)]}' { "log": [ { "commit": "1590cf0329716306e948a8fc29f1d3ee87d3989f", "tree": "7d06215501df71a05b75530877c5941f2f07c299", "parents": [ "82a47586c0b9266622657009aa30573dddf09f53" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 13:54:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 13:54:41 2026 -0700" }, "message": "Linux 7.2-rc4\n" }, { "commit": "82a47586c0b9266622657009aa30573dddf09f53", "tree": "21643e939bfa0faa34c45e4a92acd3ecd15b1b9d", "parents": [ "980ab36ae5972c83f683b939e50c469c4947229e", "5caae1deee89a6582c761d5dcd4b924b744426cc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 12:41:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 12:41:00 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n\n - Call flush_cache_vmap() after populating new vmemmap pages, on all\n architectures. This avoids spurious faults on RISC-V\n microarchitectures that cache PTEs marked as non-present\n\n - Disable LTO for the vDSO to prevent the compiler from eliding\n functions that are used, but which don\u0027t appear to be\n\n - Fix an issue with libgcc\u0027s unwinder and signal handlers by dropping\n an unnecessary CFI landing pad instruction in __vdso_rt_sigreturn\n (similar to what was done on ARM64)\n\n - Avoid reading uninitialized memory under certain conditions in\n hwprobe_get_cpus()\n\n - Save some memory and I$ when CONFIG_DYNAMIC_FTRACE\u003dn by avoiding our\n four-byte function alignment requirement in that case\n\n - Avoid clang warnings about null-pointer arithmetic in the I/O-port\n accessor macros (inb, outb, etc.) by ifdeffing them out when\n !CONFIG_HAS_IOPORT\n\n - Make the build of the lazy TLB flushing code in the vmalloc path\n depend on CONFIG_64BIT and CONFIG_MMU (since those platforms are the\n only ones that use it)\n\n* tag \u0027riscv-for-linus-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()\n arch/riscv: vdso: remove CFI landing pad from rt_sigreturn\n riscv: vdso: Do not use LTO for the vDSO\n riscv: io: avoid null-pointer arithmetic in PIO helpers\n riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE\n mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap\n riscv: mm: Make mark_new_valid_map() stuff depend on 64BIT \u0026\u0026 MMU\n" }, { "commit": "980ab36ae5972c83f683b939e50c469c4947229e", "tree": "8c031e9a3000ae2cd38faab17585e6546f64b93f", "parents": [ "a2b81de43ca64832fe09844bbf97d1251115d80f", "df308a14585649f7683a560f5c94978ab4f8224d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 09:29:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 09:29:42 2026 -0700" }, "message": "Merge tag \u0027block-7.2-20260717\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Fixes for the dio bounce buffer helpers: correct the alignment of\n bounced dio read bios to avoid a double unpin, handle huge zero\n folios in bio_free_folios(), and don\u0027t warn on the larger-order folio\n attempts in the greedy allocation path.\n\n - Try a slab allocation in bio_alloc_bioset() before falling back to\n the mempool, restoring the previous behavior for non-sleeping\n allocations from a cache-enabled bioset.\n\n - Serialize elevator changes for the same queue using the writer lock.\n\n - Fix a race in blk_time_get_ns() where a task preempted between\n setting PF_BLOCK_TS and the cached-timestamp reload could return 0.\n\n - blk-cgroup fix for leaks and the online flag on a radix_tree_insert()\n failure in blkg_create().\n\n - Free the copied pages when blk_rq_map_kern() fails after\n blk_rq_append_bio() rejects the bio.\n\n - Remove manually added partitions on loop device detach, fixing dead\n partition devices left behind and a subsequent LOOP_CONFIGURE -EBUSY\n\n - Bound the AIX partition lvd scan to the sector that was actually\n read.\n\n - Show the block operation in error injection rules (Jackie)\n\n* tag \u0027block-7.2-20260717\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n block: fix aligning of bounced dio read bios\n block: handle huge zero folios in bio_free_folios\n block: try slab allocation in bio_alloc_bioset() before mempool\n block: show operation in error injection rules\n block: serialize elevator changes for the same queue using a writer lock\n block: free copied pages when blk_rq_map_kern() fails\n block: do not warn when doing greedy allocation in folio_alloc_greedy()\n partitions: aix: bound the lvd scan to one sector\n blk-cgroup: fix leaks and online flag on radix_tree_insert failure\n loop: remove manually added partitions on detach\n block: fix race in blk_time_get_ns() returning 0\n" }, { "commit": "a2b81de43ca64832fe09844bbf97d1251115d80f", "tree": "ac05748a65f8004ceb908c08b8d8bb0b97dd2f42", "parents": [ "8b752c85019958558972b75c8703caccd6fd7c47", "3afc64c61ce906a04f073ca350b46de10e8302f9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 09:24:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 09:24:32 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.2-20260717\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix a use-after-free in the bpf-ops struct_ops path, where the same\n io_uring_bpf_ops map could be registered more than once.\n\n - Fix the deferred iovec free for the provided-buffer grow path, which\n could leave the caller with a dangling iovec and result in repeated\n frees. Follow-up to the earlier fix in this series.\n\n - Zero-check the unused addr3/pad2 SQE fields for unlinkat\n\n* tag \u0027io_uring-7.2-20260717\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/bpf-ops: reject re-registration of an already-bound ops\n io_uring/fs: check unused sqe fields for unlinkat\n io_uring/kbuf: free the replaced iovec after a successful grow\n" }, { "commit": "8b752c85019958558972b75c8703caccd6fd7c47", "tree": "c04249152f100b5cc1270b25410afe237f7b1fbb", "parents": [ "6eb9466f75c175c44520954be7bf501fb5628f99", "e919ca35a6e84b5adf085da9ffa1544c01d4ce1e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 09:07:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 09:07:30 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A couple of fairly routine driver fixes, nothing too remarkable\"\n\n* tag \u0027spi-fix-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled\n spi: dw-dma: Wait for controller idle before completing Tx\n" }, { "commit": "6eb9466f75c175c44520954be7bf501fb5628f99", "tree": "1b4b4e2564d9a9a8fa0b7071cd0c55c82e660e77", "parents": [ "502c9e9c59f193be17ea45302d7c457ee00de524", "50dce2e2f84b56d8b4b406d97a1543709e8a87f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 08:58:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 08:58:48 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"One straightforward driver fix for some incorrectly described\n bitfields in the ltc3676 driver\"\n\n* tag \u0027regulator-fix-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: ltc3676: Fix incorrect IRQSTAT bit offsets\n" }, { "commit": "502c9e9c59f193be17ea45302d7c457ee00de524", "tree": "44c7728eb40628930493153b90a0b8c977aec60f", "parents": [ "c6859eed755df351a3978b33cb92365f9b3e8f06", "ffa0aa5b625fe0bed7463ac613f8b06676ff4542" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 08:55:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 19 08:55:38 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-07-19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Reject too long acpi_rsdp\u003d boot parameter values (Thorsten Blum)\n\n - Validate console\u003duart8250 baud rate to fix early boot hang (Thorsten\n Blum)\n\n - Remove dead Makefile rule (Ethan Nelson-Moore)\n\n* tag \u0027x86-urgent-2026-07-19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/boot: Validate console\u003duart8250 baud rate to fix early boot hang\n x86/boot: Reject too long acpi_rsdp\u003d values\n x86/cpu: Remove Makefile rule for removed UMC CPU support\n" }, { "commit": "c6859eed755df351a3978b33cb92365f9b3e8f06", "tree": "6efb2d4ea9253083de5732a42eabb6f0a501f514", "parents": [ "80c1c309d8f2f02573c20410150ade13d8377af7", "49145bce539117db4b6e9e83c0e5ef528e361050" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 16:48:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 16:48:44 2026 -0700" }, "message": "Merge tag \u0027s390-7.2-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix checksum lib on machines without the vector facility where the\n non-vector fallback made csum_partial() calculate the checksum from\n address 0 instead of the provided buffer\n\n - Fix cpum_cf perf event initialization missing speculation barrier for\n user controlled event numbers used as generic event array indexes\n\n* tag \u0027s390-7.2-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()\n s390/checksum: Fix csum_partial() without vector facility\n" }, { "commit": "80c1c309d8f2f02573c20410150ade13d8377af7", "tree": "cbb5cb8781914d2ddbadf2fffb1dd35cefd905f1", "parents": [ "f2ec6312bf711369561bdcb22f8a63c0b118c479", "76f38ad1b39cf0321f7ecb7ea37b46f61a0f3d75" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 16:42:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 16:42:49 2026 -0700" }, "message": "Merge tag \u0027arc-7.2-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc\n\nPull ARC fixes from Vineet Gupta:\n\n - Misc fixes and config updates\n\n* tag \u0027arc-7.2-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:\n ARC: configs: Drop redundant I2C_DESIGNWARE_PLATFORM\n arc: validate DT CPU map strings before parsing them\n" }, { "commit": "f2ec6312bf711369561bdcb22f8a63c0b118c479", "tree": "7d4257e73fe4c3d71693835fa9095c1d7cf66444", "parents": [ "ba6bd0df9adb2a7a02db9d1973fc1dc3489b0758", "e166bafc483e927150cb9b5f286c9191ea0df84e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 12:36:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 12:36:19 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"The biggest core change is the reliable wake fix for scsi_schedule_eh\n which is used by both libata and libsas which could otherwise cause\n error handler hangs due to rare races.\n\n All other fixes are in drivers (well except the export symbol removal)\n the next biggest being the target PR-OUT transportid parsing fix\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path\n scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()\n scsi: elx: efct: Fix I/O leak on unsupported additional CDB\n scsi: core: wake eh reliably when using scsi_schedule_eh\n scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n scsi: target: Bound PR-OUT TransportID parsing to the received buffer\n scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()\n scsi: sg: Report request-table problems when any status is set\n scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()\n scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()\n scsi: xen: scsiback: Free the command tag on the TMR submit-failure path\n scsi: xen: scsiback: Free unsubmitted command instead of double-putting it\n scsi: core: Remove export for scsi_device_from_queue()\n" }, { "commit": "ba6bd0df9adb2a7a02db9d1973fc1dc3489b0758", "tree": "7abd34a2286d23e659046026f1f9189a1a1afcd8", "parents": [ "1229e2e57a5c2980ccd457b9b53ea0eed5a22ab3", "deb35336b5bfed5db9231b5348bc1514db930797" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 09:16:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 18 09:16:35 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fixes from Andi Shyti:\n \"A handful of small fixes for host controller drivers.\n\n One patch also adds Wolfram Sang to CREDITS after more than a decade\n of work on I2C\"\n\n* tag \u0027i2c-fixes-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: mediatek: fix WRRD for SoCs without auto_restart option\n i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()\n i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED\n i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)\n i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)\n CREDITS: Add Wolfram Sang\n" }, { "commit": "1229e2e57a5c2980ccd457b9b53ea0eed5a22ab3", "tree": "99b0a623438bfd56e98260382527e4ed82c2213e", "parents": [ "94dc07d6d99a9e4e3e2422c1c486cc4349e9e5a7", "15b38176fd1530372905c602fde51fe89ec8c877" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 21:41:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 21:41:54 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc3-smb3-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n \"ksmbd server fixes, mostly addressing malformed SMB request\n handling and connection/session lifetime issues, including\n two information-disclosure or memory-safety bugs in the SMB2\n request/response paths.\n\n - validate FILE_ALLOCATION_INFORMATION before block rounding to\n prevent a client-controlled overflow from truncating a file.\n\n - pin connections while asynchronous oplock and lease-break\n notifications are pending.\n\n - initialize compound SMB2 READ alignment padding, preventing\n disclosure of uninitialized heap bytes.\n\n - release the allocated alternate-stream xattr name after rename.\n\n - size multichannel binding session-key buffers for the largest\n permitted key, avoiding a stack buffer overflow.\n\n - remove a disconnecting connection\u0027s channels from every session,\n including channels whose binding state has since changed.\n\n - serialize binding preauthentication-session lookup and update\n against its teardown.\n\n - check that every compound request element contains StructureSize2\n before reading it\"\n\n* tag \u0027v7.2-rc3-smb3-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: validate compound request size before reading StructureSize2\n ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp\n ksmbd: remove stale channels from all sessions on teardown\n ksmbd: fix stack buffer overflow in multichannel session-key copy\n ksmbd: fix memory leak of xattr_stream_name in smb2_rename()\n ksmbd: zero the smb2_read alignment tail to avoid an infoleak\n ksmbd: pin conn during async oplock break notification\n ksmbd: fix integer overflow in set_file_allocation_info()\n" }, { "commit": "94dc07d6d99a9e4e3e2422c1c486cc4349e9e5a7", "tree": "4094b7d0f2cb09244704f3e3f3147bb15bf5f05a", "parents": [ "7d6ca51a444234ca436d7c19282825797507fe82", "c2130f6553f4a5cbdc259de069600117a995f197" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 17:58:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 17:58:57 2026 -0700" }, "message": "Merge tag \u0027ata-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Damien Le Moal:\n\n - Interrupt initialization and handling fixes for the Designware\n ahci_dwc driver (Rosen)\n\n - Avoid possible infinite loop when scanning completion in the\n Designware ahci_dwc driver (Rosen)\n\n* tag \u0027ata-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning\n ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts\n ata: sata_dwc_460ex: use platform_get_irq()\n ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered\n" }, { "commit": "7d6ca51a444234ca436d7c19282825797507fe82", "tree": "0b1211a5549befa505a61598e2b8d55f4043e830", "parents": [ "94515f3a7d4256a5062176b7d6ed0471938cd51a", "973fd9493ec21f12e760fbbedeb7b0b2317c02f4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 16:56:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 16:56:55 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-07-18-1\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Daie Airlie:\n \"Weekly drm fixes, there is amdgpu, xe and i915 and then a lot of\n scattered fixes.\n\n Looks about the right level for the new right.\n\n ttm:\n - Handle NULL pages and backup handles in ttm_pool_backup() correctly\n\n gpusvm:\n - Improve unmap and error handling on gpusvm\n\n udmabuf:\n - Always synchronize for CPU in begin_cpu_udmabuf\n\n xe:\n - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK\n - Hold a dma-buf reference for imported BOs\n - Fix writable override for CRI\n - Fix VF CCS attach/detach race with in-flight BO moves\n - Fix WOPCM size for LNL+\n - Reset current_op in xe_pt_update_ops_init\n - Keep scheduler timeline name alive\n - Hold device ref until queue teardown completes\n - Disable display in admin only PF mode\n\n i915:\n - NV12 display fix for bigjoiner\n - clear watermark on plane disable\n - GT selftest fixes\n\n host1x:\n - Fix UAF\n\n amdxdna\n - Fix UAF\n - Reject more invalid amdxdna command submissions\n\n ivpu:\n - Fix wrong read\n - Handle invalid firmware log in ivpu\n\n panthor:\n - Fix error handling\n\n virtio:\n - Fix virtio deadlock\n - Fix invalid gem detach\n\n amdgpu:\n - DCN 4.2 fixes\n - NUTMEG fixes\n - 8K panel fix\n - Backlight fixes\n - UserQ fix\n - Fix bo-\u003epin leaking in amdgpu_bo_create_reserved()\n - VFCT fixes\n - devcoredump fixes\n - Display fixes\n - SMU7 DPM fix\n - AC/DC fixes for SMU7 and SI\n - Queue reset fix\n - PCIe DPM fix\n - XHCI/GPU resume ordering fix\n - Pageflip timeout fix\n\n amdkfd:\n - Fix potential overflow in CWSR size calculation\n - DQM error clean up fixes\n\n* tag \u0027drm-fixes-2026-07-18-1\u0027 of https://gitlab.freedesktop.org/drm/kernel: (61 commits)\n Revert \"drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs\"\n drm/amd/display: check GRPH_FLIP status before sending event\n drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock\n drm/amd: Create a device link between APU display and XHCI devices\n drm/amd/display: wire DCN42B mcache programming callback\n drm/amd/display: set new_stream to NULL after release\n drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05\n drm/amdkfd: free MQD managers on DQM init failures\n drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities\n drm/amd/pm/smu7: Fix AC/DC switch notification\n drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge\n drm/amdgpu: always emit the job vm fence\n drm/amd/pm/si: Fix AC/DC switch notification\n drm/amd/pm/si: Don\u0027t schedule thermal work when queue isn\u0027t initialized\n drm/amd/display: dce100: skip non-DP stream encoders for DP MST\n drm/amd/display: Set native cursor mode for disabled CRTCs\n drm/amd/pm/ci: Don\u0027t disable MCLK DPM on Bonaire 0x6658 (R7 260X)\n drm/amd/display: fix __udivdi3 link error\n drm/amdgpu: Reserve space for IB contents in devcoredumps\n drm/amdgpu: Print vmid, pasid and more task info in devcoredump\n ...\n" }, { "commit": "973fd9493ec21f12e760fbbedeb7b0b2317c02f4", "tree": "59a415cfd250883e7b97b6296a9bbba46aaad6f1", "parents": [ "5554e0599c960a2b320a78ef1429ddb1a1d94aec", "f39283eab44fb7e304677b2aa1d8c38f151b6566" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 08:20:12 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 08:20:41 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.2-2026-07-17\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.2-2026-07-17:\n\namdgpu:\n- DCN 4.2 fixes\n- NUTMEG fixes\n- 8K panel fix\n- Backlight fixes\n- UserQ fix\n- Fix bo-\u003epin leaking in amdgpu_bo_create_reserved()\n- VFCT fixes\n- devcoredump fixes\n- Display fixes\n- SMU7 DPM fix\n- AC/DC fixes for SMU7 and SI\n- Queue reset fix\n- PCIe DPM fix\n- XHCI/GPU resume ordering fix\n- Pageflip timeout fix\n\namdkfd:\n- Fix potential overflow in CWSR size calculation\n- DQM error clean up fixes\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260717215008.998399-1-alexander.deucher@amd.com\n" }, { "commit": "f39283eab44fb7e304677b2aa1d8c38f151b6566", "tree": "735fa1f114505f6fbfca23abc4af039197a16917", "parents": [ "48ab86360af117123eb1b15e38f068acf3826400" ], "author": { "name": "Leo Li", "email": "sunpeng.li@amd.com", "time": "Mon May 04 14:09:49 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:43:13 2026 -0400" }, "message": "Revert \"drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs\"\n\nNow that proper fixes have been found, let\u0027s revert this workaround.\n\nThis reverts commit a1fc7bf6677eb547167cb72b3bcafdc34b976692.\n\nTested-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5)\nCc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock\nCc: stable@vger.kernel.org # 48ab86360af1: drm/amd/display: check GRPH_FLIP status before sending event\nCc: stable@vger.kernel.org\n" }, { "commit": "48ab86360af117123eb1b15e38f068acf3826400", "tree": "0517646366f92a69d9958c345219f57df75d4cd3", "parents": [ "8382cd234981ae36299bb66a10bac2cd8ff1b99d" ], "author": { "name": "Leo Li", "email": "sunpeng.li@amd.com", "time": "Fri Jun 12 15:49:03 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:42:18 2026 -0400" }, "message": "drm/amd/display: check GRPH_FLIP status before sending event\n\n[Why]\n\nAfter unifying DCN interrupt sources under VUPDATE_NO_LOCK, we have two\nremaining issues to clean up:\n\n1. On DCN, flip completion is now delivered from VUPDATE_NO_LOCK\n (dm_crtc_high_irq_handler) instead of GRPH_PFLIP. But VUPDATE_NO_LOCK\n fires every frame, regardless of whether a flip has latched.\n\n2. There is a window during commit where a flip is armed (pflip_status \u003d\n SUBMITTED) but not yet programmed into HW. If the VUPDATE_NO_LOCK\n fires in that window, its handler would deliver a flip event to\n userspace before HW has latched to it. If userspace then renders to\n what it believes is now the back buffer (but HW is still latched to\n it!), it will cause display corruption. This issue seemed to have\n been introduced by:\n commit 1159898a88db (\"drm/amd/display: Handle commit plane with no FB.\")\n Enabling replay or psr extended the duration of this window, and\n hence made corruption more likely to be observed.\n\n[How]\n\n* Move acrtc-\u003eevent/pflip_status arming to after\n update_planes_and_stream_adapter() has programmed the flip into HW.\n This closes the window where pflip_status is SUBMITTED but the flip is\n not yet programmed.\n\n* Add dc_get_flip_pending_on_otg(), which reads the HUBP flip-pending\n status straight from HW for the pipe(s) bound to an OTG instance. It\n is keyed only by otg_inst and does not take or mutate a\n dc_plane_state, so it is safe to call from the OTG interrupt handler\n without racing a concurrent commit that may be modifying plane state.\n\n* Optimistically query for flip-pending after programming, in the event\n that HW latched to the new fb between programming start and arming\n event. If it latched, send the vblank event immediately, rather than\n wait for the next vblank IRQ.\n\n* In the VUPDATE_NO_LOCK handler, only deliver flip completion once\n dc_get_flip_pending_on_otg() reports the flip is no longer pending.\n Otherwise leave the flip armed and retry on the next vupdate.\n\n* For DCE, maintain the existing behavior of arming flips before\n programming, and relying on GRPH_FLIP to fire at HW latch.\n\nv2:\n* Drop flip_programmed completion object, instead move\n event/pflip_status arming after programming.\n* For DCN, optimistically query for flip pending immediately after\n programming, and if it latched, send event right away.\n\nv3:\n* Fix event timestamps on optimistic flip latch detection, where it\u0027s\n possible for it to run *before* the vupdate IRQ updates the timestamp.\n* Add more docstrings for DCN vblank handling.\n* Clean up if conditions in dm_arm_vblank_event().\n* Code style cleanup on braces surrounding multi-line statements.\n\nFixes: 9b47278cec98 (\"drm/amd/display: temp w/a for dGPU to enter idle optimizations\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/3787\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141\nAssisted-by: Copilot:claude-opus-4.8\nTested-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5)\nCc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock\nCc: stable@vger.kernel.org\n" }, { "commit": "8382cd234981ae36299bb66a10bac2cd8ff1b99d", "tree": "21a4455f44851d3094e3c52962f5a5472f153d24", "parents": [ "75c8746b9d0a0317d8a58aa0efa2ff2f7359908b" ], "author": { "name": "Leo Li", "email": "sunpeng.li@amd.com", "time": "Fri Jun 12 13:29:31 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:41:50 2026 -0400" }, "message": "drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock\n\n[Why]\n\nOn DCN, vblank events were delivered from VSTARTUP/VUPDATE\n(dm_crtc_high_irq/dm_vupdate_high_irq) and pageflip completion from\nGRPH_PFLIP (dm_pflip_high_irq). These signals can be masked by hardware\nby a few things:\n\n* DPG - DCN can Dynamically Power Gate parts of the display pipe when a\n self-refresh capable eDP is connected. DPG is engaged when there\u0027s\n enough static frames (detected through drm_vblank_off). Once gated,\n even though the OTG (output timing generator) is still enabled,\n VSTARTUP and GRPH_FLIP are masked.\n\n* GSL - Driver can use the Global Sync Lock to block HW from latching\n onto double-buffered registers during programming, to prevent HW from\n latching onto a partially programmed state. This will mask VSTARTUP,\n GRPH_FLIP, and VUPDATE. See dcn20_pipe_control_lock().\n\n* MALL - A DCN accessible cache introduced in DCN32+ DGPUs that can\n store fb data to allow for longer DRAM sleep. When scanning out from\n MALL, VSTARTUP is masked.\n\nWhen masked, events are never delivered, which can show up as flip_done\ntimeouts in the wild.\n\nHowever, there is an interrupt source on DCN that is never masked:\nVUPDATE_NO_LOCK. It\u0027s simply an unmasked variant of VUPDATE, which fires\nwhile the OTG is active, at the exact point hardware latches\ndouble-buffered registers. It is therefore the natural single signal for\ndelivering both vblank and flip-completion events on DCN, and the\ncorrect point to timestamp both VRR and non-VRR vblanks.\n\nDCE\u0027s interrupt sources are different, it does not have an unmaskable\nVUPDATE_NO_LOCK. The only unmaskable DCE interrupt is VLINE0, but it can\nonly be programmed as a vline offset from vsync_start, making it\nunsuitable for VRR. Thus, we keep DCE untouched and use the existing mix\nof interrupt sources.\n\n[How]\n\nFor DCN1 and newer only:\n\n* Factor the body of dm_crtc_high_irq() into dm_crtc_high_irq_handler()\n and drive it from dm_vupdate_high_irq() (VUPDATE_NO_LOCK). DCE keeps\n using dm_crtc_high_irq() (VSTARTUP) and dm_pflip_high_irq()\n (GRPH_PFLIP) unchanged.\n\n* Stop registering VSTARTUP (crtc_irq) and GRPH_PFLIP (pageflip_irq) on\n DCN, and stop enabling them in amdgpu_dm_crtc_set_vblank() /\n manage_dm_interrupts(). Enable VUPDATE whenever vblank is enabled on\n DCN (previously only in VRR mode). The secure-display vline0 interrupt\n is left untouched.\n\n* VUPDATE_NO_LOCK does not early-fire on an immediate (tearing / async)\n flip, since HW latches the new address right away. Deliver the flip\n completion event immediately after programming such flips in\n amdgpu_dm_commit_planes(), and clear pflip_status so the next vupdate\n handler does not double-send.\n\nv2: Do not gate VUPDATE_NO_LOCK on DCN in dm_handle_vrr_transition()\n Also toggle VUPDATE_NO_LOCK on DCN in dm_gpureset_toggle_interrupts()\n Re-cook vblank event count and timestamp for immediate flips\n\nFixes: 9b47278cec98 (\"drm/amd/display: temp w/a for dGPU to enter idle optimizations\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/3787\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141\nAssisted-by: Copilot:claude-opus-4.8\nCo-developed-by: Matthew Schwartz \u003cmatthew.schwartz@linux.dev\u003e\nSigned-off-by: Matthew Schwartz \u003cmatthew.schwartz@linux.dev\u003e\nTested-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c87e6635d2db02c88ae8d09529362da672d34770)\nCc: stable@vger.kernel.org\n" }, { "commit": "75c8746b9d0a0317d8a58aa0efa2ff2f7359908b", "tree": "447d25cd4657d99faad35d9069b450a110836e41", "parents": [ "46c3c32ba655c94b885b75b5adb8e481612126bf" ], "author": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Mon Jul 13 14:53:13 2026 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:41:39 2026 -0400" }, "message": "drm/amd: Create a device link between APU display and XHCI devices\n\nSome AMD APU multi-function devices expose an integrated USB xHCI\ncontroller. In some circumstances (such as larger VRAM), the PM core\ncan resume can fail when the xHCI controller is resuming in parallel\nwith the GPU/display function.\n\nOn affected systems, the xHCI controller can complete pci_pm_resume\nand start resuming USB devices while the GPU is still in its much\nlonger resume path. This race condition leads to USB device resume\nfailures followed by:\n\n xhci_hcd ...: xHCI host not responding to stop endpoint command\n xhci_hcd ...: HC died; cleaning up\n\nCreate a device link from any xHCI controller sharing the same PCIe\nroot port as the APU display function. The link uses DL_FLAG_STATELESS\nand DL_FLAG_PM_RUNTIME to ensure the GPU completes its resume before\nthe xHCI controller begins resuming USB devices.\n\nThis device link is done specifically in amdgpu so that if the\nplatform firmware has been modified such that this issue doesn\u0027t happen\nthe version can be detected and the workaround skipped.\n\nSuggested-by: Aaron Ma \u003caaron.ma@canonical.com\u003e\nReported-by: mrh@frame.work\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221073\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nTested-by: Mark Pearson \u003cmpearson-lenovo@squebb.ca\u003e\nTested-by: Alexander F \u003csuperveridical@gmail.com\u003e\nTested-by: Francis DB \u003cfrancisdb@gmail.com\u003e\nLink: https://patch.msgid.link/20260713195313.1739762-1-mario.limonciello@amd.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 07c93d7eeb0d990bc1b8e3b1eafa464bc9feee97)\nCc: stable@vger.kernel.org\n" }, { "commit": "46c3c32ba655c94b885b75b5adb8e481612126bf", "tree": "fcdaab98580a7815fbd6dda7129d22316815d797", "parents": [ "9fa26b9eed6195bf840f39ac183b9a6237548755" ], "author": { "name": "Pengpeng Hou", "email": "pengpeng@iscas.ac.cn", "time": "Thu Jun 25 14:06:47 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:41:33 2026 -0400" }, "message": "drm/amd/display: wire DCN42B mcache programming callback\n\nDCN42B enables DML2 and DML21 by default and defines\ndcn42b_prepare_mcache_programming(), but the resource function table only\nwires the callback when CONFIG_DRM_AMD_DC_DML21 is defined.\n\nThere is no in-tree Kconfig symbol named DRM_AMD_DC_DML21, so the\npreprocessor always removes the callback entry. Sibling DCN42 and DCN401\nresource tables wire their prepare_mcache_programming callbacks\nunconditionally, and the core DC code already checks whether the callback\npointer is present before calling it.\n\nRemove the stale guard so DCN42B exposes the callback relation that its\nsource and DML21 build world already provide.\n\nThis is an RFC patch draft from static conditional callback legality\nauditing. It needs AMD display maintainer review before submission as a\nfinal fix.\n\nSigned-off-by: Pengpeng Hou \u003cpengpeng@iscas.ac.cn\u003e\nReviewed-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 85453fb4ff726e1ddb9984ee83dca260903c5353)\n" }, { "commit": "9fa26b9eed6195bf840f39ac183b9a6237548755", "tree": "2afd45e6027b05a5cde3a37ba7346a4bdc501aea", "parents": [ "bad177fa75e607e396cd57daaaed881450d7a471" ], "author": { "name": "WenTao Liang", "email": "vulab@iscas.ac.cn", "time": "Sun Jun 28 15:27:40 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:41:25 2026 -0400" }, "message": "drm/amd/display: set new_stream to NULL after release\n\nIn dm_update_crtc_state(), the skip_modeset path releases new_stream\nvia dc_stream_release() but does not set the pointer to NULL.\n\nIf a later error (e.g., color management failure) triggers the fail\nlabel, the error path calls dc_stream_release() again on the same\ndangling pointer, causing a double release and potential use-after-free.\n\nFix this by setting new_stream to NULL after the initial release.\n\nFixes: 9b690ef3c704 (\"drm/amd/display: Avoid full modeset when not required\")\nSigned-off-by: WenTao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)\nCc: stable@vger.kernel.org\n" }, { "commit": "bad177fa75e607e396cd57daaaed881450d7a471", "tree": "f3e22afbf139b8f8e447432af385aaa299dcc7d7", "parents": [ "b240f792ae02e9b687eafff934a39e57d1e45365" ], "author": { "name": "Alessandro Rinaldi", "email": "ale@alerinaldi.it", "time": "Fri Jun 26 16:36:00 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:41:15 2026 -0400" }, "message": "drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05\n\nThe Lenovo Legion 5 15ARH05 (Renoir) ships a BOE 0x08DF eDP panel that\nadvertises AUX/DPCD backlight control, so amdgpu\u0027s automatic detection\n(amdgpu_backlight \u003d\u003d -1) selects AUX. On this panel the AUX backlight\npath has no effect: brightness writes are accepted but the panel level\nnever changes, the display is stuck at a fixed brightness and\nmax_brightness is reported as a bogus 511000. As a result neither the\ndesktop brightness slider nor the brightness hotkeys do anything.\n\nForcing PWM backlight (amdgpu.backlight\u003d0) restores working control:\nmax_brightness becomes 65535 and the level tracks writes. This has long\nbeen applied by users as a manual kernel-parameter workaround.\n\nExtend the generic panel backlight quirk with a force_pwm flag, add an\nentry for the Legion 5 15ARH05 / BOE 0x08DF panel, and have amdgpu\ndisable AUX backlight (use PWM) when the quirk matches and the user\nlets the driver auto-select the backlight type.\n\nSigned-off-by: Alessandro Rinaldi \u003cale@alerinaldi.it\u003e\nTested-by: Alessandro Rinaldi \u003cale@alerinaldi.it\u003e\nReviewed-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 81b39f43e7e53589491e2eef6bad5389626b4b9c)\nCc: stable@vger.kernel.org\n" }, { "commit": "b240f792ae02e9b687eafff934a39e57d1e45365", "tree": "72954041ace0e5f1d7368f74fcd9e6e1265981ee", "parents": [ "79f408cc06525c6cd01d1a5bf83086a1beede49b" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Wed Jul 08 18:51:15 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:41:06 2026 -0400" }, "message": "drm/amdkfd: free MQD managers on DQM init failures\n\nThe change referenced by the Fixes tag releases the HIQ SDMA MQD trunk\nbuffer when device_queue_manager_init() fails after it has been\nallocated.\n\nHowever, the same failure path can also be reached after\ninit_mqd_managers() has succeeded. At that point dqm-\u003emqd_mgrs[] contains\nper-type MQD manager objects owned by the device queue manager. The\nnormal teardown path frees those objects from uninitialize(), but the\ninitialization error path only frees dqm itself.\n\nFree the MQD managers from the initialization error path as well. This is\nsafe for earlier failures because dqm is zeroed when allocated and\ninit_mqd_managers() clears the entries it rolls back internally.\n\nFixes: b7cccc8286bb (\"drm/amdkfd: fix a memory leak in device_queue_manager_init()\")\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nReviewed-by: Mukul Joshi \u003cmukul.joshi@amd.com\u003e\nReviewed-by: Felix Kuehling \u003cfelix.kuehling@amd.com\u003e\nSigned-off-by: Felix Kuehling \u003cfelix.kuehling@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 1fff2e07b6670bc5b8f7344a8708c136259cb176)\nCc: stable@vger.kernel.org\n" }, { "commit": "79f408cc06525c6cd01d1a5bf83086a1beede49b", "tree": "35b104594f16d6d24737a019ffb3604cfa22168b", "parents": [ "ec917f19ff1077709e1c4aa7926c7451106080d0" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Sat Jul 11 13:49:58 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:41:01 2026 -0400" }, "message": "drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities\n\nAllow using multiple SDMA schedulers only on GPUs where\nwe are allowed to do concurrent VM flushes.\nThis consideration is necessary because all GART windows\nare mapped in VMID 0 (the kernel VMID) so each buffer\nentity would flush VMID 0 concurrently.\n\nPractically this means that we can\u0027t use multiple SDMA\nengines for TTM on GFX6-8 and Navi 1x.\n\nFixes: 01c836788b37 (\"drm/amdgpu: pass all the sdma scheds to amdgpu_mman\")\nFixes: e4029f7a9474 (\"drm/amdgpu: only use working sdma schedulers for ttm\")\nCc: Pierre-Eric Pelloux-Prayer \u003cpierre-eric.pelloux-prayer@amd.com\u003e\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit a8171229bc836607fbc225d323ebc4d14489cfbb)\n" }, { "commit": "ec917f19ff1077709e1c4aa7926c7451106080d0", "tree": "0c10372e8e89137808c98fdc47b6e7246f7c3d83", "parents": [ "0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Sun Jul 12 19:39:28 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:40:43 2026 -0400" }, "message": "drm/amd/pm/smu7: Fix AC/DC switch notification\n\nThere were two mistakes in the previous implementation:\n\nThe check for AutomaticDCTransition should be inverted.\nWe recently learned that the kernel should send\nPPSMC_MSG_RunningOnAC when the flag is set, and not the\nother way around.\n\nThe clocks also need to be recomputed, because the code in\nthe smu7_apply_state_adjust_rules() function selects\ndifferent limits on AC and DC.\n\nFixes: 96da0d86614e (\"drm/amd/pm/smu7: Notify SMU7 of DC-\u003eAC switch\")\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 516f8fc30a1b56af03f39e93c18707d13419fb1f)\nCc: stable@vger.kernel.org\n" }, { "commit": "0148ac33547b9af1c5a7f3bb6e5baffcb6e9fac2", "tree": "0bc15bcbd77ba18a7cccd5395e5c57fa469edf52", "parents": [ "b2ff0595c31cce4303957dd0058e14c89eb70152" ], "author": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Wed Jul 08 22:15:20 2026 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:40:31 2026 -0400" }, "message": "drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge\n\nAMD Ryzen Pinnacle Ridge (Zen+, family 0x17 model 0x08) CPUs have\nPCI controllers that don\u0027t support PCIe dynamic speed switching,\ncausing system freezes during GPU initialization when enabled.\n\nDisable dynamic speed switching when this CPU is detected.\n\nAssisted-by: Claude:sonnet\nFixes: 466a7d115326 (\"drm/amd: Use the first non-dGPU PCI device for BW limits\")\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5436\nReviewed-by: Lijo Lazar \u003clijo.lazar@amd.com\u003e\nLink: https://patch.msgid.link/20260709031520.841611-1-mario.limonciello@amd.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 9ceb4e034a327a04155f32f1cd1a5031dfa5fe02)\nCc: stable@vger.kernel.org\n" }, { "commit": "b2ff0595c31cce4303957dd0058e14c89eb70152", "tree": "53e6b9826dc5f42fc47647ef27ba2fdc08020aae", "parents": [ "86b6cf8387a4a28754fa251c79e1abfc2e57b534" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jun 03 15:41:28 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:40:23 2026 -0400" }, "message": "drm/amdgpu: always emit the job vm fence\n\nWe need the fence to reemit the gds switch or spm update\nafter a queue reset.\n\nFixes: a17ef941212b (\"drm/amdgpu: rework ring reset backup and reemit v9\")\nCc: timur.kristof@gmail.com\nCc: christian.koenig@amd.com\nReviewed-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit bc639a9eadc75822f7f15a4315c198a4b5513bd2)\nCc: stable@vger.kernel.org\n" }, { "commit": "86b6cf8387a4a28754fa251c79e1abfc2e57b534", "tree": "7f9922a586bc5c38cb03501ff7eb2fd2523fb45f", "parents": [ "f8922d5a946699fc2bdc7660e6778bd6726bf8b8" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Sun Jul 12 19:39:27 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:40:16 2026 -0400" }, "message": "drm/amd/pm/si: Fix AC/DC switch notification\n\nThere were two mistakes in the previous implementation:\n\nThe check for ATOM_PP_PLATFORM_CAP_HARDWAREDC should be\ninverted. We recently learned that the kernel should send\nPPSMC_MSG_RunningOnAC when the flag is set, and not the\nother way around.\n\nThe clocks also need to be recomputed, because the code in\nthe si_apply_state_adjust_rules() function selects different\nlimits on AC and DC.\n\nFixes: 2d071f6457af (\"drm/amd/pm/si: Notify the SMC when switching to AC\")\nTested-by: Jeremy Klarenbeek \u003cjeremy.klarenbeek99@gmail.com\u003e\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 358dd0a9ce66d898fa934887385327547d599d88)\nCc: stable@vger.kernel.org\n" }, { "commit": "f8922d5a946699fc2bdc7660e6778bd6726bf8b8", "tree": "72697eea55e3e844422fb71eaadfcd631e33adbb", "parents": [ "d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Sun Jul 12 19:39:26 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:40:09 2026 -0400" }, "message": "drm/amd/pm/si: Don\u0027t schedule thermal work when queue isn\u0027t initialized\n\nWhen DPM is turned off with the amdgpu.dpm\u003d0 module parameter,\nthe thermal work queue isn\u0027t initialized so we shouldn\u0027t\nschedule any work on it.\n\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit bd018d36171a695952c6d391471c279c9e05c8b2)\n" }, { "commit": "d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5", "tree": "699e9a2ae68987ba327278d1a61ffc6cb941c1d2", "parents": [ "cea54c52d82dd9948126b7518af51ca1de094933" ], "author": { "name": "Andriy Korud", "email": "a.korud@gmail.com", "time": "Fri Jul 10 12:52:26 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:40:02 2026 -0400" }, "message": "drm/amd/display: dce100: skip non-DP stream encoders for DP MST\n\nOn DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital\nDIG stream encoders plus one analog DAC encoder. When assigning a stream\nencoder for a second DisplayPort MST stream, if the preferred digital\nencoder is already acquired, dce100_find_first_free_match_stream_enc_for_link()\nfalls back to the first free pool entry. That entry may be the analog\nencoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute.\nThe subsequent atomic commit then dereferences NULL function pointers in\nlink_set_dpms_on() and crashes.\n\nSkip encoders without dp_set_stream_attribute when the stream uses a DP\nsignal (including MST). Use dc_is_dp_signal(stream-\u003esignal) for the MST\nfallback path instead of checking only the link connector signal.\n\nTested on:\n- GPU: AMD Radeon R7 260X (Bonaire / DCE8)\n- Board: Supermicro C9X299-PG300\n- Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot\n- Kernel: 7.1.3 (issue observed since 6.19)\n- Result: kernel oops without patch; dual monitors stable with patch\n\nSigned-off-by: Andriy Korud \u003ca.korud@gmail.com\u003e\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5162\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8)\nCc: stable@vger.kernel.org\n" }, { "commit": "cea54c52d82dd9948126b7518af51ca1de094933", "tree": "7d2475670a4665c1b4374acae35c61b7b7c2e632", "parents": [ "85371c5ef502d10add72eab38711e191dccea981" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Sat Jul 11 13:34:35 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:39:52 2026 -0400" }, "message": "drm/amd/display: Set native cursor mode for disabled CRTCs\n\nAlways set native cursor mode when the CRTC is disabled,\nto make sure it doesn\u0027t cause atomic commits to fail when\nthey are trying to disable the CRTC.\n\nFixes: 41af6215cdbc (\"drm/amd/display: Reject cursor plane on DCE when scaled differently than primary\")\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5432\nCc: Leo Li \u003csunpeng.li@amd.com\u003e\nCc: Michel Dänzer \u003cmichel.daenzer@mailbox.org\u003e\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nTested-by: Viktor Jägersküpper \u003cviktor_jaegerskuepper@freenet.de\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 2f79f0130f828cf26fe2dcf45291821616af7b47)\nCc: stable@vger.kernel.org\n" }, { "commit": "85371c5ef502d10add72eab38711e191dccea981", "tree": "8cf609cbc5a5b07fcbdd6d1fe20e823e8e23241e", "parents": [ "54d4dee9f89e1dac1a6c2618de0bb2e3f35cc2f0" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Mon Jul 13 08:14:43 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:39:44 2026 -0400" }, "message": "drm/amd/pm/ci: Don\u0027t disable MCLK DPM on Bonaire 0x6658 (R7 260X)\n\nThe old radeon driver has a documented workaround in ci_dpm.c\nwhich claims that Bonaire 0x6658 with old memory controller\nfirmware is unstable with MCLK DPM, so as a precaution I\ndisabled MCLK DPM on this ASIC in amdgpu.\n\nNote that the old MC firmware is not actually used with\namdgpu, but in theory it\u0027s possible that the VBIOS sets\nup the ASIC with an old MC firmware that is already running\nwhen amdgpu initializes (in which case amdgpu doesn\u0027t\nload its own firmware).\n\nWhat I expected to happen is that the GPU would simply use\nits maximum memory clock, and indeed this is what seemed\nto happen according to amdgpu_pm_info which reads the\ncurrent MCLK value from the SMU.\nHowever, some users reported a huge perf regression\nand upon a closer look it seems that the GPU seems to\nnot actually use the highest MCLK value, despite the SMU\nreporting that it does.\n\nLet\u0027s not disable MCLK DPM on Bonaire 0x6658 (R7 260X).\n\nKeep MCLK DPM disabled on R9 M380 in the 2015 iMac\nbecause that still hangs if we enable it.\n\nFixes: 9851f29cb06c (\"drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs\")\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit d34acad064ee7d82bd18f5d87592c422d4d323ac)\nCc: stable@vger.kernel.org\n" }, { "commit": "54d4dee9f89e1dac1a6c2618de0bb2e3f35cc2f0", "tree": "f0efb690169d22e7bd214f871548db061b8f3094", "parents": [ "b5eab15944b6b140f003af6e639a25f5c3a8ed0b" ], "author": { "name": "yanglinlin", "email": "yanglinlin@kylinos.cn", "time": "Mon Jul 13 11:12:28 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:39:36 2026 -0400" }, "message": "drm/amd/display: fix __udivdi3 link error\n\nWhen compiling the AMDGPU display driver for 32-bit architectures,\nthe linker reports undefined reference to `__udivdi3` in functions\nget_dp_dto_frequency_100hz() and dcn401_get_dp_dto_frequency_100hz().\n\nThis is because the code uses 64-bit division (/) on 32-bit systems,\nwhich GCC cannot handle directly and instead tries to call the missing\n__udivdi3 helper function.\n\nReplace the raw division with div_u64(), the kernel\u0027s standard 64-bit\ndivision helper, to avoid the link error.\n\nSigned-off-by: Linlin Yang \u003cyanglinlin@kylinos.cn\u003e\nReported-by: k2ci \u003ckernel-bot@kylinos.cn\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 0421fc6ab3a8514e99156ff3c2cee13ee9af3fa7)\nCc: stable@vger.kernel.org\n" }, { "commit": "b5eab15944b6b140f003af6e639a25f5c3a8ed0b", "tree": "598b249c3793465d8963e10017de3205611ad6ab", "parents": [ "ea9d70db278957e1e81e4aea58b4b131ba262cfb" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Sat Jul 11 13:21:08 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:39:16 2026 -0400" }, "message": "drm/amdgpu: Reserve space for IB contents in devcoredumps\n\nCurrently the contents of IBs are abruptly cut off and don\u0027t\nshow the full contents. This patch makes sure to reserve\nspace for those contents too so they may be printed.\n\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nAcked-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 4e2c0821509fed754e8c31d5053d152fbb3484a5)\nCc: stable@vger.kernel.org\n" }, { "commit": "ea9d70db278957e1e81e4aea58b4b131ba262cfb", "tree": "88cf05a0ed8f737d8c7cde1cd80a4db3051717c3", "parents": [ "65bff26617607c1331283232016c0e89088c5b78" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Sat Jul 11 13:21:07 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:39:08 2026 -0400" }, "message": "drm/amdgpu: Print vmid, pasid and more task info in devcoredump\n\nThese are in the dmesg logs but are missing from devcoredumps.\n\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit fed7aa36d79802c3e02acd05aeae8b0a877e47c2)\nCc: stable@vger.kernel.org\n" }, { "commit": "65bff26617607c1331283232016c0e89088c5b78", "tree": "3126a0936eee1a8dcbf64a4b064e9961d515c51c", "parents": [ "db7e8108809a2245f0a17ba323f027cac0941ffb" ], "author": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Wed Jul 08 14:35:15 2026 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:39:00 2026 -0400" }, "message": "drm/amdgpu: Release VFCT ACPI table reference\n\namdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()\nbut never releases it. acpi_get_table() takes a reference on the\ntable (incrementing its validation_count and mapping it on the 0-\u003e1\ntransition); without a paired acpi_put_table() the mapping is leaked\non every call, whether or not a matching VBIOS image is found.\n\nRoute all exit paths after the table is acquired through a common\nacpi_put_table(). The VBIOS image is copied out with kmemdup() before\nthe table is released, so it remains valid for the caller.\n\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260708193518.702584-3-mario.limonciello@amd.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)\nCc: stable@vger.kernel.org\n" }, { "commit": "db7e8108809a2245f0a17ba323f027cac0941ffb", "tree": "81a59dd1ed91ef08c64bd3bed208e24f354c208a", "parents": [ "a2f895f3c852063258d62e9f74b081de07ca95df" ], "author": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Wed Jul 08 14:35:14 2026 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:38:48 2026 -0400" }, "message": "drm/amdgpu: Fix VFCT bus number matching with soft filter\n\nOn systems where PCI bus renumbering occurs (e.g. pci\u003drealloc,\nresource conflicts), the runtime bus number may differ from the\nBIOS POST bus number recorded in the VFCT table. This causes\namdgpu_acpi_vfct_bios() to fail finding the VBIOS even though\nthe correct device entry exists.\n\nIntroduce amdgpu_acpi_vfct_match() which treats the bus number\nas a soft filter: vendor/device/function identity is the hard\nrequirement, while exact bus match is the preferred path. When\nbus numbers disagree but device identity matches, accept the\nVFCT entry and log a dev_notice for diagnostics.\n\nReported-by: Oz Tiram \u003coz@shift-computing.de\u003e\nCloses: https://lore.kernel.org/amd-gfx/20260621173211.28443-1-oz@shift-computing.de/\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260708193518.702584-2-mario.limonciello@amd.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 11c141672045ffc0187aa604f2c0f597bc334fb2)\nCc: stable@vger.kernel.org\n" }, { "commit": "a2f895f3c852063258d62e9f74b081de07ca95df", "tree": "fe0fa88f1c5aa2062192a5e366ac31c3bd71cbb7", "parents": [ "5d75ec2e5f1736c2f10c7d6f4565bf1bf29f29a7" ], "author": { "name": "Zhu Lingshan", "email": "lingshan.zhu@amd.com", "time": "Wed Jul 01 18:53:21 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:38:33 2026 -0400" }, "message": "drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved\n\namdgpu_bo_create_reserved() only allocates a new BO when\n*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is\nNULL, it simply skips creation when *bo_ptr is non-NULL.\nBut it unconditionally reserves, pins, gart allocates\nand maps the BO afterwards.\n\nWhen the same non-NULL BO pointer is passed in again,\nfor example firmware buffers that live in adev and are\nre-loaded on every resume / cp_resume / start\nunder AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases\npin_count unconditionally, however the matching teardown only unpins\nonce, so pin_count never drops to zero, so TTM is not able\nto move, swap or evict a BO, causing BO leaks.\n\nThis commit fixes this issue by only pinning the bo\nonce at creation, and repeated calls no longer\ntake additional pin references.\n\nSigned-off-by: Zhu Lingshan \u003clingshan.zhu@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)\nCc: stable@vger.kernel.org\n" }, { "commit": "5d75ec2e5f1736c2f10c7d6f4565bf1bf29f29a7", "tree": "2d51a1f57e50d85a77c5eb45b2aa8e765f7549c5", "parents": [ "f9ad396aa803c34513ac4c93bce42435dfa96b68" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Fri Jul 10 16:45:42 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:38:16 2026 -0400" }, "message": "drm/amdgpu/userq: fix indefinite fence wait during GPU reset\n\npre_reset only force-completes fences of MAPPED queues. A queue in any\nother state (e.g. mid-eviction) keeps its last_fence pending; after a\nGPU reset that fence never signals, so the eviction/suspend worker and\nprocess teardown (amdgpu_evf_mgr_flush_suspend) wait on it forever and\nwedge the machine:\n\n INFO: task kworker/6:28 blocked for more than 120 seconds.\n Workqueue: events amdgpu_eviction_fence_suspend_worker [amdgpu]\n Call Trace:\n dma_fence_wait_timeout+0x7e/0x130\n amdgpu_userq_evict+0x67/0x140 [amdgpu]\n amdgpu_eviction_fence_suspend_worker+0xd8/0x160 [amdgpu]\n process_scheduled_works+0xa6/0x420\n\nForce-complete every queue\u0027s fence regardless of state. The unmap and\nmark-hung step stays gated on MAPPED, since unmapping a queue that is\nnot mapped is invalid.\n\nFixes: 290f46cf5726 (\"drm/amdgpu: Implement user queue reset functionality\")\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 9102b39fa924dcc3dc75a3137bfa9633c40b88c0)\nCc: stable@vger.kernel.org\n" }, { "commit": "f9ad396aa803c34513ac4c93bce42435dfa96b68", "tree": "91c5379d7a96abfb923ebf41ed8dc3ffc66306b5", "parents": [ "5b1250efc17058595d2776f3c1e53e258f0968ae" ], "author": { "name": "Dmytro Laktyushkin", "email": "dmytro.laktyushkin@amd.com", "time": "Fri Jul 03 13:01:12 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:38:04 2026 -0400" }, "message": "drm/amd/display: fix dcn42b det allocation order\n\nset_pipe_unlock_order needs to be set to true for the pipes to be unlocked\nin correct order to avoid det overallocation\n\nReviewed-by: Charlene Liu \u003ccharlene.liu@amd.com\u003e\nSigned-off-by: Dmytro Laktyushkin \u003cdmytro.laktyushkin@amd.com\u003e\nSigned-off-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 183bbded999a70c5996e8f399fa8790568d71112)\n" }, { "commit": "5b1250efc17058595d2776f3c1e53e258f0968ae", "tree": "2bef7515d09a46b46bfdf378efa56b6ca41ff837", "parents": [ "f1b5d8f9cc54ae8a2567ac126867ae488e1bf625" ], "author": { "name": "Dmytro Laktyushkin", "email": "dmytro.laktyushkin@amd.com", "time": "Fri Jul 03 10:08:37 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:37:52 2026 -0400" }, "message": "drm/amd/display: fix dcn42 det allocation order\n\nset_pipe_unlock_order needs to be set to true for the pipes to be unlocked\nin correct order to avoid det overallocation\n\nReviewed-by: Taimur Hassan \u003csyed.hassan@amd.com\u003e\nSigned-off-by: Dmytro Laktyushkin \u003cdmytro.laktyushkin@amd.com\u003e\nSigned-off-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 198663d035cc439eb48844a2da66f6ae1b0de303)\n" }, { "commit": "f1b5d8f9cc54ae8a2567ac126867ae488e1bf625", "tree": "199019b2e04fef40752bcf284164df646593b158", "parents": [ "9b3aa1dec7c364b0d7b171dcc00ab1092e362aef" ], "author": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Mon Jun 29 15:27:00 2026 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:37:40 2026 -0400" }, "message": "drm/amd/display: Fix backlight max_brightness to match exported range\n\n[Why]\nFWTS autobrightness fails on eDP panels because actual_brightness can\nread higher than the advertised max_brightness (e.g. 63576 vs 62451).\n\nThe conversion helpers expose the firmware PWM range to userspace as\n[0..max]. But max_brightness is advertised as (max - min), which is\nsmaller. So reading the level can return a value above max_brightness.\n\nThis regressed in commit 4b61b8a39051 (\"drm/amd/display: Add debugging\nmessage for brightness caps\"), which changed max_brightness to\n(max - min) and undid commit 8dbd72cb7900 (\"drm/amd/display: Export full\nbrightness range to userspace\").\n\n[How]\nAdvertise max_brightness as max, and scale the initial AC/DC brightness\nagainst max too. Update the KUnit expectations to match.\n\nFixes: 4b61b8a39051 (\"drm/amd/display: Add debugging message for brightness caps\")\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit bd9e2b5b0473c75abc0f4134dfe79ecbfb16610d)\nCc: stable@vger.kernel.org\n" }, { "commit": "9b3aa1dec7c364b0d7b171dcc00ab1092e362aef", "tree": "9ca7cde379f3c03b53b32239812d0fc1741a2165", "parents": [ "e39b7cf5c62e027af166772e46382356ecb45c36" ], "author": { "name": "Fangzhi Zuo", "email": "Jerry.Zuo@amd.com", "time": "Wed Jun 24 16:54:30 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:37:33 2026 -0400" }, "message": "drm/amd/display: Fix 8K Mode Not Parsed by EDID\n\n[why]\nThe 8K120/8K240 timings live in DisplayID extension blocks 2 and 3\nof this EDID. The EDID is a 4-block (512-byte) HDMI 2.1 EDID\nthat uses HF-EEODB.\ndrm core reads and parses this correctly, but amdgpu rebuilds its own copy.\nOnly 2 of 4 blocks were copied into sink-\u003edc_edid, that leads to\ndrm_edid_connector_add_modes() never sees blocks 2 and 3.\n\n[how]\nDirectly populate edid_blob_ptr with a blob whose length is the full,\nand HF-EEODB-aware size.\n\nReviewed-by: Sun peng (Leo) Li \u003csunpeng.li@amd.com\u003e\nSigned-off-by: Fangzhi Zuo \u003cJerry.Zuo@amd.com\u003e\nSigned-off-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 11a90eaf5c808ba800249dda0d481c35d0888589)\n" }, { "commit": "e39b7cf5c62e027af166772e46382356ecb45c36", "tree": "972d30a2dbf6589710897c4fc2fa33a253c5d0f3", "parents": [ "9fb646bc4d87f62bcbf0a7ea326430eb802c475c" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Fri May 29 11:09:09 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:37:28 2026 -0400" }, "message": "drm/amd/display: Add dp_skip_rbr flag for NUTMEG\n\nNo functional changes. Just clean up a conceptual mismatch.\n\nBased on feedback on the NUTMEG code in DC, the\npreferred_link_setting is meant to force the DP link to a\nspecific setting, meaning both the link rate and lane count\nshould be locked to an exact value. What NUTMEG needs is\na lower bound on the link rate, which is not the same concept.\n\nImplement this as a HW workaround flag instead.\n\nSuggested-by: Wenjing Liu \u003cwenjing.liu@amd.com\u003e\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 871ceb853841bcaa4e6cec3723b16c4887a760be)\nCc: stable@vger.kernel.org\n" }, { "commit": "9fb646bc4d87f62bcbf0a7ea326430eb802c475c", "tree": "8ece1f46b0930936b84084e64c1a15ab0ca503ed", "parents": [ "2b0386d4293920e690c0e017708f999b93cc729b" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Fri May 29 11:09:08 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:37:19 2026 -0400" }, "message": "drm/amd/display: Fix preferred link rate for NUTMEG\n\nWhen there is a preferred link rate setting, it needs to be\napplied to both the current and initial link rate.\nThis was regressed by a \"coding style\" fix, which caused\nthe current link rate to not respect the preferred value.\n\nThis commit restores the functionality of NUTMEG,\nthe DP bridge encoder found on old APUs such as Kaveri.\n\nFixes: a62346043a89 (\"drm/amd/display: Fix coding style issue\")\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5465\nCc: Chuanyu Tseng \u003cChuanyu.Tseng@amd.com\u003e\nReviewed-by: Fangzhi Zuo \u003cJerry.Zuo@amd.com\u003e\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit e78b0a367f8690b682029d90e75308dc84ed51de)\nCc: stable@vger.kernel.org\n" }, { "commit": "2b0386d4293920e690c0e017708f999b93cc729b", "tree": "4624d0f936824295aaa23ae02371eedb9b353728", "parents": [ "fbbbd98f200f11e7f9b66ca7f2d18546be8b254e" ], "author": { "name": "Yongqiang Sun", "email": "Yongqiang.Sun@amd.com", "time": "Mon Jul 06 15:15:07 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:37:12 2026 -0400" }, "message": "drm/amdkfd: fix 32-bit overflow in CWSR total size calculation\n\ntotal_cwsr_size was computed in 32-bit before being used as a BO/SVM\nallocation size.\nWith large ctx_save_restore_area_size and debug_memory_size\nmultiplied by the XCC count, the product can wrap,\nyielding an undersized CWSR save area that firmware later overruns.\n\nPromote total_cwsr_size to u64 and use check_add_overflow()/\ncheck_mul_overflow() in both kfd_queue_acquire_buffers() and\nkfd_queue_release_buffers().\n\nSigned-off-by: Yongqiang Sun \u003cYongqiang.Sun@amd.com\u003e\nReviewed-by: Philip Yang \u003cphilip.yang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)\nCc: stable@vger.kernel.org\n" }, { "commit": "fbbbd98f200f11e7f9b66ca7f2d18546be8b254e", "tree": "ae750f98678113f5b3ba809fbe75c44845b6db9a", "parents": [ "29c57db1629e7a3cddfe1a4b13e72682acfef38e" ], "author": { "name": "Matthew Stewart", "email": "Matthew.Stewart2@amd.com", "time": "Thu Jun 04 11:36:09 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:37:05 2026 -0400" }, "message": "drm/amd/display: Fix DCN42B null registers \u0026 register masks\n\n[why]\n\nDCN42B is missing some register masks, which are causing errors in dmesg.\n\n[how]\n\nMake DCN42B reuse the DCN42 register lists, and add the missing defines manually.\n\nFixes: 64142f9d51af (\"drm/amd/display: Fix DCN42 null registers \u0026 register masks\")\nReviewed-by: Ovidiu (Ovi) Bunea \u003covidiu.bunea@amd.com\u003e\nSigned-off-by: Matthew Stewart \u003cMatthew.Stewart2@amd.com\u003e\nSigned-off-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit b7d69145907cdefcbd39a70a31eefd30919af9f1)\n" }, { "commit": "29c57db1629e7a3cddfe1a4b13e72682acfef38e", "tree": "9a78e92006977a776708bbc8b8100ff9ab1464b2", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Roman Li", "email": "Roman.Li@amd.com", "time": "Wed May 13 21:49:15 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jul 17 17:36:57 2026 -0400" }, "message": "drm/amdgpu/discovery: Fix device family for DCN42\n\nGC 11.7.0 and 11.7.1 should map to AMDGPU_FAMILY_GC_11_5_4 for DCN42.\n\nFixes: cf591e67c095 (\"drm/amdgpu: add support for GC IP version 11.7.0\")\nFixes: a928d8d81ec5 (\"drm/amdgpu: add support for GC IP version 11.7.1\")\nSigned-off-by: Roman Li \u003cRoman.Li@amd.com\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f8ee6447e7ec1d75d6663c817e45566dd01f440b)\n" }, { "commit": "5554e0599c960a2b320a78ef1429ddb1a1d94aec", "tree": "3baa94af3d39a22f8628d884a8947be28ebdb745", "parents": [ "e442677c0a9afc012a93020dcc47963316e58366", "612978b83f45bf7018815209db5395d759db6f26" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 07:17:46 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 07:18:18 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-07-17\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\nCouple of display fixes (NV12 for bigjoiner and Watermark clear\non plane disable) along with couple of GT selftests fixes.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/alp3ks0K1ZsxUC05@intel.com\n" }, { "commit": "e442677c0a9afc012a93020dcc47963316e58366", "tree": "9aa0f238d589d51f9a4f3a3f2293b6e6e9e75801", "parents": [ "4f7b10f3a4bf2f05bafc9ea75a76ddba92eac687", "130910bac905a42225f93841e338bbea4a431b1a" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 07:17:28 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 07:17:30 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-07-17\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nDriver Changes:\n- Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK (Himal)\n- Hold a dma-buf reference for imported BOs (Nitin)\n- Fix writable override for CRI (Alexander)\n- Fix VF CCS attach/detach race with in-flight BO moves (Matthew Brost)\n- Fix WOPCM size for LNL+ (Daniele)\n- Reset current_op in xe_pt_update_ops_init (Zongyao Bai)\n- Keep scheduler timeline name alive (Arvind)\n- Hold device ref until queue teardown completes (Arvind)\n- Disable display in admin only PF mode (Satyanarayana)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nLink: https://patch.msgid.link/aln1tRUXZJ_qzD65@fedora\n" }, { "commit": "4f7b10f3a4bf2f05bafc9ea75a76ddba92eac687", "tree": "0874e13a6b5508bc949cd61070ea8d104850052b", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa", "faebb7ba1ac65fa5810b640df02ce04e509fdc11" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 07:15:54 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jul 18 07:16:03 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-07-17\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\ndrm-misc-fixes for v7.2-rc4:\n- Fix UAF in host1x, amdxdna.\n- Handle invalid firmware log in ivpu.\n- Fix error handling in panthor.\n- Handle NULL pages and backup handles in ttm_pool_backup() correctly.\n- Reject more invalid amdxdna command submissions.\n- Improve unmap and error handling on gpusvm.\n- Fix virtio deadlock and invalid gem detach.\n- Fix wrong read in ivpu.\n- Always synchronize for CPU in begin_cpu_udmabuf.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patch.msgid.link/7f10281e-88f5-4be5-8b42-367e7ce7c547@linux.intel.com\n" }, { "commit": "94515f3a7d4256a5062176b7d6ed0471938cd51a", "tree": "1b56309a66ef933f3b75e05e5d930832f77eb25c", "parents": [ "8fc574321e59a2484063b2e75016772815038608", "3d84d674e3a5a33ce5eaa14b92bc839c3821a348" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 12:55:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 12:55:24 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Kumar Kartikeya Dwivedi:\n\n - Fix a UAF in socket clone early bailout paths (Matt Bobrowski)\n\n - Reject unhashed UDP sockets on sockmap update to prevent refcount\n leaks (Michal Luczaj)\n\n - Account for receive queue data in FIONREAD on sockmap sockets without\n a verdict program (Mattia Meleleo)\n\n - Reject negative constant offsets for verifier buffer pointers (Sun\n Jian)\n\n - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n selftests/bpf: Cover tracing implicit kfunc args\n bpf: Fix tracing of kfuncs with implicit args\n selftests/bpf: Cover negative buffer pointer offsets\n bpf: Reject negative const offsets for buffer pointers\n selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program\n bpf, sockmap: Account for receive queue in FIONREAD without a verdict program\n selftests/bpf: Fail unbound UDP on sockmap update\n selftests/bpf: Adapt sockmap update error handling\n bpf, sockmap: Reject unhashed UDP sockets on sockmap update\n selftests/bpf: Ensure UDP sockets are bound\n bpf: Fix UAF in sock clone early bailouts\n" }, { "commit": "8fc574321e59a2484063b2e75016772815038608", "tree": "887d1b2bf7c1934c0e300eeca7f5d0964f4eaa45", "parents": [ "0dde292a4c23090459655ada697e948ff4adc7c3", "9fe595fad54d4ac6a402edb3f60bec859d52cea6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 11:04:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 11:04:46 2026 -0700" }, "message": "Merge tag \u0027selinux-pr-20260717\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fix from Paul Moore:\n \"A single SELinux patch to correct a problem with the overlayfs mmap()\n and mprotect() fixes from earlier this year where we inadvertenly\n included an additional SELinux execmem permission check on some\n operations\"\n\n* tag \u0027selinux-pr-20260717\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n selinux: fix incorrect execmem checks on overlayfs\n" }, { "commit": "0dde292a4c23090459655ada697e948ff4adc7c3", "tree": "2010c0e190af3e68a1e2d54767d509e6b55293a8", "parents": [ "e13caf1c26587434f0b768193100440939c0fb91", "e073f1238ecaea366f53e98724c40b31856da56a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 10:53:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 10:53:57 2026 -0700" }, "message": "Merge tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux\n\nPull crypto library fixes from Eric Biggers:\n\n - Fix a build error in certain configurations\n\n - Clarify some parts of the documentation\n\n - Remove unused code that I forgot to remove in commit cf52058dcdd9\n (\"lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code\")\n\n* tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:\n crypto: aes - Fix conditions for selecting MAC dependencies\n lib/crypto: docs: Improve introduction sentence\n lib/crypto: docs: Fix some sentence fragments\n lib/crypto: md5: Remove support for md5_mod_init_arch()\n" }, { "commit": "e13caf1c26587434f0b768193100440939c0fb91", "tree": "1abe8e2388ecf8993fc917c9217ee71091fc8d5d", "parents": [ "af5e34a41cd607c00ef752e00331736570992354", "56d96fededd61192cd7cc8d2b0f36adfd59036c3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 10:25:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 10:25:13 2026 -0700" }, "message": "Merge tag \u0027net-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from Wireless, IPsec, Netfilter and Bluetooth.\n\n Current release - new code bugs:\n\n - netfilter: flowtable: use correct direction to set up tunnel route\n\n Previous releases - regressions:\n\n - wifi:\n - mac80211:\n - free AP_VLAN bc_buf SKBs outside IRQ lock\n - defer link RX stats percpu free to RCU\n - fix double free on alloc failure\n - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock\n\n - ipv4: free fib_alias with kfree_rcu() on insert error path\n\n - sched: act_tunnel_key: Defer dst_release to RCU callback\n\n - xfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n\n - bluetooth: fix locking in unpair_device/disconnect_sync\n\n - can: add locking for raw flags bitfield\n\n - openvswitch: reject oversized nested action attrs\n\n - eth:\n - bnxt_en: handle partially initialized auxiliary devices\n - ppp: defer channel free to an RCU grace period to fix UAF\n\n Previous releases - always broken:\n\n - netfilter: xt_nat: reject unsupported target families\n\n - wifi:\n - brcmfmac: fix heap overflow on a short auth frame\n - cfg80211: add missing FTM API validation\n\n - xfrm:\n - reject optional IPTFS templates in outbound policies\n - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert\n\n - bluetooth: revalidate LOAD_CONN_PARAM queued update\n\n - can: fix lockless bound/ifindex race and silent RX_SETUP failure\n\n - eth: mlx5: free mlx5_st_idx_data on final dealloc\"\n\n* tag \u0027net-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits)\n mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET\u003dn\n llc: fix SAP refcount leak when creating incoming sockets\n selftests: netconsole: only restore MAC when it changed on resume\n bnxt_en: Handle partially initialized auxiliary devices\n sctp: fix auth_hmacs array size in struct sctp_cookie\n net/sched: act_tunnel_key: Defer dst_release to RCU callback\n dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()\n tcp: fix TIME_WAIT socket reference leak on PSP policy failure\n net/mlx5: free mlx5_st_idx_data on final dealloc\n can: isotp: serialize TX state transitions under so-\u003erx_lock\n can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER\n can: isotp: use unconditional synchronize_rcu() in isotp_release()\n can: bcm: track a single source interface for ANYDEV timeout/throttle ops\n can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()\n can: bcm: fix stale rx/tx ops after device removal\n can: bcm: add missing device refcount for CAN filter removal\n can: bcm: validate frame length in bcm_rx_setup() for RTR replies\n can: bcm: extend bcm_tx_lock usage for data and timer updates\n can: bcm: add missing rcu list annotations and operations\n can: bcm: fix CAN frame rx/tx statistics\n ...\n" }, { "commit": "3afc64c61ce906a04f073ca350b46de10e8302f9", "tree": "793ff990047913769a5aa89f7307bbccf11f1908", "parents": [ "cc609376e9a43166a2fba2aef6c5f9ea262ce722" ], "author": { "name": "Woraphat Khiaodaeng", "email": "worapat.kd2@gmail.com", "time": "Fri Jul 17 22:45:37 2026 +0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Jul 17 11:17:54 2026 -0600" }, "message": "io_uring/bpf-ops: reject re-registration of an already-bound ops\n\nio_install_bpf() only rejects a second registration on the ctx side\n(ctx-\u003ebpf_ops) and sets the per-map back-pointer ops-\u003epriv\nunconditionally. The struct_ops link path never advances a map past\nBPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be\nregistered more than once, and bpf_io_reg() re-resolves the target ring\nvia fget(ops-\u003ering_fd) on every call. A caller can therefore point the\nsame ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE\ncalls.\n\nThe second registration passes the ctx-\u003ebpf_ops check (the new ctx has\nnone) and overwrites ops-\u003epriv, orphaning the first ctx. Teardown\n(io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops-\u003epriv, so\nthe orphaned ctx is never torn down: its ctx-\u003eloop_step keeps pointing\ninto the struct_ops trampoline, which is freed once the map is gone. A\nlater io_uring_enter() on the orphaned ring then calls the dangling\nctx-\u003eloop_step from io_run_loop() -- a use-after-free of freed\nexecutable memory, reachable by a task with CAP_BPF + CAP_PERFMON.\n\nReject registration when ops-\u003epriv is already set, as hid_bpf_reg()\ndoes for its struct_ops.\n\nCc: stable@vger.kernel.org\nFixes: 98f37634b12b (\"io_uring/bpf-ops: implement bpf ops registration\")\nSigned-off-by: Woraphat Khiaodaeng \u003cworapat.kd2@gmail.com\u003e\nReviewed-by: Gabriel Krisman Bertazi \u003ckrisman@suse.de\u003e\nReviewed-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nLink: https://patch.msgid.link/20260717154537.129736-1-worapat.kd2@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "af5e34a41cd607c00ef752e00331736570992354", "tree": "532286b8d2d27b1359090ef98d65cf829ac86bee", "parents": [ "45419d06c943246229ecbc392f5d1038551e9b9b", "2b533e775aec580cf60074417f4ca00ac9cf3580" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 09:30:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 09:30:17 2026 -0700" }, "message": "Merge tag \u0027mtd/fixes-for-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull mtd fixes from Miquel Raynal:\n \"Among the most important fixes that we have here, there are:\n\n - the revert of the uclinux map driver which was presumed to\n be no longer used but in fact was\n\n - the use of SPI match data to get chip capabilities in the\n mchp23k256 driver\n\n - several fixes addressing the newly introduced virt-concat\n support\n\n - a missing build dependency on ndfc\n\n as well as the usual load (if not actually bigger than usual) of\n uninitialized variables, leaks, double free, and AI fuzzed issues\n being fixed\"\n\n* tag \u0027mtd/fixes-for-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:\n Revert \"mtd: maps: remove uclinux map driver\"\n mtd: onenand: samsung: report DMA completion timeouts\n mtd: rawnand: fsl_ifc: return errors for failed page reads\n mtd: mchp23k256: use SPI match data for chip caps\n mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout\n mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout\n mtd: fix double free and WARN_ON in add_mtd_device() error paths\n mtd: virt-concat: free duplicate generated name\n mtd: nand: mtk-ecc: stop on ECC idle timeouts\n mtd: mtdswap: remove debugfs stats file on teardown\n mtd: mtdpart: validate partition bounds in mtd_add_partition()\n mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path\n mtd: rawnand: ndfc: add CONFIG_OF dependency\n mtd: spinand: initialize ret in regular page reads\n mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()\n mtd: rawnand: ingenic: handle ECC clock enable failures\n mtd: nand: ecc-mtk: handle ECC clock enable failures\n mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()\n mtd: rawnand: ndfc: fix gcc uninitialized var\n" }, { "commit": "45419d06c943246229ecbc392f5d1038551e9b9b", "tree": "6eec0f5b814673b6516f708dc3409d075512d5d3", "parents": [ "111e7b23e5b05e2298f2e1a4d2a632bee4dde8b0", "e27c946b589c53520409a0956b33d52ef7a0898f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 09:27:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 09:27:02 2026 -0700" }, "message": "Merge tag \u0027mmc-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC fixes from Ulf Hansson:\n \"MMC core:\n - Fix RPMB device unregister ordering\n - Fix __counted_by handling in mmc_test\n\n MMC host:\n - mtk-sd: Document missing clocks for MT8189\n - sdhci-esdhc-imx: Fix the support for system suspend/resume for SDIO\n - sdhci-of-dwcmshc: Fix error handling for clock prepare/enable\n - vub300:\n - Fix lockdep issue for the cmd_mutex\n - Fix use-after-free on probe failure\n\n MEMSTICK:\n - Reject a card that reports too many blocks\"\n\n* tag \u0027mmc-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n mmc: sdhci-esdhc-imx: fix resume error handling\n mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend\n mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend\n mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt\n mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume\n mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore\n mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume\n mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore\n mmc: block: fix RPMB device unregister ordering\n memstick: ms_block: reject a card that reports too many blocks\n dt-bindings: mmc: mtk-sd: Document extra clocks for MT8189\n mmc: vub300: defer reset until cmd_mutex is unlocked\n mmc: vub300: fix use-after-free on probe failure\n mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion\n mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method\n" }, { "commit": "111e7b23e5b05e2298f2e1a4d2a632bee4dde8b0", "tree": "3ca8d987d6741bec91e59d94f98fa3a0ab56b073", "parents": [ "6917aa77675f48e7bd33392ed6590c8837001697", "3d9855d114f0955d590420f5670152c1099c1638" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 08:52:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 08:52:09 2026 -0700" }, "message": "Merge tag \u0027soc-fixes-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"There are only three devicetree fixes this time: one critical memory\n corruption fix for Renesas and three minor corrections for Tegra.\n\n The MAINTAINERS file is updated for a new maintainer of the CIX\n platform and two address changes.\n\n The rest is all driver fixes, mostly firmware:\n\n - multiple runtime issues in ARM SCMI and FF-A firmware code, dealing\n with error handling for corner cases in firmware.\n\n - multiple fixes for reset drivers, dealing with individual platform\n specific mistakes and more error handling\n\n - minor build and runtime fixes for the Tegra SoC drivers\"\n\n* tag \u0027soc-fixes-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n arm64: dts: renesas: ironhide: Describe inline ECC carveouts\n MAINTAINERS: Update maintainer and git tree for CIX SoC\n ARM: Don\u0027t let ARMv5 platforms select USE_OF\n MAINTAINERS: Update SpacemiT SoC git tree repository\n firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context\n firmware: arm_scmi: Use 64-bit division for clock rate rounding\n reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ\n reset: sunxi: fix memory region leak on ioremap failure\n dt-bindings: reset: altr: add COMBOPHY_RESET for Agilex5\n reset: spacemit: k3: fix USB2 ahb reset\n firmware: arm_scmi: Grammar s/may needed/may be needed/\n firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()\n firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits\n arm64: tegra: Fix CPU1 node unit-address on Tegra264\n arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234\n MAINTAINERS: .mailmap: update Jens Wiklander\u0027s email address\n soc/tegra: fuse: Fix spurious straps warning on SMCCC platforms\n soc/tegra: pmc: fix #ifdef block in header\n drm/tegra: Fix a strange error handling path\n arm64: tegra: Remove fallback compatible for GPCDMA\n" }, { "commit": "6917aa77675f48e7bd33392ed6590c8837001697", "tree": "0acb15d780ac303c5b83dc432bea5d179ac218d4", "parents": [ "fce2dfa773ced15f27dd27cd0b482a7473cdcf2a", "a2c02aa0c6ca3ec9fab6f1c99912a440c7b8bfdb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 08:46:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 17 08:46:56 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n\n - Enable CONFIG_VPA_PMU to be used with KVM\n\n - Initialize starttime at boot for native accounting\n\n - Set CPU_FTR_P11_PVR for Power11 and later processors\n\n - fix memory leak on krealloc failure in papr_init\n\n - Misc fixes and cleanups\n\nThanks to Amit Machhiwal, Christophe Leroy (CS GROUP), Ethan\nNelson-Moore, Gautam Menghani, Harsh Prateek Bora, Junrui Luo, Mukesh\nKumar Chaurasiya (IBM), Ritesh Harjani (IBM), Rosen Penev, Shrikanth\nHegde, Thorsten Blum, and Yuhao Jiang\n\n* tag \u0027powerpc-7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc: Remove dead non-preemption code\n powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors\n powerpc/pseries: fix memory leak on krealloc failure in papr_init\n powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()\n powerpc/vtime: Initialize starttime at boot for native accounting\n powerpc/85xx: Add fsl,ifc to common device ids\n powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()\n powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM\n" }, { "commit": "56d96fededd61192cd7cc8d2b0f36adfd59036c3", "tree": "9256a46888e88c7348777d6726dca11d62837efe", "parents": [ "2c72eb6286347d05a885412fb076993bd5286b53" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Sat Jul 11 04:50:00 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 13:20:38 2026 +0200" }, "message": "mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET\u003dn\n\nOn CONFIG_INET\u003dn builds, mpls_valid_fib_dump_req() walks the parsed\nattribute table itself instead of calling ip_valid_fib_dump_req(). The\nRTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is\npresent, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no\nRTA_OIF hits a NULL dereference.\n\nRTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without\nCAP_NET_ADMIN, so an unprivileged user can trigger it.\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)\n Call Trace:\n mpls_dump_routes (net/mpls/af_mpls.c:2236)\n netlink_dump (net/netlink/af_netlink.c:2331)\n __netlink_dump_start (net/netlink/af_netlink.c:2446)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)\n netlink_rcv_skb (net/netlink/af_netlink.c:2556)\n netlink_unicast (net/netlink/af_netlink.c:1345)\n netlink_sendmsg (net/netlink/af_netlink.c:1900)\n __sock_sendmsg (net/socket.c:790)\n ____sys_sendmsg (net/socket.c:2684)\n ___sys_sendmsg (net/socket.c:2738)\n __sys_sendmsg (net/socket.c:2770)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nSkip unset attributes, as ip_valid_fib_dump_req() does.\n\nFixes: 196cfebf8972 (\"net/mpls: Handle kernel side filtering of route dumps\")\nAssisted-by: Claude:claude-opus-4-8\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260711114958.1009619-3-bestswngs@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2c72eb6286347d05a885412fb076993bd5286b53", "tree": "fb703bb95a7b88c76f7758507af41d9afad5e90b", "parents": [ "04aeddf2dadd0eb7ad016a766dcbe9c983311f09" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Sun Jul 12 21:03:43 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 13:17:46 2026 +0200" }, "message": "llc: fix SAP refcount leak when creating incoming sockets\n\nllc_sap_add_socket() takes a SAP reference for each socket added to a SAP,\nand llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes\nan additional SAP reference after adding the child socket.\n\nThis extra reference was balanced by an explicit llc_sap_put() in\nllc_ui_release() until commit 3100aa9d74db (\"llc: fix SAP reference\ncounting w.r.t. socket handling\") removed that put. The corresponding hold\nin the accept path was left behind.\n\nWhen such a child socket is removed, only the reference taken by\nllc_sap_add_socket() is released. The extra reference keeps the SAP alive\nafter its last socket is removed. Remove the obsolete hold.\n\nFixes: 3100aa9d74db (\"llc: fix SAP reference counting w.r.t. socket handling\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "04aeddf2dadd0eb7ad016a766dcbe9c983311f09", "tree": "61f4fb8b4e63863205b4f53f55f35b5766fdeafc", "parents": [ "1cb8553c02e93e5a150cebd42f9ee3db0ece4707" ], "author": { "name": "Andre Carvalho", "email": "asantostc@gmail.com", "time": "Fri Jul 10 23:19:17 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 13:15:20 2026 +0200" }, "message": "selftests: netconsole: only restore MAC when it changed on resume\n\nThe \"mac\" bind mode reactivation downs the interface, restores the saved\nMAC and renames it to trigger a target resume. This assumes the recreated\ninterface comes back with a different MAC, which is true under\nMACAddressPolicy\u003dnone (as on the Netdev CI) but not when MACs are\npersistent. In the persistent case netconsole resumes the target on its\nown, and the down/restore/rename flow instead drops it and fails the test.\n\nGuard the block on the MAC having actually changed so the test passes\nunder both policies.\n\nFixes: 6ecc08329bab (\"selftests: netconsole: validate target resume\")\nReported-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nCloses: https://lore.kernel.org/netdev/f398373e-2cb4-4649-a491-9763df94d98b@kernel.org/\nSigned-off-by: Andre Carvalho \u003casantostc@gmail.com\u003e\nTested-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260710-netcons-mac-reload-v1-1-3fb1bcc70b4a@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1cb8553c02e93e5a150cebd42f9ee3db0ece4707", "tree": "2797b22625cce076c1ae05976e35367a00d6294f", "parents": [ "e0b5252a59383b77d1b8dbeda00b7184dd95f4d3" ], "author": { "name": "Ruoyu Wang", "email": "ruoyuw560@gmail.com", "time": "Sun Jul 12 00:37:16 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 12:43:57 2026 +0200" }, "message": "bnxt_en: Handle partially initialized auxiliary devices\n\nbnxt_aux_devices_init() calls auxiliary_device_init() before all fields\nused by bnxt_aux_dev_release() are initialized. After\nauxiliary_device_init() succeeds, later errors must unwind with\nauxiliary_device_uninit(), which invokes the release callback.\n\nThe release callback assumes that aux_priv-\u003eid, aux_priv-\u003eedev,\nedev-\u003enet and edev-\u003eulp_tbl are all populated. If allocation fails\nafter auxiliary_device_init(), the release path can otherwise dereference\nor clear partially initialized state.\n\nAllocate and attach the bnxt_en_dev and ULP table before calling\nauxiliary_device_init(), so the release callback only sees a fully\ninitialized auxiliary private object. If auxiliary_device_init() itself\nfails, free those allocations directly because device_initialize() has not\nrun and the release callback will not be invoked.\n\nThis issue was found by a static analysis checker and confirmed by manual\nsource review.\n\nFixes: 194fad5b2781 (\"bnxt_en: Refactor bnxt_rdma_aux_device_init/uninit functions\")\nSigned-off-by: Ruoyu Wang \u003cruoyuw560@gmail.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/20260711163716.3996929-1-ruoyuw560@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e0b5252a59383b77d1b8dbeda00b7184dd95f4d3", "tree": "a7021b05401222c576497e2c80f0c76906c5d60c", "parents": [ "f1f5c8a3955f8fda3f84ed883ac8daa1847e724c" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Fri Jul 10 14:12:35 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 12:27:53 2026 +0200" }, "message": "sctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize.\n\nFixes: 1f485649f529 (\"[SCTP]: Implement SCTP-AUTH internals\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cdstsmallbird@foxmail.com\u003e\nReported-by: Zihan Xi \u003cxizh2024@lzu.edu.cn\u003e\nReported-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.1783707155.git.lucien.xin@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f1f5c8a3955f8fda3f84ed883ac8daa1847e724c", "tree": "593665a3ba267e5df5a898e07dde3ef422bf9cab", "parents": [ "d2e914a4a0d0f753dbae830264850d044026167c" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Jul 11 11:05:37 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 12:13:20 2026 +0200" }, "message": "net/sched: act_tunnel_key: Defer dst_release to RCU callback\n\nFix a race-condition use-after-free in tunnel_key_release_params().\n\nThe function releases the metadata_dst of the old params synchronously\nvia dst_release() while deferring the params struct free with\nkfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may\nstill hold the old params pointer (under rcu_read_lock_bh) and proceed\nto call dst_clone(\u0026params-\u003etcft_enc_metadata-\u003edst) after the writer\u0027s\ndst_release has already pushed the dst\u0027s rcuref to RCUREF_DEAD.\n\nzdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified\nthat KASAN reports:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112\nBUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\nBUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109\nBUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173\nBUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168\nWrite of size 4 at addr ffff88806158de40 by task poc/9388\n\nCPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy)\nTainted: [W]\u003dWARN\nHardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94\n dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378\n print_report+0x139/0x4ad mm/kasan/report.c:482\n kasan_report+0xe4/0x1d0 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186\n kasan_check_range+0x125/0x200 mm/kasan/generic.c:200\n instrument_atomic_read_write include/linux/instrumented.h:112\n atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\n __rcuref_put include/linux/rcuref.h:109\n rcuref_put include/linux/rcuref.h:173\n dst_release+0x5b/0x370 net/core/dst.c:168\n refdst_drop include/net/dst.h:272\n skb_dst_drop include/net/dst.h:284\n skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163\n skb_release_all net/core/skbuff.c:1187\n[..]\nAllocated by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398\n __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263\n __do_kmalloc_node mm/slub.c:5296\n __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308\n kmalloc_noprof include/linux/slab.h:954\n kzalloc_noprof include/linux/slab.h:1188\n offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35\n tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n[..]\nFreed by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:253\n __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285\n kasan_slab_free include/linux/kasan.h:235\n slab_free_hook mm/slub.c:2689\n slab_free mm/slub.c:6251\n kfree+0x21f/0x6b0 mm/slub.c:6566\n tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n\nThe buggy address belongs to the object at ffff88806158de00\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 64 bytes inside of\n freed 256-byte region [ffff88806158de00, ffff88806158df00)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c\nhead: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nflags: 0x4fff00000000240(workingset|head|node\u003d1|zone\u003d1|lastcpupid\u003d0x7ff)\npage_type: f5(slab)\nraw: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190\nraw: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000\nhead: 04fff00000000240 ffff88801c841b40 ffffea0001856290 ffffea0001856190\nhead: ffff88806158d600 0000000800100009 00000000f5000000 0000000000000000\nhead: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff\nhead: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002\npage dumped because: kasan: bad access detected\npage_owner tracks the page as allocated\npage last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9391, tgid 9378 (poc), ts 123227323196, free_ts 0\n set_page_owner include/linux/page_owner.h:32\n post_alloc_hook+0xfe/0x140 mm/page_alloc.c:1853\n prep_new_page mm/page_alloc.c:1861\n get_page_from_freelist+0x110c/0x2fc0 mm/page_alloc.c:3941\n __alloc_frozen_pages_noprof+0x263/0x2bc0 mm/page_alloc.c:5221\n alloc_slab_page mm/slub.c:3278\n allocate_slab mm/slub.c:3467\n new_slab+0xa6/0x690 mm/slub.c:3525\n refill_objects+0x271/0x420 mm/slub.c:7272\n refill_sheaf mm/slub.c:2816\n __pcs_replace_empty_main+0x373/0x630 mm/slub.c:4652\n alloc_from_pcs mm/slub.c:4750\n slab_alloc_node mm/slub.c:4884\n __do_kmalloc_node mm/slub.c:5295\n __kmalloc_noprof+0x66d/0x830 mm/slub.c:5308\n kmalloc_noprof include/linux/slab.h:954\n metadata_dst_alloc+0x26/0x90 net/core/dst.c:298\n tun_rx_dst include/net/dst_metadata.h:144\n __ip_tun_set_dst include/net/dst_metadata.h:208\n tunnel_key_init+0xb01/0x1b90 net/sched/act_tunnel_key.c:451\n tcf_action_init_1+0x46b/0x6c0 net/sched/act_api.c:1428\n tcf_action_init+0x448/0xa20 net/sched/act_api.c:1503\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n[..]\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFix by moving dst_release() into a custom RCU callback that runs\nafter the grace period, matching the lifetime of the containing\nparams struct. Readers in the datapath therefore always find a live\nrcuref when calling dst_clone().\n\nFixes: 9174c3df1cd18 (\"net/sched: act_tunnel_key: fix memory leak in case of action replace\")\nReported-by: zdi-disclosures@trendmicro.com\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Davide Caratti \u003cdcaratti@redhat.com\u003e\nLink: https://patch.msgid.link/20260711150537.7946-1-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d2e914a4a0d0f753dbae830264850d044026167c", "tree": "9c872b7e4a30136988a6aebbcffd8a6190fa7bb1", "parents": [ "2c1931a81122c3cdc4c89448fe0442c69e21c0d5" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Fri Jul 10 21:36:25 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 12:02:23 2026 +0200" }, "message": "dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()\n\nWhen a dpll_pin is shared across multiple dpll_device instances and\nthose devices are being unregistered (e.g. during driver module removal),\na NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync().\n\nThis happens under the following conditions:\n - A pin is registered with two or more dpll devices (dpll_A, dpll_B)\n - The pin has ref_sync pairs with other pins\n - During unregistration of dpll_A\u0027s pins, a ref_sync partner pin is\n unregistered first, removing it from dpll_A-\u003epin_refs\n - But since the partner pin is still registered with dpll_B, its\n dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT\n run and the partner stays in the pin\u0027s ref_sync_pins xarray\n - When the pin itself is then unregistered from dpll_A, the delete\n notification calls dpll_msg_add_pin_ref_sync() which finds the\n partner in ref_sync_pins, passes dpll_pin_available() (partner is\n still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A,\n partner) returns NULL because partner was already removed from\n dpll_A-\u003epin_refs\n - The NULL priv pointer is passed to the driver\u0027s ref_sync_get\n callback, which dereferences it\n\n BUG: kernel NULL pointer dereference, address: 0000000000000034\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x]\n Call Trace:\n dpll_msg_add_pin_ref_sync+0xb8/0x200\n dpll_cmd_pin_get_one+0x3b6/0x4b0\n dpll_pin_event_send+0x72/0x140\n __dpll_pin_unregister+0x5a/0x2b0\n dpll_pin_unregister+0x49/0x70\n\nFix this by skipping ref_sync pins whose priv pointer cannot be resolved\nfor the current dpll device.\n\nFixes: 58256a26bfb3 (\"dpll: add reference sync get/set\")\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Jiri Pirko \u003cjiri@nvidia.com\u003e\nLink: https://patch.msgid.link/20260710193625.1378822-1-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2c1931a81122c3cdc4c89448fe0442c69e21c0d5", "tree": "85ade794b730bd8b7075ee1e07cfd1ff3bdb204a", "parents": [ "df6134b527a88b3e65ba6ae5073664af091d5fd2" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Jul 10 18:13:17 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:53:55 2026 +0200" }, "message": "tcp: fix TIME_WAIT socket reference leak on PSP policy failure\n\nRelease the TIME_WAIT socket reference and jump to discard_it\nupon PSP policy failure in both IPv4 and IPv6 receive paths.\nThis prevents a memory leak of tcp_tw_bucket structures.\n\nFixes: 659a2899a57d (\"tcp: add datapath logic for PSP with inline key exchange\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20260710181317.4060230-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "df6134b527a88b3e65ba6ae5073664af091d5fd2", "tree": "a8a02b0fd15f1197dc1c77cce73c652bc2bd426d", "parents": [ "892d3087c4fcee2cd9a8dbc0e9a0e5cda4827910" ], "author": { "name": "Zhiping Zhang", "email": "zhipingz@meta.com", "time": "Thu Jul 02 15:24:58 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:50:02 2026 +0200" }, "message": "net/mlx5: free mlx5_st_idx_data on final dealloc\n\nWorkloads that repeatedly allocate and release mkeys carrying TPH\nsteering-tag hints (e.g. churning RDMA MRs) leak one\nstruct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced\nand the kmalloc slab grows over time.\n\nWhen the last reference to an ST table entry is dropped,\nmlx5_st_dealloc_index() removed the entry from idx_xa but the backing\nmlx5_st_idx_data allocation was never freed.\n\nFree idx_data after the xa_erase() so the lifetime of the bookkeeping\nstruct matches the lifetime of the ST entry it tracks.\n\nCc: stable@vger.kernel.org\nFixes: 888a7776f4fb (\"net/mlx5: Add support for device steering tag\")\nReviewed-by: Michael Gur \u003cmichaelgur@nvidia.com\u003e\nSigned-off-by: Zhiping Zhang \u003czhipingz@meta.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260702222507.1234467-1-zhipingz@meta.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "892d3087c4fcee2cd9a8dbc0e9a0e5cda4827910", "tree": "b77fae26dab4f2a58f3bfeabc8e68e5b0fcc6021", "parents": [ "78d24e77ffd35e95fe3f491d416f2e947ba7e1d5", "6fd9e37916b9537143a295f854fdf5e52c4c5bc1" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:38:27 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:38:27 2026 +0200" }, "message": "Merge tag \u0027linux-can-fixes-for-7.2-20260716\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2026-07-16\n\nthis is a pull request of 19 patches for net/main.\n\nThe first patch is by Alexander Hölzl and fixes the Kconfig\ndescription of the vxcan driver.\n\nNext patch by Fan Wu fixes the tear down order in the esd_usb driver.\n\nFollowed by a patch by Oliver Hartkopp that adds missing locking for\nthe raw flags in the CAN_RAW protocol.\n\nShuhao Fu\u0027s patch for the j1939 protocol fix lockless\nlocal-destination check.\n\nStéphane Grosjean updates their email address.\n\nThe next 11 patches all target the CAM Broadcast Manager protocol. One\ncontributed by Lee Jones the remaining ones by Oliver Hartkopp. They\nfix several concurrency and locking issues found by various bots.\n\nThe last 3 patches are also by Oliver Hartkopp fixing concurrency and\nlocking issues found by various bots in the CAN ISO Transport\nProtocol.\n\nlinux-can-fixes-for-7.2-20260716\n\n* tag \u0027linux-can-fixes-for-7.2-20260716\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n can: isotp: serialize TX state transitions under so-\u003erx_lock\n can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER\n can: isotp: use unconditional synchronize_rcu() in isotp_release()\n can: bcm: track a single source interface for ANYDEV timeout/throttle ops\n can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()\n can: bcm: fix stale rx/tx ops after device removal\n can: bcm: add missing device refcount for CAN filter removal\n can: bcm: validate frame length in bcm_rx_setup() for RTR replies\n can: bcm: extend bcm_tx_lock usage for data and timer updates\n can: bcm: add missing rcu list annotations and operations\n can: bcm: fix CAN frame rx/tx statistics\n can: bcm: add locking when updating filter and timer values\n can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure\n can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF\n can: peak: Modification of references to email accounts being deleted\n can: j1939: fix lockless local-destination check\n can: raw: add locking for raw flags bitfield\n can: esd_usb: kill anchored URBs before freeing netdevs\n can: vxcan: Kconfig: fix description stating no local echo provided\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260716155528.809908-1-mkl@pengutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "78d24e77ffd35e95fe3f491d416f2e947ba7e1d5", "tree": "7f0bc4a36bb848116701893fc6c433d390bcac2d", "parents": [ "bc7291793fdc9fb1f48a0b50b4412581e78d2f27", "c1cec2bbbeb5922d42d28c6af1707c4f3f8647e3" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:27:43 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:27:43 2026 +0200" }, "message": "Merge tag \u0027for-net-2026-07-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - hci_sync: hold hdev-\u003elock for hci_conn_params lookups\n - hci_sync: extend conn_hash lookup critical sections\n - hci_qca: Clear memdump state on invalid dump size\n - MGMT: revalidate LOAD_CONN_PARAM queued update\n - MGMT: Translate HCI reason in Device Disconnected event\n - MGMT: fix locking in unpair_device/disconnect_sync\n - MGMT: hold reference for hci_conn in mgmt_pending_cmds\n - btrtl: validate firmware patch bounds\n - qca: fix NVM tag length underflow in TLV parser\n\n* tag \u0027for-net-2026-07-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: mgmt: Translate HCI reason in Device Disconnected event\n Bluetooth: hci_qca: Clear memdump state on invalid dump size\n Bluetooth: hci_sync: hold hdev-\u003elock for hci_conn_params lookups\n Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds\n Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync\n Bluetooth: hci_sync: extend conn_hash lookup critical sections\n Bluetooth: btrtl: validate firmware patch bounds\n Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\n Bluetooth: qca: fix NVM tag length underflow in TLV parser\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260713141940.954317-1-luiz.dentz@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "bc7291793fdc9fb1f48a0b50b4412581e78d2f27", "tree": "db4e0852327923eecccd92011763a9d7d7c2b6ae", "parents": [ "3f1f755366687d051174739fb99f7d560202f60b", "f468c48d488d0ea2df3422b3e1dfafae1611e853" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:19:36 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 17 11:19:37 2026 +0200" }, "message": "Merge tag \u0027nf-26-07-10\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nThe following patchset contains Netfilter fixes for *net*.\nThese are fixes for bugs except patches 6 and 9 which fix issues added in\nlast PR and 7.1-rc1.\n\n1) Reject unsupported target families in xt_nat_checkentry().\nFrom Wyatt Feng.\n\n2) Fix inverted time_after() check in ecache_work_evict_list().\nCauses pointless work rescheds and thus way longer time to\nclear the pending event backlog. From Yizhou Zhao.\n\n3) Fix a use-after-free in br_ip6_fragment() caused by a dangling prevhdr\npointer. From Xiang Mei.\n\n4) Fix incorrect conntrack zone comparison in nf_conncount tuple\ndeduplication. Pass IP_CT_DIR_ORIGINAL, not zone direction.\nFrom Yizhou Zhao.\n\n5) Add bridge tunnel flowtable regression test for a bug that\n got fixed in the previous PR. From Zhengyang Chen.\n\n6) Use the correct direction when setting up tunnel routes in the flowtable\nxmit path. From Pablo Neira Ayuso. This fixes a bug added in the\nprevious PR.\n\n7) Reload IP header after potential skb head reallocation in IPVS.\n\n8) Fix incorrect IPv6 transport offsets in TCP application code. Correct the\nICMPv6 header offset to ensure proper checksumming with extension headers,\nfrom Julian Anastasov. this is a followup to the previous PR.\n\n9) Remove null-termination requirement for xt_physdev masks, this broke\n device names with 15 characters.\n\nnetfilter pull request nf-26-07-10\n\n* tag \u0027nf-26-07-10\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: xt_physdev: masks are not c-strings\n ipvs: fix more places with wrong ipv6 transport offsets\n ipvs: reload ip header after head reallocation\n netfilter: flowtable: use correct direction to set up tunnel route\n selftests: netfilter: add bridge tunnel flowtable regression\n netfilter: nf_conncount: fix zone comparison in tuple dedup\n netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()\n netfilter: ecache: fix inverted time_after() check\n netfilter: xt_nat: reject unsupported target families\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260710143733.29741-1-fw@strlen.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "faebb7ba1ac65fa5810b640df02ce04e509fdc11", "tree": "0874e13a6b5508bc949cd61070ea8d104850052b", "parents": [ "266cddf7bd0f6c79b6c0633aef742a22bf70265b" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Thu Jul 16 08:13:05 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Thu Jul 16 20:05:28 2026 -0700" }, "message": "accel/amdxdna: Fix use-after-free of mm_struct in job scheduler\n\namdxdna_cmd_submit() stores current-\u003emm in job-\u003emm without holding any\nreference. aie2_sched_job_run() later access job-\u003emm from the DRM\nscheduler worker thread. With only a raw pointer and no structural\nreference, the mm_struct can be freed before the scheduler runs the job.\n\nFix this by calling mmgrab() to hold a structural mm_count reference for\nthe lifetime of the job, paired with mmdrop() in every cleanup path.\n\nFixes: aac243092b70 (\"accel/amdxdna: Add command execution\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260716151305.1595780-1-lizhi.hou@amd.com\n" }, { "commit": "fce2dfa773ced15f27dd27cd0b482a7473cdcf2a", "tree": "68e2d2ef7a92b277b3b00d93710d98d2053866a9", "parents": [ "481ed5dd3ed7136f627b8ec372ba39f5b2e7d27f", "d7d2adcd022baade5cab65ca492ce63421ce3a6e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 16:46:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 16:46:26 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - fallocate fixes\n\n - unit test fixes\n\n - fix allocation size after duplicate extents\n\n - fix check for overlapping data areas\n\n* tag \u0027v7.2-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb/client: flush dirty data before punching a hole\n smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols in SMB2\n smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols\n smb: client: reject overlapping data areas in SMB2 responses\n smb/client: refresh allocation after EOF-extending fallocate\n smb/client: emulate small EOF-extending mode 0 fallocate ranges\n smb/client: reduce fallocate zero buffer allocation\n smb/client: handle overlapping allocated ranges in fallocate\n smb/client: refresh allocation size after duplicate extents\n smb: client: use kvzalloc() for megabyte buffer in simple fallocate\n" }, { "commit": "3d84d674e3a5a33ce5eaa14b92bc839c3821a348", "tree": "4680b06f6bb44f7319c3313a387a4d382f5c22ba", "parents": [ "4967bd533db2dc947574ee55ba44b3306ef3b7b1", "0af15f3057a60a038864d47fa4b54d1c3c3c654c" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Thu Jul 16 16:11:30 2026 -0700" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Thu Jul 16 16:11:30 2026 -0700" }, "message": "Merge branch \u0027bpf-fix-tracing-of-kfuncs-with-implicit-args\u0027\n\nIhor Solodrai says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Fix tracing of kfuncs with implicit args\n\nTejun reported an issue where a BPF program tracing a kfunc with\nKF_IMPLICIT_ARGS can crash the kernel [1]. This is caused by a bug in\nbpf_check_attach_target(): the btf_func_model for such a kfunc is\ncomputed from a wrong BTF prototype. For more details see the commit\nmessage of patch #1.\n\nThe second patch adds a selftest that can catch this situation.\n\nThe fix is a candidate for 7.1 backport.\n\n[1] https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106\n---\n\nv2-\u003ev3:\n * Replace btf_kfunc_accumulated_flags() with btf_kfunc_check_flag()\n following a discussion with Eduard. Inlining the hook walk is a\n worse option than a helper, because BTF_KFUNC_HOOK_MAX and co are\n internal to btf.c and exposing them is uglier.\n * remove reduntant btf_is_func check (Jiri)\n * formatting nit (Eduard)\nv2: https://lore.kernel.org/bpf/20260710192940.3020280-1-ihor.solodrai@linux.dev/\n\nv1-\u003ev2:\n * Take a module reference in btf_attach_func_proto() around the\n btf_kfunc_accumulated_flags() call (sashiko)\n\nv1: https://lore.kernel.org/bpf/20260710005902.2234832-1-ihor.solodrai@linux.dev/\n\n---\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260713235223.1639022-1-ihor.solodrai@linux.dev\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "0af15f3057a60a038864d47fa4b54d1c3c3c654c", "tree": "4680b06f6bb44f7319c3313a387a4d382f5c22ba", "parents": [ "3917b1012ee2fef6da16d7450d4267dcb3e93363" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Mon Jul 13 16:52:23 2026 -0700" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Thu Jul 16 16:11:29 2026 -0700" }, "message": "selftests/bpf: Cover tracing implicit kfunc args\n\nKF_IMPLICIT_ARGS kfuncs have a BPF-call prototype and a real kernel\ntarget prototype. Add a tracing selftest that attaches fentry and fexit\nprograms to bpf_kfunc_implicit_arg(), runs a syscall BPF program that\ncalls it, and checks that the tracing context exposes both the explicit\nargument and the implicit prog aux pointer.\n\nCo-developed-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nSigned-off-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nLink: https://patch.msgid.link/20260713235223.1639022-3-ihor.solodrai@linux.dev\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "3917b1012ee2fef6da16d7450d4267dcb3e93363", "tree": "6f2b1ba4717b84cd208832d495eb7c83117b6471", "parents": [ "4967bd533db2dc947574ee55ba44b3306ef3b7b1" ], "author": { "name": "Ihor Solodrai", "email": "ihor.solodrai@linux.dev", "time": "Mon Jul 13 16:52:22 2026 -0700" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Thu Jul 16 16:11:29 2026 -0700" }, "message": "bpf: Fix tracing of kfuncs with implicit args\n\nA kfunc marked with KF_IMPLICIT_ARGS flag takes implicit arguments\n(such as bpf_prog_aux) that the verifier injects at load time.\nresolve_btfids strips those from the kfunc\u0027s BTF-visible prototype and\nkeeps the real kernel ABI in a counterpart _impl prototype [1].\n\nfentry/fexit/fmod_ret/fsession programs may attach to the BPF kernel\nfunctions, including those with implicit args. However\nbpf_check_attach_target() and bpf_check_attach_btf_id_multi() extract\nthe struct btf_func_model from the wrong BTF prototype of the\nkfunc. The btf_func_model is later read to construct the trampoline,\nwhich then causes the injected implicit argument to be clobbered and\nthe kfunc dereferencing garbage.\n\nAdd btf_attach_func_proto() to resolve the real ABI prototype of the\nkfunc the way the call site does: by looking up the _impl prototype\nfor a KF_IMPLICIT_ARGS kfunc. Use it at both attach-target model\nconstruction sites.\n\nTo enable this, make two supporting changes:\n * pass bpf_verifier_log instead of bpf_verifier_env to\n find_kfunc_impl_proto(), so it can be reused from the attach path\n * add btf_kfunc_check_flag() to test a flag across all of a kfunc\u0027s\n hook sets, because a program attaching to a kfunc is not in the\n kfunc\u0027s call-set\n\nKF_IMPLICIT_ARGS must be consistent across the sets, so\nbtf_kfunc_check_flag() returns -EINVAL on inconsistency.\n\nbtf_kfunc_check_flag() reads the kfunc\u0027s flags from the target\u0027s\nkfunc_set_tab. For a module BTF that table is stable only after the\nmodule is live, so take a module reference around the read, mirroring\nhow the kfunc call path gates the same lookup with btf_try_get_module().\n\nThe remaining call sites of btf_distill_func_proto() are safe as\nis. The BPF_TRACE_ITER case distills a registered iterator\u0027s\nprototype, and bpf_struct_ops_desc_init() distills the\nfunction-pointer members of a struct_ops type. Neither is a kfunc, and\nso can\u0027t have implicit arguments.\n\n[1] https://lore.kernel.org/all/20260120222638.3976562-1-ihor.solodrai@linux.dev/\n\nFixes: 64e1360524b9 (\"bpf: Verifier support for KF_IMPLICIT_ARGS\")\nReported-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nLink: https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106\nLink: https://patch.msgid.link/20260713235223.1639022-2-ihor.solodrai@linux.dev\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "481ed5dd3ed7136f627b8ec372ba39f5b2e7d27f", "tree": "3f6747ad347c3b1d31605ebef56a9a7606bf7288", "parents": [ "e22254e9ddd8020130c4b806b6b4aa77b09c2560", "5ab1dc6d110db6bee167a32fd94c53ea0e7ad6d2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 13:22:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 13:22:17 2026 -0700" }, "message": "Merge tag \u0027landlock-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull landlock fix from Mickaël Salaün:\n \"This fixes TCP Fast Open support, specific test environments, and doc\n warnings\"\n\n* tag \u0027landlock-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available\n selftests/landlock: Fix screwed up pointers in the scoped_signal_test\n landlock: Update formatting\n landlock: Fix kernel-doc for the nested quiet layer flag\n selftests/landlock: Add test for TCP fast open\n landlock: Fix TCP Fast Open connection bypass\n" }, { "commit": "266cddf7bd0f6c79b6c0633aef742a22bf70265b", "tree": "45ef1e5523345101d40d46c8b2dba93181acc6b5", "parents": [ "ddb44baed257560f192b145ed36cf8c0a412de47" ], "author": { "name": "Mikko Perttunen", "email": "mperttunen@nvidia.com", "time": "Wed Jun 03 17:37:49 2026 +0900" }, "committer": { "name": "Thierry Reding", "email": "treding@nvidia.com", "time": "Thu Jul 16 20:26:28 2026 +0200" }, "message": "gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings\n\n__host1x_bo_unpin() drops the last reference to the mapping and frees\nit, so we can\u0027t dereference mapping afterwards. The cache itself\noutlives the mapping, so use the cache local variable instead.\n\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u\nSigned-off-by: Mikko Perttunen \u003cmperttunen@nvidia.com\u003e\nSigned-off-by: Thierry Reding \u003ctreding@nvidia.com\u003e\nLink: https://patch.msgid.link/20260603-host1x-bocache-leak-fix-v1-1-494101dbfd30@nvidia.com\n" }, { "commit": "e22254e9ddd8020130c4b806b6b4aa77b09c2560", "tree": "1d82414e40b66294f47421b3e671e54b734a7efe", "parents": [ "133fc7aaccf61b0d29f61b37202d5812da5dc03f", "59c462b0f5cfa107794228051724b34ae9334168" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 09:40:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 09:40:03 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"This contains mostly a series of bug fixes found by different LLM\n models\"\n\n* tag \u0027xfs-fixes-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (21 commits)\n xfs: don\u0027t zap bmbt forks if they are MAXLEVELS tall\n xfs: clamp timestamp nanoseconds correctly\n xfs: fully check the parent handle when it points to the rootdir\n xfs: handle non-inode owners for rtrmap record checking\n xfs: fix off-by-one error when calling xchk_xref_has_rt_owner\n xfs: set xfarray killable sort correctly\n xfs: grab rtrmap btree when checking rgsuper\n xfs: write the rg superblock when fixing it\n xfs: use the rt version of the cow staging checker\n xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging\n xfs: don\u0027t wrap around quota ids in dqiterate\n xfs: move cow_replace_mapping to xfs_bmap_util.c\n xfs: make cow repair somewhat flaky when debugging knob enabled\n xfs: don\u0027t replace the wrong part of the cow fork\n xfs: resample the data fork mapping after cycling ILOCK\n xfs: fix null pointer dereference in tracepoint\n xfs: use xfs_csn_t for xlog_cil_push_now() push_seq parameter\n xfs: tie zoned sysfs lifetime to zone info\n xfs: fail recovery on a committed log item with no regions\n xfs: splice unsorted log items back to the transaction after the loop\n ...\n" }, { "commit": "133fc7aaccf61b0d29f61b37202d5812da5dc03f", "tree": "be2f728b9e470eeab3121666bf3c1d4531551386", "parents": [ "6f5156d7a31a8c3b0f34af4675c9299c8f877cbe", "1572282de6d3377ca8605d48c50df3a8c08468e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 09:30:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 09:30:42 2026 -0700" }, "message": "Merge tag \u0027erofs-for-7.2-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs fixes from Gao Xiang:\n\n - Fix sanity checks for ztailpacking tail pclusters to avoid\n false corruption reports\n\n - Use more informative s_id for file-backed mounts\n\n - Hide the meaningless \"cache_strategy\u003d\" mount option on plain\n (uncompressed) filesystems\n\n - Remove the unneeded erofs_is_ishare_inode() helper\n\n* tag \u0027erofs-for-7.2-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: hide \"cache_strategy\u003d\" for plain filesystems\n erofs: get rid of erofs_is_ishare_inode() helper\n erofs: relax sanity check for tail pclusters due to ztailpacking\n erofs: use more informative s_id for file-backed mounts\n" }, { "commit": "6f5156d7a31a8c3b0f34af4675c9299c8f877cbe", "tree": "fdd2662572f72521ceb3151cd5c5618c6ba6e956", "parents": [ "4302c3503cbe00c54900105d15eeea3b1a8030fa", "d2d5c129d07ea8eb91cd8a8633b5774116c4d171" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 09:27:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 09:27:05 2026 -0700" }, "message": "Merge tag \u0027pm-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix two cpufreq issues, one in the intel_pstate driver and one\n in the core:\n\n - Make cpufreq_update_pressure() use cpuinfo.max_freq as the default\n reference frequency when arch_scale_freq_ref() returns 0 to allow\n the scheduler to still take CPU frequency caps into account in\n those cases (Rafael Wysocki)\n\n - Use the HWP guaranteed performance level as the full capacity\n performance in intel_pstate on hybrid systems when turbo\n frequencies are not allowed to be used to make scale-invariance\n work as expected in those cases (Rafael Wysocki)\"\n\n* tag \u0027pm-7.2-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq\n cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()\n" }, { "commit": "4302c3503cbe00c54900105d15eeea3b1a8030fa", "tree": "36b6c29f9e6da317610210cf31a6d64bc5a6ae29", "parents": [ "c270a4218b810819ad68513cfeb8caa7830fc53a", "a4876f11aa1d076802676e23f8af500706e780e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 08:46:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 16 08:46:20 2026 -0700" }, "message": "Merge tag \u0027pmdomain-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n \"imx:\n - Assign child domains for imx93 to prevent power off when in use\n - Fix i.MX8MP power up sequences\n\n mediatek:\n - Fix possible nullptr in HWV cleanup/on-check\"\n\n* tag \u0027pmdomain-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check\n pmdomain: imx: Fix i.MX8MP VC8000E power up sequence\n pmdomain: imx: Fix i.MX8MP power notifier\n pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n dt-bindings: power: imx93: Add MIPI PHY power domain\n" }, { "commit": "612978b83f45bf7018815209db5395d759db6f26", "tree": "cf2cc51738bac96d26545d2e811a21dab271c25d", "parents": [ "e89978c1cff54e265345c66e1177d19ea5a8bc00" ], "author": { "name": "Emre Cecanpunar", "email": "emreleno@gmail.com", "time": "Wed Jul 15 01:04:30 2026 +0300" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Thu Jul 16 11:27:19 2026 -0400" }, "message": "drm/i915/selftests: Fix GT PM sort comparators\n\nCompare the sampled clock values instead of their addresses. Comparing\naddresses leaves the samples unsorted, preventing the code from discarding\nthe minimum and maximum samples.\n\nFixes: 1a5392479207 (\"drm/i915/selftests: Measure CS_TIMESTAMP\")\nSigned-off-by: Emre Cecanpunar \u003cemreleno@gmail.com\u003e\nSigned-off-by: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\nLink: https://lore.kernel.org/r/20260714220430.238433-1-emreleno@gmail.com\n(cherry picked from commit 682ea2d28d18bb06f9fc663cb5ab7e80dc0e606a)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "e89978c1cff54e265345c66e1177d19ea5a8bc00", "tree": "11aac0568db37bd22ee80e4719b841cd53f6a333", "parents": [ "f61289af2667a942f48859fe0b030894153ad1d2" ], "author": { "name": "Vinod Govindapillai", "email": "vinod.govindapillai@intel.com", "time": "Mon Jun 15 23:33:49 2026 +0300" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Thu Jul 16 11:27:12 2026 -0400" }, "message": "drm/i915/wm: clear the plane ddb_y entries on plane disable\n\nThe UV/Y plane DDB entriess are never cleared on\nsk_wm_plane_disable_noatomic() and can leave stale DDB state\nfor NV12 planes on pre-Gen11 devices\n\nFixes: d34b59d5ba41 (\"drm/i915: Add skl_wm_plane_disable_noatomic()\")\nAssisted-by: Copilot:claude-sonnet-4.6\nSigned-off-by: Vinod Govindapillai \u003cvinod.govindapillai@intel.com\u003e\nReviewed-by: Suraj Kandpal \u003csuraj.kandpal@intel.com\u003e\nLink: https://patch.msgid.link/20260615203355.218578-2-vinod.govindapillai@intel.com\n(cherry picked from commit 60f68a6ba298fd1e971a2d91576304bee89a16fc)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "50dce2e2f84b56d8b4b406d97a1543709e8a87f5", "tree": "d8727cb12929fe7a39e034454e5f9f4ce73d63c9", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Abhishek Ojha", "email": "Abhishek.ojha@savoirfairelinux.com", "time": "Wed Jul 15 13:04:08 2026 -0400" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jul 16 16:19:07 2026 +0100" }, "message": "regulator: ltc3676: Fix incorrect IRQSTAT bit offsets\n\nThe LTC3676_IRQSTAT_* bit definitions do not match the IRQSTAT\n(Interrupt Request Status) register layout documented in Table 15\nof the LTC3676/LTC3676-1 datasheet:\n\n bit 0 - Pushbutton Status Active\n bit 1 - Hard Reset Occurred\n bit 2 - PGOOD Timeout Occurred\n bit 3 - Undervoltage Warning\n bit 4 - Undervoltage Standby (Fault) Occurred\n bit 5 - Overtemperature Warning\n bit 6 - Overtemperature Standby (Fault) Occurred\n bit 7 - Reserved\n\nThe driver instead defines these starting at bit 3, one bit higher\nthan the datasheet specifies, which causes ltc3676_regulator_isr()\nto check the wrong status bits and misreport (or miss) PGOOD\ntimeout, undervoltage and thermal warning/fault conditions.\n\nFix the bit offsets to match the datasheet.\n\nFixes: 37b918a034fe (\"regulator: Add LTC3676 support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Abhishek Ojha \u003cAbhishek.ojha@savoirfairelinux.com\u003e\nLink: https://patch.msgid.link/20260715170408.295552-1-Abhishek.ojha@savoirfairelinux.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "15b38176fd1530372905c602fde51fe89ec8c877", "tree": "8de023762645c320acba8e5f34fe8ee7406bca68", "parents": [ "35754558f6c21d0fa0985dceb3387071a3348aff" ], "author": { "name": "Xiang Mei (Microsoft)", "email": "xmei5@asu.edu", "time": "Mon Jul 13 21:55:10 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: validate compound request size before reading StructureSize2\n\nWhen ksmbd validates a compound (chained) SMB2 request,\nksmbd_smb2_check_message() reads pdu-\u003eStructureSize2 without first\nchecking that the compound element is large enough to contain it.\nStructureSize2 is a 2-byte field at offset 64\n(__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.\n\nThe compound-walking logic only guarantees that a full 64-byte SMB2\nheader is present for the trailing element: when NextCommand is 0, len is\nreduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A\nremote client can craft a compound request whose last element has exactly\n64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte\npast the receive buffer, producing a slab-out-of-bounds read.\n\n BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14\n The buggy address is located 172 bytes inside of allocated 173-byte region\n Workqueue: ksmbd-io handle_ksmbd_work\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n handle_ksmbd_work (fs/smb/server/server.c:119)\n process_one_work (kernel/workqueue.c:3314)\n worker_thread (kernel/workqueue.c:3397)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\nReject any compound element that is too small to hold StructureSize2\nbefore dereferencing it.\n\nFixes: e2f34481b24d (\"cifsd: add server-side procedures for SMB3\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nSigned-off-by: Xiang Mei (Microsoft) \u003cxmei5@asu.edu\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "35754558f6c21d0fa0985dceb3387071a3348aff", "tree": "d2414da995c6ddb5a947ea2fd0a877895f68fd48", "parents": [ "b10665730fbf6b5e45fe422badcbbc3f0df96ef5" ], "author": { "name": "Gil Portnoy", "email": "dddhkts1@gmail.com", "time": "Mon Jul 13 09:20:09 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp\n\nsmb3_preauth_hash_rsp() computes the SMB3.1.1 preauth integrity hash on\nthe response path. For a binding SESSION_SETUP it looks up the\nper-connection preauth_session and reads its Preauth_HashValue.\n\nsmb2_sess_setup() frees that preauth_session under ksmbd_conn_lock().\nTwo SMB2 requests on one connection can run concurrently, so an unlocked\nlookup and hash can use a preauth_session after another worker frees it.\n\nTake ksmbd_conn_lock() before selecting conn-\u003ebinding and hold it across\nthe selected preauth hash lookup and update. This preserves the existing\nhash selection while preventing the lookup-to-use lifetime race.\n\nFixes: 1c5daa2ea924 (\"ksmbd: handle channel binding with a different user\")\nSigned-off-by: Gil Portnoy \u003cdddhkts1@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "b10665730fbf6b5e45fe422badcbbc3f0df96ef5", "tree": "e5df62fdd81be4bcb98c1adeb916fa54013ffd15", "parents": [ "610346149d047a52a92c9a0eb329dd565b8f92c5" ], "author": { "name": "Gil Portnoy", "email": "dddhkts1@gmail.com", "time": "Sun Jul 12 00:00:00 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: remove stale channels from all sessions on teardown\n\nksmbd_sessions_deregister() removes a connection\u0027s channels from other\nsessions\u0027 channel lists only while conn-\u003ebinding is still set:\n\n\tif (conn-\u003ebinding) {\n\t\thash_for_each_safe(sessions_table, ...)\n\t\t\tksmbd_chann_del(conn, sess);\n\t}\n\nconn-\u003ebinding is a transient flag: it is cleared once a binding\nSESSION_SETUP completes, and also by a subsequent non-binding\nSESSION_SETUP on the same connection (a reauthentication on a bound\nchannel, or a new SessionId\u003d\u003d0 setup). A connection that has bound a\nchannel into another session\u0027s ksmbd_chann_list and then clears\nconn-\u003ebinding leaves that channel behind when it disconnects: the\nchannel, whose chann-\u003econn points at the now freed struct ksmbd_conn,\nstays on the owner session\u0027s list.\n\nWhen the owning connection later tears down, the second loop\ndereferences the stale channel:\n\n\txa_for_each(\u0026sess-\u003eksmbd_chann_list, chann_id, chann)\n\t\tif (chann-\u003econn !\u003d conn)\n\t\t\tksmbd_conn_set_exiting(chann-\u003econn); /* freed */\n\nwhich is a use-after-free write into the freed ksmbd_conn (the same\nstale channel is also walked by show_proc_session() through /proc). The\nsession is leaked as well, because its channel list never empties.\n\nRemove the conn-\u003ebinding gate so a connection always removes its\nchannels from every session on teardown.\n\nFixes: faf8578c77f3 (\"ksmbd: find bound sessions during reauthentication\")\nSigned-off-by: Gil Portnoy \u003cdddhkts1@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "610346149d047a52a92c9a0eb329dd565b8f92c5", "tree": "d60137bb75f2518bcae9b3b647bf6f6146dca1a1", "parents": [ "08b9452a338db7b7f9560342a1fff30f7a58a226" ], "author": { "name": "Gil Portnoy", "email": "dddhkts1@gmail.com", "time": "Sun Jul 12 00:00:00 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: fix stack buffer overflow in multichannel session-key copy\n\nCommit 4b706360ffb7 (\"ksmbd: fix multichannel binding and enforce channel\nlimit\") moved the binding-path session key out of the session-wide\nsess-\u003esess_key (CIFS_KEY_SIZE \u003d 40) into a new per-channel buffer, and\nsized both that buffer and the on-stack copy used during binding with\nSMB2_NTLMV2_SESSKEY_SIZE (16):\n\n\tstruct channel {\n\t\tchar\tsess_key[SMB2_NTLMV2_SESSKEY_SIZE];\t/* 16 */\n\t\t...\n\t};\n\n\tntlm_authenticate() / krb5_authenticate():\n\t\tchar channel_key[SMB2_NTLMV2_SESSKEY_SIZE] \u003d {};\t/* 16 */\n\t\tchar *auth_key \u003d conn-\u003ebinding ? channel_key : sess-\u003esess_key;\n\nThe two writers that fill this destination still bound the copy length\nagainst CIFS_KEY_SIZE (40), not against the 16-byte buffer:\n\n\tksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange):\n\t\tif (sess_key_len \u003e CIFS_KEY_SIZE)\t/* 40 */\n\t\t\treturn -EINVAL;\n\t\tarc4_crypt(ctx_arc4, sess_key,\n\t\t\t (char *)authblob + sess_key_off, sess_key_len);\n\n\tksmbd_krb5_authenticate():\n\t\tif (resp-\u003esession_key_len \u003e sizeof(sess-\u003esess_key))\t/* 40 */\n\t\t\t...\n\t\tmemcpy(sess_key, resp-\u003epayload, resp-\u003esession_key_len);\n\nOn a binding SESSION_SETUP, auth_key points at the 16-byte channel_key,\nso a client that supplies an NTLM EncryptedRandomSessionKey of up to 40\nbytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose\nsession key is longer than 16 bytes (a normal AES256 key is 32), writes\npast the 16-byte stack buffer -- up to a 24-byte kernel stack overflow.\nKASAN reports it as a stack-out-of-bounds write in arc4_crypt() called\nfrom ksmbd_decode_ntlmssp_auth_blob().\n\nThe destinations must be able to hold the full session key the length\nchecks already permit. Size the per-channel key buffer and the two\non-stack channel_key buffers with CIFS_KEY_SIZE, matching sess-\u003esess_key.\n\nFixes: 4b706360ffb7 (\"ksmbd: fix multichannel binding and enforce channel limit\")\nSigned-off-by: Gil Portnoy \u003cdddhkts1@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "08b9452a338db7b7f9560342a1fff30f7a58a226", "tree": "c7397804863b3987f068ff27b0edb16bf1579bdc", "parents": [ "b078f39af3818292687623dd433d996aef5e69c9" ], "author": { "name": "Gil Portnoy", "email": "dddhkts1@gmail.com", "time": "Fri Jul 10 20:27:10 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: fix memory leak of xattr_stream_name in smb2_rename()\n\nOn an SMB2 SET_INFO(FileRenameInformation) whose target names an alternate\ndata stream, smb2_rename() obtains a formatted stream-name string from\nksmbd_vfs_xattr_stream_name(), which allocates it with kasprintf() and\nreturns it through an out-param:\n\n\trc \u003d ksmbd_vfs_xattr_stream_name(stream_name, \u0026xattr_stream_name, ...);\n\tif (rc)\n\t\tgoto out;\n\trc \u003d ksmbd_vfs_setxattr(..., xattr_stream_name, ...);\n\tif (rc \u003c 0) {\n\t\t...\n\t\tgoto out;\n\t}\n\tgoto out;\n\nxattr_stream_name is declared inside the alternate-data-stream block, but\nthe out: label is outside that block and frees only new_name, so it cannot\nrelease xattr_stream_name. ksmbd_vfs_setxattr() takes a const char * and\nonly reads the name, so it does not take ownership either. Both the\nsetxattr-failure and the success path therefore leak the kasprintf()\u0027d\nstring. An authenticated client with a writable share can leak kernel\nmemory on every stream rename, exhausting kernel memory over time.\n\nFree xattr_stream_name after its use, before the block\u0027s goto out. The\ntwo earlier goto out paths never assign the variable, so there is no\ndouble-free.\n\nSigned-off-by: Gil Portnoy \u003cdddhkts1@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "b078f39af3818292687623dd433d996aef5e69c9", "tree": "ccfff16b38d7d097ec02dc4670d7963aa1d2d3fa", "parents": [ "aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9" ], "author": { "name": "Gil Portnoy", "email": "dddhkts1@gmail.com", "time": "Fri Jul 10 20:23:34 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: zero the smb2_read alignment tail to avoid an infoleak\n\nCommit 6b9a2e09d4cc (\"ksmbd: avoid zeroing the read buffer in smb2_read()\")\nswitched the SMB2 READ payload buffer from kvzalloc() to kvmalloc(), on the\npremise that only the nbytes actually read are ever transmitted, so the\nALIGN(length, 8) tail need not be initialized.\n\nThat premise does not hold for a compound response. ksmbd_vfs_read() fills\nonly nbytes, leaving [nbytes, ALIGN(length, 8)) uninitialized. The aux\npayload is pinned as the last response iov with iov_len \u003d\u003d nbytes, but when\nthe READ is a member of a compound, init_chained_smb2_rsp() 8-byte-aligns\nthe previous member by extending that same iov:\n\n\tnew_len \u003d ALIGN(len, 8);\n\twork-\u003eiov[work-\u003eiov_idx].iov_len +\u003d (new_len - len);\n\tinc_rfc1001_len(work-\u003eresponse_buf, new_len - len);\n\nso up to 7 uninitialized bytes of the kvmalloc()\u0027d slab tail are sent\nto the client. When the read length is small the buffer is served from\na general kmalloc slab, so those bytes can be stale kernel-heap\ncontents, including pointer values -- an information leak usable to\ndefeat KASLR.\n\nAn authenticated client triggers it with a compound request containing a\nREAD whose returned nbytes is not 8-aligned (for example [READ, CLOSE] with\na 1-byte read).\n\nZero only the alignment tail after the read, preserving the bulk\nno-zeroing optimization of 6b9a2e09d4cc.\n\nFixes: 6b9a2e09d4cc (\"ksmbd: avoid zeroing the read buffer in smb2_read()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gil Portnoy \u003cdddhkts1@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "aa5d8f3f96aa11a4a54ce993c11ce8af11c546f9", "tree": "1ddb40c429ce98addd0298e25de9ffee690d1dee", "parents": [ "1c0ae3df692ea2a4ce992f786346154e75a3f0d5" ], "author": { "name": "Qihang", "email": "q.h.hack.winter@gmail.com", "time": "Thu Jul 09 22:49:55 2026 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: pin conn during async oplock break notification\n\nsmb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn\npointer in an async ksmbd_work and then queue that work on ksmbd-io. The\nwork only increments conn-\u003er_count, which prevents teardown from passing\nthe pending-request wait after the increment, but it does not pin the\nstruct ksmbd_conn object.\n\nIf connection teardown races with an oplock break notification, the last\nconn reference can be dropped before the queued worker finishes. The\nworker then uses the freed conn in ksmbd_conn_write() and\nksmbd_conn_r_count_dec().\n\nTake a real conn reference when publishing the conn pointer to the async\nwork item, and drop it after the notification work has decremented\nr_count. Apply the same lifetime rule to lease break notification, which\nuses the same work-\u003econn pattern.\n\nFixes: 3aa660c05924 (\"ksmbd: prevent connection release during oplock break notification\")\nSigned-off-by: Qihang \u003cq.h.hack.winter@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "1c0ae3df692ea2a4ce992f786346154e75a3f0d5", "tree": "b8cb0ecc8da6c12a9dbda1fc877ac2765ca9d83a", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Ibrahim Hashimov", "email": "security@auditcode.ai", "time": "Thu Jul 09 17:05:30 2026 +0200" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Jul 16 10:18:25 2026 -0500" }, "message": "ksmbd: fix integer overflow in set_file_allocation_info()\n\nset_file_allocation_info() converts the client-supplied\nFILE_ALLOCATION_INFORMATION::AllocationSize into a 512-byte block\ncount with:\n\n\talloc_blks \u003d (le64_to_cpu(file_alloc_info-\u003eAllocationSize) + 511) \u003e\u003e 9;\n\nAllocationSize is a fully client-controlled __le64 field; the only\nvalidation performed by the caller (smb2_set_info_file(), case\nFILE_ALLOCATION_INFORMATION) is that the fixed buffer is at least\nsizeof(struct smb2_file_alloc_info) \u003d\u003d 8 bytes. The value itself is\nnever range-checked before this arithmetic.\n\nWhen AllocationSize is close to U64_MAX (e.g. 0xffffffffffffffff),\n\"AllocationSize + 511\" wraps around mod 2^64 to a small number\n(0xffffffffffffffff + 511 \u003d 510), so alloc_blks becomes 0. Since any\nexisting regular file has stat.blocks \u003e 0, the function then takes\nthe \"shrink\" branch and calls:\n\n\tksmbd_vfs_truncate(work, fp, alloc_blks * 512); /* \u003d\u003d 0 */\n\nsilently truncating the file to size 0, even though the client asked\nto grow the allocation to (what looks like) the maximum possible\nsize. The trailing \"if (size \u003c alloc_blks * 512) i_size_write(inode,\nsize);\" restore is guarded by a comparison that is never true once\nalloc_blks \u003d\u003d 0, so the truncation is not undone. This lets an\nauthenticated SMB client that already holds an open handle with\nFILE_WRITE_DATA on a file silently truncate that same file to size 0\nvia a single crafted SET_INFO(FILE_ALLOCATION_INFORMATION) request\nadvertising a near-U64_MAX AllocationSize, even though the request\nasks to grow the file\u0027s allocation rather than shrink it. This is a\nfunctional/data-loss bug, not a privilege-boundary\nviolation: the same client could already truncate the file via\nFILE_END_OF_FILE_INFORMATION or a plain write.\n\nFix it by validating AllocationSize against MAX_LFS_FILESIZE, the\nsame upper bound the VFS itself uses to reject unrepresentable file\nsizes, before doing the \"+511\" rounding, and rejecting oversized\nvalues with -EINVAL. Bounding AllocationSize to\nMAX_LFS_FILESIZE - 511 guarantees the \"+511\" addition cannot wrap,\nand that the subsequent \"alloc_blks * 512\" values passed to\nvfs_fallocate() and ksmbd_vfs_truncate() stay within a representable\nloff_t as well.\n\nNo legitimate SMB client asks for an allocation size anywhere near\n2^64 bytes, so this only rejects a value that was previously\nsilently misinterpreted as zero.\n\nRuntime-verified on a v6.19 KASAN test stand: sending SET_INFO\n(FILE_ALLOCATION_INFORMATION) with AllocationSize \u003d 0xffffffffffffffff\nagainst ksmbd now returns -EINVAL and leaves the target file\u0027s size\nunchanged, where the unpatched kernel truncated it from 4096 to 0\nbytes.\n\nFixes: e2f34481b24d (\"cifsd: add server-side procedures for SMB3\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ibrahim Hashimov \u003csecurity@auditcode.ai\u003e\nAssisted-by: AuditCode-AI:2026.07\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "130910bac905a42225f93841e338bbea4a431b1a", "tree": "659bc209b7537552113466016d6ad22d117ecc36", "parents": [ "9b7e60184f4b22e893d4ae95234d5f26261a430c" ], "author": { "name": "Satyanarayana K V P", "email": "satyanarayana.k.v.p@intel.com", "time": "Tue Jul 14 11:03:00 2026 +0530" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 16 16:53:38 2026 +0200" }, "message": "drm/xe/pf: Disable display in admin only PF mode\n\nAdmin-only PF mode does not expose media or 3D execution capabilities\nto userspace, so display pipelines cannot receive rendered content.\n\nFixes: d88c4bac8c2a (\"drm/xe/pf: Restrict device query responses in admin-only PF mode\")\nSigned-off-by: Satyanarayana K V P \u003csatyanarayana.k.v.p@intel.com\u003e\nCc: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nCc: Piotr Piórkowski \u003cpiotr.piorkowski@intel.com\u003e\nCc: Michał Winiarski \u003cmichal.winiarski@intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nReviewed-by: Piotr Piórkowski \u003cpiotr.piorkowski@intel.com\u003e\nLink: https://patch.msgid.link/20260714053259.504308-2-satyanarayana.k.v.p@intel.com\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n(cherry picked from commit 7ef55ae582eba2b0a7a7441bd3b9aefd38a26bb9)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "9b7e60184f4b22e893d4ae95234d5f26261a430c", "tree": "267c1b803a67e5791cf3e73bf3333b38c1d3d4c7", "parents": [ "299bc6d50b1bed7d1f408391736712f01a0855e2" ], "author": { "name": "Arvind Yadav", "email": "arvind.yadav@intel.com", "time": "Thu Jul 16 11:56:24 2026 +0530" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 16 16:33:08 2026 +0200" }, "message": "drm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n - Rebase\n\nv3:\n - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n - Queue async teardown on system_dfl_wq instead of xe-\u003edestroy_wq. (Matt)\n - Drop separate deferred drm_dev_put worker.\n - Remove stale drain_workqueue(xe-\u003edestroy_wq) from guc_submit_sw_fini().\n\nv4:\n - Replace the guc_submit_sw_fini() wait with an assertion and remove\n the now-unused fini_wq. (sashiko)\n\nv5:\n - Move destroy work to a module-lifetime Xe workqueue instead of\n system_dfl_wq. (Matt)\n - Flush the module-lifetime destroy workqueue during PCI remove to\n preserve the old device-remove wait semantics.\n\nv6:\n - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n letting it outlive the xe_device/drm_device. (Sashiko)\n - Use WQ_MEM_RECLAIM for xe-\u003edestroy_wq because SVM pagemap destroy work\n can be queued from the reclaim path.\n\nv7:\n - Drop the per-device xe-\u003edestroy_wq and use the module-level destroy WQ\n for SVM pagemap destroy as well. (Matt)\n - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n - Rebase.\n\nv9:\n - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n destroy_wq because it can be queued from reclaim and embeds\n the dev_pagemap used by devres teardown. (Sashiko)\n - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n from it.\n - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n - Keep xe-\u003edestroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n workqueue allocation warning.\n\nv11:\n - Drop the SVM pagemap destroy comment as it was revision-specific.\n (Thomas)\n\nv12:\n - Rebase.\n\nFixes: 2d2be279f1ca (\"drm/xe: fix UAF around queue destruction\")\nCc: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nCc: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nCc: Tejas Upadhyay \u003ctejas.upadhyay@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Arvind Yadav \u003carvind.yadav@intel.com\u003e\nLink: https://patch.msgid.link/20260716062624.211396-1-arvind.yadav@intel.com\nSigned-off-by: Tejas Upadhyay \u003ctejas.upadhyay@intel.com\u003e\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "299bc6d50b1bed7d1f408391736712f01a0855e2", "tree": "f4e7f55e4f73d8c926dacd063642d10002bc837e", "parents": [ "6384271ac1ac0099198d15df79212a19ebdb929d" ], "author": { "name": "Arvind Yadav", "email": "arvind.yadav@intel.com", "time": "Tue Jul 14 12:14:02 2026 +0530" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 16 16:33:02 2026 +0200" }, "message": "drm/xe/guc: Keep scheduler timeline name alive\n\nThe scheduler keeps a pointer to the timeline name, but q-\u003ename\nis freed with the exec queue while scheduler fences can still\nreference it.\n\nStore the name in struct xe_guc_exec_queue so it shares\nthe scheduler\u0027s RCU-deferred lifetime.\n\nFixes: 6bd90e700b42 (\"drm/xe: Make dma-fences compliant with the safe access rules\")\nCc: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nCc: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Arvind Yadav \u003carvind.yadav@intel.com\u003e\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\nAcked-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260714064402.2457257-1-arvind.yadav@intel.com\nSigned-off-by: Tejas Upadhyay \u003ctejas.upadhyay@intel.com\u003e\n(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "6384271ac1ac0099198d15df79212a19ebdb929d", "tree": "75a03d6cd3f01a7f79e707a0ad3689604c628188", "parents": [ "ad87e2476b3b246580f407afc8ffa91d621bc849" ], "author": { "name": "Zongyao Bai", "email": "zongyao.bai@intel.com", "time": "Tue Jul 14 23:24:32 2026 +0000" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 16 16:32:56 2026 +0200" }, "message": "drm/xe/pt: Reset current_op in xe_pt_update_ops_init()\n\nxe_pt_update_ops_init() fails to reset current_op to 0. On the\nvm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside\nthe xe_validation_guard() / drm_exec_until_all_locked() loop. When\nthat loop retries due to lock contention or OOM eviction\n(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),\nxe_pt_update_ops_prepare() runs again on the same vops, and each\ncall to bind_op_prepare() increments current_op without resetting it.\n\nAfter N retries current_op exceeds the array size allocated by\nxe_vma_ops_alloc(), causing an out-of-bounds write into\nSLUB-poisoned memory and a subsequent UAF crash in\nxe_migrate_update_pgtables_cpu() when reading the corrupted pt_op-\u003ebind.\n\nAlso reset needs_svm_lock and needs_invalidation which are derived in\nthe same prepare pass and would otherwise cause wrong migrate ops\nselection and redundant TLB invalidation on retry.\n\nFix this by resetting current_op, needs_svm_lock and needs_invalidation\nin xe_pt_update_ops_init().\n\nv2 (Matt):\n - Add details in commit message.\n - Add Fixes tag and Cc to stable@vger.kernel.org\n\nFixes: e8babb280b5e (\"drm/xe: Convert multiple bind ops into single job\")\nSuggested-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: stable@vger.kernel.org\nAssisted-by: GitHub-Copilot:claude-sonnet-4.6\nSigned-off-by: Zongyao Bai \u003czongyao.bai@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260714232433.2737533-1-zongyao.bai@intel.com\n(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "ad87e2476b3b246580f407afc8ffa91d621bc849", "tree": "fed897963c8a35f7e667cc9f62504ee37c4e2d1f", "parents": [ "56441f9e08ad68697295b8835266d2bc48ab59b5" ], "author": { "name": "Daniele Ceraolo Spurio", "email": "daniele.ceraolospurio@intel.com", "time": "Mon Jul 13 15:17:59 2026 -0700" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 16 16:32:51 2026 +0200" }, "message": "drm/xe/wopcm: fix WOPCM size for LNL+\n\nStarting on LNL the WOPCM size is 8MB instead of 4, so we need to avoid\nusing the [0, 8MB) range of the GGTT as that can be unaccessible from\nthe microcontrollers.\n\nNote that the proper long-term fix here is to read the WOPCM size from\nthe HW, but that is a more serious rework that would be difficult to\nbackport, so we can do that as a follow-up.\n\nFixes: 9c57bc08652a (\"drm/xe/lnl: Drop force_probe requirement\")\nSigned-off-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nCc: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nCc: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nReviewed-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nLink: https://patch.msgid.link/20260713221758.3285744-2-daniele.ceraolospurio@intel.com\n(cherry picked from commit 3033b0b24ed0e2f5e56bdd4d9c183417c365a45b)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "56441f9e08ad68697295b8835266d2bc48ab59b5", "tree": "0c306c2b98d2758f5b4b71048d4833e854e920fe", "parents": [ "c473761f8178760b915633332908409c73bfdb9e" ], "author": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Mon Jul 13 23:24:40 2026 -0700" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 16 16:32:45 2026 +0200" }, "message": "drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves\n\nxe_bo_move() attaches VF CCS read/write batch buffers (BBs) to a BO\nafter it transitions NULL/SYSTEM -\u003e TT, and detaches them after it\ntransitions TT -\u003e SYSTEM. Both operations were done synchronously on\nthe CPU immediately after building the move\u0027s copy/clear fence,\nwithout waiting for that fence to signal. This creates two races with\nVF migration:\n\n- Attach happens too late relative to the copy job it is meant to\n protect. If the copy job is submitted before the CCS BBs are\n attached, a VF migration event that pauses execution mid-copy can\n observe partially copied CCS metadata without the attach state\n needed to correctly save/restore it.\n\n- Detach happens too early relative to the copy job that moves data\n out of TT. The CCS BBs are torn down right after the copy fence is\n obtained, while the actual blit may still be in flight. A VF\n migration event that pauses execution mid-copy can then race the\n save/restore path against the still-running blit, and the CCS BBs\n it would need to make sense of the paused state have already been\n removed.\n\nFix both races:\n\n- Move the attach call to before the copy/clear job is submitted, so\n the CCS BBs are already registered by the time the copy runs. On\n attach failure, unwind and bail out of the move. xe_migrate_ccs_rw_copy()\n now takes the destination resource explicitly, since bo-\u003ettm.resource\n is not updated to the new resource until after the move commits.\n\n- Detach only after explicitly waiting for the copy fence to signal,\n instead of tearing down the CCS BBs immediately after obtaining it.\n\nWhile here, also fix xe_sriov_vf_ccs_attach_bo() to properly unwind and\npropagate errors: the per-context loop previously never broke out on\nerror, silently discarding earlier failures. Unwind by clearing each\nattached context directly via xe_migrate_ccs_rw_copy_clear() instead of\nreusing xe_sriov_vf_ccs_detach_bo(), which requires both contexts to be\nattached before it will clean up either one.\n\nFixes: 864690cf4dd6 (\"drm/xe/vf: Attach and detach CCS copy commands with BO\")\nCc: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: Michał Winiarski \u003cmichal.winiarski@intel.com\u003e\nCc: Satyanarayana K V P \u003csatyanarayana.k.v.p@intel.com\u003e\nAssisted-by: GitHub_Copilot:claude-sonnet-5\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nAcked-by: Satyanarayana K V P \u003csatyanarayana.k.v.p@intel.com\u003e\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260714062440.3421225-1-matthew.brost@intel.com\n(cherry picked from commit d45ad0aa7a1eb5d7288b5ed948b05695611dc39e)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" } ], "next": "c473761f8178760b915633332908409c73bfdb9e" }