)]}' { "log": [ { "commit": "dd9b004b7ff3289fb7bae35130c0a5c0537266af", "tree": "a30fe3337073103d38c129f2d3d3041ee0d0f664", "parents": [ "516471569089749163be24b973ea928b56ac20d9", "39263f986da55c5b7bc328c757fe378a6a41799d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 09:30:55 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 09:30:55 2025 +1200" }, "message": "Merge tag \u0027trace-v6.19-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Add Documentation/core-api/tracepoint.rst to TRACING in MAINTAINERS\n file\n\n Updates to the tracepoint.rst document should be reviewed by the\n tracing maintainers.\n\n - Fix warning triggered by perf attaching to synthetic events\n\n The synthetic events do not add a function to be registered when perf\n attaches to them. This causes a warning when perf registers a\n synthetic event and passes a NULL pointer to the tracepoint register\n function.\n\n Ideally synthetic events should be updated to work with perf, but as\n that\u0027s a feature and not a bug fix, simply now return -ENODEV when\n perf tries to register an event that has a NULL pointer for its\n function. This no longer causes a kernel warning and simply causes\n the perf code to fail with an error message.\n\n - Fix 32bit overflow in option flag test\n\n The option\u0027s flags changed from 32 bits in size to 64 bits in size.\n Fix one of the places that shift 1 by the option bit number to to be\n 1ULL.\n\n - Fix the output of printing the direct jmp functions\n\n The enabled_functions that shows how functions are being attached by\n ftrace wasn\u0027t updated to accommodate the new direct jmp trampolines\n that set the LSB of the pointer, and outputs garbage. Update the\n output to handle the direct jmp trampolines.\n\n* tag \u0027trace-v6.19-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ftrace: Fix address for jmp mode in t_show()\n tracing: Fix UBSAN warning in __remove_instance()\n tracing: Do not register unsupported perf events\n MAINTAINERS: add tracepoint core-api doc files to TRACING\n" }, { "commit": "516471569089749163be24b973ea928b56ac20d9", "tree": "a18cbf8645674ee84f0c853fb265208ed97d690d", "parents": [ "5caa3808bc29de989f46451124e109dd33e464c6", "5a0b1882506858b12cc77f0e2439a5f3c5052761" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:39:48 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:39:48 2025 +1200" }, "message": "Merge tag \u0027libcrypto-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux\n\nPull crypto library fixes from Eric Biggers:\n\n - Fix a performance issue with the scoped_ksimd() macro (new in 6.19)\n where it unnecessarily initialized the entire fpsimd state.\n\n - Add a missing gitignore entry for a generated file added in 6.18.\n\n* tag \u0027libcrypto-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:\n lib/crypto: riscv: Add poly1305-core.S to .gitignore\n arm64/simd: Avoid pointless clearing of FP/SIMD buffer\n" }, { "commit": "5caa3808bc29de989f46451124e109dd33e464c6", "tree": "e66cc89dccc0bf0ddad807a8c76dce1caf026feb", "parents": [ "eb23a1198d2317072a44ac1b8f5742f4cb48ce2c", "f103fa127c93016bcd89b05d8e11dc1a84f6990d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:37:08 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:37:08 2025 +1200" }, "message": "Merge tag \u0027acpi-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fixes from Rafael Wysocki:\n \"These add a missing PCC check for guaranteed_perf in the ACPI CPPC\n library and fix a static local variable access race condition in\n acpi_pcc_address_space_setup() (Pengjie Zhang)\"\n\n* tag \u0027acpi-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: PCC: Fix race condition by removing static qualifier\n ACPI: CPPC: Fix missing PCC check for guaranteed_perf\n" }, { "commit": "eb23a1198d2317072a44ac1b8f5742f4cb48ce2c", "tree": "2d2f87c270e4b0be2a959beb39139b8ad5ad080b", "parents": [ "14e0e8d0fcf24963e641ba375aa2e069f0bd2c1c", "277141a897c715e787f6c51e5db32f2ca90b00dc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:28:02 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:28:02 2025 +1200" }, "message": "Merge tag \u0027pm-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix three issues in the power capping code including one recent\n regression and a runtime PM framework regression introduced during the\n 6.17 development cycle:\n\n - Fix CPU hotplug locking deadlock reported by lockdep after a recent\n update of the Intel RAPL power capping driver (Srinivas Pandruvada)\n\n - Fix sscanf() error return value handling in the power capping core\n and a race condition in register_control_type() (Sumeet Pawnikar)\n\n - Fix a concurrent bit field update issue in the runtime PM core code\n by only updating the bit field in question when runtime PM is\n disabled (Rafael Wysocki)\"\n\n* tag \u0027pm-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n powercap: intel_rapl: Fix possible recursive lock warning\n PM: runtime: Do not clear needs_force_resume with enabled runtime PM\n powercap: fix sscanf() error return value handling\n powercap: fix race condition in register_control_type()\n" }, { "commit": "14e0e8d0fcf24963e641ba375aa2e069f0bd2c1c", "tree": "704c73356f7995c70c67c594a3d1fb18571e7260", "parents": [ "cf26839d7fca7eb33ecadb7813427dbff3a7a2cd", "d113735421da322ea144c9778c433de6ff6bc57b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:23:23 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:23:23 2025 +1200" }, "message": "Merge tag \u0027thermal-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control fixes from Rafael Wysocki:\n \"These enable a new hardware feature in the int340x thermal driver and\n fix up comments in the thermal core code:\n\n - Set a feature flag in the int340x thermal driver to enable the\n power slider interface for Wildcat Lake processors (Srinivas\n Pandruvada)\n\n - Fix typo and indentation in comments in the thermal core (Thorsten\n Blum)\"\n\n* tag \u0027thermal-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n thermal: core: Fix typo and indentation in comments\n thermal: intel: int340x: Enable power slider interface for Wildcat Lake\n" }, { "commit": "cf26839d7fca7eb33ecadb7813427dbff3a7a2cd", "tree": "64d8c18656e7e2ee8bf18f69d60f31cabfb3e24b", "parents": [ "7b8e9264f55a9c320f398e337d215e68cca50131", "e6a973af11135439de32ece3b9cbe3bfc043bea8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:11:53 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 08:11:53 2025 +1200" }, "message": "Merge tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd\n\nPull iommufd fixes from Jason Gunthorpe:\n \"A few minor fixes, other than the randconfig fix this is only relevant\n to test code, not releases:\n\n - Randconfig failure if CONFIG_DMA_SHARED_BUFFER is not set\n\n - Remove gcc warning in kselftest\n\n - Fix a refcount leak on an error path in the selftest support code\n\n - Fix missing overflow checks in the selftest support code\"\n\n* tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:\n iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED\n iommufd/selftest: Do not leak the hwpt if IOMMU_TEST_OP_MD_CHECK_MAP fails\n iommufd/selftest: Make it clearer to gcc that the access is not out of bounds\n iommufd: Fix building without dmabuf\n" }, { "commit": "7b8e9264f55a9c320f398e337d215e68cca50131", "tree": "39301e904e265ad971432662897166e28f589589", "parents": [ "a91e1138b7cb0e4dfa12ef823c6eedb34b28bd08", "21a88f5d9ce0c328486073b75d082d85a1e98a8b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 07:55:35 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 07:55:35 2025 +1200" }, "message": "Merge tag \u0027net-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter and CAN.\n\n Current release - regressions:\n\n - netfilter: nf_conncount: fix leaked ct in error paths\n\n - sched: act_mirred: fix loop detection\n\n - sctp: fix potential deadlock in sctp_clone_sock()\n\n - can: fix build dependency\n\n - eth: mlx5e: do not update BQL of old txqs during channel\n reconfiguration\n\n Previous releases - regressions:\n\n - sched: ets: always remove class from active list before deleting it\n\n - inet: frags: flush pending skbs in fqdir_pre_exit()\n\n - netfilter: nf_nat: remove bogus direction check\n\n - mptcp:\n - schedule rtx timer only after pushing data\n - avoid deadlock on fallback while reinjecting\n\n - can: gs_usb: fix error handling\n\n - eth:\n - mlx5e:\n - avoid unregistering PSP twice\n - fix double unregister of HCA_PORTS component\n - bnxt_en: fix XDP_TX path\n - mlxsw: fix use-after-free when updating multicast route stats\n\n Previous releases - always broken:\n\n - ethtool: avoid overflowing userspace buffer on stats query\n\n - openvswitch: fix middle attribute validation in push_nsh() action\n\n - eth:\n - mlx5: fw_tracer, validate format string parameters\n - mlxsw: spectrum_router: fix neighbour use-after-free\n - ipvlan: ignore PACKET_LOOPBACK in handle_mode_l2()\n\n Misc:\n\n - Jozsef Kadlecsik retires from maintaining netfilter\n\n - tools: ynl: fix build on systems with old kernel headers\"\n\n* tag \u0027net-6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)\n net: hns3: add VLAN id validation before using\n net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx\n net: hns3: using the num_tqps in the vf driver to apply for resources\n net: enetc: do not transmit redirected XDP frames when the link is down\n selftests/tc-testing: Test case exercising potential mirred redirect deadlock\n net/sched: act_mirred: fix loop detection\n sctp: Clear inet_opt in sctp_v6_copy_ip_options().\n sctp: Fetch inet6_sk() after setting -\u003epinet6 in sctp_clone_sock().\n net/handshake: duplicate handshake cancellations leak socket\n net/mlx5e: Don\u0027t include PSP in the hard MTU calculations\n net/mlx5e: Do not update BQL of old txqs during channel reconfiguration\n net/mlx5e: Trigger neighbor resolution for unresolved destinations\n net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init\n net/mlx5: Serialize firmware reset with devlink\n net/mlx5: fw_tracer, Handle escaped percent properly\n net/mlx5: fw_tracer, Validate format string parameters\n net/mlx5: Drain firmware reset in shutdown callback\n net/mlx5: fw reset, clear reset requested on drain_fw_reset\n net: dsa: mxl-gsw1xx: manually clear RANEG bit\n net: dsa: mxl-gsw1xx: fix .shutdown driver operation\n ...\n" }, { "commit": "a91e1138b7cb0e4dfa12ef823c6eedb34b28bd08", "tree": "12e4ca359a22e110fae92441f1e952b9b0b1f611", "parents": [ "9a903e6d9649e45cee9a8588fa3793fdfc5408ee", "d8a4af8f3d9d3367b2c49b0d9dee529556bdd2f4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 07:50:20 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 07:50:20 2025 +1200" }, "message": "Merge tag \u0027v6.19-rc1-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - important fix for reconnect problem\n\n - minor cleanup\n\n* tag \u0027v6.19-rc1-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n cifs: update internal module version number\n smb: move some SMB1 definitions into common/smb1pdu.h\n smb: align durable reconnect v2 context to 8 byte boundary\n" }, { "commit": "9a903e6d9649e45cee9a8588fa3793fdfc5408ee", "tree": "6b8f7bb5164939ffd888dee47e41909b136c1f25", "parents": [ "ea1013c1539270e372fc99854bc6e4d94eaeff66", "6f7c877cc397ba3c6d8ba44d4a604df3d4182eec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 07:41:17 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 19 07:41:17 2025 +1200" }, "message": "Merge tag \u0027fsnotify_for_v6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull fsnotify fixes from Jan Kara:\n \"Two fsnotify fixes.\n\n The fix from Ahelenia makes sure we generate event when modifying\n inode flags, the fix from Amir disables sending of events from device\n inodes to their parent directory as it could concievably create a\n usable side channel attack in case of some devices and so far we\n aren\u0027t aware of anybody depending on the functionality\"\n\n* tag \u0027fsnotify_for_v6.19-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n fs: send fsnotify_xattr()/IN_ATTRIB from vfs_fileattr_set()/chattr(1)\n fsnotify: do not generate ACCESS/MODIFY events on child for special files\n" }, { "commit": "277141a897c715e787f6c51e5db32f2ca90b00dc", "tree": "dc6afed102444827324e9974908a6be5ce64c9a2", "parents": [ "359afc8eb02a518fbdd0cbd462c8c2827c6cbec2", "dcd0b625fe440d68bb4b97c71d18ca48ecd6e594" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Dec 18 20:31:10 2025 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Dec 18 20:31:10 2025 +0100" }, "message": "Merge branch \u0027pm-powercap\u0027\n\nMerge power capping fixes for 6.19-rc2:\n\n - Fix CPU hotplug locking deadlock reported by lockdep after a recent\n update of the Intel RAPL power capping driver (Srinivas Pandruvada)\n\n - Fix sscanf() error return value handling in the power capping core\n and a race condition in register_control_type() (Sumeet Pawnikar)\n\n* pm-powercap:\n powercap: intel_rapl: Fix possible recursive lock warning\n powercap: fix sscanf() error return value handling\n powercap: fix race condition in register_control_type()\n" }, { "commit": "21a88f5d9ce0c328486073b75d082d85a1e98a8b", "tree": "15e673beb1a2f3faf29e94ef9201e4997516f5d5", "parents": [ "373a34addca0a68b0eb77360035e9885183ffdca", "5a5aff6338c0f4164a6a8d8a7eb400c4054df256" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 17:23:07 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 17:23:07 2025 +0100" }, "message": "Merge tag \u0027linux-can-fixes-for-6.19-20251218\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2025-12-18\n\nthis is a pull request of 3 patches for net/main.\n\nTetsuo Handa contributes 2 patches to fix race windows in the j1939\nprotocol to properly handle disappearing network devices.\n\nThe last patch is by me, it fixes a build dependency with the CAN\ndrivers, that got introduced while fixing a dependency between the CAN\nprotocol and CAN device code.\n\nlinux-can-fixes-for-6.19-20251218\n\n* tag \u0027linux-can-fixes-for-6.19-20251218\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n can: fix build dependency\n can: j1939: make j1939_sk_bind() fail if device is no longer registered\n can: j1939: make j1939_session_activate() fail if device is no longer registered\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20251218123132.664533-1-mkl@pengutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "373a34addca0a68b0eb77360035e9885183ffdca", "tree": "a6bd91bd217a8c8ebe6f4c8ce7ffe774caeba6e6", "parents": [ "2939203ffee818f1e5ebd60bbb85a174d63aab9c", "6ef935e65902bfed53980ad2754b06a284ea8ac1" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:58:31 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:58:32 2025 +0100" }, "message": "Merge branch \u0027there-are-some-bugfix-for-the-hns3-ethernet-driver\u0027\n\nJijie Shao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nThere are some bugfix for the HNS3 ethernet driver\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20251211023737.2327018-1-shaojijie@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6ef935e65902bfed53980ad2754b06a284ea8ac1", "tree": "a6bd91bd217a8c8ebe6f4c8ce7ffe774caeba6e6", "parents": [ "d180c11aa8a6fa735f9ac2c72c61364a9afc2ba7" ], "author": { "name": "Jian Shen", "email": "shenjian15@huawei.com", "time": "Thu Dec 11 10:37:37 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:58:28 2025 +0100" }, "message": "net: hns3: add VLAN id validation before using\n\nCurrently, the VLAN id may be used without validation when\nreceive a VLAN configuration mailbox from VF. The length of\nvlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause\nout-of-bounds memory access once the VLAN id is bigger than\nor equal to VLAN_N_VID.\n\nTherefore, VLAN id needs to be checked to ensure it is within\nthe range of VLAN_N_VID.\n\nFixes: fe4144d47eef (\"net: hns3: sync VLAN filter entries when kill VLAN ID failed\")\nSigned-off-by: Jian Shen \u003cshenjian15@huawei.com\u003e\nSigned-off-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20251211023737.2327018-4-shaojijie@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "d180c11aa8a6fa735f9ac2c72c61364a9afc2ba7", "tree": "8671b031c8ef91d5c4a58ad95d6e5cd740358f97", "parents": [ "c2a16269742e176fccdd0ef9c016a233491a49ad" ], "author": { "name": "Jian Shen", "email": "shenjian15@huawei.com", "time": "Thu Dec 11 10:37:36 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:58:28 2025 +0100" }, "message": "net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx\n\nCurrently, rss_size \u003d num_tqps / tc_num. If tc_num is 1, then num_tqps\nequals rss_size. However, if the tc_num is greater than 1, then rss_size\nwill be less than num_tqps, causing the tqp_index check for subsequent TCs\nusing rss_size to always fail.\n\nThis patch uses the num_tqps to check whether tqp_index is out of range,\ninstead of rss_size.\n\nFixes: 326334aad024 (\"net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx()\")\nSigned-off-by: Jian Shen \u003cshenjian15@huawei.com\u003e\nSigned-off-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20251211023737.2327018-3-shaojijie@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "c2a16269742e176fccdd0ef9c016a233491a49ad", "tree": "4adb0dfb75cee4a3123a62f100fe774f7160964f", "parents": [ "2939203ffee818f1e5ebd60bbb85a174d63aab9c" ], "author": { "name": "Jian Shen", "email": "shenjian15@huawei.com", "time": "Thu Dec 11 10:37:35 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:58:28 2025 +0100" }, "message": "net: hns3: using the num_tqps in the vf driver to apply for resources\n\nCurrently, hdev-\u003ehtqp is allocated using hdev-\u003enum_tqps, and kinfo-\u003etqp\nis allocated using kinfo-\u003enum_tqps. However, kinfo-\u003enum_tqps is set to\nmin(new_tqps, hdev-\u003enum_tqps); Therefore, kinfo-\u003enum_tqps may be smaller\nthan hdev-\u003enum_tqps, which causes some hdev-\u003ehtqp[i] to remain\nuninitialized in hclgevf_knic_setup().\n\nThus, this patch allocates hdev-\u003ehtqp and kinfo-\u003etqp using hdev-\u003enum_tqps,\nensuring that the lengths of hdev-\u003ehtqp and kinfo-\u003etqp are consistent\nand that all elements are properly initialized.\n\nFixes: e2cb1dec9779 (\"net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support\")\nSigned-off-by: Jian Shen \u003cshenjian15@huawei.com\u003e\nSigned-off-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20251211023737.2327018-2-shaojijie@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "2939203ffee818f1e5ebd60bbb85a174d63aab9c", "tree": "ef3c5947c635a9571a1365d906edbdc9f8ee2ceb", "parents": [ "5cba412d6a005719d52dc72b6d7e5a59af979eaa" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Thu Dec 11 10:09:19 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:45:13 2025 +0100" }, "message": "net: enetc: do not transmit redirected XDP frames when the link is down\n\nIn the current implementation, the enetc_xdp_xmit() always transmits\nredirected XDP frames even if the link is down, but the frames cannot\nbe transmitted from TX BD rings when the link is down, so the frames\nare still kept in the TX BD rings. If the XDP program is uninstalled,\nusers will see the following warning logs.\n\nfsl_enetc 0000:00:00.0 eno0: timeout for tx ring #6 clear\n\nMore worse, the TX BD ring cannot work properly anymore, because the\nHW PIR and CIR are not equal after the re-initialization of the TX\nBD ring. At this point, the BDs between CIR and PIR are invalid,\nwhich will cause a hardware malfunction.\n\nAnother reason is that there is internal context in the ring prefetch\nlogic that will retain the state from the first incarnation of the ring\nand continue prefetching from the stale location when we re-initialize\nthe ring. The internal context is only reset by an FLR. That is to say,\nfor LS1028A ENETC, software cannot set the HW CIR and PIR when\ninitializing the TX BD ring.\n\nIt does not make sense to transmit redirected XDP frames when the link is\ndown. Add a link status check to prevent transmission in this condition.\nThis fixes part of the issue, but more complex cases remain. For example,\nthe TX BD ring may still contain unsent frames when the link goes down.\nThose situations require additional patches, which will build on this\none.\n\nFixes: 9d2b68cc108d (\"net: enetc: add support for XDP_REDIRECT\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nReviewed-by: Hariprasad Kelam \u003chkelam@marvell.com\u003e\nReviewed-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nLink: https://patch.msgid.link/20251211020919.121113-1-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "5cba412d6a005719d52dc72b6d7e5a59af979eaa", "tree": "73ba918738db3e6f9597fabe7d154cdfacfdd623", "parents": [ "1d856251a009d64007d71d01c988bead6d3a098c" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Wed Dec 10 11:22:55 2025 -0500" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:42:18 2025 +0100" }, "message": "selftests/tc-testing: Test case exercising potential mirred redirect deadlock\n\nAdd a test case that reproduces deadlock scenario where the user has\na drr qdisc attached to root and has a mirred action that redirects to\nself on egress\n\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20251210162255.1057663-2-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "1d856251a009d64007d71d01c988bead6d3a098c", "tree": "28f9766cdb1552dda76f6e0db1941fa6ab48efef", "parents": [ "cdc3074c00dc36172247017e8bb257abf7ac710c" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Wed Dec 10 11:22:54 2025 -0500" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:42:18 2025 +0100" }, "message": "net/sched: act_mirred: fix loop detection\n\nFix a loop scenario of ethx:egress-\u003eethx:egress\n\nExample setup to reproduce:\ntc qdisc add dev ethx root handle 1: drr\ntc filter add dev ethx parent 1: protocol ip prio 1 matchall \\\n action mirred egress redirect dev ethx\n\nNow ping out of ethx and you get a deadlock:\n\n[ 116.892898][ T307] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 116.893182][ T307] WARNING: possible recursive locking detected\n[ 116.893418][ T307] 6.18.0-rc6-01205-ge05021a829b8-dirty #204 Not tainted\n[ 116.893682][ T307] --------------------------------------------\n[ 116.893926][ T307] ping/307 is trying to acquire lock:\n[ 116.894133][ T307] ffff88800c122908 (\u0026sch-\u003eroot_lock_key){+...}-{3:3}, at: __dev_queue_xmit+0x2210/0x3b50\n[ 116.894517][ T307]\n[ 116.894517][ T307] but task is already holding lock:\n[ 116.894836][ T307] ffff88800c122908 (\u0026sch-\u003eroot_lock_key){+...}-{3:3}, at: __dev_queue_xmit+0x2210/0x3b50\n[ 116.895252][ T307]\n[ 116.895252][ T307] other info that might help us debug this:\n[ 116.895608][ T307] Possible unsafe locking scenario:\n[ 116.895608][ T307]\n[ 116.895901][ T307] CPU0\n[ 116.896057][ T307] ----\n[ 116.896200][ T307] lock(\u0026sch-\u003eroot_lock_key);\n[ 116.896392][ T307] lock(\u0026sch-\u003eroot_lock_key);\n[ 116.896605][ T307]\n[ 116.896605][ T307] *** DEADLOCK ***\n[ 116.896605][ T307]\n[ 116.896864][ T307] May be due to missing lock nesting notation\n[ 116.896864][ T307]\n[ 116.897123][ T307] 6 locks held by ping/307:\n[ 116.897302][ T307] #0: ffff88800b4b0250 (sk_lock-AF_INET){+.+.}-{0:0}, at: raw_sendmsg+0xb20/0x2cf0\n[ 116.897808][ T307] #1: ffffffff88c839c0 (rcu_read_lock){....}-{1:3}, at: ip_output+0xa9/0x600\n[ 116.898138][ T307] #2: ffffffff88c839c0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x2c6/0x1ee0\n[ 116.898459][ T307] #3: ffffffff88c83960 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x200/0x3b50\n[ 116.898782][ T307] #4: ffff88800c122908 (\u0026sch-\u003eroot_lock_key){+...}-{3:3}, at: __dev_queue_xmit+0x2210/0x3b50\n[ 116.899132][ T307] #5: ffffffff88c83960 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x200/0x3b50\n[ 116.899442][ T307]\n[ 116.899442][ T307] stack backtrace:\n[ 116.899667][ T307] CPU: 2 UID: 0 PID: 307 Comm: ping Not tainted 6.18.0-rc6-01205-ge05021a829b8-dirty #204 PREEMPT(voluntary)\n[ 116.899672][ T307] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 116.899675][ T307] Call Trace:\n[ 116.899678][ T307] \u003cTASK\u003e\n[ 116.899680][ T307] dump_stack_lvl+0x6f/0xb0\n[ 116.899688][ T307] print_deadlock_bug.cold+0xc0/0xdc\n[ 116.899695][ T307] __lock_acquire+0x11f7/0x1be0\n[ 116.899704][ T307] lock_acquire+0x162/0x300\n[ 116.899707][ T307] ? __dev_queue_xmit+0x2210/0x3b50\n[ 116.899713][ T307] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 116.899717][ T307] ? stack_trace_save+0x93/0xd0\n[ 116.899723][ T307] _raw_spin_lock+0x30/0x40\n[ 116.899728][ T307] ? __dev_queue_xmit+0x2210/0x3b50\n[ 116.899731][ T307] __dev_queue_xmit+0x2210/0x3b50\n\nFixes: 178ca30889a1 (\"Revert \"net/sched: Fix mirred deadlock on device recursion\"\")\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20251210162255.1057663-1-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "cdc3074c00dc36172247017e8bb257abf7ac710c", "tree": "9387aea4c60181c20e1cf000b52e66168ca3c77e", "parents": [ "15564bd67e2975002f2a8e9defee33e321d3183f", "d7ff61e6f3ef856da82bb90cbd0391839a8917a4" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:18:02 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:18:02 2025 +0100" }, "message": "Merge branch \u0027sctp-fix-two-issues-in-sctp_clone_sock\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nsctp: Fix two issues in sctp_clone_sock().\n\nsyzbot reported two issues in sctp_clone_sock().\n\nThis series fixes the issues.\n\nv1: https://lore.kernel.org/netdev/20251208133728.157648-1-kuniyu@google.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20251210081206.1141086-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d7ff61e6f3ef856da82bb90cbd0391839a8917a4", "tree": "9387aea4c60181c20e1cf000b52e66168ca3c77e", "parents": [ "b98f06f9a5d3b32cf1b3998b4115fb3b5478752d" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed Dec 10 08:11:13 2025 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:18:00 2025 +0100" }, "message": "sctp: Clear inet_opt in sctp_v6_copy_ip_options().\n\nsyzbot reported the splat below. [0]\n\nSince the cited commit, the child socket inherits all fields\nof its parent socket unless explicitly cleared.\n\nsyzbot set IP_OPTIONS to AF_INET6 socket and created a child\nsocket inheriting inet_sk(sk)-\u003einet_opt.\n\nsctp_v6_copy_ip_options() only clones np-\u003eopt, and leaving\ninet_opt results in double-free.\n\nLet\u0027s clear inet_opt in sctp_v6_copy_ip_options().\n\n[0]:\nBUG: KASAN: double-free in inet_sock_destruct+0x538/0x740 net/ipv4/af_inet.c:159\nFree of addr ffff8880304b6d40 by task ksoftirqd/0/15\n\nCPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report_invalid_free+0xea/0x110 mm/kasan/report.c:557\n check_slab_allocation+0xe1/0x130 include/linux/page-flags.h:-1\n kasan_slab_pre_free include/linux/kasan.h:198 [inline]\n slab_free_hook mm/slub.c:2484 [inline]\n slab_free mm/slub.c:6630 [inline]\n kfree+0x148/0x6d0 mm/slub.c:6837\n inet_sock_destruct+0x538/0x740 net/ipv4/af_inet.c:159\n __sk_destruct+0x89/0x660 net/core/sock.c:2350\n sock_put include/net/sock.h:1991 [inline]\n sctp_endpoint_destroy_rcu+0xa1/0xf0 net/sctp/endpointola.c:197\n rcu_do_batch kernel/rcu/tree.c:2605 [inline]\n rcu_core+0xcab/0x1770 kernel/rcu/tree.c:2861\n handle_softirqs+0x286/0x870 kernel/softirq.c:622\n run_ksoftirqd+0x9b/0x100 kernel/softirq.c:1063\n smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160\n kthread+0x711/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nAllocated by task 6003:\n kasan_save_stack mm/kasan/common.c:56 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:77\n poison_kmalloc_redzone mm/kasan/common.c:400 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417\n kasan_kmalloc include/linux/kasan.h:262 [inline]\n __do_kmalloc_node mm/slub.c:5642 [inline]\n __kmalloc_noprof+0x411/0x7f0 mm/slub.c:5654\n kmalloc_noprof include/linux/slab.h:961 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n ip_options_get+0x51/0x4c0 net/ipv4/ip_options.c:517\n do_ip_setsockopt+0x1d9b/0x2d00 net/ipv4/ip_sockglue.c:1087\n ip_setsockopt+0x66/0x110 net/ipv4/ip_sockglue.c:1417\n do_sock_setsockopt+0x17c/0x1b0 net/socket.c:2360\n __sys_setsockopt net/socket.c:2385 [inline]\n __do_sys_setsockopt net/socket.c:2391 [inline]\n __se_sys_setsockopt net/socket.c:2388 [inline]\n __x64_sys_setsockopt+0x13f/0x1b0 net/socket.c:2388\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 15:\n kasan_save_stack mm/kasan/common.c:56 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:77\n __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587\n kasan_save_free_info mm/kasan/kasan.h:406 [inline]\n poison_slab_object mm/kasan/common.c:252 [inline]\n __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284\n kasan_slab_free include/linux/kasan.h:234 [inline]\n slab_free_hook mm/slub.c:2539 [inline]\n slab_free mm/slub.c:6630 [inline]\n kfree+0x19a/0x6d0 mm/slub.c:6837\n inet_sock_destruct+0x538/0x740 net/ipv4/af_inet.c:159\n __sk_destruct+0x89/0x660 net/core/sock.c:2350\n sock_put include/net/sock.h:1991 [inline]\n sctp_endpoint_destroy_rcu+0xa1/0xf0 net/sctp/endpointola.c:197\n rcu_do_batch kernel/rcu/tree.c:2605 [inline]\n rcu_core+0xcab/0x1770 kernel/rcu/tree.c:2861\n handle_softirqs+0x286/0x870 kernel/softirq.c:622\n run_ksoftirqd+0x9b/0x100 kernel/softirq.c:1063\n smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160\n kthread+0x711/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nFixes: 16942cf4d3e31 (\"sctp: Use sk_clone() in sctp_accept().\")\nReported-by: syzbot+ec33a1a006ed5abe7309@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6936d112.a70a0220.38f243.00a8.GAE@google.com/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20251210081206.1141086-3-kuniyu@google.com\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b98f06f9a5d3b32cf1b3998b4115fb3b5478752d", "tree": "01ae0093f694e37b7b1504b3ed3e2079ee603658", "parents": [ "15564bd67e2975002f2a8e9defee33e321d3183f" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed Dec 10 08:11:12 2025 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:17:59 2025 +0100" }, "message": "sctp: Fetch inet6_sk() after setting -\u003epinet6 in sctp_clone_sock().\n\nsyzbot reported the lockdep splat below. [0]\n\nsctp_clone_sock() sets the child socket\u0027s ipv6_mc_list to NULL,\nbut somehow sock_release() in an error path finally acquires\nlock_sock() in ipv6_sock_mc_close().\n\nThe root cause is that sctp_clone_sock() fetches inet6_sk(newsk)\nbefore setting newinet-\u003epinet6, meaning that the parent\u0027s\nipv6_mc_list was actually cleared.\n\nAlso, sctp_v6_copy_ip_options() uses inet6_sk() but is called\nbefore newinet-\u003epinet6 is set.\n\nLet\u0027s use inet6_sk() only after setting newinet-\u003epinet6.\n\n[0]:\nWARNING: possible recursive locking detected\nsyzkaller #0 Not tainted\n\nsyz.0.17/5996 is trying to acquire lock:\nffff888031af4c60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline]\nffff888031af4c60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: ipv6_sock_mc_close+0xd3/0x140 net/ipv6/mcast.c:348\n\nbut task is already holding lock:\nffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline]\nffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_getsockopt+0x135/0xb60 net/sctp/socket.c:8131\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(sk_lock-AF_INET6);\n lock(sk_lock-AF_INET6);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n1 lock held by syz.0.17/5996:\n #0: ffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline]\n #0: ffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_getsockopt+0x135/0xb60 net/sctp/socket.c:8131\n\nstack backtrace:\nCPU: 0 UID: 0 PID: 5996 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041\n check_deadlock kernel/locking/lockdep.c:3093 [inline]\n validate_chain kernel/locking/lockdep.c:3895 [inline]\n __lock_acquire+0x2540/0x2cf0 kernel/locking/lockdep.c:5237\n lock_acquire+0x117/0x340 kernel/locking/lockdep.c:5868\n lock_sock_nested+0x48/0x100 net/core/sock.c:3780\n lock_sock include/net/sock.h:1700 [inline]\n ipv6_sock_mc_close+0xd3/0x140 net/ipv6/mcast.c:348\n inet6_release+0x47/0x70 net/ipv6/af_inet6.c:482\n __sock_release net/socket.c:653 [inline]\n sock_release+0x85/0x150 net/socket.c:681\n sctp_getsockopt_peeloff_common+0x56b/0x770 net/sctp/socket.c:5732\n sctp_getsockopt_peeloff_flags+0x13b/0x230 net/sctp/socket.c:5801\n sctp_getsockopt+0x3ab/0xb60 net/sctp/socket.c:8151\n do_sock_getsockopt+0x2b4/0x3d0 net/socket.c:2399\n __sys_getsockopt net/socket.c:2428 [inline]\n __do_sys_getsockopt net/socket.c:2435 [inline]\n __se_sys_getsockopt net/socket.c:2432 [inline]\n __x64_sys_getsockopt+0x1a5/0x250 net/socket.c:2432\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f8f8c38f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffcfdade018 EFLAGS: 00000246 ORIG_RAX: 0000000000000037\nRAX: ffffffffffffffda RBX: 00007f8f8c5e5fa0 RCX: 00007f8f8c38f749\nRDX: 000000000000007a RSI: 0000000000000084 RDI: 0000000000000003\nRBP: 00007f8f8c413f91 R08: 0000200000000040 R09: 0000000000000000\nR10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f8f8c5e5fa0 R14: 00007f8f8c5e5fa0 R15: 0000000000000005\n \u003c/TASK\u003e\n\nFixes: 16942cf4d3e31 (\"sctp: Use sk_clone() in sctp_accept().\")\nReported-by: syzbot+c59e6bb54e7620495725@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6936d112.a70a0220.38f243.00a7.GAE@google.com/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20251210081206.1141086-2-kuniyu@google.com\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "15564bd67e2975002f2a8e9defee33e321d3183f", "tree": "8add06ba3768f04350d7a99284efc03b7814a351", "parents": [ "3e82accd3e9c35acfc68e44e12b37e5fd350c768" ], "author": { "name": "Scott Mayhew", "email": "smayhew@redhat.com", "time": "Tue Dec 09 14:30:15 2025 -0500" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 16:01:36 2025 +0100" }, "message": "net/handshake: duplicate handshake cancellations leak socket\n\nWhen a handshake request is cancelled it is removed from the\nhandshake_net-\u003ehn_requests list, but it is still present in the\nhandshake_rhashtbl until it is destroyed.\n\nIf a second cancellation request arrives for the same handshake request,\nthen remove_pending() will return false... and assuming\nHANDSHAKE_F_REQ_COMPLETED isn\u0027t set in req-\u003ehr_flags, we\u0027ll continue\nprocessing through the out_true label, where we put another reference on\nthe sock and a refcount underflow occurs.\n\nThis can happen for example if a handshake times out - particularly if\nthe SUNRPC client sends the AUTH_TLS probe to the server but doesn\u0027t\nfollow it up with the ClientHello due to a problem with tlshd. When the\ntimeout is hit on the server, the server will send a FIN, which triggers\na cancellation request via xs_reset_transport(). When the timeout is\nhit on the client, another cancellation request happens via\nxs_tls_handshake_sync().\n\nAdd a test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED) in the pending cancel\npath so duplicate cancels can be detected.\n\nFixes: 3b3009ea8abb (\"net/handshake: Create a NETLINK service for handling handshake requests\")\nSuggested-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nSigned-off-by: Scott Mayhew \u003csmayhew@redhat.com\u003e\nReviewed-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nLink: https://patch.msgid.link/20251209193015.3032058-1-smayhew@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "3e82accd3e9c35acfc68e44e12b37e5fd350c768", "tree": "66df313498771397eb1586bf2a6471e6e8e7adb3", "parents": [ "78a47532ab4d0beebb13e67c4ef97b3fe9f56be0", "fec7b0795548b43e2c3c46e3143c34ef6070341c" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:55:01 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:55:01 2025 +0100" }, "message": "Merge tag \u0027nf-25-12-16\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nThe following patchset contains Netfilter fixes for *net*:\n\n1) Jozsef Kadlecsik is retiring. Fortunately Jozsef will still keep an\n eye on ipset patches.\n\n2) remove a bogus direction check from nat core, this caused spurious\n flakes in the \u0027reverse clash\u0027 selftest, from myself.\n\n3) nf_tables doesn\u0027t need to do chain validation on register store,\n from Pablo Neira Ayuso.\n\n4) nf_tables shouldn\u0027t revisit chains during ruleset (graph) validation\n if possible. Both 3 and 4 were slated for -next initially but there\n are now two independent reports of people hitting soft lockup errors\n during ruleset validation, so it makes no sense anymore to route\n this via -next given this is -stable material. From myself.\n\n5) call cond_resched() in a more frequently visited place during nf_tables\n chain validation, this wasn\u0027t possible earlier due to rcu read lock,\n but nowadays its not held anymore during set walks.\n\n6) Don\u0027t fail conntrack packetdrill test with HZ\u003d100 kernels.\n\nnetfilter pull request nf-25-12-16\n\n* tag \u0027nf-25-12-16\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n selftests: netfilter: packetdrill: avoid failure on HZ\u003d100 kernel\n netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate\n netfilter: nf_tables: avoid chain re-validation if possible\n netfilter: nf_tables: remove redundant chain validation on register store\n netfilter: nf_nat: remove bogus direction check\n MAINTAINERS: Remove Jozsef Kadlecsik from MAINTAINERS file\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20251216190904.14507-1-fw@strlen.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "78a47532ab4d0beebb13e67c4ef97b3fe9f56be0", "tree": "7001bbd643a919f66bc25431d35c5421a077af59", "parents": [ "71e6b15d214e2500c8482509f7b3ae6ee5030889", "4198a14c8c6252fd1191afaa742dd515dcaf3487" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:31 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:32 2025 +0100" }, "message": "Merge branch \u0027mlx5-misc-fixes-2025-12-09\u0027\n\nTariq Toukan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlx5 misc fixes 2025-12-09\n\nThis patchset provides misc bug fixes from the team to the mlx5 core and\nEth drivers.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/1765284977-1363052-1-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4198a14c8c6252fd1191afaa742dd515dcaf3487", "tree": "7001bbd643a919f66bc25431d35c5421a077af59", "parents": [ "c8591decd9dbf395cb8ae398e70b0438fdd24aee" ], "author": { "name": "Cosmin Ratiu", "email": "cratiu@nvidia.com", "time": "Tue Dec 09 14:56:17 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:30 2025 +0100" }, "message": "net/mlx5e: Don\u0027t include PSP in the hard MTU calculations\n\nCommit [1] added the 40 bytes required by the PSP header+trailer and the\nUDP header to MLX5E_ETH_HARD_MTU, which limits the device-wide max\nsoftware MTU that could be set. This is not okay, because most packets\nare not PSP packets and it doesn\u0027t make sense to always reserve space\nfor headers which won\u0027t get added in most cases.\n\nAs it turns out, for TCP connections, PSP overhead is already taken into\naccount in the TCP MSS calculations via inet_csk(sk)-\u003eicsk_ext_hdr_len.\nThis was added in commit [2]. This means that the extra space reserved\nin the hard MTU for mlx5 ends up unused and wasted.\n\nRemove the unnecessary 40 byte reservation from hard MTU.\n\n[1] commit e5a1861a298e (\"net/mlx5e: Implement PSP Tx data path\")\n[2] commit e97269257fe4 (\"net: psp: update the TCP MSS to reflect PSP\npacket overhead\")\n\nFixes: e5a1861a298e (\"net/mlx5e: Implement PSP Tx data path\")\nSigned-off-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nReviewed-by: Shahar Shitrit \u003cshshitrit@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-10-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "c8591decd9dbf395cb8ae398e70b0438fdd24aee", "tree": "24ebf094a6cf8ce6684c9b4c411ce519a44571d0", "parents": [ "9ab89bde13e5251e1d0507e1cc426edcdfe19142" ], "author": { "name": "Tariq Toukan", "email": "tariqt@nvidia.com", "time": "Tue Dec 09 14:56:16 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5e: Do not update BQL of old txqs during channel reconfiguration\n\nDuring channel reconfiguration (e.g., ethtool private flags changes),\nthe driver can trigger a kernel BUG_ON in dql_completed() with the error\n\"kernel BUG at lib/dynamic_queue_limits.c:99\".\n\nThe issue occurs in the following sequence:\n\nDuring mlx5e_safe_switch_params(), old channels are deactivated via\nmlx5e_deactivate_txqsq(). New channels are created and activated, taking\nownership of the netdev_queues and their BQL state.\n\nWhen old channels are closed via mlx5e_close_txqsq(), there may be\npending TX descriptors (sq-\u003ecc !\u003d sq-\u003epc) that were in-flight during the\ndeactivation.\n\nmlx5e_free_txqsq_descs() frees these pending descriptors and attempts to\ncomplete them via netdev_tx_completed_queue().\n\nHowever, the BQL state (dql-\u003enum_queued and dql-\u003enum_completed) have\nbeen reset in mlx5e_activate_txqsq and belong to the new queue owner,\nleading to dql-\u003enum_queued - dql-\u003enum_completed \u003c nbytes.\n\nThis triggers BUG_ON(count \u003e num_queued - num_completed) in\ndql_completed().\n\nFixes: 3b88a535a8e1 (\"net/mlx5e: Defer channels closure to reduce interface down time\")\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nSigned-off-by: William Tu \u003cwitu@nvidia.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-9-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "9ab89bde13e5251e1d0507e1cc426edcdfe19142", "tree": "c82a5bea860c3832da8f02efe55fbb8dac3c8b41", "parents": [ "e35d7da8dd9e55b37c3e8ab548f6793af0c2ab49" ], "author": { "name": "Jianbo Liu", "email": "jianbol@nvidia.com", "time": "Tue Dec 09 14:56:15 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5e: Trigger neighbor resolution for unresolved destinations\n\nWhen initializing the MAC addresses for an outbound IPsec packet offload\nrule in mlx5e_ipsec_init_macs, the call to dst_neigh_lookup is used to\nfind the next-hop neighbor (typically the gateway in tunnel mode).\nThis call might create a new neighbor entry if one doesn\u0027t already\nexist. This newly created entry starts in the INCOMPLETE state, as the\nkernel hasn\u0027t yet sent an ARP or NDISC probe to resolve the MAC\naddress. In this case, neigh_ha_snapshot will correctly return an\nall-zero MAC address.\n\nIPsec packet offload requires the actual next-hop MAC address to\nprogram the rule correctly. If the neighbor state is INCOMPLETE when\nthe rule is created, the hardware rule is programmed with an all-zero\ndestination MAC address. Packets sent using this rule will be\nsubsequently dropped by the receiving network infrastructure or host.\n\nThis patch adds a check specifically for the outbound offload path. If\nneigh_ha_snapshot returns an all-zero MAC address, it proactively\ncalls neigh_event_send(n, NULL). This ensures the kernel immediately\nsends the initial ARP or NDISC probe if one isn\u0027t already pending,\naccelerating the resolution process. This helps prevent the hardware\nrule from being programmed with an invalid MAC address and avoids\npacket drops due to unresolved neighbors.\n\nFixes: 71670f766b8f (\"net/mlx5e: Support routed networks during IPsec MACs initialization\")\nSigned-off-by: Jianbo Liu \u003cjianbol@nvidia.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-8-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "e35d7da8dd9e55b37c3e8ab548f6793af0c2ab49", "tree": "f737d4db799e2eb725c3006e53cdd8dafd4b7dc5", "parents": [ "367e501f8b095eca08d2eb0ba4ccea5b5e82c169" ], "author": { "name": "Jianbo Liu", "email": "jianbol@nvidia.com", "time": "Tue Dec 09 14:56:14 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init\n\nReplace ipv6_stub-\u003eipv6_dst_lookup_flow() with ip6_dst_lookup() in\nmlx5e_ipsec_init_macs() since IPsec transformations are not needed\nduring Security Association setup - only basic routing information is\nrequired for nexthop MAC address resolution.\n\nThis resolves an issue where XfrmOutNoStates error counter would be\nincremented when xfrm policy is configured before xfrm state, as the\nIPsec-aware routing function would attempt policy checks during SA\ninitialization.\n\nFixes: 71670f766b8f (\"net/mlx5e: Support routed networks during IPsec MACs initialization\")\nSigned-off-by: Jianbo Liu \u003cjianbol@nvidia.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-7-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "367e501f8b095eca08d2eb0ba4ccea5b5e82c169", "tree": "536e155e1885cbe7c3a26af150c44ba4534edb8f", "parents": [ "c0289f67f7d6a0dfba0e92cfe661a5c70c8c6e92" ], "author": { "name": "Shay Drory", "email": "shayd@nvidia.com", "time": "Tue Dec 09 14:56:13 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5: Serialize firmware reset with devlink\n\nThe firmware reset mechanism can be triggered by asynchronous events,\nwhich may race with other devlink operations like devlink reload or\ndevlink dev eswitch set, potentially leading to inconsistent states.\n\nThis patch addresses the race by using the devl_lock to serialize the\nfirmware reset against other devlink operations. When a reset is\nrequested, the driver attempts to acquire the lock. If successful, it\nsets a flag to block devlink reload or eswitch changes, ACKs the reset\nto firmware and then releases the lock. If the lock is already held by\nanother operation, the driver NACKs the firmware reset request,\nindicating that the reset cannot proceed.\n\nFirmware reset does not keep the devl_lock and instead uses an internal\nfirmware reset bit. This is because firmware resets can be triggered by\nasynchronous events, and processed in different threads. It is illegal\nand unsafe to acquire a lock in one thread and attempt to release it in\nanother, as lock ownership is intrinsically thread-specific.\n\nThis change ensures that firmware resets and other devlink operations\nare mutually exclusive during the critical reset request phase,\npreventing race conditions.\n\nFixes: 38b9f903f22b (\"net/mlx5: Handle sync reset request event\")\nSigned-off-by: Shay Drory \u003cshayd@nvidia.com\u003e\nReviewed-by: Mateusz Berezecki \u003cmberezecki@nvidia.com\u003e\nReviewed-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-6-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "c0289f67f7d6a0dfba0e92cfe661a5c70c8c6e92", "tree": "73e9971228c46fcd9c2e16e90becc3072248550f", "parents": [ "b35966042d20b14e2d83330049f77deec5229749" ], "author": { "name": "Shay Drory", "email": "shayd@nvidia.com", "time": "Tue Dec 09 14:56:12 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5: fw_tracer, Handle escaped percent properly\n\nThe firmware tracer\u0027s format string validation and parameter counting\ndid not properly handle escaped percent signs (%%). This caused\nfw_tracer to count more parameters when trace format strings contained\nliteral percent characters.\n\nTo fix it, allow %% to pass string validation and skip %% sequences when\ncounting parameters since they represent literal percent signs rather\nthan format specifiers.\n\nFixes: 70dd6fdb8987 (\"net/mlx5: FW tracer, parse traces and kernel tracing support\")\nSigned-off-by: Shay Drory \u003cshayd@nvidia.com\u003e\nReported-by: Breno Leitao \u003cleitao@debian.org\u003e\nReviewed-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nCloses: https://lore.kernel.org/netdev/hanz6rzrb2bqbplryjrakvkbmv4y5jlmtthnvi3thg5slqvelp@t3s3erottr6s/\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-5-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "b35966042d20b14e2d83330049f77deec5229749", "tree": "541ef1c12bca602392236e9d551fd530d4a47aee", "parents": [ "5846a365fc6476b02d6766963cf0985520f0385f" ], "author": { "name": "Shay Drory", "email": "shayd@nvidia.com", "time": "Tue Dec 09 14:56:11 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\"BAD_FORMAT: \" prefix.\n\nFixes: 70dd6fdb8987 (\"net/mlx5: FW tracer, parse traces and kernel tracing support\")\nSigned-off-by: Shay Drory \u003cshayd@nvidia.com\u003e\nReviewed-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nReported-by: Breno Leitao \u003cleitao@debian.org\u003e\nCloses: https://lore.kernel.org/netdev/hanz6rzrb2bqbplryjrakvkbmv4y5jlmtthnvi3thg5slqvelp@t3s3erottr6s/\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-4-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "5846a365fc6476b02d6766963cf0985520f0385f", "tree": "5cd7c3851be5f89c4ad756af1b0f0c83fdf8b7fd", "parents": [ "89a898d63f6f588acf5c104c65c94a38b68c69a6" ], "author": { "name": "Moshe Shemesh", "email": "moshe@nvidia.com", "time": "Tue Dec 09 14:56:10 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5: Drain firmware reset in shutdown callback\n\nInvoke drain_fw_reset() in the shutdown callback to ensure all\nfirmware reset handling is completed before shutdown proceeds.\n\nFixes: 16d42d313350 (\"net/mlx5: Drain fw_reset when removing device\")\nSigned-off-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nReviewed-by: Shay Drori \u003cshayd@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-3-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "89a898d63f6f588acf5c104c65c94a38b68c69a6", "tree": "1be21563549dda9e00c4f440352b7ce94d2e6e20", "parents": [ "71e6b15d214e2500c8482509f7b3ae6ee5030889" ], "author": { "name": "Moshe Shemesh", "email": "moshe@nvidia.com", "time": "Tue Dec 09 14:56:09 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 13:39:29 2025 +0100" }, "message": "net/mlx5: fw reset, clear reset requested on drain_fw_reset\n\ndrain_fw_reset() waits for ongoing firmware reset events and blocks new\nevent handling, but does not clear the reset requested flag, and may\nkeep sync reset polling.\n\nTo fix it, call mlx5_sync_reset_clear_reset_requested() to clear the\nflag, stop sync reset polling, and resume health polling, ensuring\nhealth issues are still detected after the firmware reset drain.\n\nFixes: 16d42d313350 (\"net/mlx5: Drain fw_reset when removing device\")\nSigned-off-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nReviewed-by: Shay Drori \u003cshayd@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/1765284977-1363052-2-git-send-email-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "71e6b15d214e2500c8482509f7b3ae6ee5030889", "tree": "fbe5fe27d4bb41ed7e3ccac81fa50b59d39836a6", "parents": [ "7b07be1ff1cb6c49869910518650e8d0abc7d25f", "7b103aaf0d564b83ee1d4bb532ee7ae36ed001ed" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 12:53:23 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 12:53:24 2025 +0100" }, "message": "Merge branch \u0027net-dsa-lantiq-a-bunch-of-fixes\u0027\n\nDaniel Golle says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: lantiq: a bunch of fixes\n\nThis series is the continuation and result of comments received for a fix\nfor the SGMII restart-an bit not actually being self-clearing, which was\nreported by by Rasmus Villemoes.\n\nA closer investigation and testing the .remove and the .shutdown paths\nof the mxl-gsw1xx.c and lantiq_gswip.c drivers has revealed a couple of\nexisting problems, which are also addressed in this series.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1765241054.git.daniel@makrotopia.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7b103aaf0d564b83ee1d4bb532ee7ae36ed001ed", "tree": "fbe5fe27d4bb41ed7e3ccac81fa50b59d39836a6", "parents": [ "651b253b80379b0eb3669405fcf50d4039dc7a0e" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Tue Dec 09 01:29:34 2025 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 12:53:21 2025 +0100" }, "message": "net: dsa: mxl-gsw1xx: manually clear RANEG bit\n\nDespite being documented as self-clearing, the RANEG bit sometimes\nremains set, preventing auto-negotiation from happening.\n\nManually clear the RANEG bit after 10ms as advised by MaxLinear.\nIn order to not hold RTNL during the 10ms of waiting schedule\ndelayed work to take care of clearing the bit asynchronously, which\nis similar to the self-clearing behavior.\n\nFixes: 22335939ec90 (\"net: dsa: add driver for MaxLinear GSW1xx switch family\")\nReported-by: Rasmus Villemoes \u003cravi@prevas.dk\u003e\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nLink: https://patch.msgid.link/76745fceb5a3f53088110fb7a96acf88434088ca.1765241054.git.daniel@makrotopia.org\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "651b253b80379b0eb3669405fcf50d4039dc7a0e", "tree": "9a17829b1608585d1903e61b3b7eabbebaaceef2", "parents": [ "8e4c0f08f6bedeb885515c5ec5a6388a45d768ec" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Tue Dec 09 01:29:05 2025 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 12:53:21 2025 +0100" }, "message": "net: dsa: mxl-gsw1xx: fix .shutdown driver operation\n\nThe .shutdown operation should call dsa_switch_shutdown() just like\nit is done also by the sibling lantiq_gswip driver. Not doing that\nresults in shutdown or reboot hanging and waiting for the CPU port\nbecoming free, which introduces a longer delay and a WARNING before\nshutdown or reboot in case the driver is built-into the kernel.\nFix this by calling dsa_switch_shutdown() in the driver\u0027s shutdown\noperation, harmonizing it with what is done in the lantiq_gswip\ndriver. As a side-effect this now allows to remove the previously\nexported gswip_disable_switch() function which no longer got any\nusers.\n\nFixes: 22335939ec907 (\"net: dsa: add driver for MaxLinear GSW1xx switch family\")\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nLink: https://patch.msgid.link/77ed91a5206e5dbf5d3e83d7e364ebfda90d31fd.1765241054.git.daniel@makrotopia.org\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8e4c0f08f6bedeb885515c5ec5a6388a45d768ec", "tree": "b7bec9440949c534adfaba5c4d8c4a0241e1b31d", "parents": [ "377d66fa86654085be1f48906c1d88b7ca721c78" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Tue Dec 09 01:28:49 2025 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 12:53:21 2025 +0100" }, "message": "net: dsa: mxl-gsw1xx: fix order in .remove operation\n\nThe driver\u0027s .remove operation was calling gswip_disable_switch() which\nclears the GSWIP_MDIO_GLOB_ENABLE bit before calling\ndsa_unregister_switch() and thereby violating a Golden Rule of driver\ndevelopment to always unpublish userspace interfaces before disabling\nhardware, as pointed out by Russell King.\n\nFix this by relying in GSWIP_MDIO_GLOB_ENABLE being cleared by the\n.teardown operation introduced by the previous commit\n(\"net: dsa: lantiq_gswip: fix teardown order\").\n\nFixes: 22335939ec907 (\"net: dsa: add driver for MaxLinear GSW1xx switch family\")\nSuggested-by: \"Russell King (Oracle)\" \u003clinux@armlinux.org.uk\u003e\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nLink: https://patch.msgid.link/63f882eeb910cf24503c35a443b541cc54a930f2.1765241054.git.daniel@makrotopia.org\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "377d66fa86654085be1f48906c1d88b7ca721c78", "tree": "533020d17bc4ff4f852879ee211c1f9cfbfb39f6", "parents": [ "7b07be1ff1cb6c49869910518650e8d0abc7d25f" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Tue Dec 09 01:28:20 2025 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 12:53:21 2025 +0100" }, "message": "net: dsa: lantiq_gswip: fix order in .remove operation\n\nRussell King pointed out that disabling the switch by clearing\nGSWIP_MDIO_GLOB_ENABLE before calling dsa_unregister_switch() is\nproblematic, as it violates a Golden Rule of driver development to\nalways first unpublish userspace interfaces and then disable the\nhardware.\n\nFix this, and also simplify the probe() function, by introducing a\ndsa_switch_ops teardown() operation which takes care of clearing the\nGSWIP_MDIO_GLOB_ENABLE bit.\n\nFixes: 14fceff4771e5 (\"net: dsa: Add Lantiq / Intel DSA driver for vrx200\")\nSuggested-by: \"Russell King (Oracle)\" \u003clinux@armlinux.org.uk\u003e\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nLink: https://patch.msgid.link/4ebd72a29edc1e4059b9666a26a0bb5d906a829a.1765241054.git.daniel@makrotopia.org\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7b07be1ff1cb6c49869910518650e8d0abc7d25f", "tree": "d4c7e78f18cf45001f5db8081a425b5b7572274d", "parents": [ "885bebac9909994050bbbeed0829c727e42bd1b7" ], "author": { "name": "Gal Pressman", "email": "gal@nvidia.com", "time": "Mon Dec 08 14:19:01 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Dec 18 12:24:25 2025 +0100" }, "message": "ethtool: Avoid overflowing userspace buffer on stats query\n\nThe ethtool -S command operates across three ioctl calls:\nETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and\nETHTOOL_GSTATS for the values.\n\nIf the number of stats changes between these calls (e.g., due to device\nreconfiguration), userspace\u0027s buffer allocation will be incorrect,\npotentially leading to buffer overflow.\n\nDrivers are generally expected to maintain stable stat counts, but some\ndrivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making\nthis scenario possible.\n\nSome drivers try to handle this internally:\n- bnad_get_ethtool_stats() returns early in case stats.n_stats is not\n equal to the driver\u0027s stats count.\n- micrel/ksz884x also makes sure not to write anything beyond\n stats.n_stats and overflow the buffer.\n\nHowever, both use stats.n_stats which is already assigned with the value\nreturned from get_sset_count(), hence won\u0027t solve the issue described\nhere.\n\nChange ethtool_get_strings(), ethtool_get_stats(),\nethtool_get_phy_stats() to not return anything in case of a mismatch\nbetween userspace\u0027s size and get_sset_size(), to prevent buffer\noverflow.\nThe returned n_stats value will be equal to zero, to reflect that\nnothing has been returned.\n\nThis could result in one of two cases when using upstream ethtool,\ndepending on when the size change is detected:\n1. When detected in ethtool_get_strings():\n # ethtool -S eth2\n no stats available\n\n2. When detected in get stats, all stats will be reported as zero.\n\nBoth cases are presumably transient, and a subsequent ethtool call\nshould succeed.\n\nOther than the overflow avoidance, these two cases are very evident (no\noutput/cleared stats), which is arguably better than presenting\nincorrect/shifted stats.\nI also considered returning an error instead of a \"silent\" response, but\nthat seems more destructive towards userspace apps.\n\nNotes:\n- This patch does not claim to fix the inherent race, it only makes sure\n that we do not overflow the userspace buffer, and makes for a more\n predictable behavior.\n\n- RTNL lock is held during each ioctl, the race window exists between\n the separate ioctl calls when the lock is released.\n\n- Userspace ethtool always fills stats.n_stats, but it is likely that\n these stats ioctls are implemented in other userspace applications\n which might not fill it. The added code checks that it\u0027s not zero,\n to prevent any regressions.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nLink: https://patch.msgid.link/20251208121901.3203692-1-gal@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "5a5aff6338c0f4164a6a8d8a7eb400c4054df256", "tree": "6503e291b94fceec7133033d770e0e71b09320ab", "parents": [ "46cea215dc9444ec32a76b1b6a9cb809e17b64d5" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Dec 17 10:45:53 2025 +0100" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Thu Dec 18 09:04:47 2025 +0100" }, "message": "can: fix build dependency\n\nArnd Bergmann\u0027s patch [1] fixed the build dependency problem introduced by\nbugfix commit cb2dc6d2869a (\"can: Kconfig: select CAN driver infrastructure\nby default\"). This ended up as commit 6abd4577bccc (\"can: fix build\ndependency\"), but I broke Arnd\u0027s fix by removing a dependency that we\nthought was superfluous.\n\n[1] https://lore.kernel.org/all/20251204100015.1033688-1-arnd@kernel.org/\n\nMeanwhile the problem was also found by intel\u0027s kernel test robot,\ncomplaining about undefined symbols:\n\n| ERROR: modpost: \"m_can_class_unregister\" [drivers/net/can/m_can/m_can_platform.ko] undefined!\n| ERROR: modpost: \"m_can_class_free_dev\" [drivers/net/can/m_can/m_can_platform.ko] undefined!\n| ERROR: modpost: \"m_can_class_allocate_dev\" [drivers/net/can/m_can/m_can_platform.ko] undefined!\n| ERROR: modpost: \"m_can_class_get_clocks\" [drivers/net/can/m_can/m_can_platform.ko] undefined!\n| ERROR: modpost: \"m_can_class_register\" [drivers/net/can/m_can/m_can_platform.ko] undefined!\n\nTo fix this problem, add the missing dependency again.\n\nCc: Vincent Mailhol \u003cmailhol@kernel.org\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202512132253.vO9WFDJK-lkp@intel.com/\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202512180808.fTAUQ2XN-lkp@intel.com/\nReported-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCloses: https://lore.kernel.org/all/7427949a-ea7d-4854-9fe4-e01db7d878c7@app.fastmail.com/\nFixes: 6abd4577bccc (\"can: fix build dependency\")\nFixes: cb2dc6d2869a (\"can: Kconfig: select CAN driver infrastructure by default\")\nAcked-by: Vincent Mailhol \u003cmailhol@kernel.org\u003e\nLink: https://patch.msgid.link/20251217-can-fix-dependency-v1-1-fd2d4f2a2bf5@pengutronix.de\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "39263f986da55c5b7bc328c757fe378a6a41799d", "tree": "88a789ef9b33cf961be711d0170ffa012cc0275b", "parents": [ "74bf97e9a8b6443ba2119dc884940e9364c91bde" ], "author": { "name": "Menglong Dong", "email": "menglong8.dong@gmail.com", "time": "Wed Dec 17 11:00:53 2025 +0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Dec 17 17:53:59 2025 -0500" }, "message": "ftrace: Fix address for jmp mode in t_show()\n\nThe address from ftrace_find_rec_direct() is printed directly in t_show().\nThis can mislead symbol offsets if it has the \"jmp\" bit in the last bit.\n\nFix this by printing the address that returned by ftrace_jmp_get().\n\nLink: https://patch.msgid.link/20251217030053.80343-1-dongml2@chinatelecom.cn\nFixes: 25e4e3565d45 (\"ftrace: Introduce FTRACE_OPS_FL_JMP\")\nSigned-off-by: Menglong Dong \u003cdongml2@chinatelecom.cn\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "74bf97e9a8b6443ba2119dc884940e9364c91bde", "tree": "fed9c0b9e347753c8e5716446ecb3b900dcc80b6", "parents": [ "ef7f38df890f5dcd2ae62f8dbde191d72f3bebae" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Dec 16 09:49:50 2025 -0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Dec 17 17:50:04 2025 -0500" }, "message": "tracing: Fix UBSAN warning in __remove_instance()\n\nxfs/558 triggers the following UBSAN warning:\n\n ------------[ cut here ]------------\n UBSAN: shift-out-of-bounds in kernel/trace/trace.c:10510:10\n shift exponent 32 is too large for 32-bit type \u0027int\u0027\n CPU: 1 UID: 0 PID: 888674 Comm: rmdir Not tainted 6.19.0-rc1-xfsx #rc1 PREEMPT(lazy) dbf607ef4c142c563f76d706e71af9731d7b9c90\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4a/0x70\n ubsan_epilogue+0x5/0x2b\n __ubsan_handle_shift_out_of_bounds.cold+0x5e/0x113\n __remove_instance.part.0.constprop.0.cold+0x18/0x26f\n instance_rmdir+0xf3/0x110\n tracefs_syscall_rmdir+0x4d/0x90\n vfs_rmdir+0x139/0x230\n do_rmdir+0x143/0x230\n __x64_sys_rmdir+0x1d/0x20\n do_syscall_64+0x44/0x230\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f7ae8e51f17\n Code: f0 ff ff 73 01 c3 48 8b 0d de 2e 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 2e 0e 00 f7 d8 64 89 02 b8\n RSP: 002b:00007ffd90743f08 EFLAGS: 00000246 ORIG_RAX: 0000000000000054\n RAX: ffffffffffffffda RBX: 00007ffd907440f8 RCX: 00007f7ae8e51f17\n RDX: 00007f7ae8f3c5c0 RSI: 00007ffd90744a21 RDI: 00007ffd90744a21\n RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000\n R10: 00007f7ae8f35ac0 R11: 0000000000000246 R12: 00007ffd90744a21\n R13: 0000000000000001 R14: 00007f7ae8f8b000 R15: 000055e5283e6a98\n \u003c/TASK\u003e\n ---[ end trace ]---\n\nwhilst tearing down an ftrace instance. TRACE_FLAGS_MAX_SIZE is now 64bit,\nso the mask comparison expression must be typecast to a u64 value to\navoid an overflow. AFAICT, ZEROED_TRACE_FLAGS is already cast to ULL\nso this is ok.\n\nLink: https://patch.msgid.link/20251216174950.GA7705@frogsfrogsfrogs\nFixes: bbec8e28cac592 (\"tracing: Allow tracer to add more than 32 options\")\nSigned-off-by: \"Darrick J. Wong\" \u003cdjwong@kernel.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "ef7f38df890f5dcd2ae62f8dbde191d72f3bebae", "tree": "2f41589248f78ebf644692282c275befa646fa79", "parents": [ "09879758d8ac345d7f08709bfcd2fbe29e96cae4" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Dec 16 18:24:40 2025 -0500" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Dec 17 15:47:35 2025 -0500" }, "message": "tracing: Do not register unsupported perf events\n\nSynthetic events currently do not have a function to register perf events.\nThis leads to calling the tracepoint register functions with a NULL\nfunction pointer which triggers:\n\n ------------[ cut here ]------------\n WARNING: kernel/tracepoint.c:175 at tracepoint_add_func+0x357/0x370, CPU#2: perf/2272\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 2 UID: 0 PID: 2272 Comm: perf Not tainted 6.18.0-ftest-11964-ge022764176fc-dirty #323 PREEMPTLAZY\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n RIP: 0010:tracepoint_add_func+0x357/0x370\n Code: 28 9c e8 4c 0b f5 ff eb 0f 4c 89 f7 48 c7 c6 80 4d 28 9c e8 ab 89 f4 ff 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc \u003c0f\u003e 0b 49 c7 c6 ea ff ff ff e9 ee fe ff ff 0f 0b e9 f9 fe ff ff 0f\n RSP: 0018:ffffabc0c44d3c40 EFLAGS: 00010246\n RAX: 0000000000000001 RBX: ffff9380aa9e4060 RCX: 0000000000000000\n RDX: 000000000000000a RSI: ffffffff9e1d4a98 RDI: ffff937fcf5fd6c8\n RBP: 0000000000000001 R08: 0000000000000007 R09: ffff937fcf5fc780\n R10: 0000000000000003 R11: ffffffff9c193910 R12: 000000000000000a\n R13: ffffffff9e1e5888 R14: 0000000000000000 R15: ffffabc0c44d3c78\n FS: 00007f6202f5f340(0000) GS:ffff93819f00f000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000055d3162281a8 CR3: 0000000106a56003 CR4: 0000000000172ef0\n Call Trace:\n \u003cTASK\u003e\n tracepoint_probe_register+0x5d/0x90\n synth_event_reg+0x3c/0x60\n perf_trace_event_init+0x204/0x340\n perf_trace_init+0x85/0xd0\n perf_tp_event_init+0x2e/0x50\n perf_try_init_event+0x6f/0x230\n ? perf_event_alloc+0x4bb/0xdc0\n perf_event_alloc+0x65a/0xdc0\n __se_sys_perf_event_open+0x290/0x9f0\n do_syscall_64+0x93/0x7b0\n ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n ? trace_hardirqs_off+0x53/0xc0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead, have the code return -ENODEV, which doesn\u0027t warn and has perf\nerror out with:\n\n # perf record -e synthetic:futex_wait\nError:\nThe sys_perf_event_open() syscall returned with 19 (No such device) for event (synthetic:futex_wait).\n\"dmesg | grep -i perf\" may provide additional information.\n\nIdeally perf should support synthetic events, but for now just fix the\nwarning. The support can come later.\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@kernel.org\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nLink: https://patch.msgid.link/20251216182440.147e4453@gandalf.local.home\nFixes: 4b147936fa509 (\"tracing: Add support for \u0027synthetic\u0027 events\")\nReported-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "09879758d8ac345d7f08709bfcd2fbe29e96cae4", "tree": "983a9f33833de54115aad3a8e0e4421daf03671d", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Lukas Bulwahn", "email": "lukas.bulwahn@redhat.com", "time": "Wed Nov 05 10:24:28 2025 +0100" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Dec 17 15:04:21 2025 -0500" }, "message": "MAINTAINERS: add tracepoint core-api doc files to TRACING\n\nThe files in Documentation/core-api/ are by virtue of their top-level\ndirectory part of the Documentation section in MAINTAINERS. Each file in\nDocumentation/core-api/ should however also have a further section in\nMAINTAINERS it belongs to, which fits to the technical area of the\ndocumented API in that file.\n\nThe tracepoint.rst provides some explanation to tracepoints defined in\nselected files under include/trace/events/, which itself is part of the\nTRACING section.\n\nSo, add this core-api document to TRACING.\n\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20251105092428.153378-1-lukas.bulwahn@redhat.com\nSigned-off-by: Lukas Bulwahn \u003clukas.bulwahn@redhat.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "dcd0b625fe440d68bb4b97c71d18ca48ecd6e594", "tree": "bcce10e032d86ef17fbca266b47498dcb08de308", "parents": [ "efc4c35b741af973de90f6826bf35d3b3ac36bf1" ], "author": { "name": "Srinivas Pandruvada", "email": "srinivas.pandruvada@linux.intel.com", "time": "Wed Dec 17 07:34:55 2025 -0800" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Wed Dec 17 17:24:28 2025 +0100" }, "message": "powercap: intel_rapl: Fix possible recursive lock warning\n\nWith the RAPL PMU addition, there is a recursive locking when CPU online\ncallback function calls rapl_package_add_pmu(). Here cpu_hotplug_lock\nis already acquired by cpuhp_thread_fun() and rapl_package_add_pmu()\ntries to acquire again.\n\n\u003c4\u003e[ 8.197433] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\u003c4\u003e[ 8.197437] WARNING: possible recursive locking detected\n\u003c4\u003e[ 8.197440] 6.19.0-rc1-lgci-xe-xe-4242-05b7c58b3367dca84+ #1 Not tainted\n\u003c4\u003e[ 8.197444] --------------------------------------------\n\u003c4\u003e[ 8.197447] cpuhp/0/20 is trying to acquire lock:\n\u003c4\u003e[ 8.197450] ffffffff83487870 (cpu_hotplug_lock){++++}-{0:0}, at:\nrapl_package_add_pmu+0x37/0x370 [intel_rapl_common]\n\u003c4\u003e[ 8.197463]\nbut task is already holding lock:\n\u003c4\u003e[ 8.197466] ffffffff83487870 (cpu_hotplug_lock){++++}-{0:0}, at:\ncpuhp_thread_fun+0x6d/0x290\n\u003c4\u003e[ 8.197477]\nother info that might help us debug this:\n\u003c4\u003e[ 8.197480] Possible unsafe locking scenario:\n\n\u003c4\u003e[ 8.197483] CPU0\n\u003c4\u003e[ 8.197485] ----\n\u003c4\u003e[ 8.197487] lock(cpu_hotplug_lock);\n\u003c4\u003e[ 8.197490] lock(cpu_hotplug_lock);\n\u003c4\u003e[ 8.197493]\n*** DEADLOCK ***\n..\n..\n\u003c4\u003e[ 8.197542] __lock_acquire+0x146e/0x2790\n\u003c4\u003e[ 8.197548] lock_acquire+0xc4/0x2c0\n\u003c4\u003e[ 8.197550] ? rapl_package_add_pmu+0x37/0x370 [intel_rapl_common]\n\u003c4\u003e[ 8.197556] cpus_read_lock+0x41/0x110\n\u003c4\u003e[ 8.197558] ? rapl_package_add_pmu+0x37/0x370 [intel_rapl_common]\n\u003c4\u003e[ 8.197561] rapl_package_add_pmu+0x37/0x370 [intel_rapl_common]\n\u003c4\u003e[ 8.197565] rapl_cpu_online+0x85/0x87 [intel_rapl_msr]\n\u003c4\u003e[ 8.197568] ? __pfx_rapl_cpu_online+0x10/0x10 [intel_rapl_msr]\n\u003c4\u003e[ 8.197570] cpuhp_invoke_callback+0x41f/0x6c0\n\u003c4\u003e[ 8.197573] ? cpuhp_thread_fun+0x6d/0x290\n\u003c4\u003e[ 8.197575] cpuhp_thread_fun+0x1e2/0x290\n\u003c4\u003e[ 8.197578] ? smpboot_thread_fn+0x26/0x290\n\u003c4\u003e[ 8.197581] smpboot_thread_fn+0x12f/0x290\n\u003c4\u003e[ 8.197584] ? __pfx_smpboot_thread_fn+0x10/0x10\n\u003c4\u003e[ 8.197586] kthread+0x11f/0x250\n\u003c4\u003e[ 8.197589] ? __pfx_kthread+0x10/0x10\n\u003c4\u003e[ 8.197592] ret_from_fork+0x344/0x3a0\n\u003c4\u003e[ 8.197595] ? __pfx_kthread+0x10/0x10\n\u003c4\u003e[ 8.197597] ret_from_fork_asm+0x1a/0x30\n\u003c4\u003e[ 8.197604] \u003c/TASK\u003e\n\nFix this issue in the same way as rapl powercap package domain is added\nfrom the same CPU online callback by introducing another interface which\ndoesn\u0027t call cpus_read_lock(). Add rapl_package_add_pmu_locked() and\nrapl_package_remove_pmu_locked() which don\u0027t call cpus_read_lock().\n\nFixes: 748d6ba43afd (\"powercap: intel_rapl: Enable MSR-based RAPL PMU support\")\nReported-by: Borah, Chaitanya Kumar \u003cchaitanya.kumar.borah@intel.com\u003e\nCloses: https://lore.kernel.org/linux-pm/5427ede1-57a0-43d1-99f3-8ca4b0643e82@intel.com/T/#u\nTested-by: Kuppuswamy Sathyanarayanan \u003csathyanarayanan.kuppuswamy@linux.intel.com\u003e\nTested-by: RavitejaX Veesam \u003cravitejax.veesam@intel.com\u003e\nSigned-off-by: Srinivas Pandruvada \u003csrinivas.pandruvada@linux.intel.com\u003e\nLink: https://patch.msgid.link/20251217153455.3560176-1-srinivas.pandruvada@linux.intel.com\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "46cea215dc9444ec32a76b1b6a9cb809e17b64d5", "tree": "0f0debe77ebc850d4136b9c76693f34ccb608fbb", "parents": [ "5d5602236f5db19e8b337a2cd87a90ace5ea776d" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Tue Nov 25 22:43:12 2025 +0900" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Dec 17 10:47:33 2025 +0100" }, "message": "can: j1939: make j1939_sk_bind() fail if device is no longer registered\n\nThere is a theoretical race window in j1939_sk_netdev_event_unregister()\nwhere two j1939_sk_bind() calls jump in between read_unlock_bh() and\nlock_sock().\n\nThe assumption jsk-\u003epriv \u003d\u003d priv can fail if the first j1939_sk_bind()\ncall once made jsk-\u003epriv \u003d\u003d NULL due to failed j1939_local_ecu_get() call\nand the second j1939_sk_bind() call again made jsk-\u003epriv !\u003d NULL due to\nsuccessful j1939_local_ecu_get() call.\n\nSince the socket lock is held by both j1939_sk_netdev_event_unregister()\nand j1939_sk_bind(), checking ndev-\u003ereg_state with the socket lock held can\nreliably make the second j1939_sk_bind() call fail (and close this race\nwindow).\n\nFixes: 7fcbe5b2c6a4 (\"can: j1939: implement NETDEV_UNREGISTER notification handler\")\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nAcked-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nLink: https://patch.msgid.link/5732921e-247e-4957-a364-da74bd7031d7@I-love.SAKURA.ne.jp\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "5d5602236f5db19e8b337a2cd87a90ace5ea776d", "tree": "7fe967bedab45ee93930af09bbb97dd9adf653f4", "parents": [ "885bebac9909994050bbbeed0829c727e42bd1b7" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Tue Nov 25 22:39:59 2025 +0900" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Dec 17 10:46:39 2025 +0100" }, "message": "can: j1939: make j1939_session_activate() fail if device is no longer registered\n\nsyzbot is still reporting\n\n unregister_netdevice: waiting for vcan0 to become free. Usage count \u003d 2\n\neven after commit 93a27b5891b8 (\"can: j1939: add missing calls in\nNETDEV_UNREGISTER notification handler\") was added. A debug printk() patch\nfound that j1939_session_activate() can succeed even after\nj1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER)\nhas completed.\n\nSince j1939_cancel_active_session() is processed with the session list lock\nheld, checking ndev-\u003ereg_state in j1939_session_activate() with the session\nlist lock held can reliably close the race window.\n\nReported-by: syzbot \u003csyzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com\u003e\nCloses: https://syzkaller.appspot.com/bug?extid\u003d881d65229ca4f9ae8c84\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nAcked-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nLink: https://patch.msgid.link/b9653191-d479-4c8b-8536-1326d028db5c@I-love.SAKURA.ne.jp\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "ea1013c1539270e372fc99854bc6e4d94eaeff66", "tree": "3160ebc191b4340228c1da3e17485ec6709341d3", "parents": [ "64e68f8a95eb771273d8d19f9dc1f763524e56d9", "1d528e794f3db5d32279123a89957c44c4406a09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Dec 17 15:54:58 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Dec 17 15:54:58 2025 +1200" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix BPF builds due to -fms-extensions. selftests (Alexei\n Starovoitov), bpftool (Quentin Monnet).\n\n - Fix build of net/smc when CONFIG_BPF_SYSCALL\u003dy, but CONFIG_BPF_JIT\u003dn\n (Geert Uytterhoeven)\n\n - Fix livepatch/BPF interaction and support reliable unwinding through\n BPF stack frames (Josh Poimboeuf)\n\n - Do not audit capability check in arm64 JIT (Ondrej Mosnacek)\n\n - Fix truncated dmabuf BPF iterator reads (T.J. Mercier)\n\n - Fix verifier assumptions of bpf_d_path\u0027s output buffer (Shuran Liu)\n\n - Fix warnings in libbpf when built with -Wdiscarded-qualifiers under\n C23 (Mikhail Gavrilov)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n selftests/bpf: add regression test for bpf_d_path()\n bpf: Fix verifier assumptions of bpf_d_path\u0027s output buffer\n selftests/bpf: Add test for truncated dmabuf_iter reads\n bpf: Fix truncated dmabuf iterator reads\n x86/unwind/orc: Support reliable unwinding through BPF stack frames\n bpf: Add bpf_has_frame_pointer()\n bpf, arm64: Do not audit capability check in do_jit()\n libbpf: Fix -Wdiscarded-qualifiers under C23\n bpftool: Fix build warnings due to MS extensions\n net: smc: SMC_HS_CTRL_BPF should depend on BPF_JIT\n selftests/bpf: Add -fms-extensions to bpf build flags\n" }, { "commit": "64e68f8a95eb771273d8d19f9dc1f763524e56d9", "tree": "09c420e94ad289a3fd3fb41996f3c43c96e4398d", "parents": [ "40fbbd64bba6c6e7a72885d2f59b6a3be9991eeb", "489e96651dfe59794195c6b2ddb78835edd9f2ed" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Dec 17 15:48:30 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Dec 17 15:48:30 2025 +1200" }, "message": "Merge tag \u0027s390-6.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Alexander Gordeev:\n\n - clear \u0027Search boot program\u0027 flag when \u0027bootprog\u0027 sysfs file is\n written to override a value set from Hardware Management Console\n\n - fix cyclic dead-lock in zpci_zdev_put() and zpci_scan_devices()\n functions when triggering PCI device recovery using sysfs\n\n - annotate the expected lock context imbalance in zpci_release_device()\n function to fix a sparse complaint\n\n - fix the logic to fallback to the return address register value in the\n topmost frame when stack tracing uses a back chain\n\n* tag \u0027s390-6.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/stacktrace: Do not fallback to RA register\n s390/pci: Annotate lock context imbalance in zpci_release_device()\n s390/pci: Fix cyclic dead-lock in zpci_zdev_put() and zpci_scan_devices()\n s390/ipl: Clear SBP flag when bootprog is set\n" }, { "commit": "d8a4af8f3d9d3367b2c49b0d9dee529556bdd2f4", "tree": "4b8bbafdf245cd5f30133969396cc2bfb0776089", "parents": [ "94d5b8dbc5d9caa8e01c8fab8d5ed56e843ff40e" ], "author": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sat Dec 13 12:48:49 2025 -0600" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Tue Dec 16 17:43:02 2025 -0600" }, "message": "cifs: update internal module version number\n\n to 2.58\n\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "94d5b8dbc5d9caa8e01c8fab8d5ed56e843ff40e", "tree": "9f43da19d18ef6f2e183ca738edce1d1193babda", "parents": [ "05f5e355cf783b30bd6eb3dec17ed1a8b3cfa95c" ], "author": { "name": "ZhangGuoDong", "email": "zhangguodong@kylinos.cn", "time": "Tue Dec 02 15:14:17 2025 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Tue Dec 16 17:43:01 2025 -0600" }, "message": "smb: move some SMB1 definitions into common/smb1pdu.h\n\nThese definitions are only used by SMB1, so move them into the new\ncommon/smb1pdu.h.\n\nKSMBD only implements SMB_COM_NEGOTIATE, see MS-SMB2 3.3.5.2.\n\nCo-developed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: ZhangGuoDong \u003czhangguodong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "05f5e355cf783b30bd6eb3dec17ed1a8b3cfa95c", "tree": "00443ed7113c613cfd50d36086e2a78559db2f03", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Bharath SM", "email": "bharathsm@microsoft.com", "time": "Tue Dec 16 21:26:05 2025 +0530" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Tue Dec 16 17:42:49 2025 -0600" }, "message": "smb: align durable reconnect v2 context to 8 byte boundary\n\nAdd a 4-byte Pad to create_durable_handle_reconnect_v2 so the DH2C\ncreate context is 8 byte aligned.\nThis avoids malformed CREATE contexts on reconnect.\nRecent change removed this Padding, adding it back.\n\nFixes: 81a45de432c6 (\"smb: move create_durable_handle_reconnect_v2 to common/smb2pdu.h\")\n\nSigned-off-by: Bharath SM \u003cbharathsm@microsoft.com\u003e\nReviewed-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "e6a973af11135439de32ece3b9cbe3bfc043bea8", "tree": "51fccb4649a80f9c0f9693ca8fd2e0dc5744366f", "parents": [ "b80fab281349f107a07e841eb412a86e2877ae88" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Dec 16 11:53:40 2025 -0400" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Dec 16 11:53:40 2025 -0400" }, "message": "iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED\n\nsyzkaller found it could overflow math in the test infrastructure and\ncause a WARN_ON by corrupting the reserved interval tree. This only\neffects test kernels with CONFIG_IOMMUFD_TEST.\n\nValidate the user input length in the test ioctl.\n\nFixes: f4b20bb34c83 (\"iommufd: Add kernel support for testing iommufd\")\nLink: https://patch.msgid.link/r/0-v1-cd99f6049ba5+51-iommufd_syz_add_resv_jgg@nvidia.com\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewed-by: Kevin Tian \u003ckevin.tian@intel.com\u003e\nTested-by: Yi Liu \u003cyi.l.liu@intel.com\u003e\nReported-by: syzbot+57fdb0cf6a0c5d1f15a2@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/69368129.a70a0220.38f243.008f.GAE@google.com\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "359afc8eb02a518fbdd0cbd462c8c2827c6cbec2", "tree": "b955620ec1cdbdd3ea6eb5065193c2d294505e14", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Dec 15 15:21:34 2025 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Dec 16 12:58:57 2025 +0100" }, "message": "PM: runtime: Do not clear needs_force_resume with enabled runtime PM\n\nCommit 89d9cec3b1e9 (\"PM: runtime: Clear power.needs_force_resume in\npm_runtime_reinit()\") added provisional clearing of power.needs_force_resume\nto pm_runtime_reinit(), but it is done unconditionally which is a\nmistake because pm_runtime_reinit() may race with driver probing\nand removal [1].\n\nTo address this, notice that power.needs_force_resume should never\nbe set when runtime PM is enabled and so it only needs to be cleared\nwhen runtime PM is disabled, and update pm_runtime_init() to only\nclear that flag when runtime PM is disabled.\n\nFixes: 89d9cec3b1e9 (\"PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()\")\nReported-by: Ed Tsai \u003ced.tsai@mediatek.com\u003e\nCloses: https://lore.kernel.org/linux-pm/20251215122154.3180001-1-ed.tsai@mediatek.com/ [1]\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nCc: 6.17+ \u003cstable@vger.kernel.org\u003e # 6.17+\nReviewed-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nLink: https://patch.msgid.link/12807571.O9o76ZdvQC@rafael.j.wysocki\n" }, { "commit": "40fbbd64bba6c6e7a72885d2f59b6a3be9991eeb", "tree": "26b72ec40b25131856110bae738c2a82607b6082", "parents": [ "53ec4a79ff4b36d9711cfe030eeebc36afbc51dd", "e1b4c6a58304fd490124cc2b454d80edc786665c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:44:36 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:44:36 2025 +1200" }, "message": "Merge tag \u0027pull-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull shmem rename fixes from Al Viro:\n \"A couple of shmem rename fixes - recent regression from tree-in-dcache\n series and older breakage from stable directory offsets stuff\"\n\n* tag \u0027pull-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:\n shmem: fix recovery on rename failures\n shmem_whiteout(): fix regression from tree-in-dcache series\n" }, { "commit": "53ec4a79ff4b36d9711cfe030eeebc36afbc51dd", "tree": "861e0e24084acba34a3cb19bce5c764933974745", "parents": [ "115fada16b5a9a5ee371ad656e56419fe0e63cfc", "95d7a890e4b03e198836d49d699408fd1867cb55" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:34:09 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:34:09 2025 +1200" }, "message": "Merge tag \u0027v6.19-rc1-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix set xattr name validation\n\n - Fix session refcount leak\n\n - Minor cleanup\n\n - smbdirect (RDMA) fixes: improve receive completion, and connect\n\n* tag \u0027v6.19-rc1-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: fix buffer validation by including null terminator size in EA length\n ksmbd: Fix refcount leak when invalid session is found on session lookup\n ksmbd: remove redundant DACL check in smb_check_perm_dacl\n ksmbd: convert comma to semicolon\n smb: server: defer the initial recv completion logic to smb_direct_negotiate_recv_work()\n smb: server: initialize recv_io-\u003ecqe.done \u003d recv_done just once\n smb: smbdirect: introduce smbdirect_socket.connect.{lock,work}\n" }, { "commit": "115fada16b5a9a5ee371ad656e56419fe0e63cfc", "tree": "28240fc357afd6b54802582471749c541fc4decd", "parents": [ "dbf89321bf1eb0cd3115662c4fbd569abf92ef9c", "37343524f000d2a64359867d7024a73233d3b438" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:28:20 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:28:20 2025 +1200" }, "message": "Merge tag \u0027for-6.19-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fix missing btrfs_path release after printing a relocation error\n message\n\n - fix extent changeset leak on mmap write after failure to reserve\n metadata\n\n - fix fs devices list structure freeing, it could be potentially leaked\n under some circumstances\n\n - tree log fixes:\n - fix incremental directory logging where inodes for new dentries\n were incorrectly skipped\n - don\u0027t log conflicting inode if it\u0027s a directory moved in the\n current transaction\n\n - regression fixes:\n - fix incorrect btrfs_path freeing when it\u0027s auto-cleaned\n - revert commit simplifying preallocation of temporary structures\n in qgroup functions, some cases were not handled properly\n\n* tag \u0027for-6.19-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix changeset leak on mmap write after failure to reserve metadata\n btrfs: fix memory leak of fs_devices in degraded seed device path\n btrfs: fix a potential path leak in print_data_reloc_error()\n Revert \"btrfs: add ASSERTs on prealloc in qgroup functions\"\n btrfs: do not skip logging new dentries when logging a new name\n btrfs: don\u0027t log conflicting inode if it\u0027s a dir moved in the current transaction\n btrfs: tests: fix double btrfs_path free in remove_extent_ref()\n" }, { "commit": "dbf89321bf1eb0cd3115662c4fbd569abf92ef9c", "tree": "06502c03555f967abbff8ad1bdc64f3aa6aa2d59", "parents": [ "6b63f90fa2afaa901e7edc9403014e46f0da1c69", "bb27226f0d00588ac53be8825e021ae80aa43371" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:24:35 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:24:35 2025 +1200" }, "message": "Merge tag \u0027sched_ext-for-6.19-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - Fix memory leak when destroying helper kthread workers during\n scheduler disable\n\n - Fix bypass depth accounting on scx_enable() failure which could leave\n the system permanently in bypass mode\n\n - Fix missing preemption handling when moving tasks to local DSQs via\n scx_bpf_dsq_move()\n\n - Misc fixes including NULL check for put_prev_task(), flushing stdout\n in selftests, and removing unused code\n\n* tag \u0027sched_ext-for-6.19-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Remove unused code in the do_pick_task_scx()\n selftests/sched_ext: flush stdout before test to avoid log spam\n sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq()\n sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()\n sched_ext: Fix bypass depth leak on scx_enable() failure\n sched/ext: Avoid null ptr traversal when -\u003eput_prev_task() is called with NULL next\n sched_ext: Fix the memleak for sch-\u003ehelper objects\n" }, { "commit": "6b63f90fa2afaa901e7edc9403014e46f0da1c69", "tree": "9a1274f8180b8f9178278077556ef38138afdead", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8", "3309b63a2281efb72df7621d60cc1246b6286ad3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:21:17 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 16 19:21:17 2025 +1200" }, "message": "Merge tag \u0027cgroup-for-6.19-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fix from Tejun Heo:\n\n - Fix a race condition in css_rstat_updated() where CMPXCHG without\n LOCK prefix could cause lnode corruption when the flusher runs\n concurrently on another CPU. The issue was introduced in 6.17 and\n causes memcg stats to become corrupted in production.\n\n* tag \u0027cgroup-for-6.19-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated\n" }, { "commit": "e1b4c6a58304fd490124cc2b454d80edc786665c", "tree": "ebb2e81a49c5e82413e3c2c09a0f550cf86704c0", "parents": [ "3010f06c52aa7da51493df59303ea733a614597b" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Dec 13 17:50:23 2025 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Dec 16 00:57:29 2025 -0500" }, "message": "shmem: fix recovery on rename failures\n\nmaple_tree insertions can fail if we are seriously short on memory;\nsimple_offset_rename() does not recover well if it runs into that.\nThe same goes for simple_offset_rename_exchange().\n\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\nprogress to d_move(), i.e. that shmem_rename2() won\u0027t fail past the\nsuccessful call of shmem_whiteout().\n\nNot hard to fix, fortunately - mtree_store() can\u0027t fail if the index we\nare trying to store into is already present in the tree as a singleton.\n\nFor simple_offset_rename_exchange() that\u0027s enough - we just need to be\ncareful about the order of operations.\n\nFor simple_offset_rename() solution is to preinsert the target into the\ntree for new_dir; the rest can be done without any potentially failing\noperations.\n\nThat preinsertion has to be done in shmem_rename2() rather than in\nsimple_offset_rename() itself - otherwise we\u0027d need to deal with the\npossibility of failure after successful shmem_whiteout().\n\nFixes: a2e459555c5f (\"shmem: stable directory offsets\")\nReviewed-by: Christian Brauner \u003cbrauner@kernel.org\u003e\nReviewed-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "b80fab281349f107a07e841eb412a86e2877ae88", "tree": "b67131839357bff13c6c63f58ce489272ff0a95d", "parents": [ "5b244b077c0b0e76573fbb9542cf038e42368901" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Fri Dec 05 15:42:47 2025 -0400" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Mon Dec 15 20:34:41 2025 -0400" }, "message": "iommufd/selftest: Do not leak the hwpt if IOMMU_TEST_OP_MD_CHECK_MAP fails\n\nIf the input validation fails it returned without freeing the hwpt\nrefcount causing a leak. This triggers a WARN_ON when closing the fd:\n\n WARNING: drivers/iommu/iommufd/main.c:369 at iommufd_fops_release+0x385/0x430, CPU#1: repro/724\n\nFound by szykaller.\n\nFixes: e93d5945ed5b (\"iommufd: Change the selftest to use iommupt instead of xarray\")\nLink: https://patch.msgid.link/r/0-v1-c8ed57e24380+44ae-iommufd_selftest_hwpt_leak_jgg@nvidia.com\nReviewed-by: Kevin Tian \u003ckevin.tian@intel.com\u003e\nReviewed-by: Pasha Tatashin \u003cpasha.tatashin@soleen.com\u003e\nReported-by: \"Lai, Yi\" \u003cyi1.lai@linux.intel.com\u003e\nCloses: https://lore.kernel.org/r/aTJGMaqwQK0ASj0G@ly-workstation\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "5b244b077c0b0e76573fbb9542cf038e42368901", "tree": "d64614ee1fe5c73036fce1577b9c5dd77e9f8dc2", "parents": [ "69dc538a4f5a57dcc5ea4893c769d567f539a1b1" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Fri Dec 05 14:56:12 2025 -0400" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Mon Dec 15 20:34:41 2025 -0400" }, "message": "iommufd/selftest: Make it clearer to gcc that the access is not out of bounds\n\nGCC gets a bit confused and reports:\n\n In function \u0027_test_cmd_get_hw_info\u0027,\n inlined from \u0027iommufd_ioas_get_hw_info\u0027 at iommufd.c:779:3,\n inlined from \u0027wrapper_iommufd_ioas_get_hw_info\u0027 at iommufd.c:752:1:\n\u003e\u003e iommufd_utils.h:804:37: warning: array subscript \u0027struct iommu_test_hw_info[0]\u0027 is partly outside array bounds of \u0027struct iommu_test_hw_info_buffer_smaller[1]\u0027 [-Warray-bounds\u003d]\n 804 | assert(!info-\u003eflags);\n | ~~~~^~~~~~~\n iommufd.c: In function \u0027wrapper_iommufd_ioas_get_hw_info\u0027:\n iommufd.c:761:11: note: object \u0027buffer_smaller\u0027 of size 4\n 761 | } buffer_smaller;\n | ^~~~~~~~~~~~~~\n\nWhile it is true that \"struct iommu_test_hw_info[0]\" is partly out of\nbounds of the input pointer, it is not true that info-\u003eflags is out of\nbounds. Unclear why it warns on this.\n\nReuse an existing properly sized stack buffer and pass a truncated length\ninstead to test the same thing.\n\nFixes: af4fde93c319 (\"iommufd/selftest: Add coverage for IOMMU_GET_HW_INFO ioctl\")\nLink: https://patch.msgid.link/r/0-v1-63a2cffb09da+4486-iommufd_gcc_bounds_jgg@nvidia.com\nReviewed-by: Kevin Tian \u003ckevin.tian@intel.com\u003e\nReviewed-by: Nicolin Chen \u003cnicolinc@nvidia.com\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202512032344.kaAcKFIM-lkp@intel.com/\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "69dc538a4f5a57dcc5ea4893c769d567f539a1b1", "tree": "a6cf080bff261910cec7be6f1dd6e51312386850", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Thu Dec 04 11:03:29 2025 +0100" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Mon Dec 15 20:34:41 2025 -0400" }, "message": "iommufd: Fix building without dmabuf\n\nWhen DMABUF is disabled, trying to use it causes a link failure:\n\nx86_64-linux-ld: drivers/iommu/iommufd/io_pagetable.o: in function `iopt_map_file_pages\u0027:\nio_pagetable.c:(.text+0x1735): undefined reference to `dma_buf_get\u0027\nx86_64-linux-ld: io_pagetable.c:(.text+0x1775): undefined reference to `dma_buf_put\u0027\n\nFixes: 44ebaa1744fd (\"iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE\")\nLink: https://patch.msgid.link/r/20251204100333.1034767-1-arnd@kernel.org\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "bb27226f0d00588ac53be8825e021ae80aa43371", "tree": "d4847bfe5731357e29bf62dbf636f7cb9ad7e730", "parents": [ "579a3297b268f0281644ead7ff574a2b4bc64d3c" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Mon Dec 15 19:29:40 2025 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Dec 15 05:53:49 2025 -1000" }, "message": "sched_ext: Remove unused code in the do_pick_task_scx()\n\nThe kick_idle variable is no longer used, this commit therefore remove\nit and also remove associated code in the do_pick_task_scx().\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "fec7b0795548b43e2c3c46e3143c34ef6070341c", "tree": "b524dbdecc6f4cf526780e0bc3ddc08f9e7767a4", "parents": [ "7e7a817f2dfd79098a706ee5581ea9518b2de878" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Dec 11 13:16:49 2025 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Mon Dec 15 15:04:04 2025 +0100" }, "message": "selftests: netfilter: packetdrill: avoid failure on HZ\u003d100 kernel\n\npacketdrill --ip_version\u003dipv4 --mtu\u003d1500 --tolerance_usecs\u003d1000000 --non_fatal packet conntrack_syn_challenge_ack.pkt\nconntrack v1.4.8 (conntrack-tools): 1 flow entries have been shown.\nconntrack_syn_challenge_ack.pkt:32: error executing `conntrack -f $NFCT_IP_VERSION \\\n-L -p tcp --dport 8080 | grep UNREPLIED | grep -q SYN_SENT` command: non-zero status 1\n\nAffected kernel had CONFIG_HZ\u003d100; reset packet was still sitting in\nbacklog.\n\nReported-by: Yi Chen \u003cyiche@redhat.com\u003e\nFixes: a8a388c2aae4 (\"selftests: netfilter: add packetdrill based conntrack tests\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "7e7a817f2dfd79098a706ee5581ea9518b2de878", "tree": "4d65e13ec4873455c524d163b846af5a812cc717", "parents": [ "8e1a1bc4f5a42747c08130b8242ebebd1210b32f" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Dec 11 12:55:19 2025 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Mon Dec 15 15:04:04 2025 +0100" }, "message": "netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate\n\nThis reverts commit\n314c82841602 (\"netfilter: nf_tables: can\u0027t schedule in nft_chain_validate\"):\nSince commit a60a5abe19d6 (\"netfilter: nf_tables: allow iter callbacks to sleep\")\nthe iterator callback is invoked without rcu read lock held, so this\ncond_resched() is now valid.\n\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "8e1a1bc4f5a42747c08130b8242ebebd1210b32f", "tree": "fdc1a615873b97f80047ce191078b1c13b3461a9", "parents": [ "a67fd55f6a09f4119b7232c19e0f348fe31ab0db" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sun Jul 07 01:18:25 2024 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Mon Dec 15 15:02:44 2025 +0100" }, "message": "netfilter: nf_tables: avoid chain re-validation if possible\n\nHamza Mahfooz reports cpu soft lock-ups in\nnft_chain_validate():\n\n watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re:37547]\n[..]\n RIP: 0010:nft_chain_validate+0xcb/0x110 [nf_tables]\n[..]\n nft_immediate_validate+0x36/0x50 [nf_tables]\n nft_chain_validate+0xc9/0x110 [nf_tables]\n nft_immediate_validate+0x36/0x50 [nf_tables]\n nft_chain_validate+0xc9/0x110 [nf_tables]\n nft_immediate_validate+0x36/0x50 [nf_tables]\n nft_chain_validate+0xc9/0x110 [nf_tables]\n nft_immediate_validate+0x36/0x50 [nf_tables]\n nft_chain_validate+0xc9/0x110 [nf_tables]\n nft_immediate_validate+0x36/0x50 [nf_tables]\n nft_chain_validate+0xc9/0x110 [nf_tables]\n nft_immediate_validate+0x36/0x50 [nf_tables]\n nft_chain_validate+0xc9/0x110 [nf_tables]\n nft_table_validate+0x6b/0xb0 [nf_tables]\n nf_tables_validate+0x8b/0xa0 [nf_tables]\n nf_tables_commit+0x1df/0x1eb0 [nf_tables]\n[..]\n\nCurrently nf_tables will traverse the entire table (chain graph), starting\nfrom the entry points (base chains), exploring all possible paths\n(chain jumps). But there are cases where we could avoid revalidation.\n\nConsider:\n1 input -\u003e j2 -\u003e j3\n2 input -\u003e j2 -\u003e j3\n3 input -\u003e j1 -\u003e j2 -\u003e j3\n\nThen the second rule does not need to revalidate j2, and, by extension j3,\nbecause this was already checked during validation of the first rule.\nWe need to validate it only for rule 3.\n\nThis is needed because chain loop detection also ensures we do not exceed\nthe jump stack: Just because we know that j2 is cycle free, its last jump\nmight now exceed the allowed stack size. We also need to update all\nreachable chains with the new largest observed call depth.\n\nCare has to be taken to revalidate even if the chain depth won\u0027t be an\nissue: chain validation also ensures that expressions are not called from\ninvalid base chains. For example, the masquerade expression can only be\ncalled from NAT postrouting base chains.\n\nTherefore we also need to keep record of the base chain context (type,\nhooknum) and revalidate if the chain becomes reachable from a different\nhook location.\n\nReported-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nCloses: https://lore.kernel.org/netfilter-devel/20251118221735.GA5477@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/\nTested-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "f103fa127c93016bcd89b05d8e11dc1a84f6990d", "tree": "e03de85d1eddf84d192af3951ff26c0f965cdab4", "parents": [ "6ea3a44cef28add2d93b1ef119d84886cb1e3c9b" ], "author": { "name": "Pengjie Zhang", "email": "zhangpengjie2@huawei.com", "time": "Wed Dec 10 21:26:34 2025 +0800" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Dec 15 13:00:33 2025 +0100" }, "message": "ACPI: PCC: Fix race condition by removing static qualifier\n\nLocal variable \u0027ret\u0027 in acpi_pcc_address_space_setup() is currently\ndeclared as \u0027static\u0027. This can lead to race conditions in a\nmultithreaded environment.\n\nRemove the \u0027static\u0027 qualifier to ensure that \u0027ret\u0027 will be allocated\ndirectly on the stack as a local variable.\n\nFixes: a10b1c99e2dc (\"ACPI: PCC: Setup PCC Opregion handler only if platform interrupt is available\")\nSigned-off-by: Pengjie Zhang \u003czhangpengjie2@huawei.com\u003e\nReviewed-by: Sudeep Holla \u003csudeep.holla@arm.com\u003e\nAcked-by: lihuisong@huawei.com\nCc: 6.2+ \u003cstable@vger.kernel.org\u003e # 6.2+\n[ rjw: Changelog edits ]\nLink: https://patch.msgid.link/20251210132634.2050033-1-zhangpengjie2@huawei.com\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "6ea3a44cef28add2d93b1ef119d84886cb1e3c9b", "tree": "552e93fc2dbcb011b88f4ab0b0cfe0b2ac3d6c35", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Pengjie Zhang", "email": "zhangpengjie2@huawei.com", "time": "Wed Dec 10 21:22:27 2025 +0800" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Dec 15 12:56:46 2025 +0100" }, "message": "ACPI: CPPC: Fix missing PCC check for guaranteed_perf\n\nThe current implementation overlooks the \u0027guaranteed_perf\u0027\nregister in this check.\n\nIf the Guaranteed Performance register is located in the PCC\nsubspace, the function currently attempts to read it without\nacquiring the lock and without sending the CMD_READ doorbell\nto the firmware. This can result in reading stale data.\n\nFixes: 29523f095397 (\"ACPI / CPPC: Add support for guaranteed performance\")\nSigned-off-by: Pengjie Zhang \u003czhangpengjie2@huawei.com\u003e\nCc: 4.20+ \u003cstable@vger.kernel.org\u003e # 4.20+\n[ rjw: Subject and changelog edits ]\nLink: https://patch.msgid.link/20251210132227.1988380-1-zhangpengjie2@huawei.com\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "d113735421da322ea144c9778c433de6ff6bc57b", "tree": "4221b9000b324d7e5b21dddf44157d4656dfa79a", "parents": [ "450f9cde66a92fd6c7f6870b3501e8debe9f69cc" ], "author": { "name": "Thorsten Blum", "email": "thorsten.blum@linux.dev", "time": "Sat Dec 06 18:42:45 2025 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Dec 15 12:47:39 2025 +0100" }, "message": "thermal: core: Fix typo and indentation in comments\n\ns/tmperature/temperature/ and adjust the indentation of the @ops\nparameter description to improve readability.\n\nSigned-off-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nLink: https://patch.msgid.link/20251206174245.116391-2-thorsten.blum@linux.dev\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "450f9cde66a92fd6c7f6870b3501e8debe9f69cc", "tree": "48374d84a93cb9c6406de2dea4abd3271f2a5424", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Srinivas Pandruvada", "email": "srinivas.pandruvada@linux.intel.com", "time": "Fri Dec 05 15:00:07 2025 -0800" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Dec 15 12:44:59 2025 +0100" }, "message": "thermal: intel: int340x: Enable power slider interface for Wildcat Lake\n\nSet the PROC_THERMAL_FEATURE_SOC_POWER_SLIDER feature flag in\nproc_thermal_pci_ids[] for Wildcat Lake to enable power slider interface.\n\nSigned-off-by: Srinivas Pandruvada \u003csrinivas.pandruvada@linux.intel.com\u003e\nLink: https://patch.msgid.link/20251205230007.2218533-1-srinivas.pandruvada@linux.intel.com\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "efc4c35b741af973de90f6826bf35d3b3ac36bf1", "tree": "20feb0dc3c87b96f6b9d222760f63eafb834fba9", "parents": [ "7bda1910c4bccd4b8d4726620bb3d6bbfb62286e" ], "author": { "name": "Sumeet Pawnikar", "email": "sumeet4linux@gmail.com", "time": "Sun Dec 07 20:45:48 2025 +0530" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Dec 15 12:33:59 2025 +0100" }, "message": "powercap: fix sscanf() error return value handling\n\nFix inconsistent error handling for sscanf() return value check.\n\nImplicit boolean conversion is used instead of explicit return\nvalue checks. The code checks if (!sscanf(...)) which is incorrect\nbecause:\n 1. sscanf returns the number of successfully parsed items\n 2. On success, it returns 1 (one item passed)\n 3. On failure, it returns 0 or EOF\n 4. The check \u0027if (!sscanf(...))\u0027 is wrong because it treats\n success (1) as failure\n\nAll occurrences of sscanf() now uses explicit return value check.\nWith this behavior it returns \u0027-EINVAL\u0027 when parsing fails (returns\n0 or EOF), and continues when parsing succeeds (returns 1).\n\nSigned-off-by: Sumeet Pawnikar \u003csumeet4linux@gmail.com\u003e\n[ rjw: Subject and changelog edits ]\nLink: https://patch.msgid.link/20251207151549.202452-1-sumeet4linux@gmail.com\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "7bda1910c4bccd4b8d4726620bb3d6bbfb62286e", "tree": "e084db4e2270398ab0f0a3385aba53212dcfa0d8", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Sumeet Pawnikar", "email": "sumeet4linux@gmail.com", "time": "Sat Dec 06 00:32:16 2025 +0530" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Dec 15 12:29:11 2025 +0100" }, "message": "powercap: fix race condition in register_control_type()\n\nThe device becomes visible to userspace via device_register()\neven before it fully initialized by idr_init(). If userspace\nor another thread tries to register a zone immediately after\ndevice_register(), the control_type_valid() will fail because\nthe control_type is not yet in the list. The IDR is not yet\ninitialized, so this race condition causes zone registration\nfailure.\n\nMove idr_init() and list addition before device_register()\nfix the race condition.\n\nSigned-off-by: Sumeet Pawnikar \u003csumeet4linux@gmail.com\u003e\n[ rjw: Subject adjustment, empty line added ]\nLink: https://patch.msgid.link/20251205190216.5032-1-sumeet4linux@gmail.com\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "6f7c877cc397ba3c6d8ba44d4a604df3d4182eec", "tree": "faf036be7cf3cd90c8db756ac0b845289b3f567e", "parents": [ "635bc4def026a24e071436f4f356ea08c0eed6ff" ], "author": { "name": "Ahelenia Ziemiańska", "email": "nabijaczleweli@nabijaczleweli.xyz", "time": "Mon Dec 08 23:20:24 2025 +0100" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Dec 15 10:19:52 2025 +0100" }, "message": "fs: send fsnotify_xattr()/IN_ATTRIB from vfs_fileattr_set()/chattr(1)\n\nCurrently it seems impossible to observe these changes to the file\u0027s\nattributes. It\u0027s useful to be able to do this to see when the file\nbecomes immutable, for example, so emit IN_ATTRIB via fsnotify_xattr(),\nlike when changing other inode attributes.\n\nSigned-off-by: Ahelenia Ziemiańska \u003cnabijaczleweli@nabijaczleweli.xyz\u003e\nLink: https://patch.msgid.link/iyvn6qjotpu6cei5jdtsoibfcp6l6rgvn47cwgaucgtucpfy2s@tarta.nabijaczleweli.xyz\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "635bc4def026a24e071436f4f356ea08c0eed6ff", "tree": "0ab252dfdecda3a1546ab04c2de7f422e9fd398f", "parents": [ "7d0a66e4bb9081d75c82ec4957c50034cb0ea449" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Sun Dec 07 11:44:55 2025 +0100" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Dec 15 10:18:46 2025 +0100" }, "message": "fsnotify: do not generate ACCESS/MODIFY events on child for special files\n\ninotify/fanotify do not allow users with no read access to a file to\nsubscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the\nsame user to subscribe for watching events on children when the user\nhas access to the parent directory (e.g. /dev).\n\nUsers with no read access to a file but with read access to its parent\ndirectory can still stat the file and see if it was accessed/modified\nvia atime/mtime change.\n\nThe same is not true for special files (e.g. /dev/null). Users will not\ngenerally observe atime/mtime changes when other users read/write to\nspecial files, only when someone sets atime/mtime via utimensat().\n\nAlign fsnotify events with this stat behavior and do not generate\nACCESS/MODIFY events to parent watchers on read/write of special files.\nThe events are still generated to parent watchers on utimensat(). This\ncloses some side-channels that could be possibly used for information\nexfiltration [1].\n\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf\n\nReported-by: Sudheendra Raghav Neela \u003csneela@tugraz.at\u003e\nCC: stable@vger.kernel.org\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "95d7a890e4b03e198836d49d699408fd1867cb55", "tree": "b932eda763e22d13b9f497438bee32ea5059ee09", "parents": [ "cafb57f7bdd57abba87725eb4e82bbdca4959644" ], "author": { "name": "Namjae Jeon", "email": "linkinjeon@kernel.org", "time": "Sun Dec 14 15:06:34 2025 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Dec 14 18:35:56 2025 -0600" }, "message": "ksmbd: fix buffer validation by including null terminator size in EA length\n\nThe smb2_set_ea function, which handles Extended Attributes (EA),\nwas performing buffer validation checks that incorrectly omitted the size\nof the null terminating character (+1 byte) for EA Name.\nThis patch fixes the issue by explicitly adding \u0027+ 1\u0027 to EaNameLength where\nthe null terminator is expected to be present in the buffer, ensuring\nthe validation accurately reflects the total required buffer size.\n\nCc: stable@vger.kernel.org\nReported-by: Roger \u003croger.andersen@protonmail.com\u003e\nReported-by: Stanislas Polu \u003cspolu@dust.tt\u003e\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "cafb57f7bdd57abba87725eb4e82bbdca4959644", "tree": "fa0ac3cd53080744341201ae19bdc8e3b02553ec", "parents": [ "8dd2e58b62731a96e276ee0545fb910ffb2057d9" ], "author": { "name": "Namjae Jeon", "email": "linkinjeon@kernel.org", "time": "Sun Dec 14 15:05:56 2025 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Dec 14 18:35:56 2025 -0600" }, "message": "ksmbd: Fix refcount leak when invalid session is found on session lookup\n\nWhen a session is found but its state is not SMB2_SESSION_VALID, It\nindicates that no valid session was found, but it is missing to decrement\nthe reference count acquired by the session lookup, which results in\na reference count leak. This patch fixes the issue by explicitly calling\nksmbd_user_session_put to release the reference to the session.\n\nCc: stable@vger.kernel.org\nReported-by: Alexandre \u003croger.andersen@protonmail.com\u003e\nReported-by: Stanislas Polu \u003cspolu@dust.tt\u003e\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "8dd2e58b62731a96e276ee0545fb910ffb2057d9", "tree": "b294cf76b3e1844731c847b6a96247817d7b87e6", "parents": [ "0446356e9f29d81757dc64ae7c61743e28d91ac0" ], "author": { "name": "Alexey Velichayshiy", "email": "a.velichayshiy@ispras.ru", "time": "Wed Dec 10 16:51:33 2025 +0300" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Dec 14 18:35:56 2025 -0600" }, "message": "ksmbd: remove redundant DACL check in smb_check_perm_dacl\n\nA zero value of pdacl-\u003enum_aces is already handled at the start of\nsmb_check_perm_dacl() so the second check is useless.\n\nDrop the unreachable code block, no functional impact intended.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nSigned-off-by: Alexey Velichayshiy \u003ca.velichayshiy@ispras.ru\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "0446356e9f29d81757dc64ae7c61743e28d91ac0", "tree": "debb7ff14b9630be6c1da3c9c21a0f2aeea15cdb", "parents": [ "d180b1d9c7a401656332b27e3428a949c00748d3" ], "author": { "name": "Chen Ni", "email": "nichen@iscas.ac.cn", "time": "Tue Nov 18 09:32:29 2025 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Dec 14 18:35:56 2025 -0600" }, "message": "ksmbd: convert comma to semicolon\n\nReplace comma between expressions with semicolons.\n\nUsing a \u0027,\u0027 in place of a \u0027;\u0027 can have unintended side effects.\nAlthough that is not the case here, it is seems best to use \u0027;\u0027\nunless \u0027,\u0027 is intended.\n\nFound by inspection.\nNo functional change intended.\nCompile tested only.\n\nSigned-off-by: Chen Ni \u003cnichen@iscas.ac.cn\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "d180b1d9c7a401656332b27e3428a949c00748d3", "tree": "367fcfb548b0ce52b023ac8021acab2fb2ebcdee", "parents": [ "c1fb124f2a7416905047cf36fa6a110f9c48cd02" ], "author": { "name": "Stefan Metzmacher", "email": "metze@samba.org", "time": "Tue Dec 02 22:15:26 2025 +0100" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Dec 14 18:35:55 2025 -0600" }, "message": "smb: server: defer the initial recv completion logic to smb_direct_negotiate_recv_work()\n\nThe previous change to relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in\nrecv_done() and smb_direct_cm_handler() seems to work around the\nproblem that the order of initial recv completion and\nRDMA_CM_EVENT_ESTABLISHED is random, but it\u0027s still\na bit ugly.\n\nThis implements a better solution deferring the recv completion\nprocessing to smb_direct_negotiate_recv_work(), which is queued\nonly if both events arrived.\n\nIn order to avoid more basic changes to the main recv_done\ncallback, I introduced a smb_direct_negotiate_recv_done,\nwhich is only used for the first pdu, this will allow\nfurther cleanup and simplifications in recv_done\nas a future patch.\n\nsmb_direct_negotiate_recv_work() is also very basic\nwith only basic error checking and the transition\nfrom SMBDIRECT_SOCKET_NEGOTIATE_NEEDED to\nSMBDIRECT_SOCKET_NEGOTIATE_RUNNING, which allows\nsmb_direct_prepare() to continue as before.\n\nCc: Tom Talpey \u003ctom@talpey.com\u003e\nCc: linux-cifs@vger.kernel.org\nCc: samba-technical@lists.samba.org\nSigned-off-by: Stefan Metzmacher \u003cmetze@samba.org\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "c1fb124f2a7416905047cf36fa6a110f9c48cd02", "tree": "af2ca306bd6cd58c18b250befd0c39379eacd82a", "parents": [ "49ca2147749fb69e1caa0f56a98bec065d903bd0" ], "author": { "name": "Stefan Metzmacher", "email": "metze@samba.org", "time": "Tue Dec 02 22:15:25 2025 +0100" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Dec 14 18:35:55 2025 -0600" }, "message": "smb: server: initialize recv_io-\u003ecqe.done \u003d recv_done just once\n\nsmbdirect_recv_io structures are pre-allocated so we can set the\ncallback function just once.\n\nThis will make it easy to move smb_direct_post_recv to common code\nsoon.\n\nCc: Tom Talpey \u003ctom@talpey.com\u003e\nCc: linux-cifs@vger.kernel.org\nCc: samba-technical@lists.samba.org\nSigned-off-by: Stefan Metzmacher \u003cmetze@samba.org\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "49ca2147749fb69e1caa0f56a98bec065d903bd0", "tree": "3d2fcfaae616ccacc8e7e38844dba1c6e66f4576", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Stefan Metzmacher", "email": "metze@samba.org", "time": "Tue Dec 02 22:15:24 2025 +0100" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Dec 14 18:35:55 2025 -0600" }, "message": "smb: smbdirect: introduce smbdirect_socket.connect.{lock,work}\n\nThis will first be used by the server in order to defer\nthe processing of the initial recv of the negotiation\nrequest.\n\nBut in future it will also be used by the client in order\nto implement an async connect.\n\nCc: Tom Talpey \u003ctom@talpey.com\u003e\nCc: Long Li \u003clongli@microsoft.com\u003e\nCc: linux-cifs@vger.kernel.org\nCc: samba-technical@lists.samba.org\nSigned-off-by: Stefan Metzmacher \u003cmetze@samba.org\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "5a0b1882506858b12cc77f0e2439a5f3c5052761", "tree": "72ed2f7a121466395570f88d21e1a8410ce27be3", "parents": [ "c4b502d60a71cf0c0c938f133dc4c0e2adc17b44" ], "author": { "name": "Charles Mirabile", "email": "cmirabil@redhat.com", "time": "Fri Dec 12 13:47:17 2025 -0500" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Sun Dec 14 10:18:22 2025 -0800" }, "message": "lib/crypto: riscv: Add poly1305-core.S to .gitignore\n\npoly1305-core.S is an auto-generated file, so it should be ignored.\n\nFixes: bef9c7559869 (\"lib/crypto: riscv/poly1305: Import OpenSSL/CRYPTOGAMS implementation\")\nCc: stable@vger.kernel.org\nSigned-off-by: Charles Mirabile \u003ccmirabil@redhat.com\u003e\nLink: https://lore.kernel.org/r/20251212184717.133701-1-cmirabil@redhat.com\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "c4b502d60a71cf0c0c938f133dc4c0e2adc17b44", "tree": "650f553d3c95445cde45362a0d2e538dd4e4a85a", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Ard Biesheuvel", "email": "ardb@kernel.org", "time": "Tue Dec 09 06:48:49 2025 +0100" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Sun Dec 14 10:18:22 2025 -0800" }, "message": "arm64/simd: Avoid pointless clearing of FP/SIMD buffer\n\nThe buffer provided to kernel_neon_begin() is only used if the task is\nscheduled out while the FP/SIMD is in use by the kernel, or when such a\nsection is interrupted by a softirq that also uses the FP/SIMD.\n\nIOW, this happens rarely, and even if it happened often, there is still\nno reason for this buffer to be cleared beforehand, which happens\nunconditionally, due to the use of a compound literal expression.\n\nSo define that buffer variable explicitly, and mark it as\n__uninitialized so that it will not get cleared, even when\n-ftrivial-auto-var-init is in effect.\n\nThis requires some preprocessor gymnastics, due to the fact that the\nvariable must be defined throughout the entire guarded scope, and the\nexpression\n\n ({ struct user_fpsimd_state __uninitialized st; \u0026st; })\n\nis problematic in that regard, even though the compilers seem to\npermit it. So instead, repeat the \u0027for ()\u0027 trick that is also used in\nthe implementation of the guarded scope helpers.\n\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Eric Biggers \u003cebiggers@kernel.org\u003e\nSigned-off-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nFixes: 4fa617cc6851 (\"arm64/fpsimd: Allocate kernel mode FP/SIMD buffers on the stack\")\nLink: https://lore.kernel.org/r/20251209054848.998878-2-ardb@kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "489e96651dfe59794195c6b2ddb78835edd9f2ed", "tree": "f8b7a7c55406b4f6c2c7c05c11dbb3154a7010bd", "parents": [ "af241e6bfc11125e6669dabf0800fce6809dd3cf" ], "author": { "name": "Jens Remus", "email": "jremus@linux.ibm.com", "time": "Thu Dec 11 12:24:50 2025 +0100" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Sun Dec 14 11:03:58 2025 +0100" }, "message": "s390/stacktrace: Do not fallback to RA register\n\nThe logic to fallback to the return address (RA) register value in\nthe topmost frame when stack tracing using back chain is broken in\nmultiple ways:\n\nWhen assuming the RA register 14 has not been saved yet one must assume\nthat a new user stack frame has not been allocated either. Therefore\nthe back chain would not contain the stack pointer (SP) at entry, but\nthe caller\u0027s SP at its entry instead.\n\nTherefore when falling back to the RA register 14 value it would also be\nnecessary to fallback to the SP register 15 value. Otherwise an invalid\ncombination of RA register 14 and caller\u0027s SP at its entry (from the\nback chain) is used.\n\nIn the topmost frame the back chain contains either the caller\u0027s SP at\nits entry (before having allocated a new stack frame in the prologue),\nthe SP at entry (after having allocated a new stack frame), or an\nuninitialized value (during static/dynamic stack allocation). In both\ncases where the back chain is valid either the caller or prologue must\nhave saved its respective RA to the respective frame. Therefore, if the\nRA obtained from the frame pointed to by the back chain is invalid, this\ndoes not indicate that the IP in the topmost frame is still early in the\nprologue and the RA has not been saved.\n\nReviewed-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\nSigned-off-by: Jens Remus \u003cjremus@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "af241e6bfc11125e6669dabf0800fce6809dd3cf", "tree": "820e26f667651fa7ff6267d6b1c0238d5d5fda7f", "parents": [ "4cb92fa763823d813d22b45b7f18fcf6e85a72ad" ], "author": { "name": "Benjamin Block", "email": "bblock@linux.ibm.com", "time": "Fri Dec 05 16:47:18 2025 +0100" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Sun Dec 14 11:03:58 2025 +0100" }, "message": "s390/pci: Annotate lock context imbalance in zpci_release_device()\n\nWhen checking `arch/s390/pci/pci.c` with `sparse` during build, the\nfollowing complaint is reported:\n\n arch/s390/pci/pci.c: note: in included file (through include/linux/smp.h, include/linux/lockdep.h, include/linux/spinlock.h, include/linux/mmzone.h, include/linux/gfp.h, include/linux/slab.h):\n ./include/linux/list.h:237:25: warning: context imbalance in \u0027zpci_release_device\u0027 - unexpected unlock\n\nBut this is expected, as zpci_release_device() is expected to be called\nwith `zpci_list_lock` held, as part of `kref_put_lock()` or similar.\n\nReflect this by annotating the function with the appropriate\n__releases().\n\nSigned-off-by: Benjamin Block \u003cbblock@linux.ibm.com\u003e\nReviewed-by: Farhan Ali \u003califm@linux.ibm.com\u003e\nReviewed-by: Niklas Schnelle \u003cschnelle@linux.ibm.com\u003e\nReviewed-by: Gerd Bayer \u003cgbayer@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "4cb92fa763823d813d22b45b7f18fcf6e85a72ad", "tree": "e7f235ae1647ef7a4f85285a5e92f401ee1f1e45", "parents": [ "b1aa01d31249bd116b18c7f512d3e46b4b4ad83b" ], "author": { "name": "Benjamin Block", "email": "bblock@linux.ibm.com", "time": "Fri Dec 05 16:47:17 2025 +0100" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Sun Dec 14 11:03:58 2025 +0100" }, "message": "s390/pci: Fix cyclic dead-lock in zpci_zdev_put() and zpci_scan_devices()\n\nWhen triggering PCI device recovery by writing into the SysFS attribute\n`recover` of a Physical Function with existing child SR-IOV Virtual\nFunctions, lockdep is reporting a possible deadlock between three\nthreads:\n\n Thread (A) Thread (B) Thread (C)\n | | |\n recover_store() zpci_scan_devices() zpci_scan_devices()\nlock(pci_rescan_remove_lock) | |\n | | |\n | | zpci_bus_scan_busses()\n | | lock(zbus_list_lock)\n | zpci_add_device() |\n | lock(zpci_add_remove_lock) |\n | | ┴\n | | zpci_bus_scan_bus()\n | | lock(pci_rescan_remove_lock)\n ┴ |\n zpci_zdev_put() |\n lock(zpci_add_remove_lock) |\n ┴\n zpci_bus_get()\n lock(zbus_list_lock)\n\nIn zpci_bus_scan_busses() the `zbus_list_lock` is taken for the whole\nduration of the function, which also includes taking\n`pci_rescan_remove_lock`, among other things. But `zbus_list_lock` only\nreally needs to protect the modification of the global registration\n`zbus_list`, it can be dropped while the functions within the list\niteration run; this way we break the cycle above.\n\nBreak up zpci_bus_scan_busses() into an \"iterator\" zpci_bus_get_next()\nthat iterates over `zbus_list` element by element, and acquires and\nreleases `zbus_list_lock` as necessary, but never keep holding it.\nReferences to `zpci_bus` objects are also acquired and released.\n\nThe reference counting on `zpci_bus` objects is also changed so that all\nput() and get() operations are done under the protection of\n`zbus_list_lock`, and if the operation results in a modification of\n`zpci_bus_list`, this modification is done in the same critical section\n(apart the very first initialization). This way objects are never seen\non the list that are about to be released and/or half-initialized.\n\nFixes: 14c87ba8123a (\"s390/pci: separate zbus registration from scanning\")\nSuggested-by: Niklas Schnelle \u003cschnelle@linux.ibm.com\u003e\nSigned-off-by: Benjamin Block \u003cbblock@linux.ibm.com\u003e\nReviewed-by: Niklas Schnelle \u003cschnelle@linux.ibm.com\u003e\nReviewed-by: Gerd Bayer \u003cgbayer@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "b1aa01d31249bd116b18c7f512d3e46b4b4ad83b", "tree": "9e3f98cb8ff78311571d1acba22fe4d328adf0fd", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Sven Schnelle", "email": "svens@linux.ibm.com", "time": "Fri Dec 05 10:58:57 2025 +0100" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Sun Dec 14 11:03:57 2025 +0100" }, "message": "s390/ipl: Clear SBP flag when bootprog is set\n\nWith z16 a new flag \u0027search boot program\u0027 was introduced for\nlist-directed IPL (SCSI, NVMe, ECKD DASD). If this flag is set,\ne.g. via selecting the \"Automatic\" value for the \"Boot program\nselector\" control on an HMC load panel, it is copied to the reipl\nstructure from the initial ipl structure. When a user now sets a\nboot prog via sysfs, the flag is not cleared and the bootloader\nwill again automatically select the boot program, ignoring user\nconfiguration.\n\nTo avoid that, clear the SBP flag when a bootprog sysfs file is\nwritten.\n\nCc: stable@vger.kernel.org\nReviewed-by: Peter Oberparleiter \u003coberpar@linux.ibm.com\u003e\nReviewed-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\nSigned-off-by: Sven Schnelle \u003csvens@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "8f0b4cce4481fb22653697cced8d0d04027cb1e8", "tree": "bbf0f60a0a676c64b8f25a71b21d79cb80a9b4ba", "parents": [ "6a1636e06625ec0dd7f2b908ab39a8beea24bfd3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 16:05:07 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 16:05:07 2025 +1200" }, "message": "Linux 6.19-rc1\n" }, { "commit": "6a1636e06625ec0dd7f2b908ab39a8beea24bfd3", "tree": "9157401e1fe53cfe758d8202bb80869c88545c6f", "parents": [ "0dfb36b2dcb666f116ba314e631bd3bc632c44d1", "946574434aa9cfe175c3e8234734a3822410ff53" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 15:35:35 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 15:35:35 2025 +1200" }, "message": "Merge tag \u0027scsi-misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"The only core fix is in doc; all the others are in drivers, with the\n biggest impacts in libsas being the rollback on error handling and in\n ufs coming from a couple of error handling fixes, one causing a crash\n if it\u0027s activated before scanning and the other fixing W-LUN\n resumption\"\n\n* tag \u0027scsi-misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: ufs: qcom: Fix confusing cleanup.h syntax\n scsi: libsas: Add rollback handling when an error occurs\n scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()\n scsi: ufs: core: Fix a deadlock in the frequency scaling code\n scsi: ufs: core: Fix an error handler crash\n scsi: Revert \"scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed\"\n scsi: ufs: core: Fix RPMB link error by reversing Kconfig dependencies\n scsi: qla4xxx: Use time conversion macros\n scsi: qla2xxx: Enable/disable IRQD_NO_BALANCING during reset\n scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset\n scsi: imm: Fix use-after-free bug caused by unfinished delayed work\n scsi: target: sbp: Remove KMSG_COMPONENT macro\n scsi: core: Correct documentation for scsi_device_quiesce()\n scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1\n scsi: target: Reset t_task_cdb pointer in error case\n scsi: ufs: core: Fix EH failure after W-LUN resume error\n" }, { "commit": "3010f06c52aa7da51493df59303ea733a614597b", "tree": "f0105bcdc4b0823da579e3e877dd2f0e5250b838", "parents": [ "0048fbb4011ec55c32d3148b2cda56433f273375" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Dec 13 12:36:15 2025 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Dec 13 22:28:53 2025 -0500" }, "message": "shmem_whiteout(): fix regression from tree-in-dcache series\n\nNow that shmem_mknod() hashes the new dentry, d_rehash() in\nshmem_whiteout() should be removed.\n\nX-paperbag: brown\nReported-by: Hugh Dickins \u003chughd@google.com\u003e\nAcked-by: Hugh Dickins \u003chughd@google.com\u003e\nTested-by: Hugh Dickins \u003chughd@google.com\u003e\nFixes: 2313598222f9 (\"convert ramfs and tmpfs\")\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "0dfb36b2dcb666f116ba314e631bd3bc632c44d1", "tree": "079ad1c6da118de5b50cd25700588bb130eba16e", "parents": [ "4cfc21494ac6dd8518b0ebbc73cf625523ddd870", "21c1466ea25114871707d95745a16ebcf231e197" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 15:24:10 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 15:24:10 2025 +1200" }, "message": "Merge tag \u0027ceph-for-6.19-rc1\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph updates from Ilya Dryomov:\n \"We have a patch that adds an initial set of tracepoints to the MDS\n client from Max, a fix that hardens osdmap parsing code from myself\n (marked for stable) and a few assorted fixups\"\n\n* tag \u0027ceph-for-6.19-rc1\u0027 of https://github.com/ceph/ceph-client:\n rbd: stop selecting CRC32, CRYPTO, and CRYPTO_AES\n ceph: stop selecting CRC32, CRYPTO, and CRYPTO_AES\n libceph: make decode_pool() more resilient against corrupted osdmaps\n libceph: Amend checking to fix `make W\u003d1` build breakage\n ceph: Amend checking to fix `make W\u003d1` build breakage\n ceph: add trace points to the MDS client\n libceph: fix log output race condition in OSD client\n" }, { "commit": "4cfc21494ac6dd8518b0ebbc73cf625523ddd870", "tree": "72d2aecd12d9464f6c0571da4617685ef3d13f63", "parents": [ "4a298a43f5e339f48d2dda0665c02b88ee9a4e03", "a9ea3a2e081d29350b7a3c0731729efbc70458b8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 15:21:02 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 15:21:02 2025 +1200" }, "message": "Merge tag \u0027tomoyo-pr-20251212\u0027 of git://git.code.sf.net/p/tomoyo/tomoyo\n\nPull tomoyo update from Tetsuo Handa:\n \"Trivial optimization\"\n\n* tag \u0027tomoyo-pr-20251212\u0027 of git://git.code.sf.net/p/tomoyo/tomoyo:\n tomoyo: Use local kmap in tomoyo_dump_page()\n" }, { "commit": "4a298a43f5e339f48d2dda0665c02b88ee9a4e03", "tree": "77ee3b7e310962b8aad187c152f38f9af1ad013b", "parents": [ "cba09e3ed06db4b6c87bc97e0aea080421fb8f7d", "c94291914b200e10c72cef23c8e4c67eb4fdbcd9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:12:46 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:12:46 2025 +1200" }, "message": "Merge tag \u0027smp-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull CPU hotplug fix from Ingo Molnar:\n\n - Fix CPU hotplug callbacks to disable interrupts on UP kernels\n\n* tag \u0027smp-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n cpu: Make atomic hotplug callbacks run with interrupts disabled on UP\n" }, { "commit": "cba09e3ed06db4b6c87bc97e0aea080421fb8f7d", "tree": "e21a36bc8c43811385887d6cabb68d483c59cadf", "parents": [ "db0130185ee32896524963289840c97dd73aaaa3", "9415f749d34b926b9e4853da1462f4d941f89a0d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:10:35 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:10:35 2025 +1200" }, "message": "Merge tag \u0027perf-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf event fixes from Ingo Molnar:\n\n - Fix NULL pointer dereference crash in the Intel PMU driver\n\n - Fix missing read event generation on task exit\n\n - Fix AMD uncore driver init error handling\n\n - Fix whitespace noise\n\n* tag \u0027perf-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common()\n perf/core: Fix missing read event generation on task exit\n perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error\n perf/uprobes: Remove \u003cspace\u003e\u003cTab\u003e whitespace noise\n" }, { "commit": "db0130185ee32896524963289840c97dd73aaaa3", "tree": "69c8e1b09a01907cf457b7b379eed1da0ffb375c", "parents": [ "edbe407235ecfc827b6a211628988261f957df9e", "7dbc0d40d8347bd9de55c904f59ea44bcc8dedb7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:07:09 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:07:09 2025 +1200" }, "message": "Merge tag \u0027irq-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fixes from Ingo Molnar:\n\n - Fix error code in the irqchip/mchp-eic driver\n\n - Fix setup_percpu_irq() affinity assumptions\n\n - Remove the unused irq_domain_add_tree() function\n\n* tag \u0027irq-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()\n irqdomain: Delete irq_domain_add_tree()\n genirq: Allow NULL affinity for setup_percpu_irq()\n" }, { "commit": "edbe407235ecfc827b6a211628988261f957df9e", "tree": "dc88215277574eab2b81e973be5b77b15efd2539", "parents": [ "9d9c1cfec01cdbf24bd9322ed555713a20422115", "bdae29d6512ddc589200b9ae6bda467bdbab863d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:04:16 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 14 06:04:16 2025 +1200" }, "message": "Merge tag \u0027core-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc core fixes from Ingo Molnar:\n\n - Improve bug reporting\n\n - Suppress W\u003d1 format warning\n\n - Improve rseq scalability on Clang builds\n\n* tag \u0027core-urgent-2025-12-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n rseq: Always inline rseq_debug_syscall_return()\n bug: Hush suggest-attribute\u003dformat for __warn_printf()\n bug: Let report_bug_entry() provide the correct bugaddr\n" }, { "commit": "9d9c1cfec01cdbf24bd9322ed555713a20422115", "tree": "c4ba1f4ae0412001f914957dfe335fb7d37ca1a1", "parents": [ "2516a87153183e1797021879121ca25c95f1ea3a", "601cc399a01049efa76be8f496541315dc9cf914" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 13 20:55:12 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 13 20:55:12 2025 +1200" }, "message": "Merge tag \u0027mm-nonmm-stable-2025-12-11-11-47\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc updates from Andrew Morton:\n \"There are no significant series in this small merge. Please see the\n individual changelogs for details\"\n\n[ Editor\u0027s note: it\u0027s mainly ocfs2 and a couple of random fixes ]\n\n* tag \u0027mm-nonmm-stable-2025-12-11-11-47\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm: memfd_luo: add CONFIG_SHMEM dependency\n mm: shmem: avoid build warning for CONFIG_SHMEM\u003dn\n ocfs2: fix memory leak in ocfs2_merge_rec_left()\n ocfs2: invalidate inode if i_mode is zero after block read\n ocfs2: avoid -Wflex-array-member-not-at-end warning\n ocfs2: convert remaining read-only checks to ocfs2_emergency_state\n ocfs2: add ocfs2_emergency_state helper and apply to setattr\n checkpatch: add uninitialized pointer with __free attribute check\n args: fix documentation to reflect the correct numbers\n ocfs2: fix kernel BUG in ocfs2_find_victim_chain\n liveupdate: luo_core: fix redundant bound check in luo_ioctl()\n ocfs2: validate inline xattr size and entry count in ocfs2_xattr_ibody_list\n fs/fat: remove unnecessary wrapper fat_max_cache()\n ocfs2: replace deprecated strcpy with strscpy\n ocfs2: check tl_used after reading it from trancate log inode\n liveupdate: luo_file: don\u0027t use invalid list iterator\n" }, { "commit": "2516a87153183e1797021879121ca25c95f1ea3a", "tree": "2e766ef57eae22051d298048257cad5f6243cc46", "parents": [ "d2ea4d254d04a89e17504af0230c7268e3cac6bf", "dafdba0964bd10913fbaa5537201cbbe05df5b9c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 13 20:35:41 2025 +1200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 13 20:35:41 2025 +1200" }, "message": "Merge tag \u0027mm-stable-2025-12-11-11-39\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull more MM updates from Andrew Morton:\n\n - \"powerpc/pseries/cmm: two smaller fixes\" (David Hildenbrand)\n fixes a couple of minor things in ppc land\n\n - \"Improve folio split related functions\" (Zi Yan)\n some cleanups and minorish fixes in the folio splitting code\n\n* tag \u0027mm-stable-2025-12-11-11-39\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/damon/tests/core-kunit: avoid damos_test_commit stack warning\n mm: vmscan: correct nr_requested tracing in scan_folios\n MAINTAINERS: add idr core-api doc file to XARRAY\n mm/hugetlb: fix incorrect error return from hugetlb_reserve_pages()\n mm: fix CONFIG_STACK_GROWSUP typo in mm.h\n mm/huge_memory: fix folio split stats counting\n mm/huge_memory: make min_order_for_split() always return an order\n mm/huge_memory: replace can_split_folio() with direct refcount calculation\n mm/huge_memory: change folio_split_supported() to folio_check_splittable()\n mm/sparse: fix sparse_vmemmap_init_nid_early definition without CONFIG_SPARSEMEM\n powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages\n powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION\n" }, { "commit": "d2ea4d254d04a89e17504af0230c7268e3cac6bf", "tree": "5d18d85a74f885a11bea3d5f88e266f8ed137830", "parents": [ "d552fc632cf5b7e3b2808fd341708bd353072c45" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sat Dec 13 08:45:23 2025 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 13 20:04:32 2025 +1200" }, "message": "file: ensure cleanup\n\nBrown paper bag time. This is a silly oversight where I missed to drop\nthe error condition checking to ensure we clean up on early error\nreturns. I have an internal unit testset coming up for this which will\ncatch all such issues going forward.\n\nReported-by: Chris Mason \u003cclm@fb.com\u003e\nReported-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nFixes: 011703a9acd7 (\"file: add FD_{ADD,PREPARE}()\")\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" } ], "next": "d552fc632cf5b7e3b2808fd341708bd353072c45" }