "message": "calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n\ncalipso_skbuff_setattr() adjusts payload_len by the length of the\noption it inserts or resizes:\n\n\tpayload \u003d ntohs(ip6_hdr-\u003epayload_len);\n\tip6_hdr-\u003epayload_len \u003d htons(payload + len_delta);\n\nGRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores\npayload_len \u003d\u003d 0 for them; ipv6_payload_len() then falls back to\nskb-\u003elen. For such a packet forwarded to a destination mapped to\nCALIPSO, the code above writes len_delta (or 65536 + len_delta when\nshrinking) into payload_len, and ipv6_payload_len() no longer falls\nback to skb-\u003elen. nf_tables, conntrack and sch_cake rely on it.\n\nThe same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,\nand a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its\nreal length back.\n\nSet payload_len from the skb length with ipv6_set_payload_len(), which\nstores 0 above IPV6_MAXPLEN and the real length otherwise, as\nipv6_gro_complete() does. The network header was just reset to\nskb-\u003edata, so skb-\u003elen - sizeof(*ip6_hdr) is the payload length.\n\nTested on one kernel (arm64, QEMU) with SELinux permissive, a minimal\nmdp-generated policy (network_peer_controls\u003d1), \"netlabelctl calipso\nadd pass doi:16\" and a NetLabel mapping of fd00:2::/64 to CALIPSO\nDOI 16. calipso_skbuff_setattr() was called through\nnetlbl_skbuff_setattr() from a test-only debugfs hook (not part of\nthis patch) adding a level-only label; payload_len after the call:\n\n case before fix after fix real length\n 1000, unlabeled 1016 1016 1016\n 70000 GSO, payload_len 0 16 0 70016\n 65530 GSO, grows past MAXPLEN 10 0 65546\n 65540 GSO with a 24 byte hop\n header, shrinks below MAXPLEN 65528 65532 65532\n 1000 with a 24 byte hop header 992 992 992\n\n(0 means ipv6_payload_len() returns the real length.) On the forward\npath, with a client injecting unlabeled UDP through a router to a\nserver, the router adds the CALIPSO option and the server delivers all\ndatagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.\n\nFixes: 81fbc812132c (\"ipv6/gro: insert temporary HBH/jumbo header\")\nSuggested-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nSuggested-by: Wang Zhan \u003cwang.zhan@smartx.com\u003e\nSigned-off-by: Joas Antonio dos Santos \u003cjoasantonio108@gmail.com\u003e\nAssisted-by: Claude:claude-opus-5-5\nReviewed-by: Wang Zhan \u003cwang.zhan@smartx.com\u003e\nAcked-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nLink: https://patch.msgid.link/179156155963.36253.400481753322266658@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1c1e8c24d537ba6133f08f523a2b8c626da4e966", "tree": "520f0800e8cf1fd8a25cb3c148a8865faeff9710", "parents": [ "89771ce4f8f67dcffae561b2ccac95c0f6e3aa01" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Fri Oct 09 06:39:25 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 12:20:02 2026 +0200" }, "message": "MAINTAINERS: add Gustavo Luiz Duarte as netconsole reviewer\n\nGustavo has been the most active netconsole reviewer, let\u0027s add him\nto the MAINTAINERS file.\n\nAdd an R: entry so get_maintainer.pl Cc\u0027s Gustavo on netconsole patches.\n\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nAcked-by: Gustavo Luiz Duarte \u003cgustavold@gmail.com\u003e\nLink: https://patch.msgid.link/20261009-netcon_main-v1-1-6d298ab5a0cd@debian.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "89771ce4f8f67dcffae561b2ccac95c0f6e3aa01", "tree": "a108e1d18bb1e39e234e08a89bcca807d6fc7d5f", "parents": [ "052b8920dd3c71438951113cad1d80a23cab7daa" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Fri Oct 09 12:10:41 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 12:03:14 2026 +0200" }, "message": "net: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the driver the same\nskb while earlier copies are still in the ring:\n\n modprobe pktgen\n pg\u003d/proc/net/pktgen\n echo \"add_device eth0\" \u003e $pg/kpktgend_0\n echo \"dst_mac AA:BB:CC:DD:EE:FF\" \u003e $pg/eth0\n echo \"dst 192.0.2.1\" \u003e $pg/eth0\n echo \"clone_skb 8\" \u003e $pg/eth0\n echo \"count 0\" \u003e $pg/eth0\n echo start \u003e $pg/pgctrl \u0026\n sleep 5\n echo stop \u003e $pg/pgctrl\n wait\n cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight\n\ninflight stays nonzero on the now idle queue. clone_skb 0 leaves it at\nzero.\n\nFixes: f48bed16a756 (\"net: bcmgenet: Free skb after last Tx frag\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20261009-nb-genet-shared-skb-net-v1-1-c6d0a841977d@tipi-net.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "052b8920dd3c71438951113cad1d80a23cab7daa", "tree": "ae2eb93396ddcd28f375b98bb135058292b9162a", "parents": [ "f88bb3606e4bd11ee035b682cddc2999e604609a", "2a3f6d2a9ac364c68e4f5b24128ba14be48b024a" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:24 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:26 2026 +0200" }, "message": "Merge branch \u0027net-move-setting-of-netops-to-fix-crash\u0027\n\nDavid Yang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: Move setting of netops to fix crash\n\nCommit ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev()\nlocking assertion\") put a netdev_need_ops_lock() check on the\nphy_attach_direct() path, in phy_link_topo_add_phy(). With\nCONFIG_NET_SHAPER enabled netdev_need_ops_lock() reads\ndev-\u003enetdev_ops-\u003enet_shaper_ops, so any driver that connects a PHY\nbefore assigning ndev-\u003enetdev_ops now dies with a NULL pointer\ndereference at probe time. The breakage showed up in v7.3-rc1.\n\nibm/emac was hit first and fixed by commit 7c9f391ec89c (\"net: emac:\nmove setting of netops to fix crash\"). These ten patches apply the\nsame one-line move to the remaining in-tree drivers whose probe path\nattaches a PHY before filling in netdev_ops:\n\n 1. hisilicon/hisi_femac (crash reproduced on hardware)\n 2. hisilicon/hip04\n 3. actions/owl-emac\n 4. adi/adin1140\n 5. marvell/mv643xx_eth\n 6. amd/au1000_eth\n 7. ethoc\n 8. aeroflex/greth\n 9. ti/icssm-prueth\n 10. microchip/lan865x (attach happens inside oa_tc6_init())\n\nOnly patch 1 was reproduced and verified on hardware; patches 2-10\nwere found by source inspection and are neither build nor boot\ntested.\n\nNote that ti/netcp_ethss and cavium/thunder_bgx attach a PHY to\nnetdevs that never get a netdev_ops at all (dummy netdevs), so they\ncannot be fixed by reordering and are not addressed here.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261008022656.3592191-1-mmyangfl@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2a3f6d2a9ac364c68e4f5b24128ba14be48b024a", "tree": "ae2eb93396ddcd28f375b98bb135058292b9162a", "parents": [ "955bb7cf680d8699ce94c73539af882840a9be43" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:52 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:22 2026 +0200" }, "message": "microchip: lan865x: move setting of netops to fix crash\n\nlan865x_probe() assigns netdev_ops only after oa_tc6_init(), which\nconnects the internal MAC-PHY through phy_connect_direct().\nphy_attach_direct() -\u003e phy_link_topo_add_phy() reads dev-\u003enetdev_ops\nthrough netdev_need_ops_lock() since the commit in question, so probing\ncrashes with a NULL pointer dereference when CONFIG_NET_SHAPER is\nenabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-11-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "955bb7cf680d8699ce94c73539af882840a9be43", "tree": "b5de780b6fb4702a80f5907aabdbbeadafa8a55b", "parents": [ "d71483f0716e7ae98578817bfdc8a5b822d250f8" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:51 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: ti: icssm-prueth: Move setting of netops to fix crash\n\nicssm_prueth_netdev_init() calls of_phy_get_and_connect() before\nndev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-10-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d71483f0716e7ae98578817bfdc8a5b822d250f8", "tree": "b22904433f238b6581688b7d67da37d26c918533", "parents": [ "c9f8ce62a5faa73515ff5457716bd7306d20fd93" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:50 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: ethernet: aeroflex: move setting of netops to fix crash\n\ngreth_of_probe() calls greth_mdio_init(), which connects the PHY,\nbefore dev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nAcked-by: Andreas Larsson \u003candreas@gaisler.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-9-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c9f8ce62a5faa73515ff5457716bd7306d20fd93", "tree": "2c488b5506ee463e0c2d2b85fba73d21ea8e8cae", "parents": [ "beabbafdd0f6779813a7656baa1b412b19bda911" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:49 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: ethoc: move setting of netops to fix crash\n\nethoc_probe() calls ethoc_mdio_probe(), which connects the PHY,\nbefore netdev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-8-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "beabbafdd0f6779813a7656baa1b412b19bda911", "tree": "43469b3b22b19fe5a4662babf95c0fbd7c7bdda5", "parents": [ "a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:48 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: au1000: move setting of netops to fix crash\n\nau1000_probe() calls au1000_mii_probe(), which connects the PHY,\nbefore dev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-7-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a", "tree": "4ba2a0db1aa0b4ed2a4a1002bbfb1ffa5048038b", "parents": [ "ea1565cbf0637b966eb31a2cf9a8159d673d4e09" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:47 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: mv643xx: move setting of netops to fix crash\n\nmv643xx_eth_probe() connects the PHY before dev-\u003enetdev_ops is\nassigned. phy_attach_direct() -\u003e phy_link_topo_add_phy() reads\ndev-\u003enetdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-6-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ea1565cbf0637b966eb31a2cf9a8159d673d4e09", "tree": "660d1f1a8c1f6105952b7df37d5bbaba10d61974", "parents": [ "c2c4824319850c87e77d26aeb8f860bc310a64d7" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:46 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: ethernet: adi: Move setting of netops to fix crash\n\nadin1140_probe() calls adin1140_phy_init(), which connects the PHY,\nbefore netdev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Ciprian Regus \u003cciprian.regus@analog.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-5-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c2c4824319850c87e77d26aeb8f860bc310a64d7", "tree": "94bd9d1dfd36085a760ca039e9fdf6aed4c35867", "parents": [ "0d9342701f14ec0a9465772b7cd5d515c1ecd818" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:45 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: ethernet: actions: Move setting of netops to fix crash\n\nowl_emac_probe() calls owl_emac_phy_init(), which connects the PHY,\nbefore netdev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-4-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0d9342701f14ec0a9465772b7cd5d515c1ecd818", "tree": "4aa04475647cde96b289b5314ca02e39577a476a", "parents": [ "444889dfa27b54b39026e962464b1f8f9093e1ea" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:44 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: hisilicon: hip04_eth: Move setting of netops to fix crash\n\nhip04_mac_probe() calls of_phy_connect() before ndev-\u003enetdev_ops is\nassigned. phy_attach_direct() -\u003e phy_link_topo_add_phy() reads\ndev-\u003enetdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-3-mmyangfl@gmail.com\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "444889dfa27b54b39026e962464b1f8f9093e1ea", "tree": "7e0f91c4ce43b09ee332cfeaeca60e7d4e12844c", "parents": [ "f88bb3606e4bd11ee035b682cddc2999e604609a" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu Oct 08 10:26:43 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:39:21 2026 +0200" }, "message": "net: hisilicon: hisi_femac: Move setting of netops to fix crash\n\nhisi_femac_drv_probe() connects the PHY before dev-\u003enetdev_ops is\nassigned. phy_attach_direct() -\u003e phy_link_topo_add_phy() reads\ndev-\u003enetdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\n phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c\n of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558\n Kernel panic - not syncing: Attempted to kill init! exitcode\u003d0x0000000b\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\").\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nLink: https://patch.msgid.link/20261008022656.3592191-2-mmyangfl@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f88bb3606e4bd11ee035b682cddc2999e604609a", "tree": "fae05efdc546e414916a2f8df8d3fc3ec4026b53", "parents": [ "513444cc62e231a11c9b15ea88de0890da9b2b4f" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Wed Oct 07 18:14:00 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 15 10:27:45 2026 +0200" }, "message": "netlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table\u0027s bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace\u0027s unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace\u0027s lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\n\nReading the socket\u0027s namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\n\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later.\n\nFixes: c428ecd1a21f (\"netlink: Move namespace into hash key\")\nAssisted-by: LLM\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261008011359.63727-2-kylebot@openai.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "dbc393f6f009a2bf7e4a22ef2d70b53f533f20f4", "tree": "e2154cff978005d7cd63e629e74c9ce2276695c3", "parents": [ "ca039df94983c441fdee0e2488263fc744e8ecb6" ], "author": { "name": "Wei Liu", "email": "wei.liu@kernel.org", "time": "Thu Oct 15 00:48:50 2026 -0700" }, "committer": { "name": "Wei Liu", "email": "wei.liu@kernel.org", "time": "Thu Oct 15 00:58:57 2026 -0700" }, "message": "MAINTAINERS: drop KY from Hyper-V maintainers list\n\nKY has retired from Microsoft.\n\nSigned-off-by: Wei Liu \u003cwei.liu@kernel.org\u003e\n" }, { "commit": "ec6b083915e8146e147314a5f4f1285d07b57bfc", "tree": "0a7433878e60ace4021e74133b057a8a21d4380c", "parents": [ "81e097a064b28b4a1f6ca1a8b433e659c1bd64c0" ], "author": { "name": "Stanley Jhu", "email": "stanleyjhu@google.com", "time": "Tue Oct 13 21:27:08 2026 +0800" }, "committer": { "name": "Martin K. Petersen (Oracle)", "email": "mkp@kernel.org", "time": "Wed Oct 14 22:14:52 2026 -0400" }, "message": "scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies\n\nbsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per\njob, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct\nufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command\nreturns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after\nthe 40-byte header and writes 8 bytes past the end of the buffer.\n\nLet each BSG transport pass its reply buffer size to bsg_setup_queue()\nand have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full\nreply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.\n\nFixes: 6ff265fc5ef6 (\"scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg\")\nCc: stable@vger.kernel.org\nSigned-off-by: Stanley Jhu \u003cstanleyjhu@google.com\u003e\nLink: https://patch.msgid.link/20261013132708.1669415-1-stanleyjhu@google.com\nSigned-off-by: Martin K. Petersen (Oracle) \u003cmkp@kernel.org\u003e\n" }, { "commit": "81e097a064b28b4a1f6ca1a8b433e659c1bd64c0", "tree": "b9bdaad6bd3e72ce0b9860c9c2c5616eb4cdb1aa", "parents": [ "11bffcd9cb346732eab2914ef44fe777a3f0b585" ], "author": { "name": "Xingui Yang", "email": "yangxingui@huawei.com", "time": "Mon Sep 28 12:02:34 2026 +0800" }, "committer": { "name": "Martin K. Petersen (Oracle)", "email": "mkp@kernel.org", "time": "Wed Oct 14 22:10:43 2026 -0400" }, "message": "scsi: libsas: Fix SMP IO deadlock during HA resume\n\nsmp_execute_task_sg() calls pm_runtime_get_sync() on the host before\nissuing an SMP command. When that command is itself issued from the HA\nresume path, the get_sync() deadlocks: it waits for the ongoing resume\n(the device is RPM_RESUMING), while the resume is blocked in\nsas_drain_work() waiting for that same SMP IO to complete.\n\nThe deadlock needs an expander-attached SATA disk. During\nsas_resume_ha() -\u003e sas_drain_work(), DISCE_RESUME -\u003e sas_resume_sata()\n-\u003e ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for\nsuch a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() -\u003e\nsas_phy_reset() -\u003e sas_smp_phy_control() -\u003e\nsmp_execute_task_sg()). Direct-attached SATA resets through\nlldd_control_phy() and SSP devices use TMFs, so neither hits this.\n\nReplace the get_sync()/put_sync() pair with\npm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only\nneeds to hold off autosuspend while the SMP is in flight, and it must\nnot try to resume the host: a sync resume issued from the HA resume path\nitself is what deadlocks, and by the time sas_resume_ha() runs, hw_init\nhas already reinitialized the hardware, so the device is accessible\nwithout one.\n\nThe usage reference is still required. Discovery work normally runs\ninside an event worker\u0027s PM reference, taken at sas_notify_port_event()\nnotify time and held until the handler has flushed the disco\nqueue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN\nfrom within the revalidation worker itself, and flush_workqueue() does\nnot wait for work items queued during execution, so that chained\nrevalidation runs with no outer PM reference - without the\nget_noresume(), its SMP could race autosuspend.\n\nFor the BSG path, sas_smp_handler() is the only caller which may find\nthe host autosuspended: expander SMP requests do not go through any SCSI\ndevice request queue, so nothing else in that path holds the host\nawake. Resume it there with pm_runtime_resume_and_get() and check the\nresult.\n\nFixes: 3dbbbf656b850 (\"scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race\")\nSigned-off-by: Xingui Yang \u003cyangxingui@huawei.com\u003e\nReviewed-by: John Garry \u003cjohn.garry@linux.dev\u003e\nLink: https://patch.msgid.link/20260928040234.992912-1-yangxingui@huawei.com\nSigned-off-by: Martin K. Petersen (Oracle) \u003cmkp@kernel.org\u003e\n" }, { "commit": "66c658033d842bb75f81f20aaa4a378fe47be1a1", "tree": "70e7c3f5958734e43cfaa4e393137d223a752fab", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Martin Kaiser", "email": "martin@kaiser.cx", "time": "Wed Oct 14 10:37:40 2026 +0200" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Thu Oct 15 10:09:36 2026 +0900" }, "message": "tracing: probes: error if BTF is required but unavailable\n\ntraceprobe_expand_meta_args expands probe arguments based on BTF info.\n\nReturn an error if we have arguments that need expanding but BTF is not\nsupported.\n\nThe params variable is now unused, it can be removed.\n\nLink: https://lore.kernel.org/all/20261014083838.31020-1-martin@kaiser.cx/\n\nFixes: d157d7694460 (\"tracing/probes: Support BTF field access from $retval\")\nSigned-off-by: Martin Kaiser \u003cmartin@kaiser.cx\u003e\nReviewed-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "9fee1f650a0a9ea6fa7c0b26244a778dd92542d5", "tree": "198141a1def7d9c1896007a16c05b11acdefc300", "parents": [ "db7afcbf9eef65aa8bfe6edb5ff4b4a92d1a4792", "d1a4549a3645e55cc9ade09e360280590b3c9559" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 14 16:11:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 14 16:11:57 2026 -0700" }, "message": "Merge tag \u0027wq-for-7.3-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue fix from Tejun Heo:\n\n - Fix a NULL dereference in the check for whether the current task is\n running a memory reclaim work item when called from a kworker outside\n work item execution\n\n* tag \u0027wq-for-7.3-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n workqueue: Fix NULL current_pwq deref in mem-reclaim helper\n" }, { "commit": "c9fc60c18b6d42efdea0cd88ca132b2f452157c3", "tree": "f7d87a761567122de2cae89bb155a613a1fd3382", "parents": [ "2cd88c498ecff8e22bf4c397b8eb226db70ac343" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Tue Oct 13 11:20:46 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Oct 14 19:03:40 2026 -0400" }, "message": "ring-buffer: Skip si_mem_available() for persistent and remote buffers\n\nPersistent and remote buffer memory is pre-allocated by the time\n__rb_allocate_pages() is called. Skip si_mem_available() to avoid\nwrongly failing the allocation under memory pressure.\n\nFor the same reason, unset user_thread.\n\nLink: https://patch.msgid.link/20261013102047.1488347-2-vdonnefort@google.com\nFixes: be68d63a139b (\"ring-buffer: Add ring_buffer_alloc_range()\")\nFixes: 2e67fabd8b77 (\"ring-buffer: Introduce ring-buffer remotes\")\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "2cd88c498ecff8e22bf4c397b8eb226db70ac343", "tree": "2a3e1e41f8a7557fb2156502c21f81371443dd73", "parents": [ "b3b974008388ab59e44d764ba7a63c988fec2524" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 09 23:51:54 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Oct 14 19:03:40 2026 -0400" }, "message": "eventfs: Free the eventfs_inode after an rcu grace period too\n\ntracefs_d_revalidate() reads -\u003eis_freed of the eventfs_inode that\ndentry-\u003ed_fsdata points to, and -\u003ed_revalidate() is called in rcu\npathwalk mode with nothing but rcu_read_lock() held. The dentry itself\nstays around for such a walker, but tracefs_d_release() drops its\nreference to the eventfs_inode when the dentry is killed, and\nrelease_ei() then frees it after a grace period of eventfs_srcu. An\nSRCU grace period doesn\u0027t wait for rcu_read_lock() sections, so the\nwalker can read an eventfs_inode that is already gone.\n\nWith a pathwalk held up in tracefs_d_revalidate() while the dentry goes\naway:\n\n BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90\n Read of size 1 at addr ff1100010152d8d0 by task walker/97\n Call Trace:\n \u003cTASK\u003e\n tracefs_d_revalidate+0x76/0x90\n lookup_fast+0x320/0x640\n path_lookupat+0x160/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n vfs_fstatat+0x4d/0x90\n __do_sys_newfstatat+0xa0/0x100\n do_syscall_64+0x10e/0x5e0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [...]\n Allocated by task 1:\n __kmalloc_cache_noprof+0x249/0x560\n eventfs_create_dir+0x7a/0x590\n event_create_dir+0x2fb/0xcf0\n trace_add_event_call+0xbf/0x150\n [...]\n Freed by task 11:\n kfree+0x1db/0x5b0\n srcu_invoke_callbacks+0x3a3/0x620\n process_one_work+0x937/0x1810\n worker_thread+0x4f1/0xd60\n\nBefore commit 8e556432477e (\"eventfs: Use SRCU for freeing\neventfs_inodes\") release_ei() used call_rcu(), which covered the walker,\nwhile eventfs_iterate() needs the SRCU grace period. Wait for both and\nchain call_rcu() from the SRCU callback.\n\nCc: stable@vger.kernel.org\nFixes: 8e556432477e (\"eventfs: Use SRCU for freeing eventfs_inodes\")\nLink: https://patch.msgid.link/20261009-work-fixes-rcu-v1-4-7446d2d335e6@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b3b974008388ab59e44d764ba7a63c988fec2524", "tree": "bc2e243d9ed61fd8f24e1c14240a33e85b9e262c", "parents": [ "9414ca3b99e5a7f1f3bf51c2a01b383e1b355dd0" ], "author": { "name": "Amit Machhiwal", "email": "amachhiw@linux.ibm.com", "time": "Fri Oct 09 22:05:56 2026 +0530" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Oct 14 19:03:40 2026 -0400" }, "message": "tracing: Do not initialize tracefs work if tracing is disabled\n\nIf trace buffer allocation fails during early boot (e.g. in\nearly_trace_init() -\u003e allocate_trace_buffers()), tracing_disabled is\nleft set to 1 and the global trace array events list remains\nuninitialized.\n\nLater during boot, tracer_init_tracefs() (invoked via fs_initcall)\nqueues tracerfs_init_work asynchronously without checking if tracing was\ndisabled. When tracer_init_tracefs_work_func() runs, it calls\nevent_trace_init() and init_tracer_tracefs(\u0026global_trace, NULL)\nunconditionally. This leads to __find_event_file() dereferencing an\nuninitialized tr-\u003eevents list, causing an early boot NULL pointer\ndereference Oops:\n\n BUG: Kernel NULL pointer dereference on read at 0x00000010\n Faulting instruction address: 0xc000000000485be0\n Oops: Kernel access of bad area, sig: 7 [#1]\n ...\n NIP [c000000000485be0] __find_event_file+0x70/0x3c0\n LR [c000000000448874] init_tracer_tracefs+0x274/0xc80\n Call Trace:\n init_tracer_tracefs+0x274/0xc80\n tracer_init_tracefs_work_func+0x50/0x320\n process_one_work+0x1e8/0x5c0\n worker_thread+0x1dc/0x3d0\n kthread+0x194/0x1b0\n start_kernel_thread+0x14/0x18\n\nCheck tracing_disabled at the beginning of tracer_init_tracefs_work_func()\nand return immediately if tracing is disabled or failed to initialize,\npreventing the crash.\n\nCc: stable@vger.kernel.org\nFixes: 6621a7004684 (\"tracing: make tracer_init_tracefs initcall asynchronous\")\nLink: https://patch.msgid.link/20261009163557.88467-2-amachhiw@linux.ibm.com\nReported-by: Michal Suchánek \u003cmsuchanek@suse.de\u003e\nCloses: https://lore.kernel.org/all/arYskzbiaNzBR9MD@kunlun.suse.cz/\nSigned-off-by: Amit Machhiwal \u003camachhiw@linux.ibm.com\u003e\nTested-by: Michal Suchánek \u003cmsuchanek@suse.de\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "9414ca3b99e5a7f1f3bf51c2a01b383e1b355dd0", "tree": "12561828210b30baf2a7db13dba0da400d593b2f", "parents": [ "3110d09bb98e3ac66482a7b257548a1683ec6c1a" ], "author": { "name": "Tengda Wu", "email": "wutengda@huaweicloud.com", "time": "Tue Sep 29 10:40:15 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Oct 14 19:03:40 2026 -0400" }, "message": "tracing: Fix hist trigger timestamps for buffered events\n\nSyzkaller triggered a WARN_ON_ONCE(!nest) warning:\n\n WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp\n Call trace:\n ring_buffer_event_time_stamp\n hist_field_timestamp\n hist_fn_call\n event_hist_trigger\n event_triggers_call\n __event_trigger_test_discard\n trace_event_buffer_commit\n do_trace_event_raw_event_sched_switch\n trace_event_raw_event_sched_switch\n\nThe warning is probabilistically reproducible and is related to syzkaller\nexecuting the following commands:\n\n echo \u0027prev_pid \u003d\u003d 999999\u0027 \u003e events/sched/sched_switch/filter\n echo \u0027hist:keys\u003dcommon_timestamp\u0027 \u003e events/sched/sched_switch/trigger\n\nThe specific triggering process is as follows:\n\nCPU 0 CPU 1\n(context switching) (echo \u0027hist:keys\u003dcommon_timestamp\u0027 \u003e \\\n events/sched/sched_switch/trigger)\ndo_trace_event_raw_event_##call\n trace_event_buffer_lock_reserve\n if (!tr-\u003eno_filter_buffering_ref \u0026\u0026\n trace_file-\u003eflags \u0026 EVENT_FILE_FL_FILTERED)\n return entry; // return directly\n event_hist_trigger_parse\n hist_register_trigger\n tracing_set_filter_buffering(file-\u003etr, true);\n tr-\u003eno_filter_buffering_ref++;\n __trace_buffer_lock_reserve\n rb_start_commit\n local_inc(\u0026cpu_buffer-\u003ecommitting); // skipped and not executed\n trace_event_buffer_commit\n __event_trigger_test_discard\n event_triggers_call\n event_hist_trigger\n hist_fn_call\n hist_field_timestamp\n ring_buffer_event_time_stamp\n nest \u003d local_read(\u0026cpu_buffer-\u003ecommitting);\n WARN_ON_ONCE(!nest) // trigger warning\n\nThe root cause is that when an event file has a filter attached and the\nhist trigger has not yet been attached, trace_event_buffer_lock_reserve()\nwrites the event into the per-CPU trace_buffered_event temp buffer instead\nof reserving it in the ring buffer, so cpu_buffer-\u003ecommitting is not\nincremented. When the event is later processed at commit time by a hist\ntrigger, hist_field_timestamp() -\u003e ring_buffer_event_time_stamp() sees a\nzero committing count, triggering WARN_ON_ONCE(!nest).\n\ntracing_event_time_stamp() was added by commit d8279bfc5e959 (\"tracing:\nAdd tracing_event_time_stamp() API\") for exactly this case: if the event\nis the per-CPU trace_buffered_event, it returns the current ring buffer\ntimestamp. But it never gained a caller. Use it in hist_field_timestamp(),\nso that a hist trigger that races onto a buffered event records the\ncurrent time, which is only marginally later than when the event was\nrecorded, instead of warning and recording a bogus timestamp.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260929104015.1689921-1-wutengda@huaweicloud.com\nFixes: b94bc80df648 (\"tracing: Use a no_filter_buffering_ref to stop using the filter buffer\")\nSigned-off-by: Tengda Wu \u003cwutengda@huaweicloud.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" } ], "next": "3110d09bb98e3ac66482a7b257548a1683ec6c1a" }