)]}' { "log": [ { "commit": "944aacb68baf7624ab8d277d0ebf07f025ca137c", "tree": "b1e67c20303b90310d9d623c7301a568e9748deb", "parents": [ "e0d4140e804380ae898da1e4c58c21e6323415a4", "309a29b5965a0b2f36b3e245213eb43300a89ac2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 14 11:24:38 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 14 11:24:38 2026 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Only one core change (and one in doc only) the rest are drivers.\n\n The one core fix is for some inline encrypting drives that can\u0027t\n handle encryption requests on non-data commands (like error handling\n ones); it saves the request level encryption parameters in the eh_save\n structure so they can be cleared for error handling and restored after\n it is completed\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: ufs: host: mediatek: Make read-only array scale_us static const\n scsi: bfa: Update outdated comment\n scsi: mpt3sas: Update maintainer list\n scsi: ufs: core: Configure MCQ after link startup\n scsi: core: Fix error handler encryption support\n scsi: core: Correct documentation for scsi_test_unit_ready()\n scsi: ufs: dt-bindings: Fix several grammar errors\n" }, { "commit": "e0d4140e804380ae898da1e4c58c21e6323415a4", "tree": "550a7f6603d95a4d5300474f6278e81c49946e58", "parents": [ "d19954ee63b2211fcc14175d6cb07cbc040980d5", "6a069876eb1402478900ee0eb7d7fe276bb1f4e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 14 08:55:09 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 14 08:55:09 2026 -0800" }, "message": "Merge tag \u0027bitmap-for-6.19-rc5\u0027 of https://github.com/norov/linux\n\nPull bitmap fix from Yury Norov:\n \"Fix Rust build for architectures implementing their own find_bit() ops\n (arm and m68k)\"\n\n* tag \u0027bitmap-for-6.19-rc5\u0027 of https://github.com/norov/linux:\n rust: bitops: fix missing _find_* functions on 32-bit ARM\n" }, { "commit": "d19954ee63b2211fcc14175d6cb07cbc040980d5", "tree": "0f308ec43ac198a3a8b48747f618798e0911ea6e", "parents": [ "c537e12daeecaecdcd322c56a5f70659d2de7bde", "69d6c6fc79eb3a8309691250a3b0a9c1870c1f83" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 14 08:18:01 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 14 08:18:01 2026 -0800" }, "message": "Merge tag \u0027media/v6.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fixes from Mauro Carvalho Chehab:\n\n - ov02c10: some fixes related to preserving bayer pattern and\n horizontal control\n\n - ipu-bridge: Add quirks for some Dell XPS laptops with inverted\n sensors\n\n - mali-c55: Fix version identifier logic\n\n - rzg2l-cru: csi-2: fix RZ/V2H input sizes on some variants\n\n* tag \u0027media/v6.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: ov02c10: Remove unnecessary hflip and vflip pointers\n media: ipu-bridge: Add DMI quirk for Dell XPS laptops with upside down sensors\n media: ov02c10: Fix the horizontal flip control\n media: ov02c10: Adjust x-win/y-win when changing flipping to preserve bayer-pattern\n media: ov02c10: Fix bayer-pattern change after default vflip change\n media: rzg2l-cru: csi-2: Support RZ/V2H input sizes\n media: uapi: mali-c55-config: Remove version identifier\n media: mali-c55: Remove duplicated version check\n media: Documentation: mali-c55: Use v4l2-isp version identifier\n" }, { "commit": "c537e12daeecaecdcd322c56a5f70659d2de7bde", "tree": "5ee184ce9e6954befa748bebe1fbbd20eb4a8c12", "parents": [ "b54345928fa1dbde534e32ecaa138678fd5d2135", "ec69daabe45256f98ac86c651b8ad1b2574489a7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 21:21:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 21:21:13 2026 -0800" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix incorrect usage of BPF_TRAMP_F_ORIG_STACK in riscv JIT (Menglong\n Dong)\n\n - Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa)\n\n - Fix metadata size check in bpf_test_run() (Toke Høiland-Jørgensen)\n\n - Check that BPF insn array is not allowed as a map for const strings\n (Deepanshu Kartikey)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n bpf: Fix reference count leak in bpf_prog_test_run_xdp()\n bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str()\n selftests/bpf: Update xdp_context_test_run test to check maximum metadata size\n bpf, test_run: Subtract size of xdp_frame from allowed metadata size\n riscv, bpf: Fix incorrect usage of BPF_TRAMP_F_ORIG_STACK\n" }, { "commit": "6a069876eb1402478900ee0eb7d7fe276bb1f4e3", "tree": "f3a8b6717cdeba31b479ea5fbfd799f2f5383df9", "parents": [ "b54345928fa1dbde534e32ecaa138678fd5d2135" ], "author": { "name": "Alice Ryhl", "email": "aliceryhl@google.com", "time": "Mon Jan 05 10:44:06 2026 +0000" }, "committer": { "name": "Yury Norov", "email": "ynorov@nvidia.com", "time": "Tue Jan 13 22:16:39 2026 -0500" }, "message": "rust: bitops: fix missing _find_* functions on 32-bit ARM\n\nOn 32-bit ARM, you may encounter linker errors such as this one:\n\n\tld.lld: error: undefined symbol: _find_next_zero_bit\n\t\u003e\u003e\u003e referenced by rust_binder_main.43196037ba7bcee1-cgu.0\n\t\u003e\u003e\u003e drivers/android/binder/rust_binder_main.o:(\u003crust_binder_main::process::Process\u003e::insert_or_update_handle) in archive vmlinux.a\n\t\u003e\u003e\u003e referenced by rust_binder_main.43196037ba7bcee1-cgu.0\n\t\u003e\u003e\u003e drivers/android/binder/rust_binder_main.o:(\u003crust_binder_main::process::Process\u003e::insert_or_update_handle) in archive vmlinux.a\n\nThis error occurs because even though the functions are declared by\ninclude/linux/find.h, the definition is #ifdef\u0027d out on 32-bit ARM. This\nis because arch/arm/include/asm/bitops.h contains:\n\n\t#define find_first_zero_bit(p,sz)\t_find_first_zero_bit_le(p,sz)\n\t#define find_next_zero_bit(p,sz,off)\t_find_next_zero_bit_le(p,sz,off)\n\t#define find_first_bit(p,sz)\t\t_find_first_bit_le(p,sz)\n\t#define find_next_bit(p,sz,off)\t\t_find_next_bit_le(p,sz,off)\n\nAnd the underscore-prefixed function is conditional on #ifndef of the\nnon-underscore-prefixed name, but the declaration in find.h is *not*\nconditional on that #ifndef.\n\nTo fix the linker error, we ensure that the symbols in question exist\nwhen compiling Rust code. We do this by defining them in rust/helpers/\nwhenever the normal definition is #ifndef\u0027d out.\n\nNote that these helpers are somewhat unusual in that they do not have\nthe rust_helper_ prefix that most helpers have. Adding the rust_helper_\nprefix does not compile, as \u0027bindings::_find_next_zero_bit()\u0027 will\nresult in a call to a symbol called _find_next_zero_bit as defined by\ninclude/linux/find.h rather than a symbol with the rust_helper_ prefix.\nThis is because when a symbol is present in both include/ and\nrust/helpers/, the one from include/ wins under the assumption that the\ncurrent configuration is one where that helper is unnecessary. This\nheuristic fails for _find_next_zero_bit() because the header file always\ndeclares it even if the symbol does not exist.\n\nThe functions still use the __rust_helper annotation. This lets the\nwrapper function be inlined into Rust code even if full kernel LTO is\nnot used once the patch series for that feature lands.\n\nYury: arches are free to implement they own find_bit() functions. Most\nrely on generic implementation, but arm32 and m86k - not; so they require\ncustom handling. Alice confirmed it fixes the build for both.\n\nCc: stable@vger.kernel.org\nFixes: 6cf93a9ed39e (\"rust: add bindings for bitops.h\")\nReported-by: Andreas Hindborg \u003ca.hindborg@kernel.org\u003e\nCloses: https://rust-for-linux.zulipchat.com/#narrow/channel/x/topic/x/near/561677301\nTested-by: Andreas Hindborg \u003ca.hindborg@kernel.org\u003e\nReviewed-by: Dirk Behme \u003cdirk.behme@de.bosch.com\u003e\nSigned-off-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nSigned-off-by: Yury Norov (NVIDIA) \u003cyury.norov@gmail.com\u003e\n" }, { "commit": "b54345928fa1dbde534e32ecaa138678fd5d2135", "tree": "6aa320426b779d6fbe2738e9fcea78cbcb65231b", "parents": [ "0bb933a9fcdee14ef82970caeb8617ad59a11303", "469d71512d135907bf5ea0972dfab8c420f57848" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 10:04:34 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 10:04:34 2026 -0800" }, "message": "Merge tag \u0027gfs2-for-6.19-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2\n\nPull gfs2 revert from Andreas Gruenbacher:\n \"Revert bad commit \"gfs2: Fix use of bio_chain\"\n\n I was originally assuming that there must be a bug in gfs2\n because gfs2 chains bios in the opposite direction of what\n bio_chain_and_submit() expects.\n\n It turns out that the bio chains are set up in \"reverse direction\"\n intentionally so that the first bio\u0027s bi_end_io callback is invoked\n rather than the last bio\u0027s callback.\n\n We want the first bio\u0027s callback invoked for the following reason: The\n initial bio starts page aligned and covers one or more pages. When it\n terminates at a non-page-aligned offset, subsequent bios are added to\n handle the remaining portion of the final page.\n\n Upon completion of the bio chain, all affected pages need to be be\n marked as read, and only the first bio references all of these pages\"\n\n* tag \u0027gfs2-for-6.19-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:\n Revert \"gfs2: Fix use of bio_chain\"\n" }, { "commit": "0bb933a9fcdee14ef82970caeb8617ad59a11303", "tree": "63280e6ec409a0bf98948dc458195878d66de12c", "parents": [ "afd12f914c8f733a9660c97bdbe539aee88e742b", "3611ca7c12b740e250d83f8bbe3554b740c503b0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 09:50:07 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 09:50:07 2026 -0800" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull x86 kvm fixes from Paolo Bonzini:\n\n - Avoid freeing stack-allocated node in kvm_async_pf_queue_task\n\n - Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]\u003d1\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]\u003d1\n selftests: kvm: try getting XFD and XSAVE state out of sync\n selftests: kvm: replace numbered sync points with actions\n x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]\u003d1\n x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task\n" }, { "commit": "afd12f914c8f733a9660c97bdbe539aee88e742b", "tree": "813e683537128be247d0c4bc10812e5579f7b372", "parents": [ "b71e635feefc852405b14620a7fc58c4c80c0f73", "173d6f64f9558ff022a777a72eb8669b6cdd2649" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 09:37:49 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jan 13 09:37:49 2026 -0800" }, "message": "Merge tag \u0027hyperv-fixes-signed-20260112\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux\n\nPull hyperv fixes from Wei Liu:\n\n - Minor fixes and cleanups for the MSHV driver\n\n* tag \u0027hyperv-fixes-signed-20260112\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:\n mshv: release mutex on region invalidation failure\n hyperv: Avoid -Wflex-array-member-not-at-end warning\n mshv: hide x86-specific functions on arm64\n mshv: Initialize local variables early upon region invalidation\n mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions\n" }, { "commit": "ec69daabe45256f98ac86c651b8ad1b2574489a7", "tree": "24d50874e59e29611c88a81226d0c01b52ac952f", "parents": [ "9df5fad801c5c568ee5f5dacd8b53565d88e4f02" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Thu Jan 08 21:36:48 2026 +0900" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Jan 12 16:37:40 2026 -0800" }, "message": "bpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n unregister_netdevice: waiting for sit0 to become free. Usage count \u003d 2\n\nproblem. A debug printk() patch found that a refcount is obtained at\nxdp_convert_md_to_buff() from bpf_prog_test_run_xdp().\n\nAccording to commit ec94670fcb3b (\"bpf: Support specifying ingress via\nxdp_md context in BPF_PROG_TEST_RUN\"), the refcount obtained by\nxdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md().\n\nTherefore, we can consider that the error handling path introduced by\ncommit 1c1949982524 (\"bpf: introduce frags support to\nbpf_prog_test_run_xdp()\") forgot to call xdp_convert_buff_to_md().\n\nReported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d881d65229ca4f9ae8c84\nFixes: 1c1949982524 (\"bpf: introduce frags support to bpf_prog_test_run_xdp()\")\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://lore.kernel.org/r/af090e53-9d9b-4412-8acb-957733b3975c@I-love.SAKURA.ne.jp\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "b71e635feefc852405b14620a7fc58c4c80c0f73", "tree": "df4de4cf01fb87dd8c48f91937e58f331b439a0b", "parents": [ "0f61b1860cc3f52aef9036d7235ed1f017632193", "ef56578274d2b98423c8ef82bb450223f5811b59" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 12 09:56:17 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 12 09:56:17 2026 -1000" }, "message": "Merge tag \u0027cgroup-for-6.19-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fix from Tejun Heo:\n\n - Fix -Wflex-array-member-not-at-end warnings in cgroup_root\n\n* tag \u0027cgroup-for-6.19-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup: Eliminate cgrp_ancestor_storage in cgroup_root\n" }, { "commit": "469d71512d135907bf5ea0972dfab8c420f57848", "tree": "886fe591008930c5baeb8beffea9a669f9f61be8", "parents": [ "8f0b4cce4481fb22653697cced8d0d04027cb1e8" ], "author": { "name": "Andreas Gruenbacher", "email": "agruenba@redhat.com", "time": "Mon Jan 12 11:47:35 2026 +0100" }, "committer": { "name": "Andreas Gruenbacher", "email": "agruenba@redhat.com", "time": "Mon Jan 12 14:58:32 2026 +0100" }, "message": "Revert \"gfs2: Fix use of bio_chain\"\n\nThis reverts commit 8a157e0a0aa5143b5d94201508c0ca1bb8cfb941.\n\nThat commit incorrectly assumed that the bio_chain() arguments were\nswapped in gfs2. However, gfs2 intentionally constructs bio chains so\nthat the first bio\u0027s bi_end_io callback is invoked when all bios in the\nchain have completed, unlike bio chains where the last bio\u0027s callback is\ninvoked.\n\nFixes: 8a157e0a0aa5 (\"gfs2: Fix use of bio_chain\")\nCc: stable@vger.kernel.org\nSigned-off-by: Andreas Gruenbacher \u003cagruenba@redhat.com\u003e\n" }, { "commit": "0f61b1860cc3f52aef9036d7235ed1f017632193", "tree": "29e4048ecebf0abc501ad4bc8eb3e9c194fa94aa", "parents": [ "7143203341dccbca809ba0a8e72239ea4652ace6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 17:03:14 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 17:03:14 2026 -1000" }, "message": "Linux 6.19-rc5\n" }, { "commit": "7143203341dccbca809ba0a8e72239ea4652ace6", "tree": "e3bf2473363e968ebfd26097ad80348c62d1366e", "parents": [ "9c7ef209cd0f7c1a92ed61eed3e835d6e4abc66c", "74d74bb78aeccc9edc10db216d6be121cf7ec176" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 15:07:56 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 15:07:56 2026 -1000" }, "message": "Merge tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux\n\nPull crypto library fixes from Eric Biggers:\n\n - A couple more fixes for the lib/crypto KUnit tests\n\n - Fix missing MMU protection for the AES S-box\n\n* tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:\n lib/crypto: aes: Fix missing MMU protection for AES S-box\n MAINTAINERS: add test vector generation scripts to \"CRYPTO LIBRARY\"\n lib/crypto: tests: Fix syntax error for old python versions\n lib/crypto: tests: polyval_kunit: Increase iterations for preparekey in IRQs\n" }, { "commit": "9c7ef209cd0f7c1a92ed61eed3e835d6e4abc66c", "tree": "187bfb72c24eba7cdd47afd5ad908725491fe515", "parents": [ "316a94cb6398ea073790462ddd337da06ad8e1de", "361e0ff456a8daf9753c18030533256e4133ce7a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:27:44 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:27:44 2026 -1000" }, "message": "Merge tag \u0027char-misc-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc driver fixes from Greg KH:\n \"Here are some small char/misc driver fixes for some reported issues.\n Included in here is:\n\n - much reported rust_binder fix\n\n - counter driver fixes\n\n - new device ids for the mei driver\n\n All of these have been in linux-next for a while with no reported\n issues\"\n\n* tag \u0027char-misc-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n rust_binder: remove spin_lock() in rust_shrink_free_page()\n mei: me: add nova lake point S DID\n counter: 104-quad-8: Fix incorrect return value in IRQ handler\n counter: interrupt-cnt: Drop IRQF_NO_THREAD flag\n" }, { "commit": "316a94cb6398ea073790462ddd337da06ad8e1de", "tree": "f74bc928199f22e143e5680f19df92da8dcb7b26", "parents": [ "fac4bdbacab5a9abe7e017069c640273c2a704e2", "9efb74f84ba82a9de81fc921baf3c5e2decf8256" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:19:43 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:19:43 2026 -1000" }, "message": "Merge tag \u0027x86-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n \"Disable GCOV instrumentation in the SEV noinstr.c collection of SEV\n noinstr methods, to further robustify the code\"\n\n* tag \u0027x86-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/sev: Disable GCOV on noinstr object\n" }, { "commit": "fac4bdbacab5a9abe7e017069c640273c2a704e2", "tree": "b89acb94f450802cdf88ddecee536e0ee9c56380", "parents": [ "fe948326e95dcc7b1efb6b76e92b5b919f56250c", "2bdf777410dc6e022d1081885ff34673b5dfee99" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:11:53 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:11:53 2026 -1000" }, "message": "Merge tag \u0027sched-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n \"Fix a crash in sched_mm_cid_after_execve()\"\n\n* tag \u0027sched-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()\n" }, { "commit": "fe948326e95dcc7b1efb6b76e92b5b919f56250c", "tree": "6005f7d3f342a3bb27cfb83cc4e41b26fc89846c", "parents": [ "88730166f3ee261c43e5087ea665f3a47966865b", "ff5860f5088e9076ebcccf05a6ca709d5935cfa9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:55:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:55:27 2026 -1000" }, "message": "Merge tag \u0027perf-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf event fix from Ingo Molnar:\n \"Fix perf swevent hrtimer deinit regression\"\n\n* tag \u0027perf-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Ensure swevent hrtimer is properly destroyed\n" }, { "commit": "88730166f3ee261c43e5087ea665f3a47966865b", "tree": "9c4c5704ce52aca69d3f35b5d25dbc5748d7caba", "parents": [ "2e4b28c48f88ce9e263957b1d944cf5349952f88", "a33d16dc874a9512c02b1f1a3e08c26a82b4be5e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:36:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:36:20 2026 -1000" }, "message": "Merge tag \u0027irq-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc irqchip fixes from Ingo Molnar:\n\n - Fix an endianness bug in the gic-v5 irqchip driver\n\n - Revert a broken commit from the riscv-imsic irqchip driver\n\n* tag \u0027irq-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n Revert \"irqchip/riscv-imsic: Embed the vector array in lpriv\"\n irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness\n" }, { "commit": "2e4b28c48f88ce9e263957b1d944cf5349952f88", "tree": "8c5aa5d9f94ddfc086819c069bb9b08c75048da9", "parents": [ "755bc1335e3b116b702205b72eb57b7b8aef2bb2" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sun Jan 11 16:53:48 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:09:11 2026 -1000" }, "message": "treewide: Update email address\n\nIn a vain attempt to consolidate the email zoo switch everything to the\nkernel.org account.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "755bc1335e3b116b702205b72eb57b7b8aef2bb2", "tree": "3b4b7cbd9217bd19a769b5e0192e7fac2e0b3fc3", "parents": [ "0fa27899e0147fe180b603bda30930e8c145dd47", "b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:54:41 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:54:41 2026 -1000" }, "message": "Merge tag \u0027riscv-for-linus-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"Notable changes include a fix to close one common microarchitectural\n attack vector for out-of-order cores. Another patch exposed an\n omission in my boot test coverage, which is currently missing\n relocatable kernels. Otherwise, the fixes seem to be settling down for\n us.\n\n - Fix CONFIG_RELOCATABLE\u003dy boots by building Image files from\n vmlinux, rather than vmlinux.unstripped, now that the .modinfo\n section is included in vmlinux.unstripped\n\n - Prevent branch predictor poisoning microarchitectural attacks that\n use the syscall index as a vector by using array_index_nospec() to\n clamp the index after the bounds check (as x86 and ARM64 already\n do)\n\n - Fix a crash in test_kprobes when building with Clang\n\n - Fix a deadlock possible when tracing is enabled for SBI ecalls\n\n - Fix the definition of the Zk standard RISC-V ISA extension bundle,\n which was missing the Zknh extension\n\n - A few other miscellaneous non-functional cleanups, removing unused\n macros, fixing an out-of-date path in code comments, resolving a\n compile-time warning for a type mismatch in a pr_crit(), and\n removing an unnecessary header file inclusion\"\n\n* tag \u0027riscv-for-linus-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: trace: fix snapshot deadlock with sbi ecall\n riscv: remove irqflags.h inclusion in asm/bitops.h\n riscv: cpu_ops_sbi: smp_processor_id() returns int, not unsigned int\n riscv: configs: Clean up references to non-existing configs\n riscv: kexec_image: Fix dead link to boot-image-header.rst\n riscv: pgtable: Cleanup useless VA_USER_XXX definitions\n riscv: cpufeature: Fix Zk bundled extension missing Zknh\n riscv: fix KUnit test_kprobes crash when building with Clang\n riscv: Sanitize syscall table indexing under speculation\n riscv: boot: Always make Image from vmlinux, not vmlinux.unstripped\n" }, { "commit": "0fa27899e0147fe180b603bda30930e8c145dd47", "tree": "1a9f4ef6b4871ddcdfcc0cafcd7a05f0d33ba5b4", "parents": [ "b061fcffe336f1f1d1afe6a904f36962378c4026", "8510ef5e3cfbd7d59a16845f85cd0194a8689761" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:04:04 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:04:04 2026 -1000" }, "message": "Merge tag \u0027driver-core-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Fix swapped example values for the `family` and `machine` attributes\n in the sysfs SoC bus ABI documentation\n\n - Fix Rust build and intra-doc issues when optional subsystems\n (CONFIG_PCI, CONFIG_AUXILIARY_BUS, CONFIG_PRINTK) are disabled\n\n - Fix typos and incorrect safety comments in Rust PCI, DMA, and\n device ID documentation\n\n* tag \u0027driver-core-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n rust: device: Remove explicit import of CStrExt\n rust: pci: fix typos in Bar struct\u0027s comments\n rust: device: fix broken intra-doc links\n rust: dma: fix broken intra-doc links\n rust: driver: fix broken intra-doc links to example driver types\n rust: device_id: replace incorrect word in safety documentation\n rust: dma: remove incorrect safety documentation\n docs: ABI: sysfs-devices-soc: Fix swapped sample values\n" }, { "commit": "b061fcffe336f1f1d1afe6a904f36962378c4026", "tree": "4b487c997a2875f001d678d667ed8d5d0fc0b081", "parents": [ "97313d6113ab4362ad15076f65560e65288fbcb8", "6e39903c73df08b256322d04c4dfe4a82ec63a45" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 14:57:55 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 14:57:55 2026 -1000" }, "message": "Merge tag \u0027linux_kselftest-fixes-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kselftest fix from Shuah Khan:\n \"Fix tracing test_multiple_writes stalls when buffer_size_kb is less\n than 12KB\"\n\n* tag \u0027linux_kselftest-fixes-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n selftests/tracing: Fix test_multiple_writes stall\n" }, { "commit": "97313d6113ab4362ad15076f65560e65288fbcb8", "tree": "ab69e5df60f015d96a3b268492eedc9d1fe4a183", "parents": [ "7893cc12251f6f19e7689a4cf3ba803bddbd8437", "6a3d5fda2ce464a80a9af9e358dfbab6a989ab5d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 07:14:40 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 07:14:40 2026 -1000" }, "message": "Merge tag \u0027iommu-fixes-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iomu fixes from Joerg Roedel:\n\n - several Kconfig-related build fixes\n\n - fix for when gcc 8.5 on PPC refuses to inline a function from a\n header file\n\n* tag \u0027iommu-fixes-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommupt: Make pt_feature() always_inline\n iommufd/selftest: Prevent module/builtin conflicts in kconfig\n iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFER\n iommupt: Fix the kunit building\n" }, { "commit": "7893cc12251f6f19e7689a4cf3ba803bddbd8437", "tree": "cea3118673d1aef8096b83eeb20f5a33e13cba46", "parents": [ "b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Sat Jan 10 19:47:03 2026 +0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 06:39:20 2026 -1000" }, "message": "erofs: fix file-backed mounts no longer working on EROFS partitions\n\nSheng Yong reported [1] that Android APEX images didn\u0027t work with commit\n072a7c7cdbea (\"erofs: don\u0027t bother with s_stack_depth increasing for\nnow\") because \"EROFS-formatted APEX file images can be stored within an\nEROFS-formatted Android system partition.\"\n\nIn response, I sent a quick fat-fingered [PATCH v3] to address the\nreport. Unfortunately, the updated condition was incorrect:\n\n if (erofs_is_fileio_mode(sbi)) {\n- sb-\u003es_stack_depth \u003d\n- file_inode(sbi-\u003edif0.file)-\u003ei_sb-\u003es_stack_depth + 1;\n- if (sb-\u003es_stack_depth \u003e FILESYSTEM_MAX_STACK_DEPTH) {\n- erofs_err(sb, \"maximum fs stacking depth exceeded\");\n+ inode \u003d file_inode(sbi-\u003edif0.file);\n+ if ((inode-\u003ei_sb-\u003es_op \u003d\u003d \u0026erofs_sops \u0026\u0026 !sb-\u003es_bdev) ||\n+ inode-\u003ei_sb-\u003es_stack_depth) {\n\nThe condition `!sb-\u003es_bdev` is always true for all file-backed EROFS\nmounts, making the check effectively a no-op.\n\nThe real fix tested and confirmed by Sheng Yong [2] at that time was\n[PATCH v3 RESEND], which correctly ensures the following EROFS^2 setup\nworks:\n EROFS (on a block device) + EROFS (file-backed mount)\n\nBut sadly I screwed it up again by upstreaming the outdated [PATCH v3].\n\nThis patch applies the same logic as the delta between the upstream\n[PATCH v3] and the real fix [PATCH v3 RESEND].\n\nReported-by: Sheng Yong \u003cshengyong1@xiaomi.com\u003e\nCloses: https://lore.kernel.org/r/3acec686-4020-4609-aee4-5dae7b9b0093@gmail.com [1]\nFixes: 072a7c7cdbea (\"erofs: don\u0027t bother with s_stack_depth increasing for now\")\nLink: https://lore.kernel.org/r/243f57b8-246f-47e7-9fb1-27a771e8e9e8@gmail.com [2]\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6a3d5fda2ce464a80a9af9e358dfbab6a989ab5d", "tree": "f5a726481f386a9d81da34d476641fa86c875255", "parents": [ "7adfd682745a41fdf0279e4457d11fffab145a8f" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Fri Jan 09 10:29:52 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:50:45 2026 +0100" }, "message": "iommupt: Make pt_feature() always_inline\n\ngcc 8.5 on powerpc does not automatically inline these functions even\nthough they evaluate to constants in key cases. Since the constant\npropagation is essential for some code elimination and built-time checks\nthis causes a build failure:\n\n ERROR: modpost: \"__pt_no_sw_bit\" [drivers/iommu/generic_pt/fmt/iommu_amdv1.ko] undefined!\n\nCaused by this:\n\n\tif (pts_feature(\u0026pts, PT_FEAT_DMA_INCOHERENT) \u0026\u0026\n\t !pt_test_sw_bit_acquire(\u0026pts,\n\t\t\t\t SW_BIT_CACHE_FLUSH_DONE))\n\t\tflush_writes_item(\u0026pts);\n\nWhere pts_feature() evaluates to a constant false. Mark them as\n__always_inline to force it to evaluate to a constant and trigger the code\nelimination.\n\nFixes: 7c5b184db714 (\"genpt: Generic Page Table base API\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202512230720.9y9DtWIo-lkp@intel.com/\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "7adfd682745a41fdf0279e4457d11fffab145a8f", "tree": "fe049c6c14ed9dc3886a907c868be581731d5003", "parents": [ "faa37ff3bf18d5242fe3d54f5462b1c3254c2567" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Jan 06 15:22:12 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:40:58 2026 +0100" }, "message": "iommufd/selftest: Prevent module/builtin conflicts in kconfig\n\nThe selftest now depends on the AMDv1 page table, however the selftest\nkconfig itself is just an sub-option of the main IOMMUFD module kconfig.\n\nThis means it cannot be modular and so kconfig allowed a modular\nIOMMU_PT_AMDV1 with a built in IOMMUFD. This causes link failures:\n\n ld: vmlinux.o: in function `mock_domain_alloc_pgtable.isra.0\u0027:\n selftest.c:(.text+0x12e8ad3): undefined reference to `pt_iommu_amdv1_init\u0027\n ld: vmlinux.o: in function `BSWAP_SHUFB_CTL\u0027:\n sha1-avx2-asm.o:(.rodata+0xaa36a8): undefined reference to `pt_iommu_amdv1_read_and_clear_dirty\u0027\n ld: sha1-avx2-asm.o:(.rodata+0xaa36f0): undefined reference to `pt_iommu_amdv1_map_pages\u0027\n ld: sha1-avx2-asm.o:(.rodata+0xaa36f8): undefined reference to `pt_iommu_amdv1_unmap_pages\u0027\n ld: sha1-avx2-asm.o:(.rodata+0xaa3720): undefined reference to `pt_iommu_amdv1_iova_to_phys\u0027\n\nAdjust the kconfig to disable IOMMUFD_TEST if IOMMU_PT_AMDV1 is incompatible.\n\nFixes: e93d5945ed5b (\"iommufd: Change the selftest to use iommupt instead of xarray\")\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202512210135.freQWpxa-lkp@intel.com/\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "faa37ff3bf18d5242fe3d54f5462b1c3254c2567", "tree": "8e5c862c2bb83fbd774896c0b58ce49d3742b7a7", "parents": [ "cefd81e76a8c0dc4aa2bacd884acca44e7b61e5b" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Jan 06 15:22:11 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:40:58 2026 +0100" }, "message": "iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFER\n\nThe test doesn\u0027t build without it, dma-buf.h does not provide stub\nfunctions if it is not enabled. Compilation can fail with:\n\n ERROR:root:ld: vmlinux.o: in function `iommufd_test\u0027:\n (.text+0x3b1cdd): undefined reference to `dma_buf_get\u0027\n ld: (.text+0x3b1d08): undefined reference to `dma_buf_put\u0027\n ld: (.text+0x3b2105): undefined reference to `dma_buf_export\u0027\n ld: (.text+0x3b211f): undefined reference to `dma_buf_fd\u0027\n ld: (.text+0x3b2e47): undefined reference to `dma_buf_move_notify\u0027\n\nAdd the missing select.\n\nFixes: d2041f1f11dd (\"iommufd/selftest: Add some tests for the dmabuf flow\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "cefd81e76a8c0dc4aa2bacd884acca44e7b61e5b", "tree": "61c2360c5a324c83eebe92e7ff9633c106bcfd27", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Jan 06 15:22:10 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:40:57 2026 +0100" }, "message": "iommupt: Fix the kunit building\n\nThe kunit doesn\u0027t work since the below commit made GENERIC_PT\nunselectable:\n\n $ make ARCH\u003dx86_64 O\u003dbuild_kunit_x86_64 olddefconfig\n ERROR:root:Not all Kconfig options selected in kunitconfig were in the generated .config.\n This is probably due to unsatisfied dependencies.\n Missing: CONFIG_DEBUG_GENERIC_PT\u003dy, CONFIG_IOMMUFD_TEST\u003dy,\n CONFIG_IOMMU_PT_X86_64\u003dy, CONFIG_GENERIC_PT\u003dy, CONFIG_IOMMU_PT_AMDV1\u003dy,\n CONFIG_IOMMU_PT_VTDSS\u003dy, CONFIG_IOMMU_PT\u003dy, CONFIG_IOMMU_PT_KUNIT_TEST\u003dy\n\nAlso remove the unneeded CONFIG_IOMMUFD_TEST reference as the iommupt kunit\ndoesn\u0027t interact with iommufd, and it doesn\u0027t currently build for the\nkunit due problems with DMA_SHARED buffer either.\n\nFixes: 01569c216dde (\"genpt: Make GENERIC_PT invisible\")\nFixes: 1dd4187f53c3 (\"iommupt: Add a kunit test for Generic Page Table\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Alejandro Jimenez \u003calejandro.j.jimenez@oracle.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "3611ca7c12b740e250d83f8bbe3554b740c503b0", "tree": "71699f57588f9fd858e03e987bf9521a6871b9b9", "parents": [ "0383a8edef396cf0a6884b0be81d62bde60737b0" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Mon Dec 29 12:23:30 2025 -0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Jan 10 07:17:30 2026 +0100" }, "message": "selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]\u003d1\n\nRework the AMX test\u0027s #NM handling to use kvm_asm_safe() to verify an #NM\nactually occurs. As is, a completely missing #NM could go unnoticed.\n\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "0383a8edef396cf0a6884b0be81d62bde60737b0", "tree": "f6f6342e8369712a681edaa0ff7cf81b7b410aa1", "parents": [ "a1025dcd377ef92d9a09af03b70ce80be281ee22" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Dec 31 16:47:26 2025 +0100" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Jan 10 07:17:30 2026 +0100" }, "message": "selftests: kvm: try getting XFD and XSAVE state out of sync\n\nThe host is allowed to set FPU state that includes a disabled\nxstate component. Check that this does not cause bad effects.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "a1025dcd377ef92d9a09af03b70ce80be281ee22", "tree": "d9bde78956a741eaa773c2119628eea82c74495b", "parents": [ "b45f721775947a84996deb5c661602254ce25ce6" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Dec 24 00:44:49 2025 +0100" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Jan 10 07:17:29 2026 +0100" }, "message": "selftests: kvm: replace numbered sync points with actions\n\nRework the guest\u003d\u003ehost syncs in the AMX test to use named actions instead\nof arbitrary, incrementing numbers. The \"stage\" of the test has no real\nmeaning, what matters is what action the test wants the host to perform.\nThe incrementing numbers are somewhat helpful for triaging failures, but\nfully debugging failures almost always requires a much deeper dive into\nthe test (and KVM).\n\nUsing named actions not only makes it easier to extend the test without\nhaving to shift all sync point numbers, it makes the code easier to read.\n\n[Commit message by Sean Christopherson]\n\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "b45f721775947a84996deb5c661602254ce25ce6", "tree": "98ef12bdf1f1a36efe5747a816a404fd41d3d8cb", "parents": [ "95cc9e7cf03d3646abce4129d5c013af33a7df99" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Wed Dec 31 16:43:15 2025 +0100" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Jan 10 07:17:16 2026 +0100" }, "message": "x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]\u003d1\n\nWhen loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in\nresponse to a guest WRMSR, clear XFD-disabled features in the saved (or to\nbe restored) XSTATE_BV to ensure KVM doesn\u0027t attempt to load state for\nfeatures that are disabled via the guest\u0027s XFD. Because the kernel\nexecutes XRSTOR with the guest\u0027s XFD, saving XSTATE_BV[i]\u003d1 with XFD[i]\u003d1\nwill cause XRSTOR to #NM and panic the kernel.\n\nE.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:\n\n ------------[ cut here ]------------\n WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:exc_device_not_available+0x101/0x110\n Call Trace:\n \u003cTASK\u003e\n asm_exc_device_not_available+0x1a/0x20\n RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n switch_fpu_return+0x4a/0xb0\n kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm]\n kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n __x64_sys_ioctl+0x8f/0xd0\n do_syscall_64+0x62/0x940\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nThis can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] \u003d 1,\nand a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler\u0027s\ncall to fpu_update_guest_xfd().\n\nand if userspace stuffs XSTATE_BV[i]\u003d1 via KVM_SET_XSAVE:\n\n ------------[ cut here ]------------\n WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:exc_device_not_available+0x101/0x110\n Call Trace:\n \u003cTASK\u003e\n asm_exc_device_not_available+0x1a/0x20\n RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n fpu_swap_kvm_fpstate+0x6b/0x120\n kvm_load_guest_fpu+0x30/0x80 [kvm]\n kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm]\n kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n __x64_sys_ioctl+0x8f/0xd0\n do_syscall_64+0x62/0x940\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nThe new behavior is consistent with the AMX architecture. Per Intel\u0027s SDM,\nXSAVE saves XSTATE_BV as \u00270\u0027 for components that are disabled via XFD\n(and non-compacted XSAVE saves the initial configuration of the state\ncomponent):\n\n If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,\n the instruction does not generate #NM when XCR0[i] \u003d IA32_XFD[i] \u003d 1;\n instead, it operates as if XINUSE[i] \u003d 0 (and the state component was\n in its initial state): it saves bit i of XSTATE_BV field of the XSAVE\n header as 0; in addition, XSAVE saves the initial configuration of the\n state component (the other instructions do not save state component i).\n\nAlternatively, KVM could always do XRSTOR with XFD\u003d0, e.g. by using\na constant XFD based on the set of enabled features when XSAVEing for\na struct fpu_guest. However, having XSTATE_BV[i]\u003d1 for XFD-disabled\nfeatures can only happen in the above interrupt case, or in similar\nscenarios involving preemption on preemptible kernels, because\nfpu_swap_kvm_fpstate()\u0027s call to save_fpregs_to_fpstate() saves the\noutgoing FPU state with the current XFD; and that is (on all but the\nfirst WRMSR to XFD) the guest XFD.\n\nTherefore, XFD can only go out of sync with XSTATE_BV in the above\ninterrupt case, or in similar scenarios involving preemption on\npreemptible kernels, and it we can consider it (de facto) part of KVM\nABI that KVM_GET_XSAVE returns XSTATE_BV[i]\u003d0 for XFD-disabled features.\n\nReported-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: stable@vger.kernel.org\nFixes: 820a6ee944e7 (\"kvm: x86: Add emulation for IA32_XFD\", 2022-01-14)\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\n[Move clearing of XSTATE_BV from fpu_copy_uabi_to_guest_fpstate\n to kvm_vcpu_ioctl_x86_set_xsave. - Paolo]\nReviewed-by: Binbin Wu \u003cbinbin.wu@linux.intel.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba", "tree": "847e5358a6c67c8260b2bdd46478ae6cfce0cd36", "parents": [ "cb2076b0910f3b19036ec7d50530113fcb9736c8", "072a7c7cdbea4f91df854ee2bb216256cd619f2a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 19:34:50 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 19:34:50 2026 -1000" }, "message": "Merge tag \u0027erofs-for-6.19-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs fix from Gao Xiang:\n\n - Don\u0027t increase s_stack_depth which caused regressions in some\n composefs mount setups (EROFS + ovl^2)\n\n Instead just allow one extra unaccounted fs stacking level for\n straightforward cases.\n\n* tag \u0027erofs-for-6.19-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: don\u0027t bother with s_stack_depth increasing for now\n" }, { "commit": "072a7c7cdbea4f91df854ee2bb216256cd619f2a", "tree": "aab8613a5bbfd7a1c0fe8e8273a81599000fb2b5", "parents": [ "f8f9c1f4d0c7a64600e2ca312dec824a0bc2f1da" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Thu Jan 08 10:38:31 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Sat Jan 10 13:01:15 2026 +0800" }, "message": "erofs: don\u0027t bother with s_stack_depth increasing for now\n\nPreviously, commit d53cd891f0e4 (\"erofs: limit the level of fs stacking\nfor file-backed mounts\") bumped `s_stack_depth` by one to avoid kernel\nstack overflow when stacking an unlimited number of EROFS on top of\neach other.\n\nThis fix breaks composefs mounts, which need EROFS+ovl^2 sometimes\n(and such setups are already used in production for quite a long time).\n\nOne way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH\nfrom 2 to 3, but proving that this is safe in general is a high bar.\n\nAfter a long discussion on GitHub issues [1] about possible solutions,\none conclusion is that there is no need to support nesting file-backed\nEROFS mounts on stacked filesystems, because there is always the option\nto use loopback devices as a fallback.\n\nAs a quick fix for the composefs regression for this cycle, instead of\nbumping `s_stack_depth` for file backed EROFS mounts, we disallow\nnesting file-backed EROFS over EROFS and over filesystems with\n`s_stack_depth` \u003e 0.\n\nThis works for all known file-backed mount use cases (composefs,\ncontainerd, and Android APEX for some Android vendors), and the fix is\nself-contained.\n\nEssentially, we are allowing one extra unaccounted fs stacking level of\nEROFS below stacking filesystems, but EROFS can only be used in the read\npath (i.e. overlayfs lower layers), which typically has much lower stack\nusage than the write path.\n\nWe can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more\nstack usage analysis or using alternative approaches, such as splitting\nthe `s_stack_depth` limitation according to different combinations of\nstacking.\n\nFixes: d53cd891f0e4 (\"erofs: limit the level of fs stacking for file-backed mounts\")\nReported-and-tested-by: Dusty Mabe \u003cdusty@dustymabe.com\u003e\nReported-by: Timothée Ravier \u003ctim@siosm.fr\u003e\nCloses: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1]\nReported-by: \"Alekséi Naidénov\" \u003can@digitaltide.io\u003e\nCloses: https://lore.kernel.org/r/CAFHtUiYv4+\u003d+JP_-JjARWjo6OwcvBj1wtYN\u003dz0QXwCpec9sXtg@mail.gmail.com\nAcked-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nAcked-by: Alexander Larsson \u003calexl@redhat.com\u003e\nReviewed-and-tested-by: Sheng Yong \u003cshengyong1@xiaomi.com\u003e\nReviewed-by: Zhiguo Niu \u003czhiguo.niu@unisoc.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "cb2076b0910f3b19036ec7d50530113fcb9736c8", "tree": "7acbea961c180ab45e5799abc511aab127cfa495", "parents": [ "68ad2095ca0f42a92d16d8cd1df0fb4f4bff634a", "f0d385f6689f37a2828c686fb279121df006b4cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:42:46 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:42:46 2026 -1000" }, "message": "Merge tag \u0027block-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Kill unlikely checks for blk-rq-qos. These checks are really\n all-or-nothing, either the branch is taken all the time, or it\u0027s not.\n Depending on the configuration, either one of those cases may be\n true. Just remove the annotation\n\n - Fix for merging bios with different app tags set\n\n - Fix for a recently introduced slowdown due to RCU synchronization\n\n - Fix for a status change on loop while it\u0027s in use, and then a later\n fix for that fix\n\n - Fix for the async partition scanning in ublk\n\n* tag \u0027block-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n ublk: fix use-after-free in ublk_partition_scan_work\n blk-mq: avoid stall during boot due to synchronize_rcu_expedited\n loop: add missing bd_abort_claiming in loop_set_status\n block: don\u0027t merge bios with different app_tags\n blk-rq-qos: Remove unlikely() hints from QoS checks\n loop: don\u0027t change loop device under exclusive opener in loop_set_status\n" }, { "commit": "68ad2095ca0f42a92d16d8cd1df0fb4f4bff634a", "tree": "bf7dcf081a974e348dfbe52690f0f11cc1e5a63f", "parents": [ "e28ddd0b7af218e1a8863c524e15918895af9ac8", "e4fdbca2dc774366aca6532b57bfcdaae29aaf63" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:21:15 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:21:15 2026 -1000" }, "message": "Merge tag \u0027io_uring-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n \"A single fix for a regression introduced in 6.15, where a failure to\n wake up idle io-wq workers at ring exit will wait for the timeout to\n expire.\n\n This isn\u0027t normally noticeable, as the exit is async.\n\n But if a parent task created a thread that sets up a ring and uses\n requests that cause io-wq threads to be created, and the parent task\n then waits for the thread to exit, then it can take 5 seconds for that\n pthread_join() to succeed as the child thread is waiting for its\n children to exit.\n\n On top of that, just a basic cleanup as well\"\n\n* tag \u0027io_uring-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/io-wq: remove io_wq_for_each_worker() return value\n io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic\n" }, { "commit": "e28ddd0b7af218e1a8863c524e15918895af9ac8", "tree": "0a0350c6837e5bd973533442d538dab7807a0f32", "parents": [ "e55feea3a03aa1eaf5abb22cc854208813865e04", "bdf3f4176092df5281877cacf42f843063b4784d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:17:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:17:48 2026 -1000" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n\n - Do not return false if !preemptible() in current_in_efi(). EFI\n runtime services can now run with preemption enabled\n\n - Fix uninitialised variable in the arm MPAM driver, reported by sparse\n\n - Fix partial kasan_reset_tag() use in change_memory_common() when\n calculating page indices or comparing ranges\n\n - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit\n is lost\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: Fix cleared E0POE bit after cpu_suspend()/resume()\n arm64: mm: Fix incomplete tag reset in change_memory_common()\n arm_mpam: Stop using uninitialized variables in __ris_msmon_read()\n arm64/efi: Don\u0027t fail check current_in_efi() if preemptible\n" }, { "commit": "e55feea3a03aa1eaf5abb22cc854208813865e04", "tree": "ec953d00c28b555e8c36e53ce3cbd7f9189c50ad", "parents": [ "4621c338d33f2e49c55d317fa5b1fbc0ae1cccb7", "bf104037ebd5c1774fa736050a484c1f28cb2e6b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:11:45 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:11:45 2026 -1000" }, "message": "Merge tag \u0027soc-fixes-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"The main code change is a revert of the Raspberry Pi RP1 overlay\n support that was decided to not be ready.\n\n The other fixes are all for devicetree sources:\n\n - ethernet configuration on ixp42x-actiontec-mi424wr is board\n revision specific\n\n - validation warning fixes for imx27/imx51/imx6, hikey960 and k3\n\n - Minor corrections across imx8 boards, addressing all types of\n issues with interrups, dma, ethernet and clock settings, all simple\n one-line changes\"\n\n* tag \u0027soc-fixes-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)\n arm64: dts: hisilicon: hikey960: Drop \"snps,gctl-reset-quirk\" and \"snps,tx_de_emphasis*\" properties\n Documentation/process: maintainer-soc: Mark \u0027make\u0027 as commands\n Documentation/process: maintainer-soc: Be more explicit about defconfig\n arm64: dts: mba8mx: Fix Ethernet PHY IRQ support\n arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart\n arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM\n arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells\n arm64: dts: freescale: moduline-display: fix compatible\n dt-bindings: arm: fsl: moduline-display: fix compatible\n ARM: dts: imx6q-ba16: fix RTC interrupt level\n arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position\n arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt\n arm64: dts: add off-on-delay-us for usdhc2 regulator\n arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level\n ARM: dts: nxp: imx: Fix mc13xxx LED node names\n arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP\n MAINTAINERS: Fix a linusw mail address\n arm64: dts: broadcom: rp1: drop RP1 overlay\n arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology\n misc: rp1: drop overlay support\n ...\n" }, { "commit": "4621c338d33f2e49c55d317fa5b1fbc0ae1cccb7", "tree": "90897bc6911827159349e8e97870ca640eee90db", "parents": [ "372800cb95a35a7c40a07e2e0f7de4ce6786d230", "c0fe2994f9a9d0a2ec9e42441ea5ba74b6a16176" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:05:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:05:19 2026 -1000" }, "message": "Merge tag \u0027ceph-for-6.19-rc5\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"A bunch of libceph fixes split evenly between memory safety and\n implementation correctness issues (all marked for stable) and a change\n in maintainers for CephFS: Slava and Alex have formally taken over\n Xiubo\u0027s role\"\n\n* tag \u0027ceph-for-6.19-rc5\u0027 of https://github.com/ceph/ceph-client:\n libceph: make calc_target() set t-\u003epaused, not just clear it\n libceph: reset sparse-read state in osd_fault()\n libceph: return the handler error from mon_handle_auth_done()\n libceph: make free_choose_arg_map() resilient to partial allocation\n ceph: update co-maintainers list in MAINTAINERS\n libceph: replace overzealous BUG_ON in osdmap_apply_incremental()\n libceph: prevent potential out-of-bounds reads in handle_auth_done()\n" }, { "commit": "6e39903c73df08b256322d04c4dfe4a82ec63a45", "tree": "61a0058a144352f62814575cfe25c91b9cfd137c", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Fushuai Wang", "email": "wangfushuai@baidu.com", "time": "Fri Jan 09 11:36:20 2026 +0800" }, "committer": { "name": "Shuah Khan", "email": "skhan@linuxfoundation.org", "time": "Fri Jan 09 15:49:32 2026 -0700" }, "message": "selftests/tracing: Fix test_multiple_writes stall\n\nWhen /sys/kernel/tracing/buffer_size_kb is less than 12KB,\nthe test_multiple_writes test will stall and wait for more\ninput due to insufficient buffer space.\n\nCheck current buffer_size_kb value before the test. If it is\nless than 12KB, it temporarily increase the buffer to 12KB,\nand restore the original value after the tests are completed.\n\nLink: https://lore.kernel.org/r/20260109033620.25727-1-fushuai.wang@linux.dev\nFixes: 37f46601383a (\"selftests/tracing: Add basic test for trace_marker_raw file\")\nSuggested-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Fushuai Wang \u003cwangfushuai@baidu.com\u003e\nAcked-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\n" }, { "commit": "372800cb95a35a7c40a07e2e0f7de4ce6786d230", "tree": "1162377754d67a6afcebdb9f85f995d3fc79fe05", "parents": [ "4d6fe1dd12a77c7774a3210f8450bdad2f84d879", "2bb83bc42be6280d9bc363b8fbcd6fdab690d16d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 07:02:38 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 07:02:38 2026 -1000" }, "message": "Merge tag \u0027for-6.19-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fix potential NULL pointer dereference when replaying tree log after\n an error\n\n - release path before initializing extent tree to avoid potential\n deadlock when allocating new inode\n\n - on filesystems with block size \u003e page size\n - fix potential read out of bounds during encoded read of an inline\n extent\n - only enforce free space tree if v1 cache is required\n\n - print correct tree id in error message\n\n* tag \u0027for-6.19-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: show correct warning if can\u0027t read data reloc tree\n btrfs: fix NULL pointer dereference in do_abort_log_replay()\n btrfs: force free space tree for bs \u003e ps cases\n btrfs: only enforce free space tree if v1 cache is required for bs \u003c ps cases\n btrfs: release path before initializing extent tree in btrfs_read_locked_inode()\n btrfs: avoid access-beyond-folio for bs \u003e ps encoded writes\n" }, { "commit": "4d6fe1dd12a77c7774a3210f8450bdad2f84d879", "tree": "5d938686b1b3578e02c99ecce49ee194493a1030", "parents": [ "553410fcb95e3acf1a4ac7c08c5b30407f5f30b6", "bdb32359eab94013e80cf7e3d40a3fd4972da93a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:41:10 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:41:10 2026 -1000" }, "message": "Merge tag \u0027pci-v6.19-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Remove ASPM L0s support for MSM8996 SoC since we now enable L0s when\n advertised, and it caused random hangs on this device (Manivannan\n Sadhasivam)\n\n - Fix meson-pcie to report that the link is up while in ASPM L0s or L1,\n since those are active states from the software point of view, and\n treating the link as down caused config access failures (Bjorn\n Helgaas)\n\n - Fix up sparc DTS BAR descriptions that are above 4GB but not marked\n as prefetchable, which caused resource assignment and driver probe\n failures after we converted from the SPARC pcibios_enable_device() to\n the generic version (Ilpo Järvinen)\n\n* tag \u0027pci-v6.19-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n sparc/PCI: Correct 64-bit non-pref -\u003e pref BAR resources\n PCI: meson: Report that link is up while in ASPM L0s and L1 states\n PCI: qcom: Remove ASPM L0s support for MSM8996 SoC\n" }, { "commit": "553410fcb95e3acf1a4ac7c08c5b30407f5f30b6", "tree": "fc5caa329f649d7c0ed28c530fa58d850469e5f8", "parents": [ "81c5ffec9ece10079b8c6d944a754fcddfcd37da", "1ca8677d9f3491e51395b0e6b9a2b7a75089dc6f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:20:15 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:20:15 2026 -1000" }, "message": "Merge tag \u0027acpi-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fix from Rafael Wysocki:\n \"This fixes the ACPI/PCI legacy interrupts (INTx) parsing in the case\n when the ACPI Global System Interrupt (GSI) value is a 32-bit one with\n the MSB set.\n\n That was interpreted as a negative integer and caused\n acpi_pci_link_allocate_irq() to fail and acpi_irq_get_penalty() to\n trigger an out-of-bounds array dereference (Lorenzo Pieralisi)\"\n\n* tag \u0027acpi-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: PCI: IRQ: Fix INTx GSIs signedness\n" }, { "commit": "81c5ffec9ece10079b8c6d944a754fcddfcd37da", "tree": "25c26f8e15476b0b99a54f162441e1194c9e69b8", "parents": [ "a81668db9e2c46d7274fe00892f943ed68f86481", "7966cf0ebe32c981bfa3db252cb5fc3bb1bf2e77" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:18:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:18:05 2026 -1000" }, "message": "Merge tag \u0027pm-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fix from Rafael Wysocki:\n \"This fixes a crash in the hibernation image saving code that can be\n triggered when the given compression algorithm is unavailable (Malaya\n Kumar Rout)\"\n\n* tag \u0027pm-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n PM: hibernate: Fix crash when freeing invalid crypto compressor\n" }, { "commit": "a81668db9e2c46d7274fe00892f943ed68f86481", "tree": "565f10bdc65594c70b32f10d1e1a7b60124a3709", "parents": [ "cbd4480cfac54dd4e9f7fb9ac2e0226ea38fecbb", "d578b31856cec31315f27b3ba97b212e4c6989b3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:10:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:10:22 2026 -1000" }, "message": "Merge tag \u0027gpio-fixes-for-v6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n \"There are several ordinary driver fixes and a fix to a race between\n the registration of two chips that causes a crash in GPIO core.\n\n The bulk of the changed lines however, concerns the management of\n shared GPIOs that landed in v6.19-rc1. Enabling it for ARCH_QCOM\n enabled it in defconfig which effectively enabled it for all arm64\n platforms and exposed the code to quite a lot of testing (which is\n good, right? :)).\n\n As a resukt, I received a number of bug reports, which I progressively\n fixed over the course of last weeks. This explains the number of lines\n higher than what I normally aim for at this stage.\n\n - balance superio enter/exit calls in error path in gpio-it87\n\n - fix a race where we try to take the SRCU read lock of the GPIO\n device before it\u0027s been initialized causing a NULL-pointer\n dereference\n\n - fix handling of short-pulse interrupts in gpio-pca053x\n\n - fix a reference leak in error path in gpio-mpsse\n\n - mark the GPIO controller as sleeping (it calls sleeping functions)\n in gpio-rockchip\n\n - fix several issues in management of shared GPIOs\"\n\n* tag \u0027gpio-fixes-for-v6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: shared: fix a false-positive sharing detection with reset-gpios\n gpiolib: fix lookup table matching\n gpio: shared: don\u0027t allocate the lookup table until we really need it\n gpio: shared: fix a race condition\n gpio: shared: assign the correct firmware node for reset-gpio use-case\n gpio: rockchip: mark the GPIO controller as sleeping\n gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths\n gpio: pca953x: handle short interrupt pulses on PCAL devices\n gpiolib: fix race condition for gdev-\u003esrcu\n gpio: shared: allow sharing a reset-gpios pin between reset-gpio and gpiolib\n gpio: shared: verify con_id when adding proxy lookup\n gpiolib: allow multiple lookup tables per consumer\n gpio: it87: balance superio enter/exit calls in error path\n" }, { "commit": "cbd4480cfac54dd4e9f7fb9ac2e0226ea38fecbb", "tree": "b1e0dfbea9b5c66631bf904b26e074dbaa6d8d74", "parents": [ "2bfe3e0da6e619dbf6157dfad896307ab6b9a58a", "f6eac56d6bf2026437b606a69aff903941282f9a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:04:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:04:05 2026 -1000" }, "message": "Merge tag \u0027drm-fixes-2026-01-09\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"I missed the drm-rust fixes tree for last week, so this catches up on\n that, along with amdgpu, and then some misc fixes across a few\n drivers. I hadn\u0027t got an xe pull by the time I sent this, I suspect\n one will arrive 10 mins after, but I don\u0027t think there is anything\n that can\u0027t wait for next week.\n\n Things seem to have picked up a little with people coming back from\n holidays,\n\n MAINTAINERS:\n - Fix Nova GPU driver git links\n - Fix typo in TYR driver entry preventing correct behavior of\n scripts/get_maintainer.pl\n - Exclude TYR driver from DRM MISC\n\n nova-core:\n - Correctly select RUST_FW_LOADER_ABSTRACTIONS to prevent build\n errors\n - Regenerate nova-core bindgen bindings with \u0027--explicit-padding\u0027 to\n avoid uninitialized bytes\n - Fix length of received GSP messages, due to miscalculated message\n payload size\n - Regenerate bindings to derive MaybeZeroable\n - Use a bindings alias to derive the firmware version\n\n exynos:\n - hdmi: replace system_wq with system_percpu_wq\n\n pl111:\n - Fix error handling in probe\n\n mediatek/atomic/tidss:\n - Fix tidss in another way and revert reordering of pre-enable and\n post-disable operations, as it breaks other bridge drivers\n\n nouveau:\n - Fix regression from fwsec s/r fix\n\n pci/vga:\n - Fix multiple gpu\u0027s being reported a \u0027boot_display\u0027\n\n fb-helper:\n - Fix vblank timeout during suspend/reset\n\n amdgpu:\n - Clang fixes\n - Navi1x PCIe DPM fixes\n - Ring reset fixes\n - ISP suspend fix\n - Analog DC fixes\n - VPE fixes\n - Mode1 reset fix\n\n radeon:\n - Variable sized array fix\"\n\n* tag \u0027drm-fixes-2026-01-09\u0027 of https://gitlab.freedesktop.org/drm/kernel: (32 commits)\n Reapply \"Revert \"drm/amd: Skip power ungate during suspend for VPE\"\"\n drm/amd/display: Check NULL before calling dac_load_detection\n drm/amd/pm: Disable MMIO access during SMU Mode 1 reset\n drm/exynos: hdmi: replace use of system_wq with system_percpu_wq\n drm/fb-helper: Fix vblank timeout during suspend/reset\n PCI/VGA: Don\u0027t assume the only VGA device on a system is `boot_vga`\n drm/amdgpu: Fix query for VPE block_type and ip_count\n drm/amd/display: Add missing encoder setup to DACnEncoderControl\n drm/amd/display: Correct color depth for SelectCRTC_Source\n drm/amd/amdgpu: Fix SMU warning during isp suspend-resume\n drm/amdgpu: always backup and reemit fences\n drm/amdgpu: don\u0027t reemit ring contents more than once\n drm/amd/pm: force send pcie parmater on navi1x\n drm/amd/pm: fix wrong pcie parameter on navi1x\n drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]\n drm/amd/display: Reduce number of arguments of dcn30\u0027s CalculateWatermarksAndDRAMSpeedChangeSupport()\n drm/amd/display: Reduce number of arguments of dcn30\u0027s CalculatePrefetchSchedule()\n drm/amd/display: Apply e4479aecf658 to dml\n nouveau: don\u0027t attempt fwsec on sb on newer platforms\n drm/tidss: Fix enable/disable order\n ...\n" }, { "commit": "2bfe3e0da6e619dbf6157dfad896307ab6b9a58a", "tree": "1c8cd111ef9d4e28ce69675db5aa605b2e0a75a8", "parents": [ "77d4c5da97ceb5f9bf9993a36b5fb453616412e8", "75ddaa4ddc86d31edb15e50152adf4ddee77a6ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:57:57 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:57:57 2026 -1000" }, "message": "Merge tag \u0027vfs-6.19-rc5.fixes\u0027 of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Remove incorrect __user annotation from struct xattr_args::value\n\n - Documentation fix: Add missing kernel-doc description for the @isnew\n parameter in ilookup5_nowait() to silence Sphinx warnings\n\n - Documentation fix: Fix kernel-doc comment for __start_dirop() - the\n function name in the comment was wrong and the @state parameter was\n undocumented\n\n - Replace dynamic folio_batch allocation with stack allocation in\n iomap_zero_range(). The dynamic allocation was problematic for\n ext4-on-iomap work (didn\u0027t handle allocation failure properly) and\n triggered lockdep complaints. Uses a flag instead to control batch\n usage\n\n - Re-add #ifdef guards around PIDFD_GET_\u003cns-type\u003e_NAMESPACE ioctls.\n When a namespace type is disabled, ns-\u003eops is NULL, causes crashes\n during inode eviction when closing the fd. The ifdefs were removed in\n a recent simplification but are still needed\n\n - Fixe a race where a folio could be unlocked before the trailing zeros\n (for EOF within the page) were written\n\n - Split out a dedicated lease_dispose_list() helper since lease code\n paths always know they\u0027re disposing of leases. Removes unnecessary\n runtime flag checks and prepares for upcoming lease_manager\n enhancements\n\n - Fix userland delegation requests succeeding despite conflicting\n opens. Previously, FL_LAYOUT and FL_DELEG leases bypassed conflict\n checks (a hack for nfsd). Adds new -\u003elm_open_conflict() lease_manager\n operation so userland delegations get proper conflict checking while\n nfsd can continue its own conflict handling\n\n - Fix LOOKUP_CACHED path lookups incorrectly falling through to the\n slow path. After legitimize_links() calls were conditionally elided,\n the routine would always fail with LOOKUP_CACHED regardless of\n whether there were any links. Now the flag is checked at the two\n callsites before calling legitimize_links()\n\n - Fix bug in media fd allocation in media_request_alloc()\n\n - Fix mismatched API calls in ecryptfs_mknod(): was calling\n end_removing() instead of end_creating() after\n ecryptfs_start_creating_dentry()\n\n - Fix dentry reference count leak in ecryptfs_mkdir(): a dget() of the\n lower parent dir was added but never dput()\u0027d, causing BUG during\n lower filesystem unmount due to the still-in-use dentry\n\n* tag \u0027vfs-6.19-rc5.fixes\u0027 of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs:\n pidfs: protect PIDFD_GET_* ioctls() via ifdef\n ecryptfs: Release lower parent dentry after creating dir\n ecryptfs: Fix improper mknod pairing of start_creating()/end_removing()\n get rid of bogus __user in struct xattr_args::value\n VFS: fix __start_dirop() kernel-doc warnings\n fs: Describe @isnew parameter in ilookup5_nowait()\n fs: make sure to fail try_to_unlazy() and try_to_unlazy() for LOOKUP_CACHED\n netfs: Fix early read unlock of page with EOF in middle\n filelock: allow lease_managers to dictate what qualifies as a conflict\n filelock: add lease_dispose_list() helper\n iomap: replace folio_batch allocation with stack allocation\n media: mc: fix potential use-after-free in media_request_alloc()\n" }, { "commit": "77d4c5da97ceb5f9bf9993a36b5fb453616412e8", "tree": "5beb0d19fa854091bf77f227b2408cd0f49e5120", "parents": [ "623fb9912f6af600cda3b6bd166ac738c1115ef4", "961ac9d97be72267255f1ed841aabf6694b17454" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:55:34 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:55:34 2026 -1000" }, "message": "Merge tag \u0027v6.19-p3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fix from Herbert Xu:\n\n - Fix duplicate restart messages in qat\n\n* tag \u0027v6.19-p3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: qat - fix duplicate restarting msg during AER error\n" }, { "commit": "a33d16dc874a9512c02b1f1a3e08c26a82b4be5e", "tree": "8f727026735092d2905633eee3b412b1e517171f", "parents": [ "1690eeb0cb2bb77096cb6c826b6849ef05013e34" ], "author": { "name": "Anup Patel", "email": "anup.patel@oss.qualcomm.com", "time": "Tue Dec 23 20:05:44 2025 +0530" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Jan 09 16:10:05 2026 +0100" }, "message": "Revert \"irqchip/riscv-imsic: Embed the vector array in lpriv\"\n\nThe __alloc_percpu() fails when the number of IDs are greater than 959\nbecause size parameter of __alloc_percpu() must be less than 32768 (aka\nPCPU_MIN_UNIT_SIZE). This failure is observed with KVMTOOL when AIA is\ntrap-n-emulated by in-kernel KVM because in this case KVM guest has 2047\ninterrupt IDs.\n\nTo address this issue, don\u0027t embed vector array in struct imsic_local_priv\nuntil __alloc_percpu() support size parameter greater than 32768.\n\nThis reverts commit 79eaabc61dfb (\"irqchip/riscv-imsic: Embed the vector\narray in lpriv\").\n\nSigned-off-by: Anup Patel \u003canup.patel@oss.qualcomm.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nLink: https://patch.msgid.link/20251223143544.1504217-1-anup.patel@oss.qualcomm.com\n" }, { "commit": "1690eeb0cb2bb77096cb6c826b6849ef05013e34", "tree": "f07671aecafa710e03c24b224c86ab2740100155", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Lorenzo Pieralisi", "email": "lpieralisi@kernel.org", "time": "Mon Dec 22 11:22:50 2025 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Jan 09 16:10:04 2026 +0100" }, "message": "irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness\n\nKbuild bot (through sparse) reported that the ITTE read to carry out\na valid check in gicv5_its_map_event() lacks proper endianness handling.\n\nAdd the missing endianess conversion.\n\nFixes: 57d72196dfc8 (\"irqchip/gic-v5: Add GICv5 ITS support\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nSigned-off-by: Lorenzo Pieralisi \u003clpieralisi@kernel.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nAcked-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nLink: https://patch.msgid.link/20251222102250.435460-1-lpieralisi@kernel.org\nCloses: https://lore.kernel.org/oe-kbuild-all/202512131849.30ZRTBeR-lkp@intel.com/\n" }, { "commit": "f0d385f6689f37a2828c686fb279121df006b4cb", "tree": "06a18f95b540441acaf99f8876ce06734ae2df06", "parents": [ "9670db22e7ab4aefe2b2619589a47fef9d3e0c7e" ], "author": { "name": "Ming Lei", "email": "ming.lei@redhat.com", "time": "Fri Jan 09 20:14:54 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Jan 09 06:55:30 2026 -0700" }, "message": "ublk: fix use-after-free in ublk_partition_scan_work\n\nA race condition exists between the async partition scan work and device\nteardown that can lead to a use-after-free of ub-\u003eub_disk:\n\n1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()\n2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:\n - del_gendisk(ub-\u003eub_disk)\n - ublk_detach_disk() sets ub-\u003eub_disk \u003d NULL\n - put_disk() which may free the disk\n3. The worker ublk_partition_scan_work() then dereferences ub-\u003eub_disk\n leading to UAF\n\nFix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold\na reference to the disk during the partition scan. The spinlock in\nublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker\neither gets a valid reference or sees NULL and exits early.\n\nAlso change flush_work() to cancel_work_sync() to avoid running the\npartition scan work unnecessarily when the disk is already detached.\n\nFixes: 7fc4da6a304b (\"ublk: scan partition in async way\")\nReported-by: Ruikai Peng \u003cruikai@pwno.io\u003e\nSigned-off-by: Ming Lei \u003cming.lei@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "2bdf777410dc6e022d1081885ff34673b5dfee99", "tree": "5a369dca9ec971aeba85768e9fbbe6771b140a3d", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Cong Wang", "email": "cwang@multikernel.io", "time": "Tue Dec 23 13:51:13 2025 -0800" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Jan 09 13:02:57 2026 +0100" }, "message": "sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()\n\nsched_mm_cid_after_execve() is called in bprm_execve()\u0027s cleanup path even\nwhen exec_binprm() fails. For the init task\u0027s first execve(), this causes a\nproblem:\n\n 1. current-\u003emm is NULL (kernel threads don\u0027t have an mm)\n 2. sched_mm_cid_before_execve() exits early because mm is NULL\n 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)\n 4. sched_mm_cid_after_execve() is called with mm still NULL\n 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON\n\nThis is easily reproduced by booting with an init that is a shell script\n(#!/bin/sh) where the interpreter doesn\u0027t exist in the initramfs.\n\nFix this by checking if t-\u003emm is NULL before calling sched_mm_cid_fork(),\nmatching the behavior of sched_mm_cid_before_execve() which already\nhandles this case via sched_mm_cid_exit()\u0027s early return.\n\nFixes: b0c3d51b54f8 (\"sched/mmcid: Provide precomputed maximal value\")\nSigned-off-by: Cong Wang \u003ccwang@multikernel.io\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nAcked-by: Will Deacon \u003cwill@kernel.org\u003e\nLink: https://patch.msgid.link/20251223215113.639686-1-xiyou.wangcong@gmail.com\n" }, { "commit": "bdf3f4176092df5281877cacf42f843063b4784d", "tree": "3296b5fa5765bdc867c4f0aa7ecd735002fc7e80", "parents": [ "5fcd5513072b09f6533e22a779183fa2818bce81" ], "author": { "name": "Yeoreum Yun", "email": "yeoreum.yun@arm.com", "time": "Wed Jan 07 16:21:15 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Jan 09 10:41:45 2026 +0000" }, "message": "arm64: Fix cleared E0POE bit after cpu_suspend()/resume()\n\nTCR2_ELx.E0POE is set during smp_init().\nHowever, this bit is not reprogrammed when the CPU enters suspension and\nlater resumes via cpu_resume(), as __cpu_setup() does not re-enable E0POE\nand there is no save/restore logic for the TCR2_ELx system register.\n\nAs a result, the E0POE feature no longer works after cpu_resume().\n\nTo address this, save and restore TCR2_EL1 in the cpu_suspend()/cpu_resume()\npath, rather than adding related logic to __cpu_setup(), taking into account\npossible future extensions of the TCR2_ELx feature.\n\nFixes: bf83dae90fbc (\"arm64: enable the Permission Overlay Extension for EL0\")\nCc: \u003cstable@vger.kernel.org\u003e # 6.12.x\nSigned-off-by: Yeoreum Yun \u003cyeoreum.yun@arm.com\u003e\nReviewed-by: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nReviewed-by: Kevin Brodsky \u003ckevin.brodsky@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "d578b31856cec31315f27b3ba97b212e4c6989b3", "tree": "d29cc084d841368a081d621843c41de5cf394e5e", "parents": [ "36f597bba049928004a050c132ab787ba0eba524" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Jan 08 14:39:19 2026 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Fri Jan 09 09:56:46 2026 +0100" }, "message": "gpio: shared: fix a false-positive sharing detection with reset-gpios\n\nAfter scanning the devicetree, we remove all entries that have only one\nreference, while creating GPIO shared proxies for the remaining, shared\nentries. However: for the reset-gpio corner-case, we will have two\nreferences for a \"reset-gpios\" pin that\u0027s not really shared. In this\ncase one will come from the actual consumer fwnode and the other from\nthe potential auxiliary reset-gpio device. This causes the GPIO core to\ncreate unnecessary GPIO shared proxy devices for pins that are not\nreally shared.\n\nAdd a function that can detect this situation and remove entries that\nhave exactly two references but one of them is a reset-gpio.\n\nFixes: 7b78b26757e0 (\"gpio: shared: handle the reset-gpios corner case\")\nLink: https://lore.kernel.org/r/20260108-gpio-shared-false-positive-v1-1-5dbf8d1b2f7d@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "623fb9912f6af600cda3b6bd166ac738c1115ef4", "tree": "f9e07b4af8c6c731caddf67a7ac4bd2f1a5a1098", "parents": [ "5572ad8fddecd4a0db19801262072ff5916b7589", "ebc18e9854e5a2b62a041fb57b216a903af45b85" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 16:38:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 16:38:19 2026 -1000" }, "message": "Merge tag \u0027pinctrl-v6.19-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Fix the mt8189 register base name order back from being fixed broken\n\n - Add REGMAP_MMIO to the pic64gx-gpio2 to avoid build breakages\n\n - Mark the Qualcomm lpass-lpi pin controller GPIO chip instance as\n sleeping to fix lock splats\n\n - Update .mailmap with my new kernel.org address for all old mails\n after maintainers ran into issues with this\n\n* tag \u0027pinctrl-v6.19-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping\n pinctrl: pic64gx-gpio2: Add REGMAP_MMIO dependency\n Update .mailmap for Linus Walleij\n pinctrl: mediatek: mt8189: restore previous register base name array order\n" }, { "commit": "5fcd5513072b09f6533e22a779183fa2818bce81", "tree": "9450913e4a6e0384e96092d58223300f286e1e61", "parents": [ "c2803bd580db226008aabf2fb2f0c9a7d3b5d0de" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Sun Jan 04 20:35:27 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu Jan 08 19:47:59 2026 +0000" }, "message": "arm64: mm: Fix incomplete tag reset in change_memory_common()\n\nRunning KASAN KUnit tests with {HW,SW}_TAGS mode triggers a fault in\nchange_memory_common():\n\n Call trace:\n change_memory_common+0x168/0x210 (P)\n set_memory_ro+0x20/0x48\n vmalloc_helpers_tags+0xe8/0x338\n kunit_try_run_case+0x74/0x188\n kunit_generic_run_threadfn_adapter+0x30/0x70\n kthread+0x11c/0x200\n ret_from_fork+0x10/0x20\n ---[ end trace 0000000000000000 ]---\n # vmalloc_helpers_tags: try faulted\n not ok 67 vmalloc_helpers_tags\n\nCommit a06494adb7ef (\"arm64: mm: use untagged address to calculate page index\")\nfixed a KASAN warning in the BPF subsystem by adding kasan_reset_tag() to\nthe index calculation. In the execmem flow:\n\n bpf_prog_pack_alloc()\n -\u003e bpf_jit_alloc_exec()\n -\u003e execmem_alloc()\n\nThe returned address from execmem_vmalloc/execmem_cache_alloc is passed\nthrough kasan_reset_tag(), so start has no tag while area-\u003eaddr still\nretains the original tag. The fix correctly handled this case by resetting\nthe tag on area-\u003eaddr:\n\n (start - (unsigned long)kasan_reset_tag(area-\u003eaddr)) \u003e\u003e PAGE_SHIFT\n\nHowever, in normal vmalloc paths, both start and area-\u003eaddr have matching\ntags(or no tags). Resetting only area-\u003eaddr causes a mismatch when\nsubtracting a tagged address from an untagged one, resulting in an\nincorrect index.\n\nFix this by resetting tags on both addresses in the index calculation.\nThis ensures correct results regardless of the tag state of either address.\n\nTested with KASAN KUnit tests under CONFIG_KASAN_GENERIC,\nCONFIG_KASAN_SW_TAGS, and CONFIG_KASAN_HW_TAGS - all pass. Also verified\nthe original BPF KASAN warning from [1] is still fixed.\n\n[1] https://lore.kernel.org/all/20251118164115.GA3977565@ax162/\n\nFixes: a06494adb7ef (\"arm64: mm: use untagged address to calculate page index\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "74d74bb78aeccc9edc10db216d6be121cf7ec176", "tree": "bd7e5fea28ac6c0b710af29946f08845e9c43eb2", "parents": [ "2eb57ca7cc373404aa1399a9d926dea8479eb728" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Tue Jan 06 21:20:23 2026 -0800" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "lib/crypto: aes: Fix missing MMU protection for AES S-box\n\n__cacheline_aligned puts the data in the \".data..cacheline_aligned\"\nsection, which isn\u0027t marked read-only i.e. it doesn\u0027t receive MMU\nprotection. Replace it with ____cacheline_aligned which does the right\nthing and just aligns the data while keeping it in \".rodata\".\n\nFixes: b5e0b032b6c3 (\"crypto: aes - add generic time invariant AES cipher\")\nCc: stable@vger.kernel.org\nReported-by: Qingfang Deng \u003cdqfext@gmail.com\u003e\nCloses: https://lore.kernel.org/r/20260105074712.498-1-dqfext@gmail.com/\nAcked-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260107052023.174620-1-ebiggers@kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "2eb57ca7cc373404aa1399a9d926dea8479eb728", "tree": "2471c8f0ae6d94c677ff3cec1a70cd03ceb4dbe0", "parents": [ "0f42c2a52d8a7535088895c3104150ac9019afd8" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Tue Jan 06 19:39:48 2026 -0800" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "MAINTAINERS: add test vector generation scripts to \"CRYPTO LIBRARY\"\n\nThe scripts in scripts/crypto/ are used to generate files in\nlib/crypto/, so they should be included in \"CRYPTO LIBRARY\".\n\nAcked-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260107033948.29368-1-ebiggers@kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "0f42c2a52d8a7535088895c3104150ac9019afd8", "tree": "6673a78a42d15b3dd2a0ab241b4903fbc23966a6", "parents": [ "fcff71fd888dce1533a3975e68fc80824ff69ef9" ], "author": { "name": "Jie Zhan", "email": "zhanjie9@hisilicon.com", "time": "Wed Jan 07 09:58:29 2026 +0800" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "lib/crypto: tests: Fix syntax error for old python versions\n\n\u0027make binrpm-pkg\u0027 throws me this error, with Python 3.9:\n\n*** Error compiling \u0027.../gen-hash-testvecs.py\u0027...\n File \".../scripts/crypto/gen-hash-testvecs.py\", line 121\n return f\u0027{alg.upper().replace(\u0027-\u0027, \u0027_\u0027)}_DIGEST_SIZE\u0027\n ^\nSyntaxError: f-string: unmatched \u0027(\u0027\n\nOld python versions, presumably \u003c\u003d 3.11, can\u0027t resolve these quotes.\n\nFix it with double quotes for compatibility.\n\nFixes: 15c64c47e484 (\"lib/crypto: tests: Add SHA3 kunit tests\")\nSigned-off-by: Jie Zhan \u003czhanjie9@hisilicon.com\u003e\nLink: https://lore.kernel.org/r/20260107015829.2000699-1-zhanjie9@hisilicon.com\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "fcff71fd888dce1533a3975e68fc80824ff69ef9", "tree": "4555d1365e243f18abf608dbc812630f91ab63a1", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Fri Jan 02 08:32:03 2026 +0100" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "lib/crypto: tests: polyval_kunit: Increase iterations for preparekey in IRQs\n\nOn my development machine the generic, memcpy()-only implementation of\npolyval_preparekey() is too fast for the IRQ workers to actually fire.\nThe test fails.\n\nIncrease the iterations to make the test more robust.\nThe test will run for a maximum of one second in any case.\n\n[EB: This failure was already fixed by commit c31f4aa8fed0 (\"kunit:\nEnforce task execution in {soft,hard}irq contexts\"). I\u0027m still applying\nthis patch too, since the iteration count in this test made its running\ntime much shorter than the other similar ones.]\n\nFixes: b3aed551b3fc (\"lib/crypto: tests: Add KUnit tests for POLYVAL\")\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nLink: https://lore.kernel.org/r/20260102-kunit-polyval-fix-v1-1-5313b5a65f35@linutronix.de\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "c2803bd580db226008aabf2fb2f0c9a7d3b5d0de", "tree": "5a193d3486a6ba4051658c0c5009cd8430418cdf", "parents": [ "dd4d71f587f3908f058b516d3793aaed66cfb692" ], "author": { "name": "Ben Horgan", "email": "ben.horgan@arm.com", "time": "Fri Dec 19 18:11:03 2025 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu Jan 08 19:03:15 2026 +0000" }, "message": "arm_mpam: Stop using uninitialized variables in __ris_msmon_read()\n\nDan has reported two uses of uninitialized variables in __ris_msmon_read().\nIf an unknown monitor type is encountered then the local variable, now, is\nused uninitialized. Fix this by returning early on error. If a non-mbwu\nmonitor is being read then the local variable, overflow, is not initialized\nbut still read. Initialize it to false as overflow is not relevant for csu\nmonitors.\n\nFixes: 823e7c3712c5 (\"arm_mpam: Add mpam_msmon_read() to read monitor value\")\nFixes: 9e5afb7c3283 (\"arm_mpam: Use long MBWU counters if supported\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nReported-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nCloses: https://lore.kernel.org/r/202512091519.RBwiJcSq-lkp@intel.com/\nCloses: https://lore.kernel.org/r/202512100547.N7QPYgfb-lkp@intel.com/\nSigned-off-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nReviewed-by: Jonathan Cameron \u003cjonathan.cameron@huawei.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "5572ad8fddecd4a0db19801262072ff5916b7589", "tree": "2f4572a9a6b14d511581f0c2467f2e323c687ea4", "parents": [ "f2a3b12b305c7bb72467b2a56d19a4587b6007f9", "1e2ed4bfd50ace3c4272cfab7e9aa90956fb7ae0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:47:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:47:05 2026 -1000" }, "message": "Merge tag \u0027trace-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Remove useless assignment of soft_mode variable\n\n The function __ftrace_event_enable_disable() sets \"soft_mode\" in one\n of the branch paths but doesn\u0027t use it after that. Remove the setting\n of that variable.\n\n - Add a cond_resched() in ring_buffer_resize()\n\n The resize function that allocates all the pages for the ring buffer\n was causing a soft lockup on PREEMPT_NONE configs when allocating\n large buffers on machines with many CPUs. Hopefully this is the last\n cond_resched() needed to be added as PREEMPT_LAZY becomes the norm in\n the future.\n\n - Make ftrace_graph_ent depth field signed\n\n The \"depth\" field of struct ftrace_graph_ent was converted from \"int\"\n to \"unsigned long\" for alignment reasons to work with being embedded\n in other structures. The conversion from a signed to unsigned caused\n integrity checks to always pass as they were comparing \"depth\" to\n less than zero. Make the field signed long.\n\n - Add recursion protection to stack trace events\n\n A infinite recursion was triggered by a stack trace event calling RCU\n which internally called rcu_read_unlock_special(), which triggered an\n event that was also doing stacktraces which cause it to trigger the\n same RCU lock that called rcu_read_unlock_special() again.\n\n Update the trace_test_and_set_recursion() to add a set of context\n checks for events to use, and have the stack trace event use that for\n recursion protection.\n\n - Make the variable ftrace_dump_on_oops static\n\n The cleanup of sysctl that moved all the updates to the files that\n use them moved the reference of ftrace_dump_on_oops to where it is\n used. It is no longer used outside of the trace.c file. Make it\n static.\n\n* tag \u0027trace-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n trace: ftrace_dump_on_oops[] is not exported, make it static\n tracing: Add recursion protection in kernel stack trace recording\n ftrace: Make ftrace_graph_ent depth field signed\n ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free\n tracing: Drop unneeded assignment to soft_mode\n" }, { "commit": "f2a3b12b305c7bb72467b2a56d19a4587b6007f9", "tree": "2ec90d83ea6f42067376ba27127cc725fc2fb837", "parents": [ "79b95d74470dd97d7d0908d5a3c0734a23e51aa4", "c92510f5e3f82ba11c95991824a41e59a9c5ed81" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:40:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:40:35 2026 -1000" }, "message": "Merge tag \u0027net-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from netfilter and wireless.\n\n Current release - fix to a fix:\n\n - net: do not write to msg_get_inq in callee\n\n - arp: do not assume dev_hard_header() does not change skb-\u003ehead\n\n Current release - regressions:\n\n - wifi: mac80211: don\u0027t iterate not running interfaces\n\n - eth: mlx5: fix NULL pointer dereference in ioctl module EEPROM\n\n Current release - new code bugs:\n\n - eth: bnge: add AUXILIARY_BUS to Kconfig dependencies\n\n Previous releases - regressions:\n\n - eth: mlx5: dealloc forgotten PSP RX modify header\n\n Previous releases - always broken:\n\n - ping: fix ICMP out SNMP stats double-counting with ICMP sockets\n\n - bonding: preserve NETIF_F_ALL_FOR_ALL across TSO updates\n\n - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress\n\n - eth: bnxt: fix potential data corruption with HW GRO/LRO\"\n\n* tag \u0027net-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits)\n arp: do not assume dev_hard_header() does not change skb-\u003ehead\n net: enetc: fix build warning when PAGE_SIZE is greater than 128K\n atm: Fix dma_free_coherent() size\n tools: ynl: don\u0027t install tests\n net: do not write to msg_get_inq in callee\n bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup\n net: usb: pegasus: fix memory leak in update_eth_regs_async()\n net: 3com: 3c59x: fix possible null dereference in vortex_probe1()\n net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n wifi: mac80211: collect station statistics earlier when disconnect\n wifi: mac80211: restore non-chanctx injection behaviour\n wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock\n wifi: mac80211: don\u0027t iterate not running interfaces\n wifi: mac80211_hwsim: fix typo in frequency notification\n wifi: avoid kernel-infoleak from struct iw_point\n net: airoha: Fix schedule while atomic in airoha_ppe_deinit()\n selftests: netdevsim: add carrier state consistency test\n net: netdevsim: fix inconsistent carrier state after link/unlink\n selftests: drv-net: Bring back tool() to driver __init__s\n net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy\n ...\n" }, { "commit": "c92510f5e3f82ba11c95991824a41e59a9c5ed81", "tree": "6329c392e3e007ded629b97ee38299def0fdf002", "parents": [ "1f20c77496b3e253f18ea636f4f14069e383749d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jan 07 21:22:50 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 09:04:24 2026 -0800" }, "message": "arp: do not assume dev_hard_header() does not change skb-\u003ehead\n\narp_create() is the only dev_hard_header() caller\nmaking assumption about skb-\u003ehead being unchanged.\n\nA recent commit broke this assumption.\n\nInitialize @arp pointer after dev_hard_header() call.\n\nFixes: db5b4e39c4e6 (\"ip6_gre: make ip6gre_header() robust\")\nReported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1f20c77496b3e253f18ea636f4f14069e383749d", "tree": "dc9714c5a1eca66aa452ae68fcc486fd0dd2352f", "parents": [ "4b5bdabb5449b652122e43f507f73789041d4abe", "4648fb2f2e7210c53b85220ee07d42d1e4bae3f9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:54:54 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:54:55 2026 -0800" }, "message": "Merge branch \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-01-06 (idpf)\n\nThis series contains updates to idpf driver only.\n\nEmil fixes issues related to resets; among them timeouts, NULL pointer\ndereferences, and memory leaks.\n\nSreedevi resolves issues around RSS; mainly involving operations when\nthe interface is down and resets. She also addresses some incomplete\ncleanups for ntuple filters and interrupts.\n\nErik fixes incomplete output of ntuple filters.\n\nJosh sets restriction of Rx buffer size to follow hardware restrictions.\n\nLarysa adds check to prevent NULL pointer dereference when RDMA is not\nenabled.\n\n* \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n idpf: fix aux device unplugging when rdma is not supported by vport\n idpf: cap maximum Rx buffer size\n idpf: Fix error handling in idpf_vport_open()\n idpf: Fix RSS LUT NULL ptr issue after soft reset\n idpf: Fix RSS LUT configuration on down interfaces\n idpf: Fix RSS LUT NULL pointer crash on early ethtool operations\n idpf: fix issue with ethtool -n command display\n idpf: fix memory leak of flow steer list on rmmod\n idpf: fix error handling in the init_task on load\n idpf: fix memory leak in idpf_vc_core_deinit()\n idpf: fix memory leak in idpf_vport_rel()\n idpf: detach and close netdevs while handling a reset\n idpf: keep the netdev when a reset fails\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260107000648.1861994-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4b5bdabb5449b652122e43f507f73789041d4abe", "tree": "0b59e68534b8feea7d2706093af85553c1d86693", "parents": [ "804809ae408571d67e171e87bdd03b6b88fbfd3d" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed Jan 07 17:12:04 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:51:09 2026 -0800" }, "message": "net: enetc: fix build warning when PAGE_SIZE is greater than 128K\n\nThe max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE\nis greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will\nbe greater than 0xFFFF, thus causing a build warning.\n\nThis will not cause any practical issues because ENETC is currently only\nused on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch\nis only for fixing the build warning that occurs when compiling ENETC\ndrivers for other platforms.\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/\nFixes: e59bc32df2e9 (\"net: enetc: correct the value of ENETC_RXB_TRUESIZE\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nLink: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "804809ae408571d67e171e87bdd03b6b88fbfd3d", "tree": "b35dcdd47bee772f7cc740f78eb0c82294cd2d36", "parents": [ "4d984b0574ff708e66152763fbfdef24ea40933f", "a203dbeeca15a9b924f0d51f510921f4bae96801" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:49:24 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:49:24 2026 -0800" }, "message": "Merge tag \u0027wireless-2026-01-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nCouple of fixes:\n - mac80211:\n - long-standing injection bug due to chanctx rework\n - more recent interface iteration issue\n - collect statistics before removing stations\n - hwsim:\n - fix NAN frequency typo (potential NULL ptr deref)\n - fix locking of radio lock (needs softirqs disabled)\n - wext:\n - ancient issue with compat and events copying some\n uninitialized stack data to userspace\n\n* tag \u0027wireless-2026-01-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n wifi: mac80211: collect station statistics earlier when disconnect\n wifi: mac80211: restore non-chanctx injection behaviour\n wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock\n wifi: mac80211: don\u0027t iterate not running interfaces\n wifi: mac80211_hwsim: fix typo in frequency notification\n wifi: avoid kernel-infoleak from struct iw_point\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260108140141.139687-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4d984b0574ff708e66152763fbfdef24ea40933f", "tree": "6ecc7b27cf5c14515c4ec8a4dee7feb61ed6e182", "parents": [ "790792ebc9603a7ccbf6996cb537d89607e3a75b" ], "author": { "name": "Thomas Fourier", "email": "fourier.thomas@gmail.com", "time": "Wed Jan 07 10:01:36 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:47:32 2026 -0800" }, "message": "atm: Fix dma_free_coherent() size\n\nThe size of the buffer is not the same when alloc\u0027d with\ndma_alloc_coherent() in he_init_tpdrq() and freed.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Thomas Fourier \u003cfourier.thomas@gmail.com\u003e\nLink: https://patch.msgid.link/20260107090141.80900-2-fourier.thomas@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "790792ebc9603a7ccbf6996cb537d89607e3a75b", "tree": "2a5a9718462d68f6ea8dcd23891e3f9b61d3fc48", "parents": [ "7d11e047eda5f98514ae62507065ac961981c025" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 06 08:34:26 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:46:36 2026 -0800" }, "message": "tools: ynl: don\u0027t install tests\n\nmake\u0027s install target is meant for installing the production\nartifacts, AFAIU. Don\u0027t install test_ynl_cli and test_ynl_ethtool\nfrom under the main YNL install target. The install target\nunder tests/ is retained in case someone wants the tests\nto be installed.\n\nFixes: 308b7dee3e5c (\"tools: ynl: add YNL test framework\")\nReviewed-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nReviewed-by: Donald Hunter \u003cdonald.hunter@gmail.com\u003e\nLink: https://patch.msgid.link/20260106163426.1468943-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7d11e047eda5f98514ae62507065ac961981c025", "tree": "9f5786b4d6fb6d0aade3e1cec6fda738c231ac2b", "parents": [ "3358995b1a7f9dcb52a56ec8251570d71024dad0" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Tue Jan 06 10:05:46 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:45:13 2026 -0800" }, "message": "net: do not write to msg_get_inq in callee\n\nNULL pointer dereference fix.\n\nmsg_get_inq is an input field from caller to callee. Don\u0027t set it in\nthe callee, as the caller may not clear it on struct reuse.\n\nThis is a kernel-internal variant of msghdr only, and the only user\ndoes reinitialize the field. So this is not critical for that reason.\nBut it is more robust to avoid the write, and slightly simpler code.\nAnd it fixes a bug, see below.\n\nCallers set msg_get_inq to request the input queue length to be\nreturned in msg_inq. This is equivalent to but independent from the\nSO_INQ request to return that same info as a cmsg (tp-\u003erecvmsg_inq).\nTo reduce branching in the hot path the second also sets the msg_inq.\nThat is WAI.\n\nThis is a fix to commit 4d1442979e4a (\"af_unix: don\u0027t post cmsg for\nSO_INQ unless explicitly asked for\"), which fixed the inverse.\n\nAlso avoid NULL pointer dereference in unix_stream_read_generic if\nstate-\u003emsg is NULL and msg-\u003emsg_get_inq is written. A NULL state-\u003emsg\ncan happen when splicing as of commit 2b514574f7e8 (\"net: af_unix:\nimplement splice for stream af_unix sockets\").\n\nAlso collapse two branches using a bitwise or.\n\nCc: stable@vger.kernel.org\nFixes: 4d1442979e4a (\"af_unix: don\u0027t post cmsg for SO_INQ unless explicitly asked for\")\nLink: https://lore.kernel.org/netdev/willemdebruijn.kernel.24d8030f7a3de@gmail.com/\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260106150626.3944363-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3358995b1a7f9dcb52a56ec8251570d71024dad0", "tree": "8a355f7a4931494b4340ff224bf11ea0024afbdc", "parents": [ "afa27621a28af317523e0836dad430bec551eb54" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Jan 06 06:31:14 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:44:41 2026 -0800" }, "message": "bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup\n\nWhen bnxt_init_one() fails during initialization (e.g.,\nbnxt_init_int_mode returns -ENODEV), the error path calls\nbnxt_free_hwrm_resources() which destroys the DMA pool and sets\nbp-\u003ehwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called,\nwhich invokes ptp_clock_unregister().\n\nSince commit a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to\ndisable events\"), ptp_clock_unregister() now calls\nptp_disable_all_events(), which in turn invokes the driver\u0027s .enable()\ncallback (bnxt_ptp_enable()) to disable PTP events before completing the\nunregistration.\n\nbnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin()\nand bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This\nfunction tries to allocate from bp-\u003ehwrm_dma_pool, causing a NULL\npointer dereference:\n\n bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed\n KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n Call Trace:\n __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72)\n bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517)\n ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66)\n ptp_clock_unregister (drivers/ptp/ptp_clock.c:518)\n bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134)\n bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889)\n\nLines are against commit f8f9c1f4d0c7 (\"Linux 6.19-rc3\")\n\nFix this by clearing and unregistering ptp (bnxt_ptp_clear()) before\nfreeing HWRM resources.\n\nSuggested-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nFixes: a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to disable events\")\nCc: stable@vger.kernel.org\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/20260106-bnxt-v3-1-71f37e11446a@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "afa27621a28af317523e0836dad430bec551eb54", "tree": "f0121427cc8bdf8b92688117b635fda06ae54169", "parents": [ "a4e305ed60f7c41bbf9aabc16dd75267194e0de3" ], "author": { "name": "Petko Manolov", "email": "petkan@nucleusys.com", "time": "Tue Jan 06 10:48:21 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:40:20 2026 -0800" }, "message": "net: usb: pegasus: fix memory leak in update_eth_regs_async()\n\nWhen asynchronously writing to the device registers and if usb_submit_urb()\nfail, the code fail to release allocated to this point resources.\n\nFixes: 323b34963d11 (\"drivers: net: usb: pegasus: fix control urb submission\")\nSigned-off-by: Petko Manolov \u003cpetkan@nucleusys.com\u003e\nLink: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a4e305ed60f7c41bbf9aabc16dd75267194e0de3", "tree": "c2d21e1de7d79ceacf57c055f856f2dc25a0ddcd", "parents": [ "c1d73b1480235731e35c81df70b08f4714a7d095" ], "author": { "name": "Thomas Fourier", "email": "fourier.thomas@gmail.com", "time": "Tue Jan 06 10:47:21 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:36:56 2026 -0800" }, "message": "net: 3com: 3c59x: fix possible null dereference in vortex_probe1()\n\npdev can be null and free_ring: can be called in 1297 with a null\npdev.\n\nFixes: 55c82617c3e8 (\"3c59x: convert to generic DMA API\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Thomas Fourier \u003cfourier.thomas@gmail.com\u003e\nLink: https://patch.msgid.link/20260106094731.25819-2-fourier.thomas@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c1d73b1480235731e35c81df70b08f4714a7d095", "tree": "6e01873ec969f37a072572b8865ce9ab097c47f9", "parents": [ "6abcf751bc084804a9e5b3051442e8a2ce67f48a" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Mon Jan 05 20:41:00 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:22:28 2026 -0800" }, "message": "net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n\n`qfq_class-\u003eleaf_qdisc-\u003eq.qlen \u003e 0` does not imply that the class\nitself is active.\n\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\nwhen:\n\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\n\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\n/ qdisc_put()) and is pending to be destroyed, as in function\ntc_new_tfilter.\n\nWhen packets are enqueued through the root QFQ qdisc, the shared\nleaf_qdisc-\u003eq.qlen increases. At the same time, the second QFQ\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\nqfq_reset() with its own q-\u003eq.qlen \u003d\u003d 0, but its class\u0027s leaf\nqdisc-\u003eq.qlen \u003e 0. Therefore, the qfq_reset would wrongly deactivate\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\n\n[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 0.903571] #PF: supervisor write access in kernel mode\n[ 0.903860] #PF: error_code(0x0002) - not-present page\n[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\n[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\n[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\n[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n 0:\t0f 84 4d 01 00 00 \tje 0x153\n 6:\t48 89 70 18 \tmov %rsi,0x18(%rax)\n a:\t8b 4b 10 \tmov 0x10(%rbx),%ecx\n d:\t48 c7 c2 ff ff ff ff \tmov $0xffffffffffffffff,%rdx\n 14:\t48 8b 78 08 \tmov 0x8(%rax),%rdi\n 18:\t48 d3 e2 \tshl %cl,%rdx\n 1b:\t48 21 f2 \tand %rsi,%rdx\n 1e:\t48 2b 13 \tsub (%rbx),%rdx\n 21:\t48 8b 30 \tmov (%rax),%rsi\n 24:\t48 d3 ea \tshr %cl,%rdx\n 27:\t8b 4b 18 \tmov 0x18(%rbx),%ecx\n\t...\n[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[ 0.910247] PKRU: 55555554\n[ 0.910391] Call Trace:\n[ 0.910527] \u003cTASK\u003e\n[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\n[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\n[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)\n[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)\n[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\n[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\n[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)\n[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)\n[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))\n[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)\n[ 0.913077] ksys_write (fs/read_write.c:738)\n[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n[ 0.913687] RIP: 0033:0x424c34\n[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9\n\nCode starting with the faulting instruction\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n 0:\t89 02 \tmov %eax,(%rdx)\n 2:\t48 c7 c0 ff ff ff ff \tmov $0xffffffffffffffff,%rax\n 9:\teb bd \tjmp 0xffffffffffffffc8\n b:\t66 2e 0f 1f 84 00 00 \tcs nopw 0x0(%rax,%rax,1)\n 12:\t00 00 00\n 15:\t90 \tnop\n 16:\tf3 0f 1e fa \tendbr64\n 1a:\t80 3d 2d 44 09 00 00 \tcmpb $0x0,0x9442d(%rip) # 0x9444e\n 21:\t74 13 \tje 0x36\n 23:\tb8 01 00 00 00 \tmov $0x1,%eax\n 28:\t0f 05 \tsyscall\n 2a:\t09 \t.byte 0x9\n[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34\n[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003\n[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000\n[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28\n[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001\n[ 0.917039] \u003c/TASK\u003e\n[ 0.917158] Modules linked in:\n[ 0.917316] CR2: 0000000000000000\n[ 0.917484] ---[ end trace 0000000000000000 ]---\n[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n 0:\t0f 84 4d 01 00 00 \tje 0x153\n 6:\t48 89 70 18 \tmov %rsi,0x18(%rax)\n a:\t8b 4b 10 \tmov 0x10(%rbx),%ecx\n d:\t48 c7 c2 ff ff ff ff \tmov $0xffffffffffffffff,%rdx\n 14:\t48 8b 78 08 \tmov 0x8(%rax),%rdi\n 18:\t48 d3 e2 \tshl %cl,%rdx\n 1b:\t48 21 f2 \tand %rsi,%rdx\n 1e:\t48 2b 13 \tsub (%rbx),%rdx\n 21:\t48 8b 30 \tmov (%rax),%rsi\n 24:\t48 d3 ea \tshr %cl,%rdx\n 27:\t8b 4b 18 \tmov 0x18(%rbx),%ecx\n\t...\n[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[ 0.922097] PKRU: 55555554\n[ 0.922240] Kernel panic - not syncing: Fatal exception\n[ 0.922590] Kernel Offset: disabled\n\nFixes: 0545a3037773 (\"pkt_sched: QFQ - quick fair queue scheduler\")\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nLink: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "79b95d74470dd97d7d0908d5a3c0734a23e51aa4", "tree": "129761473149e8fc28991b4b83c8f75242b21465", "parents": [ "108b661c79111ec163edb999825718aa57c3452d", "d7f6629bffdcb962d383ef8c9a30afef81e997fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:44:48 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:44:48 2026 -0800" }, "message": "Merge tag \u0027hid-for-linus-2026010801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - build fix for HID-BPF (Benjamin Tissoires)\n\n - fix for potential buffer overflow in i2c-hid (Kwok Kin Ming)\n\n - a couple of selftests/hid fixes (Peter Hutterer)\n\n - fix for handling pressure pads in hid-multitouch (Peter Hutterer)\n\n - fix for potential NULL pointer dereference in intel-thc-hid (Even Xu)\n\n - fix for interrupt delay control in intel-thc-hid (Even Xu)\n\n - fix finger release detection on some VTL-class touchpads (DaytonCL)\n\n - fix for correct enumeration on intel-ish-hid systems with no sensors\n (Zhang Lixu)\n\n - assorted device ID additions and device-specific quirks\n\n* tag \u0027hid-for-linus-2026010801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (21 commits)\n HID: logitech: add HID++ support for Logitech MX Anywhere 3S\n HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)\n HID: quirks: work around VID/PID conflict for appledisplay\n HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)\n HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()\n selftests/hid: add a test for the Digitizer/Button Type pressurepad\n selftests/hid: use a enum class for the different button types\n selftests/hid: require hidtools 0.12\n HID: multitouch: set INPUT_PROP_PRESSUREPAD based on Digitizer/Button Type\n HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list\n HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer\n hid: intel-thc-hid: Select SGL_ALLOC\n selftests/hid: fix bpf compilations due to -fms-extensions\n HID: bpf: fix bpf compilation with -fms-extensions\n HID: Intel-thc-hid: Intel-thc: Fix wrong register reading\n HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL\n HID: intel-ish-hid: Reset enum_devices_done before enumeration\n HID: intel-ish-hid: Update ishtp bus match to support device ID table\n HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value\n HID: playstation: Center initial joystick axes to prevent spurious events\n ...\n" }, { "commit": "108b661c79111ec163edb999825718aa57c3452d", "tree": "810b800394843d492bd8a114fd533b9b33734a15", "parents": [ "f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1", "9ed7a28225af02b74f61e7880d460db49db83758" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:42:16 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:42:16 2026 -0800" }, "message": "Merge tag \u0027sound-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small device-specific fixes:\n\n - ASoC Intel topology fixes for conflicting Bluetooth bits\n\n - Cleanups of ASoC drivers for superfluous NULL checks\n\n - Fix for error handling in the AC97 bus\n\n - A regression fix for TAS2781 speaker ID handling\n\n - HD-audio quirks\"\n\n* tag \u0027sound-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk\n ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55\n ALSA: hda/tas2781: properly initialize speaker_id for TAS2563\n ALSA: ac97: fix a double free in snd_ac97_controller_register()\n ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks\n ASoC: codecs: pm4125: clean up bind() device reference handling\n ASoC: soc_sdw_utils: drop bogus container_of() error handling\n ASoC: codecs: wcd937x: drop bogus container_of() error handling\n ASoC: codecs: pm4125: drop bogus container_of() error handling\n ASoC: SOF: Intel: add -bt tplg suffix if BT is present\n ASoC: Intel: sof_sdw: shift SSP BT mask bits.\n" }, { "commit": "36f597bba049928004a050c132ab787ba0eba524", "tree": "65b1483641ab20dc467dc68a9c309e843d1e9983", "parents": [ "a80208072df8f4ceb53cd905c1f4362f84ce397f" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Jan 08 11:23:14 2026 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Jan 08 15:23:15 2026 +0100" }, "message": "gpiolib: fix lookup table matching\n\nIf on any iteration in gpiod_find(), gpio_desc_table_match() returns\nNULL (which is normal and expected), we never reinitialize desc back to\nERR_PTR(-ENOENT) and if we don\u0027t find a match later on, we will return\nNULL causing a NULL-pointer dereference in users not expecting it. Don\u0027t\ninitialize desc, but return ERR_PTR(-ENOENT) explicitly at the end of\nthe function.\n\nFixes: 9700b0fccf38 (\"gpiolib: allow multiple lookup tables per consumer\")\nReported-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nCloses: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/\nTested-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nLink: https://lore.kernel.org/r/20260108102314.18816-1-bartosz.golaszewski@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "a203dbeeca15a9b924f0d51f510921f4bae96801", "tree": "03f55039c530c47a91cec7f445e880c47ca818c1", "parents": [ "d594cc6f2c588810888df70c83a9654b6bc7942d" ], "author": { "name": "Baochen Qiang", "email": "baochen.qiang@oss.qualcomm.com", "time": "Mon Dec 22 10:29:07 2025 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:11 2026 +0100" }, "message": "wifi: mac80211: collect station statistics earlier when disconnect\n\nIn __sta_info_destroy_part2(), station statistics are requested after the\nIEEE80211_STA_NONE -\u003e IEEE80211_STA_NOTEXIST transition. This is\nproblematic because the driver may be unable to handle the request due to\nthe STA being in the NOTEXIST state (i.e. if the driver destroys the\nunderlying data when transitioning to NOTEXIST).\n\nMove the statistics collection to before the state transition to avoid\nthis issue.\n\nSigned-off-by: Baochen Qiang \u003cbaochen.qiang@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20251222-mac80211-move-station-stats-collection-earlier-v1-1-12cd4e42c633@oss.qualcomm.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "d594cc6f2c588810888df70c83a9654b6bc7942d", "tree": "2d8741940fc18c320fbccc788da8a7c1cc2c64e2", "parents": [ "6f385937160174b31a5e4105e759406f0b128494" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Dec 16 11:52:42 2025 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211: restore non-chanctx injection behaviour\n\nDuring the transition to use channel contexts throughout, the\nability to do injection while in monitor mode concurrent with\nanother interface was lost, since the (virtual) monitor won\u0027t\nhave a chanctx assigned in this scenario.\n\nIt\u0027s harder to fix drivers that actually transitioned to using\nchannel contexts themselves, such as mt76, but it\u0027s easy to do\nthose that are (still) just using the emulation. Do that.\n\nCc: stable@vger.kernel.org\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d218763\nReported-and-tested-by: Oscar Alfonso Diaz \u003coscar.alfonso.diaz@gmail.com\u003e\nFixes: 0a44dfc07074 (\"wifi: mac80211: simplify non-chanctx drivers\")\nLink: https://patch.msgid.link/20251216105242.18366-2-johannes@sipsolutions.net\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "6f385937160174b31a5e4105e759406f0b128494", "tree": "ed26c1facce049797488f95a1f9ccca95631e6ba", "parents": [ "c0d82ba9612fb65a8394af639f1427dbe87fb788" ], "author": { "name": "Benjamin Berg", "email": "benjamin.berg@intel.com", "time": "Wed Jan 07 14:38:05 2026 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock\n\nThe hwsim_radio_lock spinlock expects bottom-half to be disabled, fix\nthe call in mac80211_hwsim_nan_stop to ensure BHs are disabled.\n\nSigned-off-by: Benjamin Berg \u003cbenjamin.berg@intel.com\u003e\nLink: https://patch.msgid.link/20260107143805.ce7406511608.I688f8b19346e94c1f8de0cdadde072054d4b861c@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "c0d82ba9612fb65a8394af639f1427dbe87fb788", "tree": "9294abbc7963621e360cb3122812c165a5866b59", "parents": [ "333418872bfecf4843f1ded7a4151685dfcf07d5" ], "author": { "name": "Miri Korenblit", "email": "miriam.rachel.korenblit@intel.com", "time": "Wed Jan 07 14:37:36 2026 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211: don\u0027t iterate not running interfaces\n\nfor_each_chanctx_user_* was introdcued as a replacement for\nfor_each_sdata_link, which visits also other chanctx users that are not\nlink.\nfor_each_sdata_link skips not running interfaces, do the same for\nfor_each_chanctx_user_*\n\nFixes: 1ce954c98b89 (\"wifi: mac80211: add and use chanctx usage iteration\")\nSigned-off-by: Miri Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20260107143736.55c084e2a976.I38b7b904a135dadca339321923b501b2c2c5c8c0@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "333418872bfecf4843f1ded7a4151685dfcf07d5", "tree": "0bc7c2a6b9cd0faec48144547f8ad1d8bcf3b30a", "parents": [ "21cbf883d073abbfe09e3924466aa5e0449e7261" ], "author": { "name": "Benjamin Berg", "email": "benjamin.berg@intel.com", "time": "Wed Jan 07 14:36:51 2026 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211_hwsim: fix typo in frequency notification\n\nThe NAN notification is for 5745 MHz which corresponds to channel 149\nand not 5475 which is not actually a valid channel. This could result in\na NULL pointer dereference in cfg80211_next_nan_dw_notif.\n\nFixes: a37a6f54439b (\"wifi: mac80211_hwsim: Add simulation support for NAN device\")\nSigned-off-by: Benjamin Berg \u003cbenjamin.berg@intel.com\u003e\nReviewed-by: Ilan Peer \u003cilan.peer@intel.com\u003e\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20260107143652.7dab2035836f.Iacbaf7bb94ed5c14a0928a625827e4137d8bfede@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "21cbf883d073abbfe09e3924466aa5e0449e7261", "tree": "0812cb683f541bcd151bba1d1726198f9123cb18", "parents": [ "dbf8fe85a16a33d6b6bd01f2bc606fc017771465" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Jan 08 10:19:27 2026 +0000" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:05 2026 +0100" }, "message": "wifi: avoid kernel-infoleak from struct iw_point\n\nstruct iw_point has a 32bit hole on 64bit arches.\n\nstruct iw_point {\n void __user *pointer; /* Pointer to the data (in user space) */\n __u16 length; /* number of fields or size in bytes */\n __u16 flags; /* Optional params */\n};\n\nMake sure to zero the structure to avoid disclosing 32bits of kernel data\nto user space.\n\nFixes: 87de87d5e47f (\"wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c\")\nReported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "d7f6629bffdcb962d383ef8c9a30afef81e997fe", "tree": "1ff78171d08711f346e67baf344249c6bbbcb5a1", "parents": [ "12adb969658ec39265eb8c7ea9e1856867fb9ceb" ], "author": { "name": "Dennis Marttinen", "email": "twelho@welho.tech", "time": "Sun Jan 04 13:00:51 2026 +0000" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Thu Jan 08 12:22:01 2026 +0100" }, "message": "HID: logitech: add HID++ support for Logitech MX Anywhere 3S\n\nI\u0027ve acquired a Logitech MX Anywhere 3S mouse, which supports HID++ over\nBluetooth. Adding its PID 0xb037 to the allowlist enables the additional\nfeatures, such as high-resolution scrolling. Tested working across multiple\nmachines, with a mix of Intel and Mediatek Bluetooth chips.\n\n[jkosina@suse.com: standardize shortlog]\nSigned-off-by: Dennis Marttinen \u003ctwelho@welho.tech\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "6abcf751bc084804a9e5b3051442e8a2ce67f48a", "tree": "d647c01fe4d3060a0ba35439d8c9d72c0dfa019a", "parents": [ "653267321f05316f159e05b3ef562aa700632db6" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Mon Jan 05 09:43:31 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jan 08 11:23:20 2026 +0100" }, "message": "net: airoha: Fix schedule while atomic in airoha_ppe_deinit()\n\nairoha_ppe_deinit() runs airoha_npu_ppe_deinit() in atomic context.\nairoha_npu_ppe_deinit routine allocates ppe_data buffer with GFP_KERNEL\nflag. Rely on rcu_replace_pointer in airoha_ppe_deinit routine in order\nto fix schedule while atomic issue in airoha_npu_ppe_deinit() since we\ndo not need atomic context there.\n\nFixes: 00a7678310fe3 (\"net: airoha: Introduce flowtable offload support\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260105-airoha-fw-ethtool-v2-1-3b32b158cc31@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "9df5fad801c5c568ee5f5dacd8b53565d88e4f02", "tree": "f46d5f23f2f956ab34b8cbce70156f101098c1a2", "parents": [ "ab86d0bf01f6d0e37fd67761bb62918321b64efc" ], "author": { "name": "Deepanshu Kartikey", "email": "kartikey406@gmail.com", "time": "Wed Jan 07 07:40:37 2026 +0530" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Jan 07 19:03:46 2026 -0800" }, "message": "bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str()\n\nBPF_MAP_TYPE_INSN_ARRAY maps store instruction pointers in their\nips array, not string data. The map_direct_value_addr callback for\nthis map type returns the address of the ips array, which is not\nsuitable for use as a constant string argument.\n\nWhen a BPF program passes a pointer to an insn_array map value as\nARG_PTR_TO_CONST_STR (e.g., to bpf_snprintf), the verifier\u0027s\nnull-termination check in check_reg_const_str() operates on the\nwrong memory region, and at runtime bpf_bprintf_prepare() can read\nout of bounds searching for a null terminator.\n\nReject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() since this\nmap type is not designed to hold string data.\n\nReported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d2c29addf92581b410079\nTested-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com\nFixes: 493d9e0d6083 (\"bpf, x86: add support for indirect jumps\")\nSigned-off-by: Deepanshu Kartikey \u003ckartikey406@gmail.com\u003e\nAcked-by: Anton Protopopov \u003ca.s.protopopov@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260107021037.289644-1-kartikey406@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "ef56578274d2b98423c8ef82bb450223f5811b59", "tree": "926a26cfe8c758ea22b495f946f19780e47db063", "parents": [ "aa7d3a56a20f07978d9f401e13637a6479b13bd0" ], "author": { "name": "Michal Koutný", "email": "mkoutny@suse.com", "time": "Wed Jan 07 17:59:41 2026 +0100" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Jan 07 15:11:03 2026 -1000" }, "message": "cgroup: Eliminate cgrp_ancestor_storage in cgroup_root\n\nThe cgrp_ancestor_storage has two drawbacks:\n- it\u0027s not guaranteed that the member immediately follows struct cgrp in\n cgroup_root (root cgroup\u0027s ancestors[0] might thus point to a padding\n and not in cgrp_ancestor_storage proper),\n- this idiom raises warnings with -Wflex-array-member-not-at-end.\n\nInstead of relying on the auxiliary member in cgroup_root, define the\n0-th level ancestor inside struct cgroup (needed for static allocation\nof cgrp_dfl_root), deeper cgroups would allocate flexible\n_low_ancestors[]. Unionized alias through ancestors[] will\ntransparently join the two ranges.\n\nThe above change would still leave the flexible array at the end of\nstruct cgroup inside cgroup_root, so move cgrp also towards the end of\ncgroup_root to resolve the -Wflex-array-member-not-at-end.\n\nLink: https://lore.kernel.org/r/5fb74444-2fbb-476e-b1bf-3f3e279d0ced@embeddedor.com/\nReported-by: Gustavo A. R. Silva \u003cgustavo@embeddedor.com\u003e\nCloses: https://lore.kernel.org/r/b3eb050d-9451-4b60-b06c-ace7dab57497@embeddedor.com/\nCc: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nAcked-by: Gustavo A. R. Silva \u003cgustavoars@kernel.org\u003e\nSigned-off-by: Michal Koutný \u003cmkoutny@suse.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "f6eac56d6bf2026437b606a69aff903941282f9a", "tree": "50057afca34ba16f4519c2f8e5c99f0a411d84c5", "parents": [ "a5f207e27207fbd3e4b5b466c73a6f9b1170fcf3", "6b2989ac5e8c496c1814d7961bee6f2d05382b3e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 09:50:08 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 10:34:27 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-6.19-2026-01-06\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-6.19-2026-01-06:\n\namdgpu:\n- Clang fixes\n- Navi1x PCIe DPM fixes\n- Ring reset fixes\n- ISP suspend fix\n- Analog DC fixes\n- VPE fixes\n- Mode1 reset fix\n\nradeon:\n- Variable sized array fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260107223315.16095-1-alexander.deucher@amd.com\n" }, { "commit": "12adb969658ec39265eb8c7ea9e1856867fb9ceb", "tree": "b6637740af23e4dc4f103101168ab2df468dc972", "parents": [ "c7fabe4ad9219866c203164a214c474c95b36bf2" ], "author": { "name": "Arnoud Willemsen", "email": "mail@lynthium.com", "time": "Sun Dec 07 03:43:19 2025 +0100" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Wed Jan 07 23:36:58 2026 +0100" }, "message": "HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)\n\nWireless/new version of the Elecom trackball mouse M-XT3DRBK has a\nproduct id that differs from the existing M-XT3DRBK.\nThe report descriptor format also seems to have changed and matches\nother (newer?) models instead (except for six buttons instead of eight).\nThis patch follows the same format as the patch for the M-XT3URBK (018F)\nby Naoki Ueki (Nov 3rd 2025) to enable the sixth mouse button.\n\ndmesg output:\n[ 292.074664] usb 1-2: new full-speed USB device number 7 using xhci_hcd\n[ 292.218667] usb 1-2: New USB device found, idVendor\u003d056e, idProduct\u003d018c, bcdDevice\u003d 1.00\n[ 292.218676] usb 1-2: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d0\n[ 292.218679] usb 1-2: Product: ELECOM TrackBall Mouse\n[ 292.218681] usb 1-2: Manufacturer: ELECOM\n\nusbhid-dump output:\n001:006:000:DESCRIPTOR 1765072638.050578\n 05 01 09 02 A1 01 09 01 A1 00 85 01 05 09 19 01\n 29 05 15 00 25 01 95 08 75 01 81 02 95 01 75 00\n 81 01 05 01 09 30 09 31 16 00 80 26 FF 7F 75 10\n 95 02 81 06 C0 A1 00 05 01 09 38 15 81 25 7F 75\n 08 95 01 81 06 C0 A1 00 05 0C 0A 38 02 95 01 75\n 08 15 81 25 7F 81 06 C0 C0 06 01 FF 09 00 A1 01\n 85 02 09 00 15 00 26 FF 00 75 08 95 07 81 02 C0\n 05 0C 09 01 A1 01 85 05 15 00 26 3C 02 19 00 2A\n 3C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85\n 03 19 81 29 83 15 00 25 01 95 03 75 01 81 02 95\n 01 75 05 81 01 C0 06 BC FF 09 88 A1 01 85 04 95\n 01 75 08 15 00 26 FF 00 19 00 2A FF 00 81 00 C0\n 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 FF 00\n 75 08 95 07 B1 02 C0\n\nSigned-off-by: Arnoud Willemsen \u003cmail@lynthium.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "c7fabe4ad9219866c203164a214c474c95b36bf2", "tree": "847b8e8056e0c43ea44c5d4518fa92c32f8b0f59", "parents": [ "85a866809333cd2bf8ddac93d9a3e3ba8e4f807d" ], "author": { "name": "René Rebe", "email": "rene@exactco.de", "time": "Fri Nov 28 13:46:41 2025 +0100" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Wed Jan 07 23:36:58 2026 +0100" }, "message": "HID: quirks: work around VID/PID conflict for appledisplay\n\nFor years I wondered why the Apple Cinema Display driver would not\njust work for me. Turns out the hidraw driver instantly takes it\nover. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.\n\nFixes: 069e8a65cd79 (\"Driver for Apple Cinema Display\")\nSigned-off-by: René Rebe \u003crene@exactco.de\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "85a866809333cd2bf8ddac93d9a3e3ba8e4f807d", "tree": "f43b6e8018e0ad6d9e2b7689fd5506459a772b77", "parents": [ "2497ff38c530b1af0df5130ca9f5ab22c5e92f29" ], "author": { "name": "Rodrigo Lugathe da Conceição Alves", "email": "lugathe2@gmail.com", "time": "Thu Nov 27 19:03:57 2025 -0300" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Wed Jan 07 23:36:58 2026 +0100" }, "message": "HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)\n\nThe USB speaker has a bug that causes it to reboot when changing the\nbrightness using the physical knob.\n\nAdd a new vendor and product ID entry in hid-ids.h, and register\nthe corresponding device in hid-quirks.c with the required quirk.\n\nSigned-off-by: Rodrigo Lugathe da Conceição Alves \u003clugathe2@gmail.com\u003e\nReviewed-by: Terry Junge \u003clinuxhid@cosmicgizmosystems.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "6b2989ac5e8c496c1814d7961bee6f2d05382b3e", "tree": "27d64503965c5439a2c3e330187e2c01c9f1ceb0", "parents": [ "eb236fb911ca0f4243124d8a285ec0453a99a8b4" ], "author": { "name": "Mario Limonciello (AMD)", "email": "superm1@kernel.org", "time": "Sat Nov 29 19:46:31 2025 -0600" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jan 07 17:24:16 2026 -0500" }, "message": "Reapply \"Revert \"drm/amd: Skip power ungate during suspend for VPE\"\"\n\nSkipping power ungate exposed some scenarios that will fail\nlike below:\n\n```\namdgpu: Register(0) [regVPEC_QUEUE_RESET_REQ] failed to reach value 0x00000000 !\u003d 0x00000001n\namdgpu 0000:c1:00.0: amdgpu: VPE queue reset failed\n...\namdgpu: [drm] *ERROR* wait_for_completion_timeout timeout!\n```\n\nThe underlying s2idle issue that prompted this commit is going to\nbe fixed in BIOS.\nThis reverts commit 2a6c826cfeedd7714611ac115371a959ead55bda.\n\nThis was lost in the 6.19 merge so reapply it.\n\nFixes: 2a6c826cfeed (\"drm/amd: Skip power ungate during suspend for VPE\")\nSigned-off-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReported-by: Konstantin \u003canswer2019@yandex.ru\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d220812\nReported-by: Matthew Schwartz \u003cmatthew.schwartz@linux.dev\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 3925683515e93844be204381d2d5a1df5de34f31)\n" }, { "commit": "eb236fb911ca0f4243124d8a285ec0453a99a8b4", "tree": "3b32de02ea7ce891dc5c5572096670ed099a8ab6", "parents": [ "0de604d0357d0d22cbf03af1077d174b641707b6" ], "author": { "name": "Alex Hung", "email": "alex.hung@amd.com", "time": "Mon Dec 08 12:11:43 2025 -0700" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jan 07 17:24:16 2026 -0500" }, "message": "drm/amd/display: Check NULL before calling dac_load_detection\n\ndac_load_detection can be NULL in some scenario, so checking it before\ncalling.\n\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Chenyu Chen \u003cchen-yu.chen@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 179176134b535246f0b368b30e8ecad50066f896)\n" }, { "commit": "0de604d0357d0d22cbf03af1077d174b641707b6", "tree": "2b330df004067851605a1cdd383206048afe666b", "parents": [ "72d7f4573660287f1b66c30319efecd6fcde92ee" ], "author": { "name": "Perry Yuan", "email": "perry.yuan@amd.com", "time": "Thu Dec 25 16:43:49 2025 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jan 07 17:24:10 2026 -0500" }, "message": "drm/amd/pm: Disable MMIO access during SMU Mode 1 reset\n\nDuring Mode 1 reset, the ASIC undergoes a reset cycle and becomes\ntemporarily inaccessible via PCIe. Any attempt to access MMIO registers\nduring this window (e.g., from interrupt handlers or other driver threads)\ncan result in uncompleted PCIe transactions, leading to NMI panics or\nsystem hangs.\n\nTo prevent this, set the `no_hw_access` flag to true immediately after\ntriggering the reset. This signals other driver components to skip\nregister accesses while the device is offline.\n\nA memory barrier `smp_mb()` is added to ensure the flag update is\nglobally visible to all cores before the driver enters the sleep/wait\nstate.\n\nSigned-off-by: Perry Yuan \u003cperry.yuan@amd.com\u003e\nReviewed-by: Yifan Zhang \u003cyifan1.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4)\n" }, { "commit": "a5f207e27207fbd3e4b5b466c73a6f9b1170fcf3", "tree": "50702bb9e7ea88f5220cf77c255e3be566bd1054", "parents": [ "50cf611b0bfa6c5bccfcd28dba32837c18ee3083", "d5bdf88d1f9d1e4808177f03d89de3d0ba6c6e84" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:40:42 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:41:00 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-01-07\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\ndrm-misc-fixes for v6.19-rc5:\n\npl111:\n- Fix error handling in probe\n\nmediatek/atomic/tidss:\n- Fix tidss in another way and revert reordering of pre-enable and post-disable operations,\n as it breaks other bridge drivers.\n\nnouveau:\n- Fix regression from fwsec s/r fix.\n\npci/vga:\n- Fix multiple gpu\u0027s being reported a \u0027boot_display\u0027\n\nfb-helper:\n- Fix vblank timeout during suspend/reset\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patch.msgid.link/f50067e6-243a-4ed8-9781-1e4e4fdebc8e@linux.intel.com\n" }, { "commit": "50cf611b0bfa6c5bccfcd28dba32837c18ee3083", "tree": "ecb35ebd6a9cfd095cd37f7b2f41ac6de70ee4ea", "parents": [ "c4f2ae53863de2b5d125c3cdc9ff12668868a74a", "8e6ad0dac6266c5e13874e816b016759d7145500" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:34:36 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:34:42 2026 +1000" }, "message": "Merge tag \u0027exynos-drm-fixes-v6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes\n\nOne code cleanup\n. Replace system_wq with system_percpu_wq in the Exynos HDMI driver.\n system_wq is effectively a per-cpu workqueue, but its name does not make\n this explicit. Recent workqueue changes introduced system_percpu_wq to clarify\n semantics and support ongoing workqueue API refactoring.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Inki Dae \u003cinki.dae@samsung.com\u003e\nLink: https://patch.msgid.link/20260107091154.27436-1-inki.dae@samsung.com\n" }, { "commit": "b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0", "tree": "4fca374bb2a3328819704721379961fe42e4e809", "parents": [ "957afeb99b111b672b3529a737fe19b95daaf1a2" ], "author": { "name": "Martin Kaiser", "email": "martin@kaiser.cx", "time": "Tue Dec 23 14:50:06 2025 +0100" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Jan 07 13:25:56 2026 -0700" }, "message": "riscv: trace: fix snapshot deadlock with sbi ecall\n\nIf sbi_ecall.c\u0027s functions are traceable,\n\necho \"__sbi_ecall:snapshot\" \u003e /sys/kernel/tracing/set_ftrace_filter\n\nmay get the kernel into a deadlock.\n\n(Functions in sbi_ecall.c are excluded from tracing if\nCONFIG_RISCV_ALTERNATIVE_EARLY is set.)\n\n__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code\nraises an IPI interrupt, which results in another call to __sbi_ecall\nand another snapshot...\n\nAll it takes to get into this endless loop is one initial __sbi_ecall.\nOn RISC-V systems without SSTC extension, the clock events in\ntimer-riscv.c issue periodic sbi ecalls, making the problem easy to\ntrigger.\n\nAlways exclude the sbi_ecall.c functions from tracing to fix the\npotential deadlock.\n\nsbi ecalls can easiliy be logged via trace events, excluding ecall\nfunctions from function tracing is not a big limitation.\n\nSigned-off-by: Martin Kaiser \u003cmartin@kaiser.cx\u003e\nLink: https://patch.msgid.link/20251223135043.1336524-1-martin@kaiser.cx\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "bdb32359eab94013e80cf7e3d40a3fd4972da93a", "tree": "dd92ada8d66c331ded118a298f020661b4a13b31", "parents": [ "df27c03b9e3ef2baa9e9c9f56a771d463a84489d" ], "author": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Mon Nov 24 19:04:11 2025 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Wed Jan 07 14:22:32 2026 -0600" }, "message": "sparc/PCI: Correct 64-bit non-pref -\u003e pref BAR resources\n\nSPARC T5-2 dts describes some PCI BARs as 64-bit resources without the\npref(etchable) bit (0x83... vs 0xc3... in assigned-addresses) for address\nranges above the 4G threshold. Such resources cannot be placed into a\nnon-prefetchable PCI bridge window that is capable only of 32-bit\naddressing. As such, it looks like the platform is improperly described by\nthe dts.\n\nThe kernel detects this problem (see the IORESOURCE_PREFETCH check in\npci_find_parent_resource()) and fails to assign these BAR resources to the\nresource tree due to lack of a compatible bridge window.\n\nPrior to 754babaaf333 (\"sparc/PCI: Remove pcibios_enable_device() as they\ndo nothing extra\") SPARC arch code did not test whether device resources\nwere successfully in the resource tree when enabling a device, effectively\nhiding the problem. After removing the arch-specific enable code,\npci_enable_resources() refuses to enable the device when it finds not all\nmem resources are assigned, and therefore mpt3sas can\u0027t be enabled:\n\n pci 0001:04:00.0: reg 0x14: [mem 0x801110000000-0x80111000ffff 64bit]\n pci 0001:04:00.0: reg 0x1c: [mem 0x801110040000-0x80111007ffff 64bit]\n pci 0001:04:00.0: BAR 1 [mem 0x801110000000-0x80111000ffff 64bit]: can\u0027t claim; no compatible bridge window\n pci 0001:04:00.0: BAR 3 [mem 0x801110040000-0x80111007ffff 64bit]: can\u0027t claim; no compatible bridge window\n mpt3sas 0001:04:00.0: BAR 1 [mem size 0x00010000 64bit]: not assigned; can\u0027t enable device\n\nFor clarity, this filtered log only shows failures for one mpt3sas device\nbut other devices fail similarly. In the reported case, the end result with\nall the failures is an unbootable system.\n\nThings appeared to \"work\" before 754babaaf333 (\"sparc/PCI: Remove\npcibios_enable_device() as they do nothing extra\") because the resource\ntree is agnostic to whether PCI BAR resources are properly in the tree or\nnot. So as long as there was a parent resource (e.g. a root bus resource)\nthat contains the address range, the resource tree code just places\nresource request underneath it without any consideration to the\nintermediate BAR resource. While it worked, it\u0027s incorrect setup still.\n\nAdd an OF fixup to set the IORESOURCE_PREFETCH flag for a 64-bit PCI\nresource that has the end address above 4G requiring placement into the\nprefetchable window. Also log the issue.\n\nFixes: 754babaaf333 (\"sparc/PCI: Remove pcibios_enable_device() as they do nothing extra\")\nReported-by: Nathaniel Roach \u003cnroach44@gmail.com\u003e\nCloses: https://github.com/sparclinux/issues/issues/22\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Nathaniel Roach \u003cnroach44@gmail.com\u003e\nLink: https://patch.msgid.link/20251124170411.3709-1-ilpo.jarvinen@linux.intel.com\n" }, { "commit": "957afeb99b111b672b3529a737fe19b95daaf1a2", "tree": "ac7ae7a11c424cd2afc1acfc9ef0f9a7f8830c6b", "parents": [ "2ca5bb54bde739b32ed42758fff8dc1025c1225f" ], "author": { "name": "Yunhui Cui", "email": "cuiyunhui@bytedance.com", "time": "Tue Dec 16 09:47:19 2025 +0800" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Jan 07 13:16:38 2026 -0700" }, "message": "riscv: remove irqflags.h inclusion in asm/bitops.h\n\nThe arch/riscv/include/asm/bitops.h does not functionally require\nincluding /linux/irqflags.h. Additionally, adding\narch/riscv/include/asm/percpu.h causes a circular inclusion:\nkernel/bounds.c\n-\u003einclude/linux/log2.h\n-\u003einclude/linux/bitops.h\n-\u003earch/riscv/include/asm/bitops.h\n-\u003einclude/linux/irqflags.h\n-\u003einclude/linux/find.h\n-\u003ereturn val ? __ffs(val) : size;\n-\u003earch/riscv/include/asm/bitops.h\n\nThe compilation log is as follows:\nCC kernel/bounds.s\nIn file included from ./include/linux/bitmap.h:11,\n from ./include/linux/cpumask.h:12,\n from ./arch/riscv/include/asm/processor.h:55,\n from ./arch/riscv/include/asm/thread_info.h:42,\n from ./include/linux/thread_info.h:60,\n from ./include/asm-generic/preempt.h:5,\n from ./arch/riscv/include/generated/asm/preempt.h:1,\n from ./include/linux/preempt.h:79,\n from ./arch/riscv/include/asm/percpu.h:8,\n from ./include/linux/irqflags.h:19,\n from ./arch/riscv/include/asm/bitops.h:14,\n from ./include/linux/bitops.h:68,\n from ./include/linux/log2.h:12,\n from kernel/bounds.c:13:\n./include/linux/find.h: In function \u0027find_next_bit\u0027:\n./include/linux/find.h:66:30: error: implicit declaration of function \u0027__ffs\u0027 [-Wimplicit-function-declaration]\n 66 | return val ? __ffs(val) : size;\n | ^~~~~\n\nSigned-off-by: Yunhui Cui \u003ccuiyunhui@bytedance.com\u003e\nAcked-by: Yury Norov (NVIDIA) \u003cyury.norov@gmail.com\u003e\nLink: https://patch.msgid.link/20251216014721.42262-2-cuiyunhui@bytedance.com\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "2ca5bb54bde739b32ed42758fff8dc1025c1225f", "tree": "3cf6b72f8edd9a8893663deeea82a889e459a211", "parents": [ "003c03a4b40085784d5b661133d1124f7e587e02" ], "author": { "name": "Ben Dooks", "email": "ben.dooks@codethink.co.uk", "time": "Fri Jan 02 14:58:39 2026 +0000" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Jan 07 13:03:16 2026 -0700" }, "message": "riscv: cpu_ops_sbi: smp_processor_id() returns int, not unsigned int\n\nThe print in sbi_cpu_stop() assumes smp_processor_id() returns an\nunsigned int, when it is actually an int. Fix the format string to\navoid mismatch type warnings in rht pr_crit().\n\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\nLink: https://patch.msgid.link/20260102145839.657864-1-ben.dooks@codethink.co.uk\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" } ], "next": "1e2ed4bfd50ace3c4272cfab7e9aa90956fb7ae0" }