)]}' { "log": [ { "commit": "d48723711bae9b8cdc56719c448ba42fef28cbee", "tree": "01dee483dfd26ba340ee4d3653f6c848b24fe823", "parents": [ "bdeb84ed24e543930487f03f5243bbf83aebaf31", "58c1eb84e97701c583605ba2fd553b69afba2245" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:18:19 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:18:19 2026 -0800" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n \"Fix SDEI (software delegated exception interface) handlers taking\n nested exceptions (looping on the KPTI trampoline vectors and\n clobbering the interrupted context\u0027s exception registers), TPIDR2_EL0\n preservation across CPU suspend, a kexec_file_load() memory leak and\n an overflow in the /dev/mem valid_mmap_phys_addr_range() check:\n\n - Fix nested exceptions taken by SDEI event handlers.\n\n With KPTI, an event interrupting user space left the trampoline\n vectors installed and any exception in the handler looped forever.\n Also save and restore ELR/SPSR/ESR/FAR around the handler since an\n event can interrupt exception entry or return where these registers\n are live\n\n - Save and restore TPIDR2_EL0 across CPU suspend.\n\n Its value is UNKNOWN after a warm reset and the task initiating\n suspend could return to user space with a corrupted value\n\n - Fix an overflow in valid_mmap_phys_addr_range() allowing /dev/mem\n to map out-of-range PFNs\n\n - Fix an elf_headers memory leak in the kexec_file segment placement\n retry loop\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: sdei: Preserve the interrupted context\u0027s exception registers\n arm64: sdei: Run the event handler on the kernel vectors\n arm64: kexec_file: Fix elf_headers memory leak in retry loop\n arm64: mm: validate /dev/mem mmap ranges without overflow\n arm64: suspend: Save and restore TPIDR2_EL0 across CPU suspend\n" }, { "commit": "bdeb84ed24e543930487f03f5243bbf83aebaf31", "tree": "701efcdca2b8f7b74e930f0435756092602cd49b", "parents": [ "a7963b12ca3e764e6ad3b15d1373430eb02492ee", "8a7f26aa072a4e63bc3b1adfe649546709db722e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:13:41 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:13:41 2026 -0800" }, "message": "Merge tag \u0027printk-for-7.4-fixups\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux\n\nPull printk fixes from Petr Mladek:\n\n - Prevent possible use-after-free when printk kthreads\n could not be created\n\n - Fix computation of the free space when allocating a\n bigger ring buffer\n\n - Add info about the new printk mailing list for\n printk-related subsystems\n\n* tag \u0027printk-for-7.4-fixups\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:\n printk: Avoid multiple unregistration in unregister_console_locked()\n MAINTAINERS: Add new \"printk\" mailing list for PRINTK, PRINTK INDEXING, and VSPRINTF\n printk_ringbuffer: Fix space_used() when blk_lpos-\u003enext overflows\n" }, { "commit": "a7963b12ca3e764e6ad3b15d1373430eb02492ee", "tree": "b44ef3f445e404a9c72c7fd4f2cb307a84701204", "parents": [ "c53d8fc9a7571b63482548a7e5284ef9f025fd3f", "2cf4be57b301ed2d7af82e70cff5dfd96894d8de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:02:02 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:02:02 2026 -0800" }, "message": "Merge tag \u0027iommu-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"AMD IOMMU:\n\n - Move PerfOpt management into the IOMMU domain attachment paths,\n enabling it automatically for supported integrated GPUs in identity\n mode and clearing it before switching to translated or blocked\n domains\n\n - Fix a boot panic in the GPU identity-mapping quirk when a GPU has\n no upstream PCI bridge\n\n - Clear the IOMMU SNP enable flag when RMP table initialization\n fails, preventing subsequent initialization from assuming SNP setup\n succeeded\n\n - Check IVRS subtable types before parsing memory definitions,\n avoiding bogus PCI segments caused by misinterpreting IVHD entries\n under QEMU\n\n - Remove an obsolete warning on device release that incorrectly fires\n for devices required to remain attached to an identity domain\"\n\n* tag \u0027iommu-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge\n iommu/amd: remove obsolete domain pointer warning on release\n iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions\n iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails\n iommu/amd: Enable PerfOpt automatically for integrated GPUs\n" }, { "commit": "c53d8fc9a7571b63482548a7e5284ef9f025fd3f", "tree": "5365b3daafb2c0256dee4d434d8edb412878008d", "parents": [ "90d9e367d4dc3e4bec20c2919c1beab69a4d7431", "28f7d31c2aeb350df9a0116093fade0a840fb4ce" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:36:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:36:20 2026 -0800" }, "message": "Merge tag \u0027block-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed\n connect, and the nvme-rdma counterpart of the NULL queue-\u003ectrl on\n reconnect\n - nvmet-rdma iWARP disconnect and device removal fixes\n - nvmet-tcp: ask for the TLS record type on every receive, and bound\n the connections accepted per work run so a connect flood can\u0027t\n hold up port removal; nvmet-auth keep the old keys if the new ones\n fail to decode; nvme-loop delete the controller if a reset fails\n - nvmet-auth reject incomplete DHCHAP messages, and a keep-alive\n timeout overflow\n - nvmet locking and bounds fixes for tbkas reconnects and the\n traddr/trsvcid configfs writes, don\u0027t leak stale memory in the ANA\n log page, and cache the passthru reference across queue_response\n - Wait for SRCU readers before splicing the namespace list, with a\n new list_splice_init_srcu() helper, and drop an extra grace period\n in nvmet_ns_disable()\n - Unregister when pr_register() is given a zero new key, and don\u0027t\n drop the cdev reference twice on cdev_device_add() failure\n - Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d\n - Various smaller fixes and cleanups\n\n - blk-mq: end the request if getting a keyslot fails, which left the\n in-flight count and zone write plug stuck, reset the queue state on\n scheduler teardown so requests don\u0027t stall in software queues, and\n fix an out-of-bounds read in blk_mq_free_rqs() after a failed\n nr_hw_queues update\n\n - Only serialize elevator switches of the same queue\n\n - dma-buf bio fixes: don\u0027t use the bvec fast path for them, and only\n fail the ones that need block layer PI\n\n - Reject GPT entries with starting_lba \u003e ending_lba\n\n - Return the soft block size for compat BLKBSZGET, report the correct\n discard alignment in sysfs, and account the flush sequence latency\n only once in iocost\n\n - virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue\n layout at probe time, clamp max_segments to the ring size, and fix\n zone append sector reporting in batched completion\n\n - null_blk zone fixes and a cache state reset\n\n - zloop fixes\n\n - ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build\n\n* tag \u0027block-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)\n nvmet: cache passthru reference in __nvmet_req_complete()\n nvmet: drop the redundant auth check in nvmet_parse_io_cmd()\n nvmet: bound the traddr and trsvcid configfs writes\n nvmet: take subsys-\u003elock when forcing reconnects for tbkas\n nvme: wait for SRCU readers before splicing the namespace list\n srcu: Add list_splice_init_srcu()\n nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d\n nvmet: don\u0027t return memory contents beyond valid data when reading ANA log page\n nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE\n nvmet: drop the extra RCU grace period in nvmet_ns_disable()\n nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()\n ublk: add missing DEL_DEV_ASYNC to unprivileged permission check\n selftests: ublk: fix the build and file offsets on 32-bit\n nvmet-rdma: disconnect a queue on device removal\n nvmet-rdma: queue the release work under the mutex\n nvmet-rdma: take a device off the list last\n nvmet-tcp: limit the connections accepted per work run\n nvmet-rdma: disconnect only established queues\n nvmet-auth: keep the old keys if the new ones fail\n nvmet-tcp: ask for the TLS record type on every receive\n ...\n" }, { "commit": "90d9e367d4dc3e4bec20c2919c1beab69a4d7431", "tree": "fa9342a4a7c5c526d740e897188f87c245712532", "parents": [ "a91337fb5e8e0127c8b5be87be9f3027f95b48bc", "cf6542493e35ab9e72ac07da10a178ac78db5a16" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:30:19 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:30:19 2026 -0800" }, "message": "Merge tag \u0027io_uring-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Only wait for in-flight requests on ring release if the closing task\n actually uses the ring.\n\n - SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,\n as memory.high reclaim and blkcg throttling otherwise only ran at\n thread exit, and don\u0027t set the stop bit on thread exit, which tripped\n a WARN_ON_ONCE() in the ring teardown.\n\n - Don\u0027t poll a writer for a read side hangup or for urgent data, as a\n half-closed peer or unread OOB data kept the async poll of a send\n ready on every re-arm.\n\n - Cancel all matching poll requests in one pass for CANCEL_ALL rather\n than restarting the hash walk per request.\n\n - Hold uring_lock across the put_user() for the index-alloc file\n install.\n\n - Don\u0027t arm an hrtimer and schedule for a wait whose timeout has\n already expired.\n\n - Add a feature flag for the dma-buf registered buffer support.\n\n - selftests 32-bit cast fix\n\n* tag \u0027io_uring-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: only wait for in-flight requests if the closing task uses the ring\n io_uring: add feature flag for dma-buf support\n io_uring/wait: don\u0027t sleep on an already expired timeout\n io_uring/rsrc: hold uring_lock across index-alloc put_user\n selftests/io_uring: cast optval through uintptr_t in mini_liburing.h\n io_uring/poll: don\u0027t poll a writer for urgent data\n io_uring/poll: don\u0027t poll a writer for a read side hangup\n io_uring/poll: cancel all matching requests in one pass\n io_uring/cancel: count all requests that a CANCEL_ALL cancels\n io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread\n io_uring/sqpoll: don\u0027t set IO_SQ_THREAD_SHOULD_STOP on thread exit\n" }, { "commit": "58c1eb84e97701c583605ba2fd553b69afba2245", "tree": "0a10c684cb1127d414c669333fac05129a101eaf", "parents": [ "9bf6ee7952c7ee151c30e0fffcfc61b58127c899" ], "author": { "name": "Kiryl Shutsemau (Meta)", "email": "kas@kernel.org", "time": "Thu Nov 05 12:08:34 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 17:43:20 2026 +0000" }, "message": "arm64: sdei: Preserve the interrupted context\u0027s exception registers\n\nAn SDEI event is dispatched by firmware regardless of PSTATE.DAIF, so it\ncan interrupt the kernel where the exception registers are live:\n\n - exception entry, before kernel_entry has saved ELR_EL1/SPSR_EL1 and\n before the C handler has read ESR_EL1/FAR_EL1;\n - exception return, after kernel_exit has loaded ELR_EL1/SPSR_EL1 and\n before the ERET.\n\nAn IRQ or pseudo-NMI cannot arrive there with PSTATE.I set. Firmware\nsaves only x0-x17, PC and PSTATE around an SDEI event, so a synchronous\nexception taken by the handler overwrites the interrupted context\u0027s\nELR, SPSR, ESR and FAR. do_sdei_event() only notices that ELR changed,\nand warns.\n\nThe interrupted context then carries on with the handler\u0027s state. A\ntask interrupted on its way into the kernel can be sent SIGILL for the\nhandler\u0027s kernel data abort. A task interrupted on its way back to user\nspace ERETs to EL1, at the handler\u0027s fixup address, with user registers\nloaded.\n\nWith SDEI delivering NMI backtraces, this happens in normal operation.\nThe handler runs show_regs(), which reads through possibly-NULL pointers\nwith the _nofault() accessors. print_worker_info() faults this way for a\nkworker that is not running a work item, and a single sysrq-l warned\nonce per such kworker.\n\nSave ELR, SPSR, ESR and FAR in __sdei_handler() before\nirqentry_nmi_enter(), which can take an exception too, and restore them\nafter irqentry_nmi_exit().\n\nOnce they are restored, a nested exception is harmless if its handler is\nsafe in NMI context. That holds for EL1 data aborts on translation,\npermission and access-flag faults, which never take the mmap lock in NMI\ncontext, and for BRK. Warn once, with the syndrome, about any other\nexception class.\n\nFixes: f5df26961853 (\"arm64: kernel: Add arch-specific SDEI entry code and CPU masking\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nTested-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "9bf6ee7952c7ee151c30e0fffcfc61b58127c899", "tree": "93f56b4959bb18af21fffabe91e44be8f32c2c63", "parents": [ "ac302aea3d824ccc99f29b8e499c365cb9a684a9" ], "author": { "name": "Kiryl Shutsemau (Meta)", "email": "kas@kernel.org", "time": "Thu Nov 05 12:08:33 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 17:43:12 2026 +0000" }, "message": "arm64: sdei: Run the event handler on the kernel vectors\n\nWith KPTI, VBAR_EL1 holds the trampoline vectors from the return to EL0\nuntil the next exception from EL0 maps the kernel and installs the\nkernel vectors. The trampoline vectors only handle exceptions from EL0;\ntheir current-EL half is zero-filled.\n\nAn SDEI event is dispatched regardless of PSTATE.DAIF, so it lands there\nwhenever the CPU is in user space. The SDEI entry trampoline maps the\nkernel but leaves VBAR_EL1 alone. An exception taken by the handler then\nexecutes the zeros, takes an undefined instruction exception to the same\nvector, and loops there forever. The event never completes and the CPU\nis lost; RCU stall reports are the first sign of it.\n\nRAS notifications land in user space whenever a task consumes the\nerror, and NMI backtraces land wherever the CPU happens to be. The GHES\nhandler takes no exception on its own, but any exception in the handler\npath does it: a WARN, a kprobe hit, or a fault fixed up by a _nofault()\naccessor.\n\nInstall the kernel vectors in __sdei_handler() when VBAR_EL1 holds the\ntrampoline vectors, and restore it before returning to firmware. The\nswitch covers irqentry_nmi_enter() and irqentry_nmi_exit() too, as Usama\nArif pointed out: their tracepoints and context tracking WARNs can take\nan exception as well.\n\nThe IRQ-like resume into user space must still go through the\ntrampoline to map the kernel. do_sdei_event() takes the interrupted\nVBAR_EL1 and keeps basing the resume address on it.\n\nFixes: 79e9aa59dc29 (\"arm64: sdei: Add trampoline code for remapping the kernel\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nTested-by: Breno Leitao \u003cleitao@debian.org\u003e\n[catalin.marinas@arm.com: use raw_cpu_read() for this_cpu_vector]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "a91337fb5e8e0127c8b5be87be9f3027f95b48bc", "tree": "29a4aab100d12968f421c2373b5d6f21a6962ad1", "parents": [ "b556f1c4dc9fa538bb3b27c0b9710e62baca692f", "57d94d26ed42773d6378da45eed9de03b116e7f7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:38:11 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:38:11 2026 -0800" }, "message": "Merge tag \u0027configfs-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux\n\nPull configfs fix from Breno Leitao:\n\n - Fix the build of the configfs selftest on 32-bit architectures,\n broken since the test was added in the v7.4 merge window.\n\n The harness casts the ASSERT_NE() operands to intmax_t, so handing it\n the pointer returned by mkdtemp() triggers gcc\u0027s pointer-to-int-cast\n warning on 32-bit, and the test builds with -Werror.\n\n KernelCI\u0027s 32-bit arm kselftest builds hit this.\n\n* tag \u0027configfs-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:\n selftests/configfs: fix the build on 32-bit architectures\n" }, { "commit": "b556f1c4dc9fa538bb3b27c0b9710e62baca692f", "tree": "92fe3a7e319d79105df14e1bc41e2cca4d3287cf", "parents": [ "fb382e8efdd4b89b0dcd0169abd31d90b7ddd570", "e5801273f93eb7513850b1c38ea14d69f2de1592" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:00:12 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:00:12 2026 -0800" }, "message": "Merge tag \u0027fs_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull udf, ext2, isofs and quota fixes from Jan Kara:\n - Some disk format validation improvements for udf\n - Fix isofs handling of dates before 1900\n - Fix ext2 inadvertedly syncing buffer on every directory modification\n - Fix ext2 O_DSYNC handling for direct IO\n - A couple of smaller ext2 fixes\n - Fix tmpfs quotas for root filesystem\n - Unify my email addresses in MAINTAINERS file\n\n* tag \u0027fs_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n udf: Fix incorrect error code in udf_current_aext()\n udf: Simplify udf_table_prealloc_blocks()\n udf: don\u0027t use eloc after the end of the unallocated space table\n udf: fix preallocation discarding before an empty allocation extent\n udf: check the unallocated space table when it is loaded\n udf: don\u0027t let the extent type hide an exhausted free-space table extent\n ext2: preserve IOMAP_F_DIRTY for extending direct writes\n udf, ext2, quota, jbd2: Unify email addresses in MAINTAINERS\n isofs: handle Rock Ridge long-form dates before 1900\n ext2: only flush DIRSYNC directories on every change\n ext2: preserve completed DIO bytes when buffered fallback fails\n ext2: take invalidate_lock in ext2_write_failed()\n ext2: Make sbi an proper alias for EXT2_SB(sb) in ext2_fill_super()\n udf: Validate extended attribute space is large enough\n quota: initialize dquot cache before mounting rootfs\n udf: validate vat20-\u003elengthHeader and VAT inode size in udf_load_vat()\n" }, { "commit": "fb382e8efdd4b89b0dcd0169abd31d90b7ddd570", "tree": "600300070cc8fdfca73cba8f8d4c085b8b58b381", "parents": [ "0ccc72d4b3fcf8c79178b7024541e1aa694e08a7", "581230d2ec3c0380917d1255792508851e7c4627" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:55:48 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:55:48 2026 -0800" }, "message": "Merge tag \u0027fsnotify_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull fsnotify fixes from Jan Kara:\n \"Two small fixes for fsnotify\"\n\n* tag \u0027fsnotify_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n inotify: do not coalesce rename events\n fsnotify: preserve 64-bit pre-content ranges\n" }, { "commit": "0ccc72d4b3fcf8c79178b7024541e1aa694e08a7", "tree": "59a031210383c8e677ccadb2d3b402886cdec645", "parents": [ "ce8f7280865e90c02878419733b7bed420eba94b", "7ba9663607b31108b4350b604a3c85ae86c67c19" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:50:27 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:50:27 2026 -0800" }, "message": "Merge tag \u0027xfs-fixes-7.4-rc2\u0027 of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"The most notable fix here IMO is for xfs\u0027s pNFS support (mostly\n related to LAYOUTCOMMIT) and for that it contains several patches.\n\n Besides that, this contains bug fixes for different subsystems in xfs.\n The last patch is mostly a refactor than a bug fix, but the refactor\n is done to prevent a nasty journal transaction state corruption to\n happen\"\n\n* tag \u0027xfs-fixes-7.4-rc2\u0027 of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux:\n xfs: kill xfs_trans_set/clear_context() helpers\n xfs: fix recovery of partial attr removals\n xfs: make pNFS LAYOUTCOMMIT stable the way fdatasync does\n xfs: add datasync and log_flushed arguments to xfs_log_force_inode()\n xfs: take the invalidate lock while mapping a pNFS layout\n xfs: clamp the pNFS layout range to the maximum file size\n xfs: cap the block count of xfs_iomap_write_direct() at one extent\n xfs: clamp a pNFS LAYOUTCOMMIT extent before computing its end\n xfs: refuse a pNFS LAYOUTCOMMIT of a range without blocks\n xfs: add a flag to convert unwritten extents without allocating blocks\n xfs: mark the inode preallocated for pNFS write layouts past EOF\n xfs: fix wrong compat fields in xfs_ioctl32_bstat_copyin()\n xfs: fix temporary cursor leak in btree shift corruption paths\n xfs: skip iunlock with empty iolock flags in xfs_file_dio_write_aligned\n xfs: don\u0027t skip free extents of the longest length in a whole-AG FITRIM\n xfs: don\u0027t skip free extents in later batches of a whole-AG FITRIM\n xfs: fix unwind handling during xfs_mount_sysfs_init()\n xfs: mark i_mode\u003d0 and shut down on attr fork inactivation failure\n xfs: set healthmon mount cookie before publishing it\n" }, { "commit": "ce8f7280865e90c02878419733b7bed420eba94b", "tree": "24bc88d3f33422d7360389a242a210c2f1bf4bbd", "parents": [ "41b77d5dccc7809f5f56f0822e00ea55b42691a8", "db1c5da238dc80a61ab429a7b71b0e2835766c45" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:28:14 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:28:14 2026 -0800" }, "message": "Merge tag \u0027ovl-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs\n\nPull overlayfs fixes from Amir Goldstein:\n\n - Fix a self deadlock of a fanotify permission event listener that also\n watches the layers, when it reads an overlay directory\n\n - Three casefold fixes, found by Chris Mason\u0027s AI review\n\n - Fix a decode of a modified file handle with nfs_export\u003don, which\n could read the stale lower data of a copied up file, also found by\n Chris Mason\u0027s AI review\n\n - Fix an overlay selftest after an errno change\n\n* tag \u0027ovl-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:\n selftests/fscontext_ns: expect EINVAL for overlay descendant userns create\n ovl: look up the index by the decoded origin\n ovl: inherit FMODE_NONOTIFY when reading directory layers\n ovl: inherit FMODE_NONOTIFY when opening directory realfiles\n ovl: fix whiteout creation in casefolded directories\n ovl: do not let chattr change the casefold flag\n ovl: fail the mount if the casefold flag has changed\n" }, { "commit": "ac302aea3d824ccc99f29b8e499c365cb9a684a9", "tree": "d83c1190893e2223afd4ff37f6694cc7c24b4df5", "parents": [ "b0958b1397fb5ffdb995c0ccc74349841929c08d" ], "author": { "name": "Jinjie Ruan", "email": "ruanjinjie@huawei.com", "time": "Thu Nov 05 20:57:24 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 16:25:34 2026 +0000" }, "message": "arm64: kexec_file: Fix elf_headers memory leak in retry loop\n\nA retry allocates new elf headers and overwrites image-\u003eelf_headers,\nleaking the previous buffer.\n\nFree it before assigning.\n\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Thomas Huth \u003cthuth@redhat.com\u003e\nCc: Breno Leitao \u003cleitao@debian.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Yeoreum Yun \u003cyeoreum.yun@arm.com\u003e\nCc: Baoquan He \u003cbhe@redhat.com\u003e\nCc: stable@vger.kernel.org\nFixes: 108aa503657e (\"arm64: kexec_file: try more regions if loading segments fails\")\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Jinjie Ruan \u003cruanjinjie@huawei.com\u003e\n[catalin.marinas@arm.com: drop the redundant NULL check before vfree()]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "41b77d5dccc7809f5f56f0822e00ea55b42691a8", "tree": "4e8145baa0871f805bf3bab96f53c2f170fdf98e", "parents": [ "f66469d9905b39d2c260a15d7d6db450f4db67c1", "a02926f7c89bfc798ee9514e09694ff4279928a1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:16:23 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:16:23 2026 -0800" }, "message": "Merge tag \u0027xsa526-xsa528-7.4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n \"Fix three UAF issues that can be hit in the Xen netback and blkback\n drivers when a guest is forcing a teardown of a PV device\"\n\n* tag \u0027xsa526-xsa528-7.4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen-blkback: Avoid UAF when reading I/O statistics\n xen-netback: defer xenvif_mcast_addr_list_free()\n xen-netback: Fix UAF when reading statistics data\n" }, { "commit": "a02926f7c89bfc798ee9514e09694ff4279928a1", "tree": "9e7e8cad8dc7b350aea8a69d385a7130dc8cb92d", "parents": [ "bfddc420afe827d9f06458cdf8087cd602f8c9cb" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu Nov 05 08:27:38 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:09:08 2026 +0100" }, "message": "xen-blkback: Avoid UAF when reading I/O statistics\n\nReading I/O statistics via sysfs concurrently with tearing down a\nfrontend device might result in UAF or a NULL dereference, as the\nreading of the statistics data is not synchronized with freeing the\ndata.\n\nUse a rwlock for synchronizing.\n\nThis is XSA-528 / CVE-2026-100082\n\nFixes: db6fbc106786 (\"xen/blkback: make st_ statistics per ring\")\nReported-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nAcked-by: Roger Pau Monné \u003croger@xenproject.org\u003e\n" }, { "commit": "bfddc420afe827d9f06458cdf8087cd602f8c9cb", "tree": "2e68b6d1562e5807055a26eb1a4653ec2df0648b", "parents": [ "5fb756f1bbec7a3862dda5d79028bf656271804c" ], "author": { "name": "Jan Beulich", "email": "jbeulich@suse.com", "time": "Fri Nov 06 17:07:01 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:09:08 2026 +0100" }, "message": "xen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()\u0027s error path doesn\u0027t require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081.\n\nFixes: b17075d5c198 (\"xen-netback: fix race condition on XenBus disconnect\")\nReported-by: kerhunt \u003ckerhunt@proton.me\u003e\nSigned-off-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "5fb756f1bbec7a3862dda5d79028bf656271804c", "tree": "15aedb616568e17d286e04d1a2cb8f71f5e00166", "parents": [ "05441d697f7f9a927264f4058cbbc6a03dfcac9d" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 13:07:52 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:08:55 2026 +0100" }, "message": "xen-netback: Fix UAF when reading statistics data\n\nThe network statistic data in the driver is protected by RCU.\nUnfortunately when tearing down the queues after an error during\nconnecting to the frontend (e.g. due to illegal Xenstore data filled\nin by the guest), the statistic data is being freed without\nsynchronizing the RCU state. In case the data is being read via sysfs\nin this phase, access to already freed memory or memory being in new\nuse is possible.\n\nFix that by calling synchronize_net() before freeing the queue data.\n\nThis is XSA-526 / CVE-2026-100080\n\nReported-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "2cf4be57b301ed2d7af82e70cff5dfd96894d8de", "tree": "840554440aef942334f2800bf8a5ebe2347e7364", "parents": [ "fa77b023eb80cdb297ff32f6b13786e483a81ca8" ], "author": { "name": "Jean-Christophe Guillain", "email": "jean-christophe@guillain.net", "time": "Thu Nov 05 16:32:19 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:44 2026 +0100" }, "message": "iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge\n\npci_upstream_bridge() can return NULL for devices without an upstream\nbridge. The AMD GPU identity mapping quirk dereferences the returned\npointer unconditionally, causing a kernel panic during boot.\n\nCheck the pointer before accessing the bridge vendor ID.\n\nThis fixes a boot regression on a Lenovo system with an AMD PRO\nA10-9700E APU. The system now boots with AMD IOMMU enabled.\n\nFixes: bf5bdfd1f8d4 (\"iommu/amd: Force identity mode for selected GPUs only\")\n\nSigned-off-by: Jean-Christophe Guillain \u003cjean-christophe@guillain.net\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "fa77b023eb80cdb297ff32f6b13786e483a81ca8", "tree": "b07d2c97d7d863f5faadcb7433c9e115448d286b", "parents": [ "e62df37e0eff4d670e78bbd415be2c1675883c15" ], "author": { "name": "Kevin Mitchell", "email": "kevmitch@arista.com", "time": "Thu Nov 05 16:32:18 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:44 2026 +0100" }, "message": "iommu/amd: remove obsolete domain pointer warning on release\n\nA warning is triggered in amd_iommu_release_device() on removal of a\ndevice with an IOMMU_RESV_DIRECT region. The warning is based on the\nfalse assumption that correct attachment to the release_domain will\nalways result in a NULL dev_data-\u003edomain pointer. For devices with\nIOMMU_RESV_DIRECT (and consequently dev-\u003eiommu-\u003erequire_direct), the\nrelease domain is the permanent identity_domain which sets\nitself to dev_data-\u003edomain on attach.\n\nThis behaviour was added in commit e94160488e65 (\"iommu: Generic support\nfor RMRs during device release\"). Commit c21b34762e2f (\"iommu/amd: Set\nrelease_domain to blocked_domain\") caused it to take effect for AMD\nIOMMU.\n\nRemove the warning as it is no longer strictly an error to have a non-NULL\ndomain pointer. As this leaves amd_iommu_release_device() empty, remove it.\n\nThe warning was observed for a device with direct mapped region:\n\n/sys/bus/pci/devices/0000:04:00.0/iommu_group/reserved_regions:\n\n 0x00000000fee00000 0x00000000feefffff msi\n 0x000000fd00000000 0x000000ffffffffff reserved\n 0x0000fffd00000000 0x0000ffffffffffff direct\n\nUpon hotunplug:\n\n[ 28.715475] pcieport 0000:00:03.1: pciehp: Slot(0-3): Link Down\n[ 28.715482] pcieport 0000:00:03.1: pciehp: Slot(0-3): Card not present\n[ 28.715601] ------------[ cut here ]------------\n[ 28.715603] WARNING: drivers/iommu/amd/iommu.c:2521 at amd_iommu_release_device+0x5d/0x70, CPU#4: irq/29-pciehp/99\n[ 28.715657] RIP: 0010:amd_iommu_release_device+0x5d/0x70\n[ 28.715687] Call Trace:\n[ 28.715689] \u003cTASK\u003e\n[ 28.715694] iommu_deinit_device+0x84/0x110\n[ 28.715699] __iommu_group_remove_device+0xa8/0xd0\n[ 28.715703] iommu_bus_notifier+0x48/0x70\n[ 28.715707] notifier_call_chain+0x48/0xe0\n[ 28.715712] blocking_notifier_call_chain+0x45/0x60\n[ 28.715716] bus_notify+0x3b/0x60\n[ 28.715720] device_del+0x259/0x3b0\n[ 28.715730] pci_remove_bus_device+0x85/0x100\n[ 28.715735] pciehp_unconfigure_device+0x9d/0x180\n[ 28.715743] __pciehp_disable_slot+0x47/0xe0\n[ 28.715747] pciehp_handle_presence_or_link_change+0x80/0x5e0\n[ 28.715753] pciehp_ist+0x162/0x290\n\nFixes: c21b34762e2f (\"iommu/amd: Set release_domain to blocked_domain\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kevin Mitchell \u003ckevmitch@arista.com\u003e\nReviewed-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "e62df37e0eff4d670e78bbd415be2c1675883c15", "tree": "11ced107ed00d943dd364ea60d5fe2f0dd6e772d", "parents": [ "ec91bb159dc24eefe144ef8867937f4a055dd0e2" ], "author": { "name": "Akshay Jindal", "email": "Akshay.Jindal@amd.com", "time": "Thu Nov 05 16:32:17 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:43 2026 +0100" }, "message": "iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions\n\ninit_memory_definitions() walks every top-level subtable including the\nIVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets\neach one as a \u0027struct ivmd_header\u0027, solely on m-\u003eflags, without first\nchecking that the subtable\u0027s type actually is one of the IVMD types\n(ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE).\n\n if (m-\u003eflags \u0026 (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))\n init_unity_map_range(m, table);\n\nIVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD\nflags field\u0027s HtTunEn bit. Unlike real hardware, QEMU\u0027s AMD IOMMU\nemulation sets HtTunEn unconditionally (flags\u003d0xD1 for type 0x10,\n0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified\nas a unity-map/exclusion-range IVMD entry, which subsequently results\nin the creation of a bogus pci segment. Eg:\n\n AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000\n\nFix by checking the subtable\u0027s type before treating it as IVMD.\n\nFixes: be2a022c0dd0 (\"x86, AMD IOMMU: add functions to parse IOMMU memory mapping requirements for devices\")\nCc: stable@vger.kernel.org\nSigned-off-by: Akshay Jindal \u003cAkshay.Jindal@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "ec91bb159dc24eefe144ef8867937f4a055dd0e2", "tree": "00787bab9a3345387259654cdbf6fa0645cc3dfb", "parents": [ "b32ecac779bba6e7ac7caeae8c40db4280941634" ], "author": { "name": "Dheeraj Kumar Srivastava", "email": "dheerajkumar.srivastava@amd.com", "time": "Thu Nov 05 16:32:16 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:43 2026 +0100" }, "message": "iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails\n\niommu_snp_enable() checks that the IOMMU can support SNP and sets\namd_iommu_snp_en, then calls snp_rmptable_init() to map the RMP table.\nIf that call fails, CC_ATTR_HOST_SEV_SNP is cleared but amd_iommu_snp_en\nis left set. Later IOMMU initialization uses amd_iommu_snp_en to\nconfigure the IOMMU for SNP, on the assumption that RMP setup succeeded.\n\nClear amd_iommu_snp_en along with CC_ATTR_HOST_SEV_SNP.\n\nFixes: 409f45387c93 (\"x86/sev: Fix broken SNP support with KVM module built-in\")\nSigned-off-by: Dheeraj Kumar Srivastava \u003cdheerajkumar.srivastava@amd.com\u003e\nReviewed-by: Ankit Soni \u003cAnkit.Soni@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "b32ecac779bba6e7ac7caeae8c40db4280941634", "tree": "9bc62b6b19e7267d39ead4ab721ebc1d7995d5ee", "parents": [ "6628e7d4c6b25c8d18f1345e3a20d21829aae7e4" ], "author": { "name": "Mario Limonciello (AMD)", "email": "superm1@kernel.org", "time": "Thu Nov 05 16:32:15 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:42 2026 +0100" }, "message": "iommu/amd: Enable PerfOpt automatically for integrated GPUs\n\nPerfOpt is usable by integrated GPUs in identity mode. Enable it from\nthe IOMMU driver\u0027s domain attachment paths instead of requiring an\namdgpu policy knob and exported enable/disable interfaces.\n\nMark supported integrated GPUs as PerfOpt-eligible when selecting their\ndefault identity domain. Skip GCR3 setup and ATS/PRI/PASID enablement for\nthese identity attachments, then enable PerfOpt after installing the DTE.\nClear PerfOpt before attaching an eligible GPU to a translated or blocked\ndomain, including unmanaged domains used by VFIO. Propagate failures to\nclear bypass, but keep a completed identity attachment successful if the\noptional PerfOpt enable fails.\n\nClear inherited PerfOpt state during initialization, including when a crash\nkernel reuses device tables. Read feature support directly from hardware\nbecause cached features may not be available yet, and stop initialization\nif the initial clear fails.\n\nEach IOMMU has at most one PerfOpt-eligible GPU, so track activation with a\nboolean under the IOMMU lock. Preserve this state while clearing hardware\nat suspend and shutdown, and restore the bit on resume only where it was\nactive. Do not enable PerfOpt unconditionally during early IOMMU\ninitialization.\n\nRemove the amdgpu parameter, driver callbacks, and exported interfaces.\nTranslated attachments retain their normal device capability setup.\n\nSuggested-by: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nSigned-off-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "f66469d9905b39d2c260a15d7d6db450f4db67c1", "tree": "ce6e028e57b075aabbc4e0e5cf6e039455fa12a9", "parents": [ "2d2200551ccc3b9e444aecb59c4b53287e169266", "fafbc4051123d5459ea6950899cec08ed946e278" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 18:00:16 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 18:00:16 2026 -0800" }, "message": "Merge tag \u0027net-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from Bluetooth, IPsec, WiFi and CAN.\n\n Current release - regressions:\n\n - eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced\n\n Previous releases - regressions:\n\n - core:\n - use a dedicated flag to track disabled napi instances\n - frags: limit the truesize of a reassembly queue\n - reject a negative TCP header offset in qdisc_pkt_len_segs_init()y\n\n - tcp:\n - reject unhashed sockets during established lookups\n - free ireq-\u003eipv6_opt after an RCU grace period\n\n - ipv6:\n - fix fib6 walker UAF on NLM_F_REPLACE\n - raw: fix use-after-free in rawv6_send_hdrinc()\n\n - wifi:\n - mac80211: reinstate IEEE80211_TX_CTL_AMPDU, fix ath9k stall\n - brcmfmac: map msgbuf RX packet IDs bidirectional, fix firmware\n crash loop\n\n - vsock: size receive SKBs from declared payload\n\n - xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()\n\n - bluetooth: hci_sync: copy the LE accept list under hdev-\u003elock\n\n - ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked\n\n - can: protect the receive lists with a per-device lock\n\n - eth:\n - bnxt: don\u0027t keep MSI-X vectors added before FW reserves them\n - vxlan: stop rejecting dynamic FDB entries with a nexthop ID\n\n Previous releases - always broken:\n\n - sched: sch_qfq: prevent aggregate self-replacement\n\n - bridge: disable MRP ports before the FDB flush in del_nbp()\n\n - mptcp: do not use fast open on MP_JOIN subflows\n\n - ipv6: serialize multicast router socket ownership\n\n - bluetooth: hci_core: keep link-key filtering inside RCU\n\n - eth:\n - atl1c: drop oversized RX frames instead of panicking\n - stmmac: a bunch of XDP path fixes\n - b53: enable IGMP and MLD control packet CPU copies\"\n\n* tag \u0027net-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (170 commits)\n tcp: ipv6: free ireq-\u003eipv6_opt after an RCU grace period\n mptcp: pm: kernel: use RCU to free endpoint listeners\n tcp: initialize send sequence numbers before deferring TFO\n net: bridge: disable MRP ports before the FDB flush in del_nbp()\n net: stmmac: set XDP metadata length on the page_pool RX path\n bonding: fix missing down path on speed/duplex failure after FAIL-\u003eUP\n ip6mr: Serialize multicast router socket ownership\n bonding: 3ad: don\u0027t set BOND_LINK_FAIL on a slave that is not up\n net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets\n net: count last skb of each sk_backlog pass in __release_sock()\n net: 8139cp: keep Rx masked while NAPI is scheduled\n net/smc: don\u0027t spin in smc_rx_recvmsg() while a pipe holds spliced data\n net: dsa: b53: restore the NSP IMP port 2 Gbps mode\n net: ethernet: bgmac: preserve forced 2.5 Gbps link speed\n l2tp: only return sessions of the given tunnel in l2tp_session_get()\n tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead\n mptcp: do not use Fast Open on MP_JOIN subflows\n tcp: ipv6: do not read ireq-\u003epktopts from tcp_v6_send_synack()\n ipv4: Call rt_add_uncached_list() if !do_cache in ip_route_input_slow().\n ipv6: Flush rt-\u003efrom in rt6_uncached_list_flush_dev().\n ...\n" }, { "commit": "2d2200551ccc3b9e444aecb59c4b53287e169266", "tree": "ba0fdc02abf88b45affba21916f7fadbed222632", "parents": [ "eedaa7d61f1ec8ae053a9ece0d553785350ac486", "086aeca907789bd2604f16f07bfc073b19015015" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 17:32:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 17:32:20 2026 -0800" }, "message": "Merge tag \u0027platform-drivers-x86-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull platform driver fixes from Ilpo Järvinen:\n\n - arm64: asus-glymur-ec: Resolve config loop due to THERMAL symbol\n\n - uniwill-laptop: Add .hw_offloaded() to avoid leds subsystem warning\n about missing callback\n\n* tag \u0027platform-drivers-x86-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: uniwill-laptop: Implement .hw_offloaded trigger callback\n platform: arm64: drop the vacuous THERMAL dependency from EC_ASUS_GLYMUR\n" }, { "commit": "eedaa7d61f1ec8ae053a9ece0d553785350ac486", "tree": "0dc683e608627133cbbf3910d485ee86e71058ea", "parents": [ "3e516eae690b3f24c19168cc0fe605e1c610eb21", "2433db2af8e1482a3a50b8cefaf25cf7e4a9374d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:51:29 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:51:29 2026 -0800" }, "message": "Merge tag \u0027chrome-platform-firmware-fixes-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux\n\nPull chrome platform firmware fixes from Tzung-Bi Shih:\n\n - Don\u0027t skip CBMEM entries outside of known memory resources\n\n - Fix a Coccinelle warning for error-pointer handling in coreboot-cfr\n\n* tag \u0027chrome-platform-firmware-fixes-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:\n firmware: coreboot: Fix CFR error-pointer handling warning\n firmware: coreboot: Don\u0027t skip CBMEM entries outside of known memory\n" }, { "commit": "3e516eae690b3f24c19168cc0fe605e1c610eb21", "tree": "0e43cabe52b1df9cc2abae2610c049f3875dc7c2", "parents": [ "69e2b55fc3b4fa3639b8c320374c255f046ddda5", "e395bbf3ddf1b3175fd3bddaead63a2909b33694" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:37:21 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:37:21 2026 -0800" }, "message": "Merge tag \u0027hwmon-for-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - acpi_power_meter: Check for 32-bit and 64-bit unknown ACPI values,\n Fix missing locking in sysfs show callbacks and resume, and Prevent\n spurious power alarm when power is unknown\n\n - aquacomputer_d5next: Avoid truncating scaled sensor readings, Check\n maxcollection when probing AQUAERO devices, and reject short status\n reports\n\n - asus_rog_ryujin: Fix pump control source on the Ryujin III, and Fix\n timeout when reading 0% duty cycle\n\n - asus_wmi_sensors: Avoid global struct mutation\n\n - chipcap2: Series of fixes addressing various bugs in the driver\n\n - coretemp: Check for NULL platform device in hotplug callbacks, Fix\n 32-bit jiffies wraparound in show_temp() hnd Set nr_cores only after\n core_data allocation succeeds\n\n - corsair-cpro: Cache fan target only after a successful command\n\n - gpd-fan: Reset both fans to automatic on duo boards, and Update the\n speed cache before dropping the PM reference\n\n - hp-wmi-sensors: Avoid global struct mutation, Fix unbounded loops in\n scale_numeric_sensor(), and Serialize alarm flag read-and-clear with\n state-\u003elock\n\n - lm75: Fix setting polarity mask for chips with 16-bit config register\n\n - lm87: Fix drvdata type confusion in vrm_show() and vrm_store()\n\n - nct6683: Fix incorrect struct cast in show_pwm() and store_pwm()\n\n - peci/dimmtemp: Fix devres leak and UAF on concurrent unbind\n\n - pmbus core: Check return value from pmbus_thermal_add_sensor(),\n Register the thermal sensors with a 0-based index, and Fix return\n value check from thermal zone registration, and release devres\n allocated memory after devm_thermal_of_zone_register error\n\n - pmbus/q54sj108a2: Add missing NULL pointer check\n\n - sht15: Stop deferred work before releasing its resources\n\n - sht4x: Convert update_interval to jiffies in pending data check\n\n - tmp108: Fix initial conversion delay and wait until ready\n\n* tag \u0027hwmon-for-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (41 commits)\n hwmon: (asus_rog_ryujin) Fix timeout when reading 0% duty cycle\n hwmon: (hp-wmi-sensors) Serialize alarm flag read-and-clear with state-\u003elock\n hwmon: (acpi_power_meter) Check for 32-bit and 64-bit unknown ACPI values\n hwmon: (acpi_power_meter) Prevent spurious power alarm when power is unknown\n hwmon: (acpi_power_meter) Fix missing locking in sysfs show callbacks and resume\n hwmon: (aquacomputer_d5next) Avoid truncating scaled sensor readings\n hwmon: (sht4x) Convert update_interval to jiffies in pending data check\n hwmon: (coretemp) Fix 32-bit jiffies wraparound in show_temp()\n hwmon: (coretemp) Set nr_cores only after core_data allocation succeeds\n hwmon: (coretemp) Check for NULL platform device in hotplug callbacks\n hwmon: (gpio-fan) Update the speed cache before dropping the PM reference\n hwmon: (tmp108) Fix initial conversion delay and wait until ready\n hwmon: (lm75) Fix setting polarity mask for chips with 16-bit config register\n hwmon: (pmbus) Fix return value check from thermal zone registration\n hwmon: (pmbus) Release devres allocated memory after devm_thermal_of_zone_register error\n hwmon: (pmbus) Check return value from pmbus_thermal_add_sensor()\n hwmon: (pmbus/q54sj108a2) Add missing NULL pointer check\n hwmon: (peci/dimmtemp) Fix devres leak and UAF on concurrent unbind\n hwmon: (nct6683) Fix incorrect struct cast in show_pwm() and store_pwm()\n hwmon: (lm87) Fix drvdata type confusion in vrm_show() and vrm_store()\n ...\n" }, { "commit": "69e2b55fc3b4fa3639b8c320374c255f046ddda5", "tree": "be00cb69e1108adf375e24fb307aab5b689d1a60", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5", "1a577f9402c1780cc1e663f48d5dd54c02051b09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 15:10:52 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 15:10:52 2026 -0800" }, "message": "Merge tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost\n\nPull virtio fixes from Michael Tsirkin:\n \"vhost, virtio, and vdpa bugfixes.\n\n Just a bunch of fixes all over the place\"\n\n* tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (38 commits)\n virtio_pci: don\u0027t take the MSI mutex under cpu_hotplug_lock\n virtio_ring: Initialize id field in packed indirect descriptors\n vhost-scsi: fix page reference leak in misaligned I/O fallback\n vduse: fix VA/PA confusion in the coherent page fault path\n hwrng: virtio - prevent use-after-free after a failed restore\n virtio: use consistent virtqueue terminology\n virtio_balloon: initialize wakeup_lock before virtqueues are set up\n MAINTAINERS: add missing virtio/vdpa/vduse/vhost headers\n vhost-vdpa: initialize state before publishing cdev\n vhost: reject backend enable without a kick file\n vhost-scsi: reject delayed virtqueue setup\n virtio_ring: use shadow flags when detaching split descriptors\n vhost-scsi: validate event queue descriptor direction\n vhost-scsi: do not count PI bytes in the data length\n vdpa/snet: Don\u0027t discard the DPU error in snet_send_ctrl_msg()\n iommu/virtio: Reset device before deleting virtqueues on probe failure\n vhost: fix used ring index wrap in vhost_add_used_n_in_order\n vhost-scsi: zero misaligned I/O bounce pages\n vringh: reject empty / undersized indirect descriptor tables\n virtio_blk: Reset device on probe error paths after DRIVER_OK\n ...\n" }, { "commit": "d68ce4e71248e1ff5af9654b407541d9260b3ba5", "tree": "90d3a58f5651b3f3a78c0c753a9770e74b4dab6f", "parents": [ "46a062865b6b6b9a2ba199101b44feb925455c66", "71555ae8c7572fd99158013ca2e29187c5d2508d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:13:35 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:13:35 2026 -0800" }, "message": "Merge tag \u0027mm-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core\n\nPull core memory management fixes from David Hildenbrand:\n \"Here\u0027s a bigger set of MM fixes that we didn\u0027t manage to have ready\n for -rc1. All fixes are stable-worthy; the majority fixes nasty\n long-standing bugs instead of being purely hotfixes.\n\n We have some more of these kinds of stable-worthy fixes in the\n pipeline, but we\u0027ll focus on the really urgent fixes as we get closer\n to the release.\n\n (Leaving urgent MM fixes lurking for various weeks is not good, but\n having too many changes close to the release is also not good, it\u0027s\n tricky ...)\n\n Most issues were reported by Anthropic. Others were found while\n reworking proposed fixes, and of course some of the fixes were just\n reported and fixed on the mailing list.\n\n All fixes were in linux-next for several days without changes. Some\n commit IDs changed recently when I had to drop some non-stable fixes,\n rebased to -rc1 and picked up more trailers.\n\n This includes fixes to:\n - THP (Transparent Huge Pages)\n - GUP (Get User Pages)\n - KSM (Kernel Samepage Merging)\n - USERFAULTFD\n - SHARED MEMORY (shmem/tmpfs/memfd)\n - HUGETLB\n - Core MM, PAGE CACHE and MEMORY RECLAIM\n\n The main changes are:\n\n - Prevent information leaks through memfd pinning, and out-of bounds\n writes in GUP.\n\n - Fix data loss in shmem, THP collapse, KSM and memfd pinning.\n\n - Fix corruption and reference-counting errors with huge PMD/PUD\n mappings, and incorrect TLB flushing and unmapping.\n\n - Fix various use-after-free bugs, deadlocks and unkillable loops,\n witha a focus on shmem swap handling.\n\n - Fix execution-seal enforcement for memfd (incl. hugetlb).\n\n Other changes fix accounting, quota and userfaultfd (un)registration\n handling\"\n\n* tag \u0027mm-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core: (61 commits)\n mm/gup: check folio-\u003emapping under folio lock in memfd_pin_folios()\n khugepaged: fix readahead lock inversion in collapse_file()\n mm/huge_memory: set the mmu_gather page size in zap_huge_pud()\n mm/memory-tiers: unregister empty tiers outside memory_tier_lock\n mm/cma: don\u0027t release CMA pages still in use\n mm/vma: don\u0027t leak the charge for stack growth\n mm/huge_memory: split huge PUDs when adjusting VMA boundaries\n mm/vma: call -\u003emay_split() before a partial merge\n mm/ksm: check large swap-cache folios before mapping them\n mm/ksm: fix use of a freed anon_vma at swap-in\n mm/ksm: reset the unstable trees of all nodes\n mm: fix deadlock of mremap() against UFFDIO_MOVE\n mm: fix unkillable fault loop on MAP_DROPPABLE memory\n mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit\n mm/memory: reject remote COW faults on PFN mappings\n mm/madvise: fix data loss from MADV_FREE on a KSM page\n mm/mremap: fix moving PUD leaves\n mm/mremap: recheck PUDs under the page table lock\n mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs\n mm/mmu_notifier: set -\u003emm only after mmgrab()\n ...\n" }, { "commit": "46a062865b6b6b9a2ba199101b44feb925455c66", "tree": "e2949d7e0aeda38114a1df371b34893c46c145d5", "parents": [ "afd661f6a26438c407bd9928ea16e80c14b121d9", "5b4696e0bfc358619adaeab25ad35b4979af8331" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:05:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:05:13 2026 -0800" }, "message": "Merge tag \u0027mm-nonmm-hotfixes-stable-2026-11-04-20-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull non-MM fixes from Andrew Morton:\n \"22 patches. 17 are cc:stable.\n\n Most are OCFS2 fixes. These address extended-attribute corruption,\n missing attributes and kernel BUGs, along with crashes during cluster\n configuration, lock migration, recovery and unmount. Extent movement\n is also fixed to validate its range against a stable file size.\n\n Three FAT changes prevent a failed-write/FIBMAP race from spuriously\n making the filesystem read-only, correct directory link counts after\n rename, and speed up file expansion. The reported QEMU benchmarks show\n particularly large improvements on synchronous mounts.\n\n A taint-string fix prevents an out-of-bounds read which can expose\n slab contents in the kernel log. There are also build fixes for\n OpenRISC modules on CPUs without hardware multiply and for Clang 24\"\n\n* tag \u0027mm-nonmm-hotfixes-stable-2026-11-04-20-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (22 commits)\n ocfs2: cache the mount context for dentry lock callbacks\n ocfs2: wait for filecheck kobject release after a failed add\n fat: fix parent link count when replacing a sibling directory\n ocfs2/cluster: unlink socket containers before releasing resources\n ocfs2: stop recovery before shutting down local allocators\n ocfs2/dlm: serialize migration MLE cleanup on failure\n panic: zero the dynamically allocated taint buffer\n ocfs2: keep locking_state within the cluster connection lifetime\n MAINTAINERS: mailmap: use Clément Léger\u0027s linux.dev mail address\n MAINTAINERS: add an IPC entry\n ocfs2: validate move extents against a stable EOF\n fat: hold truncate_lock in fat_write_failed()\n fat: preallocate space before expanding in fat_cont_expand()\n ocfs2: do not read the entry array of an empty xattr block\n ocfs2: do not index before the entry array when dividing an empty bucket\n ocfs2: do not read the entry array of an empty xattr bucket\n ocfs2: find the xattr entry again after converting a block to a bucket\n ocfs2: find the xattr entry again after defragmenting a bucket\n ocfs2: read the xattr entry hash before defragmenting the bucket\n ocfs2/heartbeat: serialize concurrent writes to a region\u0027s dev attribute\n ...\n" }, { "commit": "28f7d31c2aeb350df9a0116093fade0a840fb4ce", "tree": "8c02276ad07123e0d1156e52475480ce3c10db6f", "parents": [ "e6ac1da6a53c5f670bf09e60a2500d15be68d2fc", "f33c8bc785401669b29229bcf3d0086ba9f5b87c" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Nov 05 13:47:13 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Nov 05 13:47:13 2026 -0700" }, "message": "Merge tag \u0027nvme-7.4-2026-11-05\u0027 of git://git.infradead.org/nvme into block-7.4\n\nPull NVMe fixes from Keith:\n\n\"- Fix a passthru reference leak that hangs disabling a target passthru\n controller (7.4-rc1 regression)\n - Fix namespace removal race with SRCU readers of the namespace list\n - Fix use-after-free in nvme-tcp controller teardown after a failed\n connect\n - Fix NULL dereference in nvme-rdma when a reconnect adds queues\n - nvmet-rdma device removal and disconnect fixes\n - nvmet-tcp TLS record type handling and bounded connection accept work\n - Don\u0027t leak stale memory in the nvmet ANA log page\n - Harden nvmet against invalid input: keep-alive timeout overflow,\n incomplete DHCHAP messages, configfs address bounds, arbitration\n burst mask, and locking for traffic based keep alive updates\n - Keep the old nvmet auth keys if setting new ones fails\n - Delete nvme-loop controller on failed reset\n - Fix extra cdev reference put and unregister on a zero pr_register key\n - Fix a TLS key reference leak in the nvme keyring\n - Quirks for ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d\n - Speed up nvmet namespace disable\n - Misc cleanups\"\n\n* tag \u0027nvme-7.4-2026-11-05\u0027 of git://git.infradead.org/nvme: (29 commits)\n nvmet: cache passthru reference in __nvmet_req_complete()\n nvmet: drop the redundant auth check in nvmet_parse_io_cmd()\n nvmet: bound the traddr and trsvcid configfs writes\n nvmet: take subsys-\u003elock when forcing reconnects for tbkas\n nvme: wait for SRCU readers before splicing the namespace list\n srcu: Add list_splice_init_srcu()\n nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d\n nvmet: don\u0027t return memory contents beyond valid data when reading ANA log page\n nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE\n nvmet: drop the extra RCU grace period in nvmet_ns_disable()\n nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()\n nvmet-rdma: disconnect a queue on device removal\n nvmet-rdma: queue the release work under the mutex\n nvmet-rdma: take a device off the list last\n nvmet-tcp: limit the connections accepted per work run\n nvmet-rdma: disconnect only established queues\n nvmet-auth: keep the old keys if the new ones fail\n nvmet-tcp: ask for the TLS record type on every receive\n nvme-loop: delete the controller if a reset fails\n nvmet-rdma: remove dead allocated field in nvmet_rdma_rsp\n ...\n" }, { "commit": "afd661f6a26438c407bd9928ea16e80c14b121d9", "tree": "6ecd7744905f3e3949e4b5f07deb5bf79ff0fdfc", "parents": [ "05441d697f7f9a927264f4058cbbc6a03dfcac9d", "19eab4cf787c917bfb7615460933e4ae894af65b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 12:32:29 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 12:32:29 2026 -0800" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-11-04-20-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n\n - \"mm: avoid losing atomic VMA flags\" (Lorenzo Stoakes):\n\n Preserve guard-page and soft-dirty state across VMA changes. Prevent\n fork and THP collapse from losing guard markers, and keep changes\n visible to applications which track modified memory.\n\n - \"MAINTAINERS: MM updates\" (David Hildenbrand):\n\n Start routing more MM components through mm/core.git and add Zi Yan\n as a THP co-maintainer. Update component coverage and integration\n branches as part of the transition to separate MM component trees.\n\n - \"mm/hugetlb: fix mremap bugs\" (Li Zhe):\n\n Fix hugetlb mremap deadlocks and truncated move lengths. Prevent\n userfaultfd poison markers from affecting other processes through\n shared hugetlb page tables.\n\n - \"MAINTAINERS updates for page and slab allocators\" (Vlastimil Babka):\n\n Add Johannes Weiner as a page allocator co-maintainer and update page\n and slab allocator entries for their component trees and integration\n through mm/linux.\n\n - \"mm/damon: fix three race bugs in sysfs and core\" (SJ Park):\n\n Serialize DAMOS tuning updates and stop monitoring contexts from\n sharing mutable state. Avoid interference between concurrent DAMON\n instances and incorrect auto-tuning.\n\n - \"mm: page_alloc: fix reserve access for non-blocking requests\"\n (Johannes Weiner):\n\n Stop ordinary non-blocking allocations from consuming reserves or\n bypassing watermarks. Avoid severe allocation stalls under memory\n pressure and preserve reserves for requests entitled to use them.\n\n - \"mm/cma: accept memory of CMA areas reserved with memblock_reserve()\"\n (Mike Rapoport):\n\n Accept memory in fixed-address and multi-range CMA reservations.\n Prevent fatal accesses to these pages in TDX and SEV-SNP guests.\n\n - Summary of singletons in this merge:\n\n Several fixes address crashes and unsafe memory access. Failed THP\n collapse now flushes stale translations before releasing pages which\n another collapse can free. A truncation race with MADV_DONTNEED could\n remove still-mapped shmem pages and hit a kernel BUG. Large-folio\n page-table scans no longer wrap addresses and crash near\n address-space boundaries. Hugetlb vmemmap optimization no longer\n causes write faults from racing reference-count operations.\n Memory-cgroup teardown is also protected against reclaim work\n accessing released state.\n\n KSM now preserves userfaultfd protection during merging and\n unmerging, and retains soft-dirty information needed by incremental\n memory dumpers. Reads of /proc/PID/maps and related files no longer\n omit continuously mapped ranges during concurrent VMA changes. There\n are also fixes for expanding mixed mappings with mremap() and\n querying NUMA placement with tagged addresses. Swapoff checks for\n signals while processing large address spaces and shmem files, so it\n can be interrupted without holding up suspend until the whole object\n is read.\n\n Costly allocations with cheap smaller-order fallbacks avoid direct\n reclaim and compaction. Reported arm64 PostgreSQL tests improved from\n 58,602 to 157,246 transactions per second with defrag_mode disabled;\n this addresses a buffered-write regression under fragmentation.\n Background reclaim can recover on the highest-numbered memory node\n after it has given up, and 32-bit writeback threshold calculations no\n longer overflow and assign incorrect dirty-memory limits.\n\n* tag \u0027mm-hotfixes-stable-2026-11-04-20-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (43 commits)\n MAINTAINERS: move SLAB ALLOCATOR under MEMORY MANAGEMENT\n MAINTAINERS: add Johannes as the page allocator co-maintainer\n MAINTAINERS: route more MM changes through mm/core.git\n MAINTAINERS: rename and move MEMORY HOT(UN)PLUG\n MAINTAINERS: add missing files to MM component sections\n MAINTAINERS: sort entries in MM sections\n MAINTAINERS: add Zi Yan as co-maintainer for MEMORY MANAGEMENT - THP\n MAINTAINERS: TMPFS (SHMEM FILESYSTEM) updates\n MAINTAINERS: mention for-next branch in MEMORY MANAGEMENT - MEMORY MAP\n mm: memcontrol: fix NULL pointer deref and UAF from high_work_func() on dying memcg\n mm/cma: accept memory of CMA areas reserved at a fixed address\n mm/cma: accept memory of multi-range CMA areas\n mm/page_alloc: avoid direct reclaim and compaction for costly __GFP_NORETRY allocations\n mm: page_alloc: remove ALLOC_NON_BLOCK from ALLOC_RESERVES\n mm: page_alloc: do not give all non-blocking requests reserve access\n mm/hugetlb_vmemmap: map the shared tail page writable\n fs/proc/task_mmu: fix missed VMAs when reading /proc/PID/maps and friends\n selftests/mm: fix khugepaged_race build with older glibc\n mm/vma: update VMA iterator state on error in new VMA merge\n mm/migrate: snapshot the source nid before the misplaced migration\n ...\n" }, { "commit": "f33c8bc785401669b29229bcf3d0086ba9f5b87c", "tree": "9b6c7eabee8f955a3495814d779a9961707cb9d5", "parents": [ "c92055eb22a8e135011c14c5eb40f5da0a0c8153" ], "author": { "name": "Nilay Shroff", "email": "nilay@linux.ibm.com", "time": "Thu Nov 05 17:54:55 2026 +0530" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:01 2026 -0800" }, "message": "nvmet: cache passthru reference in __nvmet_req_complete()\n\n__nvmet_req_complete() releases the passthru reference held while\nprocessing a passthru request. However, it currently does so after\ncalling ops-\u003equeue_response().\n\nOnce ops-\u003equeue_response() is called, the transport may complete and\nrecycle the request on another CPU. If the request is reused, its\nreq-\u003ep.ref_held field may be reset to false before\n__nvmet_req_complete() checks it in nvmet_put_passthru_ref().\nConsequently, the passthru reference may not be released, leaving\nwait_for_completion(\u0026passthru-\u003edisable_done) in\n__nvmet_passthru_ctrl_disable() blocked indefinitely.\n\nFix this by caching the passthru pointer at the beginning of\n__nvmet_req_complete(), while the request is still valid, and use\nthe cached pointer to release the reference after queuing the\nresponse. This also changes nvmet_put_passthru_ref() to accept\nthe passthru pointer directly instead of accessing it through\nthe request.\n\nReported-by: Shin\u0027ichiro Kawasaki \u003cshinichiro.kawasaki@wdc.com\u003e\nCloses: https://lore.kernel.org/all/auhpmq499RVE9YpC@shinmob/\nFixes: 5e12d81874a1 (\"nvmet: fix use-after-free in passthru I/O hotpath\")\nTested-by: Shin\u0027ichiro Kawasaki \u003cshinichiro.kawasaki@wdc.com\u003e\nSigned-off-by: Nilay Shroff \u003cnilay@linux.ibm.com\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "c92055eb22a8e135011c14c5eb40f5da0a0c8153", "tree": "fa4b50506e6550c7fd89c4a6ee6db9a7bf2debc6", "parents": [ "cf399d4abbeddc317f8160a79fefb4016c469862" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Wed Nov 04 21:14:46 2026 +0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:01 2026 -0800" }, "message": "nvmet: drop the redundant auth check in nvmet_parse_io_cmd()\n\nnvmet_parse_io_cmd() calls nvmet_check_auth_status() and then\nnvmet_check_ctrl_status(), which performs the same check again. The\nfirst call cannot fail either: this path only handles commands from I/O\nqueues, and nvmet_check_auth_status() returns true unconditionally for\nqid \u003e 0. Drop the duplicate.\n\nNo functional change.\n\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "cf399d4abbeddc317f8160a79fefb4016c469862", "tree": "4e82fd3db3751cac5f1950f57c58bfe1aabf958a", "parents": [ "6d7388d1097f6b2367026114ce8d9e7b8b9d3426" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Wed Nov 04 03:07:27 2026 +0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:01 2026 -0800" }, "message": "nvmet: bound the traddr and trsvcid configfs writes\n\nnvmet_addr_traddr_store() and nvmet_addr_trsvcid_store() reject a write\nonly when count is larger than NVMF_TRADDR_SIZE (256) respectively\nNVMF_TRSVCID_SIZE (32). A write of exactly that many characters is\naccepted, and the following\n\n\tsscanf(page, \"%s\\n\", port-\u003edisc_addr.traddr)\n\nhas no field width. configfs terminates the buffer at page[count], so\nthe scan writes 256 characters plus the trailing NUL, i.e. 257 bytes,\ninto traddr[256]. The extra byte lands in the following tsas field of\nthe discovery log entry, silently clearing the first TSAS byte (the\nRDMA queue type, or the TLS section type for TCP). trsvcid has the\nsame off-by-one with a 32-byte write; there the extra byte lands in\nthe reserved bytes that follow trsvcid.\n\nLimit the scans to one byte less than the destination arrays. The\ncount checks can stay as they are so that a normal newline-terminated\nwrite is still accepted.\n\nFixes: 9ba2a5cb8896 (\"nvmet: filter newlines from user input\")\nCc: stable@vger.kernel.org\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "6d7388d1097f6b2367026114ce8d9e7b8b9d3426", "tree": "af5320504a32362cbfb6cc78a454d57b4d06378b", "parents": [ "8a0449832b50cd4f99f2d2952cfc1476e5f26d0f" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Wed Nov 04 03:07:25 2026 +0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:00 2026 -0800" }, "message": "nvmet: take subsys-\u003elock when forcing reconnects for tbkas\n\nnvmet_subsys_attr_tbkas_store() walks subsys-\u003ectrls to force a reconnect\nwhile holding only nvmet_config_sem. The list is protected by\nsubsys-\u003elock: nvmet_alloc_ctrl() adds entries and nvmet_ctrl_free()\nremoves them under that lock, and the controller free path does not take\nnvmet_config_sem. Writing attr_tbkas concurrently with a controller\ngoing away, for example on a keep-alive timeout or a fatal error, can\ntherefore dereference a controller that has already been removed and\nfreed.\n\nTake subsys-\u003elock around the list walk, as\nnvmet_subsys_attr_qid_max_store() already does for the same loop.\ndelete_ctrl() only schedules the asynchronous teardown, so it does not\nrecurse into subsys-\u003elock.\n\nFixes: e98e45e9465b (\"nvmet: Add traffic based keep alive support to configfs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "8a0449832b50cd4f99f2d2952cfc1476e5f26d0f", "tree": "6de8cf5e1bbac48b33d3b1817453378f3a331cf8", "parents": [ "d06917d0ba226206dbd606330d73a8eb1e3029c1" ], "author": { "name": "Qiliang Yuan", "email": "odys.yuan@gmail.com", "time": "Wed Nov 04 01:30:40 2026 -0500" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 07:07:47 2026 -0800" }, "message": "nvme: wait for SRCU readers before splicing the namespace list\n\nReaders walk ctrl-\u003enamespaces under ctrl-\u003esrcu, and some of them sleep\nthere, e.g. nvme_wait_freeze() waiting for I/O to drain.\n\nnvme_remove_namespaces() moves the list onto its on-stack ns_list with\nlist_splice_init_rcu(), which only waits for RCU readers before\nrelinking the entries. A reader still on the last namespace then follows\nits next pointer to ns_list instead of ctrl-\u003enamespaces and treats the\nstack as a namespace. Deleting a controller while a Format NVM\npassthrough waits for a delayed read on the last namespace gives:\n\n BUG: KASAN: stack-out-of-bounds in nvme_wait_freeze+0x102/0x120\n Read of size 8 at addr ff110001d2f3fc38 by task nvme/4413\n Call Trace:\n nvme_wait_freeze\n nvme_passthru_start\n nvme_submit_user_cmd\n nvme_user_cmd\n nvme_dev_ioctl\n BUG: unable to handle page fault for address: ffffffff8af04850\n\nUse list_splice_init_srcu() instead, which waits for the SRCU readers.\nThis also takes the RCU grace period out of every controller deletion.\nDeleting 64 tcp controllers with one namespace each, median of 3 runs on\neach of two boots per kernel:\n\n before after\n nvme disconnect-all (ms) 3491 / 3509 2996 / 3165\n nvme_remove_namespaces() avg (ms) 39.0 / 40.5 31.9 / 34.7\n\nFixes: be647e2c76b2 (\"nvme: use srcu for iterating namespace list\")\nCc: stable@vger.kernel.org\nSigned-off-by: Qiliang Yuan \u003codys.yuan@gmail.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "d06917d0ba226206dbd606330d73a8eb1e3029c1", "tree": "0ba263e46c61c4d5e27df305a4034abe68b8e503", "parents": [ "c64d9b2c1f4fd1d8fa52dab37b48428a99c4d58d" ], "author": { "name": "Qiliang Yuan", "email": "odys.yuan@gmail.com", "time": "Wed Nov 04 01:30:39 2026 -0500" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 07:07:47 2026 -0800" }, "message": "srcu: Add list_splice_init_srcu()\n\nlist_splice_init_rcu() makes a list look empty to new readers, waits for\nthe current ones with the given sync function, and only then links the\nentries into the new list. The sync function takes no argument, so it\ncan wait for RCU readers but not for the readers of an srcu_struct.\n\nPassing synchronize_rcu() for a list read under SRCU still builds, but\nleaves SRCU readers on the entries while the last one\u0027s next pointer is\nmoved onto the new list head. nvme_remove_namespaces() does this today.\n\nAdd list_splice_init_srcu(), which waits for the readers of the given\nsrcu_struct instead.\n\nCc: stable@vger.kernel.org\nSuggested-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Qiliang Yuan \u003codys.yuan@gmail.com\u003e\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "e5801273f93eb7513850b1c38ea14d69f2de1592", "tree": "adf92d2a69aa6c7f6014b74c0653dc4752808847", "parents": [ "a3b98efdb320e62ec0f89caaa67993a2d1c178be" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:11:44 2026 +0100" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:11:44 2026 +0100" }, "message": "udf: Fix incorrect error code in udf_current_aext()\n\nThere are two places in udf_current_aext() that return -1 instead of\nproper error code. Fix them.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "a3b98efdb320e62ec0f89caaa67993a2d1c178be", "tree": "99a0d6fc4d902b210fc145c25d641c1fb9a1ff59", "parents": [ "94401199df90e1c2a50c6e4b73618ac5a4ba83ba" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:09:19 2026 +0100" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:09:19 2026 +0100" }, "message": "udf: Simplify udf_table_prealloc_blocks()\n\nSimplify handling when the specified extent is not found in the table\nof free blocks.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "94401199df90e1c2a50c6e4b73618ac5a4ba83ba", "tree": "b41fdf705418ed27a59f2a7a455b8e1ff64cef83", "parents": [ "0c52750caaaccee8b0e929450fe6538ec4985722" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Fri Oct 30 22:05:37 2026 +0800" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:07:35 2026 +0100" }, "message": "udf: don\u0027t use eloc after the end of the unallocated space table\n\nWhen udf_next_aext() returns 0, its eloc, elen and etype outputs hold\nno defined value. Two walks of the unallocated space table still use\neloc after the walk has reached the end of the table.\n\nudf_table_prealloc_blocks() looks for a free extent starting at\nfirst_block and decides whether it found one by comparing eloc with\nfirst_block after the walk. If the table\u0027s list ends in a continuation\ndescriptor that leads to an empty allocation extent, eloc is then the\nblock of that allocation extent, which is in use, and if that is\nfirst_block, the block is handed out as preallocation. Once\nudf_discard_prealloc() no longer frees the wrong block, this is what\nstill makes fsx in generic/091 and generic/263 read back bad data on a\ntable, in about one run in four. Only take the extent if the walk\nstopped at it.\n\nWhen udf_table_free_blocks() cannot merge the freed blocks into an\nexisting extent, it appends a new one and sets only its block number,\nso the partition reference comes from whatever eloc held after the\nwalk, and with long allocation descriptors it is written to disk. For\na table without extents, eloc was never set. Take the partition\nreference from the freed blocks instead. Short allocation descriptors\ndo not store the partition reference, which is why this half remains a\nlatent long-descriptor fix rather than a reproduced failure.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nLink: https://patch.msgid.link/fd9ca4c4ba98c00c012ec861f6c0bc08a3b1d07b.1793349907.git.matthias.goergens@gmail.com\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "0c52750caaaccee8b0e929450fe6538ec4985722", "tree": "f23310b8492bba06e1937bcdf79fcc63eeb7a8ac", "parents": [ "e614c3e35a6699ed691b4d17e1ec4230e34aa3eb" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Fri Oct 30 22:05:36 2026 +0800" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:07:35 2026 +0100" }, "message": "udf: fix preallocation discarding before an empty allocation extent\n\nudf_discard_prealloc() finds the last extent of a file by peeking at\nthe next one with udf_next_aext() and stopping when that returns 0.\nThe peek reads into eloc and elen, and the code then uses them as the\nlast extent. But when udf_next_aext() returns 0 they hold no defined\nvalue: if the extent list ends in a continuation descriptor that leads\nto an empty allocation extent, they describe that continuation, i.e.\nthe block of the empty allocation extent, one block long.\n\nThe kernel creates such lists itself: when udf_delete_aext() removes\nthe only descriptor of the last allocation extent in a list, it leaves\nthat allocation extent empty and the continuation to it in place.\n\nIf the last extent is a preallocation, udf_discard_prealloc() deletes\nit with udf_delete_aext(), which finds the following allocation extent\nempty, so it also removes the continuation and frees that allocation\nextent\u0027s block. udf_discard_prealloc() then frees eloc and elen: that\nblock a second time, instead of the preallocated blocks. On a space\nbitmap the preallocated blocks leak and the free block count drifts.\nOn an unallocated space table the second free adds a second free\nextent for the same block, which is later handed out twice: fsx as run\nby generic/091 and generic/263 ends up with two parts of its test file\nin one block and reads back bad data.\n\nPeek into separate variables, so that eloc and elen keep the last\nextent that udf_next_aext() returned with 1.\n\nFixes: cfe4c1b25dd6 (\"udf: Fix preallocation discarding at indirect extent boundary\")\nCc: stable@vger.kernel.org\nSuggested-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nLink: https://patch.msgid.link/480eccd1264a4cea5226fc36ed108931b2c403fb.1793349907.git.matthias.goergens@gmail.com\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "e614c3e35a6699ed691b4d17e1ec4230e34aa3eb", "tree": "20d3ed005ba8a61913b2e653a8fbbe29223790df", "parents": [ "da582d84fcf5f2f0c1d7760e1a899ca7cedb80fc" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Fri Oct 30 22:05:35 2026 +0800" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:07:35 2026 +0100" }, "message": "udf: check the unallocated space table when it is loaded\n\nudf_table_new_block() hands out the first block of the extent closest\nto its goal and trusts that the extent covers at least one whole block\ninside the partition. Nothing checks that. A zero-length extent makes\nit return the block the extent points at, which need not be free, and\nthe subtraction of one block then underflows the length into the type\nbits, turning the entry into a bogus continuation. An extent running\npast the end of the partition makes it return blocks behind the\npartition.\n\nSuch tables are not only found on crafted images: until the previous\ncommit, udf_table_new_block() itself left zero-length extents behind\nin tables written by mkudffs, and then converted them into extents\nrunning past the partition.\n\nCheck every extent once when the table is loaded, and refuse\nread-write access if one is empty, is not a whole number of blocks, or\ndoes not lie inside the partition, in the same way as for other\nallocation information the kernel cannot use. Check first that the\ntable is an Unallocated Space Entry at all: the walk starts at the\noffset of the allocation descriptors in one, and for a file entry that\noffset lies before the inode\u0027s in-memory copy of the descriptors.\nTreat a chain of allocation extent descriptors that leads back to\nitself the same way: the walk would otherwise return the same extents\nforever, and the mount would never finish. Let a fatal signal\ninterrupt the walk and fail the mount.\n\nRefusing read-write access to an empty extent is deliberate. It shows\nthat an old kernel took the last block but left the entry behind. If\nconsumed again, the entry returns an in-use block and turns into a huge\nbogus extent. Refusing the table before that\nhappens avoids this second allocation; the filesystem can still be\nmounted read-only. The check cannot detect every overlap that may\nalready exist in a damaged table.\n\nThis patch should be backported together with the previous one: that\npatch stops creating new empty extents, and this one rejects existing\nones before they are consumed again.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nLink: https://patch.msgid.link/81233decd91f4a48bf4d74e3d15b547c7711e39f.1793349907.git.matthias.goergens@gmail.com\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "da582d84fcf5f2f0c1d7760e1a899ca7cedb80fc", "tree": "921deec96d8add6dca97f4e0e048a35db17b2031", "parents": [ "4f91b042af212ca0b610e43f9a975ddc7f0d0923" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Fri Oct 30 22:05:34 2026 +0800" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 15:07:35 2026 +0100" }, "message": "udf: don\u0027t let the extent type hide an exhausted free-space table extent\n\nudf_table_new_block() takes the first block of the free-space table\nextent closest to the goal. It keeps that extent\u0027s type and length\ntogether in goal_elen, subtracts one block, and deletes the extent only\nif goal_elen then reaches zero. UDF 2.60 section 2.3.7.1 requires the\nfree-space extents of an Unallocated Space Entry to be of type 1\n(allocated but not recorded), and mkudffs writes them that way. For\nsuch an extent the type bits keep goal_elen non-zero, so taking its last\nblock leaves a type-1 extent of length zero behind, starting at the\nblock after the extent, which is in use.\n\nThe next allocation that picks this empty extent returns that in-use\nblock. Subtracting a block from 0x40000000 then borrows from the type\nbits, and the extent becomes type 0 with a length of 2^30 - blocksize:\nabout a gigabyte of \"free\" space overlapping live metadata, the other\ntable extents and whatever lies behind the partition. From then on\nblocks are handed out twice, or past the end of the partition.\n\nExtents that udf_table_free_blocks() adds are type 0, where the check\nworks, so only tables written by mkudffs or by another implementation\nare affected. Nothing more than filling such a filesystem is needed:\non a fresh 1 MiB \"mkudffs --space\u003dunalloctable\" image, creating empty\nfiles until the partition is full writes file entries over the reserve\nvolume descriptor sequence and the backup anchor, and df then reports a\nnegative amount of used space.\n\nOn syzbot\u0027s images the same double allocation is what the two reports\nbelow trip over. In the first, ftruncate() extends a new file with\nenough hole extents to need a chain of allocation extent descriptors;\none AED is placed on another inode\u0027s file entry, and a later one is\nplaced on the block of the AED currently being filled, which\nudf_setup_indirect_aext() zeroes, so __udf_add_aext() finds\nlengthAllocDescs out of step with its cursor. In the second, an AED\nis placed past the end of the device, sb_getblk() fails, and the error\npath of udf_do_extend_file() calls udf_truncate_extents() on an extent\nlist that no longer covers i_size.\n\nKeep the type separately from the length, as udf_table_prealloc_blocks()\nalready does.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nReported-by: syzbot+799a0e744ac47f928024@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d799a0e744ac47f928024\nReported-by: syzbot+43fc5ba6dcb33e3261ca@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d43fc5ba6dcb33e3261ca\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nLink: https://patch.msgid.link/6b51c38d2d069544053c542470950e2a448b0b8d.1793349907.git.matthias.goergens@gmail.com\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "fafbc4051123d5459ea6950899cec08ed946e278", "tree": "5ee02308dc7ba4452e49b702d960aed5b72ea468", "parents": [ "49b09ae0bf57b4230187d4cdd0a370558e44a6e8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Tue Nov 03 10:00:11 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 15:07:23 2026 +0100" }, "message": "tcp: ipv6: free ireq-\u003eipv6_opt after an RCU grace period\n\nireq-\u003eipv6_opt is only set by calipso_req_setattr(), when a CALIPSO\nNetLabel mapping is configured.\n\nRequest socket migration (net.ipv4.tcp_migrate_req\u003d1, or a\nBPF_SK_REUSEPORT_SELECT_OR_MIGRATE program) clones the request\nsocket with inet_reqsk_clone(), so that the old request socket and\nits clone share the same ipv6_opt, then reqsk_migrate_reset() clears\nthe pointer in the old one.\n\nAnother cpu holding a reference on the old request socket can still\nbe using these options, sending a SYNACK from tcp_v6_send_synack()\nor creating a child in tcp_v6_syn_recv_sock(), when the clone\nis freed. tcp_v6_reqsk_destructor() frees ipv6_opt with a plain\nkfree(), leading to a use-after-free.\n\nBoth readers already run under RCU, like their IPv4 counterparts.\nUse kfree_rcu() in tcp_v6_reqsk_destructor(), as commit e3f33b0a1d89\n(\"ipv4: free inet_opt and ireq_opt after an RCU grace period\") did\nfor ireq_opt.\n\nFixes: c905dee62232 (\"tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/netdev/179369559062.488856.15441115725436277776@kernel.org/\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nTested-by: Linkui Xiao \u003cxiaolinkui@kylinos.cn\u003e\nLink: https://patch.msgid.link/20261103090011.4128420-1-edumazet@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "49b09ae0bf57b4230187d4cdd0a370558e44a6e8", "tree": "ce5eac15d5225510c288460a9309e427499bd8b7", "parents": [ "57889a8f6d49fc153aa0017d13086ab736567f8a" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Thu Oct 29 21:22:55 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 15:01:42 2026 +0100" }, "message": "mptcp: pm: kernel: use RCU to free endpoint listeners\n\nmptcp_pm_nl_create_listen_socket() starts the TCP listener directly\ninstead of going through mptcp_listen(). It consequently misses setting\nSOCK_RCU_FREE on the parent MPTCP socket.\n\ntcp_child_process() can invoke the listener\u0027s subflow_data_ready()\ncallback without holding the MPTCP parent lock or a reference to the\nparent. An authenticated MP_JOIN racing with endpoint teardown can\ntherefore access the parent after its last reference has been dropped.\nThe ADD_ADDR error path can also close an already published listener.\n\nSet SOCK_RCU_FREE before __inet_listen_sk() publishes the TCP listener,\nmatching mptcp_listen(). This protects the parent on every subsequent\nclose path, including a failed endpoint addition.\n\nFixes: 1729cf186d8a (\"mptcp: create the listening socket for new port\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20261030042255.74216-1-kylebot@openai.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "57889a8f6d49fc153aa0017d13086ab736567f8a", "tree": "7100680ab8abb88ad7004414a283379c300cdefb", "parents": [ "37dfd0efbfffc20a57e41c2eb349ac49b1ca1ff8" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Mon Nov 02 11:59:43 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 12:36:46 2026 +0100" }, "message": "tcp: initialize send sequence numbers before deferring TFO\n\nTCP_FASTOPEN_CONNECT can return from connect() before tcp_connect_init()\nwhen a cached cookie or cookieless Fast Open allows deferring the SYN.\nAt this point write_seq contains the initial sequence number, while\nsnd_una and snd_nxt have not been initialized to that sequence number.\n\nConsequently, inet_diag and /proc/net/tcp{,6} report the initial\nsequence number as the send queue length despite no SYN or payload being\nqueued.\n\nInitialize snd_una and snd_nxt to write_seq before marking the\nconnection as deferred. Both sequence-based queue lengths then remain\nzero until the first write starts the connection and runs\ntcp_connect_init().\n\nFixes: 19f6d3f3c842 (\"net/tcp-fastopen: Add new API support\")\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nLink: https://patch.msgid.link/20261102035943.9700-1-qingfang.deng@linux.dev\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "37dfd0efbfffc20a57e41c2eb349ac49b1ca1ff8", "tree": "93660a34fd000cd14f4a2e6a0e1a9b6c5c89718b", "parents": [ "6d9b7c85af57305ec2bd5907124478867edcc60b" ], "author": { "name": "Cheng Yongkang", "email": "teel4res@gmail.com", "time": "Sat Oct 31 21:48:40 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 12:14:28 2026 +0100" }, "message": "net: bridge: disable MRP ports before the FDB flush in del_nbp()\n\ndel_nbp() flushes the port\u0027s FDB entries before it unregisters the RX\nhandler. For a normal port, br_stp_disable_port() moves the port to\nBR_STATE_DISABLED before this cleanup.\n\nThat does not hold for an MRP ring port. br_set_state() ignores state\nchanges while BR_MRP_AWARE_BIT is set, so br_stp_disable_port() leaves\nthe port state alone. br_mrp_port_del() then restores forwarding when\nthe bridge is up before clearing the bit. A frame received between\nbr_fdb_cleanup_by_dst() and netdev_rx_handler_unregister() can therefore\ncreate a new FDB entry referencing the dying port. Nothing removes that\nentry before destroy_nbp_rcu() frees the port, so a later frame to the\nlearned MAC can be forwarded through the freed port.\n\nRemove the MRP and CFM instances before disabling the port, so that\nbr_stp_disable_port() actually transitions it to BR_STATE_DISABLED.\nWith CONFIG_BRIDGE_VLAN_FILTERING\u003dy, synchronize_net() in\nnbp_vlan_group_unpublish() also drains receive paths that could still\nlearn with the old state before the final FDB cleanup.\n\nFound through an LLM-assisted source code analysis workflow and\nreproduced on net with KASAN and CONFIG_BRIDGE_VLAN_FILTERING\u003dy in QEMU.\nA diagnostic switchdev module accepts MRP objects and delays the\nNETDEV_CHANGEUPPER callback for 1.5 s, holding del_nbp() after the FDB\ncleanup and before RX handler removal. The reproducer floods the MRP\nport with rotating source MACs, waits for the port\u0027s RCU callback\nthrough the module\u0027s rcu_barrier(), then sends frames to those MACs\nfrom another port. The unpatched kernel reports:\n\n BUG: KASAN: slab-use-after-free in br_forward+0xb1/0x820\n Call Trace:\n \u003cIRQ\u003e\n br_forward+0xb1/0x820\n br_handle_frame_finish+0x148b/0x1e50\n br_handle_frame+0x90a/0x15c0\n\nWith this patch, three runs of six cycles each reach the delay without\na KASAN report.\n\nFixes: 6536993371fa (\"bridge: mrp: Integrate MRP into the bridge\")\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20261012123051.GA714215@shredder/\nCloses: https://lore.kernel.org/netdev/20261022090431.3641707-1-teel4res@gmail.com/\nSigned-off-by: Cheng Yongkang \u003cteel4res@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20261101044840.1595584-1-1020691186@qq.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6d9b7c85af57305ec2bd5907124478867edcc60b", "tree": "6ffe993f5f39a17450365125285d95d580bec24f", "parents": [ "a76ab5e733b41dede6f238a691eefb4374f99f79" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Nov 02 12:46:04 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 12:08:32 2026 +0100" }, "message": "net: stmmac: set XDP metadata length on the page_pool RX path\n\nstmmac_rx() initializes the XDP buffer with the metadata area valid, so\nan XDP program can reserve metadata with bpf_xdp_adjust_meta() and write\nit in [xdp-\u003edata_meta, xdp-\u003edata), for example to export the RX hardware\ntimestamp obtained from the metadata kfunc. When such a frame is passed\nto the stack, the skb is built in place around the same page with\nnapi_build_skb(), but skb_metadata_set() is never called.\n\nnapi_build_skb() clears skb_shared_info up to dataref, which includes\nmeta_len, so skb_metadata_len() stays zero. The stack and TC BPF then see\nan empty metadata range even though the bytes are present in the skb\nheadroom. The AF_XDP zero-copy path already records the length in\nstmmac_construct_skb_zc().\n\nRecord the metadata length after reserving the headroom and adding the\nframe data. No copy is needed because the skb is built over the buffer the\nXDP program wrote to. With the length recorded, the software VLAN\nstripping path can move the metadata together with the MAC header, as it\nalready does for zero-copy frames.\n\nFixes: e3f9c3e34840 (\"net: stmmac: add Rx HWTS metadata to XDP receive pkt\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261102-stmmac_meatada_pp_path-v1-1-d93cc4f9a864@oss.qualcomm.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a76ab5e733b41dede6f238a691eefb4374f99f79", "tree": "87cc489029a1535be33c1462f83550d1ace4f5e5", "parents": [ "c6b41de4dd9f2d6856d8d8d292348f7961034152" ], "author": { "name": "Timur Stukan", "email": "timur.stukan.linux@gmail.com", "time": "Sun Nov 01 17:02:39 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 11:53:05 2026 +0100" }, "message": "bonding: fix missing down path on speed/duplex failure after FAIL-\u003eUP\n\nIn bond_miimon_commit(), when a slave is proposed as BOND_LINK_UP but\nbond_update_speed_duplex() fails in bonding mode that needs speed/duplex\n(802.3ad, tlb, alb), the slave is set to BOND_LINK_DOWN directly. This\nbypasses bond_set_slave_link_state(), bond_miimon_link_change() and\nfailover.\n\nThis is fine for slave that coming from BOND_LINK_BACK, which was never\nbrought up and is not in use. But since commit 1899bb325149 (\"bonding:\nfix state transition issue in link monitoring\") the commit phase also\nhandles BOND_LINK_FAIL -\u003e BOND_LINK_UP which means a slave that is still\nin use and may be curr_active_slave.\n\nIf the link recovers within downdelay and goes down again before the\ncommit phase reads speed/duplex, the slave is silently marked down while\nremaining the active slave in worst cases. In alb/tlb the bond MAC stays\non the dead port, no failover happens and TLB/RLB state is not cleaned,\nso the bond stops passing traffic until that link comes back even though\nother slaves are up. A non-active slave is affected too, in alb, RLB\nclients assigned to it are not reassigned and become unreachable.\n\nReproduced in tlb and alb mode with miimon\u003d100 and downdelay\u003d10000 by\nflapping a slave within downdelay and dropping it again before commit\n(a longer delay was added between inspect and commit to make window\nwider and easier to test):\n bond0: (slave enp0s3): link status down for interface, disabling it in 10000 ms\n bond0: (slave enp0s3): link status up again after 3400 ms\n bond0: (slave enp0s3): failed to get link speed/duplex\n\nprocfs then shows the active slave with \"MII Status: down\" and \"Link\nFailure Count: 0\", and all traffic is lost.\n\nFix this by dropping the loop in bond_mii_monitor() that applied all\nproposed link states before bond_miimon_commit(). bond_miimon_commit()\nnow applies each state itself: UP after the speed/duplex check, as it\nalready did, DOWN in the down path, and FAIL/BACK directly. So when the\nspeed/duplex check runs, slave-\u003elink still holds the previous state. If\nthe check fails for a slave that is FAIL or UP, take it through the\nregular down path, including failover. DOWN and BACK slaves were\nnever brought up and are still just reverted to DOWN. The down path is\nmoved into bond_miimon_slave_down() so both callers share it.\n\nAfter the fix:\n bond0: (slave enp0s3): failed to get link speed/duplex\n bond0: (slave enp0s3): link status definitely down, disabling slave\n bond0: (slave enp0s4): making interface the new active one\n\nFixes: 1899bb325149 (\"bonding: fix state transition issue in link monitoring\")\nSigned-off-by: Timur Stukan \u003ctimur.stukan.linux@gmail.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20261101150240.66292-1-timur.stukan.linux@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c6b41de4dd9f2d6856d8d8d292348f7961034152", "tree": "cbd1f87f78b68760d7db07c584b80209eedeb008", "parents": [ "9a65b9c2a97594bcaaf393329807653eff895bbf" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Thu Oct 29 21:22:21 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 11:33:48 2026 +0100" }, "message": "ip6mr: Serialize multicast router socket ownership\n\nMRT6_TABLE checks whether the socket owns its current table before\nacquiring RTNL. MRT6_INIT also looks up its table before taking RTNL.\nConsequently, concurrent TABLE and INIT calls can initialize the old\ntable and then change the socket\u0027s selected table. Another INIT can\nregister the same socket in the new table.\n\nrawv6_close() calls ip6mr_sk_done(), which clears only the first table\nowned by the socket. After the socket\u0027s RCU-delayed free, the other\ntable retains a dangling mroute_sk pointer. A subsequent multicast cache\nreport passes that pointer to sock_queue_rcv_skb_reason(). This produces\na KASAN slab-use-after-free in sk_filter_trim_cap().\n\nLook up the selected table in ip6mr_sk_init() after acquiring RTNL.\nLikewise, re-read the current table and check its owner under RTNL in\nMRT6_TABLE before updating the selection. This preserves the single-table\nownership invariant shared with ip6mr_sk_done(), without changing the\nlocking of the other multicast socket options.\n\nFixes: d1db275dd3f6 (\"ipv6: ip6mr: support multiple tables\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20261030042221.73996-1-kylebot@openai.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9a65b9c2a97594bcaaf393329807653eff895bbf", "tree": "53775dd15e782cc1c46d669989782fe8123b7e0e", "parents": [ "6887a8f98244ba4c0fbe2d2461b9b8f8a300e326" ], "author": { "name": "Timur Stukan", "email": "timur.stukan.linux@gmail.com", "time": "Sun Nov 01 16:56:53 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 11:26:32 2026 +0100" }, "message": "bonding: 3ad: don\u0027t set BOND_LINK_FAIL on a slave that is not up\n\nIn 802.3ad mode, when bond_update_speed_duplex() fails on NETDEV_UP or\nNETDEV_CHANGE, bond_slave_netdev_event() sets the slave link to FAIL if\nthe slave has ever been up (last_link_up !\u003d 0), and to DOWN otherwise,\nso that miimon can set it right once speed/duplex are valid.\n\nlast_link_up is never cleared, so a slave that is currently DOWN but\nwas up before is set to FAIL as well. miimon then treats it as a slave\nthat is still in use and takes it through the full down path again:\nthe link failure count is incremented, \"link status definitely down\"\nis logged and the 802.3ad port is disabled a second time, although the\nslave has not been up since it went down.\n\nReproduced in 802.3ad mode with miimon\u003d100 by setting a slave down and\nup again. On NETDEV_UP the speed is still unknown, so the notifier sets\nFAIL, and the next miimon pass sees no carrier and proposes DOWN:\n\n\tip link add bond0 type bond mode 802.3ad miimon 100 lacp_rate 1\n\tip link set enp0s3 down\n\tip link set enp0s4 down\n\tip link set enp0s3 master bond0\n\tip link set enp0s4 master bond0\n\tip link set enp0s3 up\n\tip link set enp0s4 up\n\tip link set bond0 up\n\t# wait for LACP to settle\n\tip link set enp0s3 down\n\tip link set enp0s3 up\n\nprocfs then shows \"Link Failure Count: 2\" in enp0s3 slave part. Also in\ndmesg wrote twice: \"link status definitely down, disabling slave\".\n\nFix this by setting FAIL only for a slave that is currently UP and\nleaving other states alone. An up slave that loses speed/duplex still\ngoes through FAIL as before, and DOWN/BACK slaves are left to miimon,\nas in the other modes.\n\nFixes: ea53abfab960 (\"bonding/802.3ad: fix link_failure_count tracking\")\nSigned-off-by: Timur Stukan \u003ctimur.stukan.linux@gmail.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20261101145653.63648-1-timur.stukan.linux@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6887a8f98244ba4c0fbe2d2461b9b8f8a300e326", "tree": "2233a6724cce217a0982dd9ce481406bfd804616", "parents": [ "c4e4056b21355356f6a95bcdf03a850edd9f49e7" ], "author": { "name": "James Clark", "email": "jjc@jclark.com", "time": "Mon Nov 02 20:51:17 2026 +0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 11:20:32 2026 +0100" }, "message": "net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets\n\nOn a BeagleY-AI (J722S), ptp4l as a unicast master (unicast_listen) logs\n\"received DELAY_REQ without timestamp\" for each unicast Delay_Req, and\nits port goes to FAULTY after \"timed out while polling for tx timestamp\"\nfor the first unicast Sync.\n\nam65_cpsw_nuss_hwtstamp_set() does not set the TS_UNI_EN bit (bit 24) of\nthe port\u0027s TS_CTL_LTYPE2 register. According to the TRM (J722S TRM\nSPRUJB3D, 12.2.1.4.7.13.5.1 Ethernet Port Receive Event and\n12.2.1.4.7.13.5.2 Ethernet Port Transmit Event), this bit must be set\nfor the port to timestamp PTP event messages over UDP sent to a unicast\naddress; without it, only messages sent to the PTP multicast addresses\nselected by the TS_107 and TS_129 to TS_132 bits are timestamped. TI\u0027s\nnetcp_ethss driver for the Keystone 2 Ethernet switch, which has the\nsame timestamping registers, always sets TS_UNI_EN.\n\nSet TS_UNI_EN along with the other bits. With this change, ptp4l in the\nsame setup gets timestamps for the unicast Delay_Req and Sync messages.\n\nFixes: b1f66a5bee07 (\"net: ethernet: ti: am65-cpsw-nuss: enable packet timestamping support\")\nCc: stable@vger.kernel.org\nSigned-off-by: James Clark \u003cjjc@jclark.com\u003e\nReviewed-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nLink: https://patch.msgid.link/20261102135117.419539-1-jjc@jclark.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c4e4056b21355356f6a95bcdf03a850edd9f49e7", "tree": "669ffa725a9285f3a0067907642ca0fbee79d9f4", "parents": [ "547b1ae5ec50b7d81b05b4219e0db7e56279d65f" ], "author": { "name": "Ray Zhang", "email": "sgzhang@google.com", "time": "Sun Nov 01 00:51:45 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 11:16:38 2026 +0100" }, "message": "net: count last skb of each sk_backlog pass in __release_sock()\n\nRunning 500 concurrent TCPv6 streams (neper \"tcp_stream -6 -T 1 -F 500\")\non a 2-core Cortex-A53 (CONFIG_PREEMPT_NONE\u003dy, HZ\u003d1000, LATENCY_WARN)\ntriggers resched_latency_warn() in __release_sock():\n\n [ 3655.311821] sched: CPU 0 need_resched set for \u003e 100006892 ns (100 ticks) without schedule\n [ 3655.311889] Call trace:\n ...\n [ 3655.311944] resched_latency_warn+0x7c/0x88\n [ 3655.311958] sched_tick+0x1c0/0x418\n ...\n [ 3655.312578] net_rx_action+0x238/0x438\n ...\n [ 3655.312641] do_softirq+0x4c/0x90\n [ 3655.312651] __local_bh_enable_ip+0x84/0x90\n [ 3655.312663] local_bh_enable+0x1c/0x28\n [ 3655.312674] __dev_queue_xmit+0x4a8/0xb00\n ...\n [ 3655.312782] tcp_v6_do_rcv+0x240/0x5f8\n [ 3655.312793] __release_sock+0x9c/0x188\n [ 3655.312806] release_sock+0x150/0x168\n [ 3655.312817] tcp_sendmsg+0x4c/0x70\n\n__release_sock() can loop past 100 ms without calling cond_resched():\n\n- Each outer-loop pass drains sk_backlog, but \"if (!skb) break;\" runs\n before \"++nb\", so a pass of B skbs only adds B - 1 to nb (0 for 1 skb).\n- With 500 TCPv6 streams and NAPI sharing two Cortex-A53 cores, runnable\n tasks keep TIF_NEED_RESCHED set on CPU 0.\n- During spin_unlock_bh() and TX softirqs (__dev_queue_xmit() -\u003e\n local_bh_enable()), tcp_add_backlog() coalesces arriving pure ACKs into\n a single tail skb.\n- Repeated 1-skb passes never advance nb or call cond_resched(),\n triggering resched_latency_warn() after 100 ticks.\n\nRestore the do-while loop and drop \"if (!skb) break;\" so every skb\nincrements nb across passes and calls cond_resched() every 16 skbs.\n\nReproduced the issue and verified the fix on two 2-core Cortex-A53 hosts\n(CONFIG_PREEMPT_NONE\u003dy, HZ\u003d1000, LATENCY_WARN, latency_warn_once\u003d0) with\na userspace reproducer over /dev/net/tun:\n\n- CPU 0 runs a TCPv6 sender and a second runnable task while CPU 1 writes\n pure ACKs to /dev/net/tun (~30k TCPBacklogCoalesce/run), sustaining\n 1-skb sk_backlog refills in __release_sock() for ~400 ms (ftrace).\n- Before: CPU 0 stayed unscheduled in __release_sock(), hitting\n resched_latency_warn() 293 and 275 times on the two hosts (\u003e 100.9 ms).\n- After: cond_resched() yielded CPU 0 inside __release_sock(), with\n 0 resched_latency_warn() hits on both hosts.\n- Also observed no regression with the workload from\n commit 16c610162d1f (\"net: call cond_resched() less often in\n __release_sock()\"), \"super_netperf 4 -H srv -T,10 -l 3000 \u0026\".\n\nFixes: 16c610162d1f (\"net: call cond_resched() less often in __release_sock()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ray Zhang \u003csgzhang@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261101075145.698399-1-sgzhang@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "547b1ae5ec50b7d81b05b4219e0db7e56279d65f", "tree": "e973fdd24e1530181ba0e98a77aa83c14d30ba35", "parents": [ "8288ba942cfd20621c05e16978b7c3da91513ae1" ], "author": { "name": "Colton Pawielski", "email": "colton.pawielski@gmail.com", "time": "Sat Oct 31 11:47:23 2026 -0500" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 11:09:42 2026 +0100" }, "message": "net: 8139cp: keep Rx masked while NAPI is scheduled\n\ncp_rx_poll() calls napi_complete_done() and only then takes cp-\u003elock\nwith interrupts disabled to unmask the Rx interrupts. An interrupt\nthat is not masked while polling (TxOK, TxErr, ...) can arrive in\nbetween. cp_interrupt() then sees the Rx status bits, which are still\nset, finds NAPI no longer scheduled, masks Rx and schedules NAPI again.\ncp_rx_poll() then carries on and unmasks Rx anyway.\n\nFrom that point Rx interrupts are enabled while NAPI is scheduled:\ncp_interrupt() leaves the Rx bits for the poll routine, does not mask\nthem because napi_schedule_prep() fails, and the level-triggered\ninterrupt fires again as soon as it returns. On an SH7751 LANDISK\nunder combined Tx/Rx load this interrupt storm was captured with a RAM\ntrace right before the board locked up hard.\n\nMask Rx in cp_interrupt() whenever Rx status is pending, not only when\nNAPI gets scheduled. If the race leaves Rx unmasked, the next interrupt\nmasks it again, and the pending poll unmasks it when it completes.\n\nFixes: ab1e7e1d2666 (\"8139cp: use napi_complete_done()\")\nSigned-off-by: Colton Pawielski \u003ccolton.pawielski@gmail.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261031-b4-8139cp-napi-v2-1-5824797c0fe6@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8288ba942cfd20621c05e16978b7c3da91513ae1", "tree": "3808f8737881e929393542d8b5de4437f845e6fc", "parents": [ "6c1c41effa342a94221e5d92c2a5aae8fe7d1c04" ], "author": { "name": "Bryam Vargas", "email": "hexlabsecurity@proton.me", "time": "Thu Oct 29 03:03:33 2026 -0500" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 11:06:27 2026 +0100" }, "message": "net/smc: don\u0027t spin in smc_rx_recvmsg() while a pipe holds spliced data\n\nWhile bytes spliced off the RMB are still in a pipe, recvmsg() waits\nfor the pipe to release them before it copies the data behind them.\nThe path to that wait skips the timeout and signal checks, and\nsmc_rx_wait() returns at once on RCV_SHUTDOWN. With a signal pending,\nafter SHUT_RD, or once the peer closes or shuts down writing,\nrecvmsg() spins on a CPU until the pipe is drained, and SIGKILL cannot\nstop it. MSG_DONTWAIT and an expired SO_RCVTIMEO wait there too\ninstead of returning -EAGAIN.\n\nCheck the timeout and signals before that wait, and end it when the\npipe releases the data or the connection is killed, not on RCV_SHUTDOWN.\nA zero-length read returns 0 without waiting for the pipe; a\nnon-blocking one returns -EAGAIN while poll() still reports the socket\nreadable (splice() can still take those bytes). The wait sets\nSOCKWQ_ASYNC_WAITDATA like smc_rx_wait(), so a byte arriving behind\nthe pipe raises no SIGIO on a reader already asleep for it, and a full\nbarrier orders its wait queue entry before its read of splice_pending,\nso no wake is lost.\n\nFixes: 9014db202cb7 (\"smc: add support for splice()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20261029-b4-disp-da7f8e6a-v2-1-9052904adf72@proton.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4f91b042af212ca0b610e43f9a975ddc7f0d0923", "tree": "b26810f686169f0147b42a30ce13a44fbf9c37ff", "parents": [ "d4a6efef3e21b3b9cbcc48c34f270ff95d21a248" ], "author": { "name": "Hungyu Lin", "email": "dennylin0707@gmail.com", "time": "Thu Oct 29 01:36:16 2026 +0000" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 09:36:19 2026 +0100" }, "message": "ext2: preserve IOMAP_F_DIRTY for extending direct writes\n\next2_iomap_begin() sets IOMAP_F_DIRTY for writes that may extend i_size,\nbut clears the flag after ext2_get_blocks(). When the write uses an\nexisting mapped block, iomap can then use FUA and skip\ngeneric_write_sync(), even though ext2_dio_write_end_io() updates the\ninode size. An O_DSYNC write can therefore return without persisting\nthe new size.\n\nFor example, on a FUA-capable device, a 512-byte O_DIRECT|O_DSYNC write\nat offset 512 into a fsynced one-byte file returns successfully and\nextends the in-memory size to 1024, while an immediate read of the\non-disk inode still shows size 1. An explicit fsync persists the new\nsize.\n\nMove setting of IOMAP_F_DIRTY after the initialization.\n\nFixes: fb5de4358e1a (\"ext2: Move direct-io to use iomap\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hungyu Lin \u003cdennylin0707@gmail.com\u003e\nLink: https://patch.msgid.link/20261029013616.97194-1-dennylin0707@gmail.com\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "d4a6efef3e21b3b9cbcc48c34f270ff95d21a248", "tree": "fc558f0f5c7e6186892c14a8406c67f9a631facc", "parents": [ "0cbfc16fe49629f5c1fc3628405661c2b938ec61" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 09:30:43 2026 +0100" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Nov 05 09:30:43 2026 +0100" }, "message": "udf, ext2, quota, jbd2: Unify email addresses in MAINTAINERS\n\nIn MAINTAINERS file I was using two different email address. With the\nadvent of various tools which use address in MAINTAINERS as an\nidentifier (like Sashiko\u0027s pre-existing issues list) it is a bit\nannoying to remember which entry has what. Make all entries use the same\naddress.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "6c1c41effa342a94221e5d92c2a5aae8fe7d1c04", "tree": "4de356bd78b1074c5da0cb2d36e86a5d4b2942e2", "parents": [ "6baae996ecf6a3f57b08ea6f6786e29af9260f51", "2d4c272e816a5b784f1fc7899256f8826df34edb" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 09:21:42 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 05 09:21:43 2026 +0100" }, "message": "Merge tag \u0027linux-can-fixes-for-7.4-20261103\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2026-11-03\n\nthis is a pull request of 15 patches for net/main.\n\nThe first patch is by Vincent Mailhol and drops CAN-XL frames on non\nCAN-XL devices.\n\nA patch by Kaixuan Li for the CAN ISOTP protocol improves the check\nfor the correct CAN CC/FD frames.\n\nThe next 3 patches are by Cunhao Lu and make CAN skb freeing safe in\nany context in several CAN helper functions.\n\nA series by Oliver Hartkopp et al fixes several problems in the CAN\nnet-layer:\n\nOliver Hartkopp contributes a patch to convert the unreliable\nARPHRD_CAN type check to the robust can_get_ml_priv(). Further a patch\nthat adds missing error checking to the bind callback of the CAN\nISO-TP protocol. Followed by converting the CAN RAW, BCM and ISO-TP\nprotocol to protect the receive lists with a per-device lock. Then the\nRAW and ISO-TP protocols are converted to copy the socket options\noutside of lock_sock().\n\n3 patches target the CAN procfs: A patch by Runyu Xiao resets the CAN\npkg_stats using atomics, a patch by Oliver Hartkopp fixes the stats\ncalculation after a statistics reset. Followed by a patch to remove\nkernel pointers from the output.\n\nChunYuZhiQiang contributes 2 patches for the CAN netlink interfaces,\nto prevent waking up the CAN device, if the interface is down.\n\nThe last patch is by Liu Changjie and fixes the decoding of bulk USB\nURBs in the Peak USB CAN driver.\n\nlinux-can-fixes-for-7.4-20261103\n\n* tag \u0027linux-can-fixes-for-7.4-20261103\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n can: peak_usb: pcan_usb_fd_decode_buf(): accept short uCAN end-of-list records\n can: dev: can_tdc_fill_info(): don\u0027t read automatic TDCV if interface is down\n can: dev: can_fill_info(): don\u0027t wake up controller if interface is down\n can: proc: remove pointers from CAN specific proc output\n can: proc: skip stats calculation after reset in can_stat_update()\n can: proc: reset pkg_stats atomics individually\n can: raw, isotp: copy socket options outside of lock_sock()\n can: protect the receive lists with a per-device lock\n can: isotp: check the return values of can_rx_register() in isotp_bind()\n can: replace ARPHRD_CAN type checks with can_get_ml_priv()\n can: dev: can_put_echo_skb(): free skb on invalid echo index\n can: skb: make CAN skb allocation failure paths IRQ-safe\n can: skb: make echo skb freeing safe in any IRQ context\n can: isotp: check the frame type, not just the length\n can: dev: can_dropped_invalid_skb: drop CAN XL frames on non-CAN XL devices\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261103204305.3211144-1-mkl@pengutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6baae996ecf6a3f57b08ea6f6786e29af9260f51", "tree": "6274b7ab77f5b1f29bcf1a277e916624c561e804", "parents": [ "a75facf4bb3e866103ddca4f47a6f3ca4b090d8b", "41af38324341df9d769641d6485abb67fd5209ed" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 22:18:46 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 22:18:47 2026 +0100" }, "message": "Merge branch \u0027fix-tcp-retransmissions-on-ns-nsp-socs\u0027\n\nFlorian Fainelli says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix TCP retransmissions on NS/NSP SoCs\n\nOn Northstar and Northstar Plus SoCs we would see about 1000 TCP\nretransmissions per second due to a rate mismatch between bgmac and b53,\nmake sure that we run at the same speed on both side to avoid dropping\npackets on the floor.\n\nThis issue was found during testing on a Northstar Plus reference board\n(BCM958625HR) while running iperf3 to a test machine and noticing\nretranmsisions:\n\nConnecting to host 192.168.3.1, port 5201\n[ 4] local 192.168.3.204 port 49856 connected to 192.168.3.1 port 5201\n[ ID] Interval Transfer Bitrate Retr Cwnd\n[ 4] 0.00-1.00 sec 111 MBytes 933 Mbits/sec 915 99.0 KBytes\n[ 4] 1.00-2.00 sec 111 MBytes 928 Mbits/sec 909 109 KBytes\n[ 4] 2.00-3.00 sec 110 MBytes 925 Mbits/sec 1097 99.0 KBytes\n[ 4] 3.00-4.00 sec 111 MBytes 928 Mbits/sec 814 58.0 KBytes\n[ 4] 4.00-5.00 sec 111 MBytes 930 Mbits/sec 1187 109 KBytes\n[ 4] 5.00-6.00 sec 110 MBytes 923 Mbits/sec 893 72.1 KBytes\n[ 4] 6.00-7.00 sec 111 MBytes 929 Mbits/sec 843 67.9 KBytes\n[ 4] 7.00-8.00 sec 111 MBytes 928 Mbits/sec 920 79.2 KBytes\n[ 4] 8.00-9.00 sec 111 MBytes 929 Mbits/sec 1109 66.5 KBytes\n[ 4] 9.00-10.00 sec 111 MBytes 930 Mbits/sec 1055 63.6 KBytes\n- - - - - - - - - - - - - - - - - - - - - - - - -\n[ ID] Interval Transfer Bitrate Retr\n[ 4] 0.00-10.00 sec 1.09 GBytes 933 Mbits/sec 9742\nsender\n[ 4] 0.00-10.01 sec 1.09 GBytes 933 Mbits/sec\nreceiver\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261029211540.4123250-1-florian.fainelli@broadcom.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "41af38324341df9d769641d6485abb67fd5209ed", "tree": "6274b7ab77f5b1f29bcf1a277e916624c561e804", "parents": [ "d4f3d2c04624854d27aa948cd7bfc9d946faaac5" ], "author": { "name": "Florian Fainelli", "email": "florian.fainelli@broadcom.com", "time": "Thu Oct 29 14:15:40 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 22:18:44 2026 +0100" }, "message": "net: dsa: b53: restore the NSP IMP port 2 Gbps mode\n\nThe Northstar Plus IMP port uses the switch\u0027s proprietary 2 Gbps mode for\nits internal link to the AMAC. Its fixed-link description reports 1 Gbps,\nso applying that speed clears PORT_OVERRIDE_SPEED_2000M and leaves the two\nends of the internal link configured at different speeds.\n\nForce the 2 Gbps mode and flow control for BCM5301x and NSP CPU ports. The\nmismatch caused switch output queue discards on both copper and SerDes\nports, with one discard for every TCP retransmission. With both ends\nrestored to their high-speed modes, iperf3 reports no retransmissions.\n\nFixes: b6a8a5477fe9 (\"net: dsa: b53: fix resetting speed and pause on forced link\")\nSigned-off-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261029211540.4123250-3-florian.fainelli@broadcom.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d4f3d2c04624854d27aa948cd7bfc9d946faaac5", "tree": "05d49b9f78374be490dbdf22340d060230383c5c", "parents": [ "a75facf4bb3e866103ddca4f47a6f3ca4b090d8b" ], "author": { "name": "Florian Fainelli", "email": "florian.fainelli@broadcom.com", "time": "Thu Oct 29 14:15:39 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 22:18:44 2026 +0100" }, "message": "net: ethernet: bgmac: preserve forced 2.5 Gbps link speed\n\nNorthstar and Northstar Plus use a 2.5 Gbps internal link between the\nAMAC and the switch. BGMAC_FEAT_FORCE_SPEED_2500 makes bgmac_miiconfig()\nconfigure that speed, but bgmac_adjust_link() subsequently replaces it\nwith the synthetic fixed PHY\u0027s 1 Gbps speed.\n\nUse the forced speed when processing link changes so the MAC remains at\n2.5 Gbps. Together with configuring the switch IMP port for its 2 Gbps\nmode, this eliminates the output queue discards that caused approximately\n1000 TCP retransmissions per second during an iperf3 transmit test.\n\nRestrict the platform forced-speed flag to Northstar Plus using the SoC\ncompatible, since Hurricane2 shares the AMAC compatible. Other platform\nAMACs without a phy-handle must continue following the fixed PHY speed.\nThe BCMA path already selects the flag only for the Northstar family.\n\nFixes: f6a95a24957a (\"net: ethernet: bgmac: Add platform device support\")\nSigned-off-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261029211540.4123250-2-florian.fainelli@broadcom.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a75facf4bb3e866103ddca4f47a6f3ca4b090d8b", "tree": "79d521d8d2f837fbb21aab6724d574834fc541da", "parents": [ "03897066069fd47caf2908183edf3b22b822ea73" ], "author": { "name": "Hengyu Liang", "email": "hengyul@cs.unc.edu", "time": "Thu Oct 29 23:26:17 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 22:11:09 2026 +0100" }, "message": "l2tp: only return sessions of the given tunnel in l2tp_session_get()\n\nCommit 5f77c18ea556 (\"l2tp: use IDR for all session lookups\") made\npppol2tp_connect() and the netlink session commands find sessions with\nl2tp_session_get(), passing the socket of the tunnel they name.\n\nL2TPv3 session IDs are unique per network namespace, except that\nsessions carried over UDP are only unique per UDP socket, the socket of\ntheir tunnel. However, l2tp_v3_session_get() only checks the socket when\nanother session has the same session ID. Otherwise it returns the\nsession, whichever tunnel it belongs to. As of now, a session command\nthat names the wrong tunnel acts on a session of another tunnel, and a\nPPPoL2TP socket for a second L2TPv3 tunnel fails with EEXIST, because it\nfinds session 0 of the first tunnel.\n\nThe issue can be reproduced with:\n\n ip l2tp add tunnel tunnel_id 3 peer_tunnel_id 3 encap udp \\\n local 127.0.0.1 remote 127.0.0.1 udp_sport 5003 udp_dport 6003\n ip l2tp add tunnel tunnel_id 4 peer_tunnel_id 4 encap udp \\\n local 127.0.0.1 remote 127.0.0.1 udp_sport 5004 udp_dport 6004\n ip l2tp add session tunnel_id 3 session_id 7 peer_session_id 7\n ip l2tp del session tunnel_id 4 session_id 7\n ip l2tp show session\n\nBefore that commit, the delete fails with \"No such device\", and session\n7 of tunnel 3 is still listed. After that commit, the delete succeeds,\nand session 7 of tunnel 3 is gone.\n\nThis patch will make l2tp_session_get() return NULL when the L2TPv3\nsession it finds does not belong to the given socket. The receive path\ncalls l2tp_v3_session_get() directly and is not changed.\n\nFixes: 5f77c18ea556 (\"l2tp: use IDR for all session lookups\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nAcked-by: Guillaume Nault \u003cgnault@redhat.com\u003e\nLink: https://patch.msgid.link/20261030032617.4065353-1-hengyul@cs.unc.edu\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "db1c5da238dc80a61ab429a7b71b0e2835766c45", "tree": "e15b53b554c04ed8a4d05e887a04b2da47f0f096", "parents": [ "520ef67f47f69255695859b0008281a384d0bc20" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Mon Nov 02 14:21:40 2026 +0100" }, "committer": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Wed Nov 04 21:47:48 2026 +0100" }, "message": "selftests/fscontext_ns: expect EINVAL for overlay descendant userns create\n\nCommit a518e63c3775 (\"ovl: return EINVAL instead of EIO in case of\nmismatched user_ns\") changed the errno for completing an overlay\nfscontext from another user namespace. Update the overlay test variant\nto match binfmt_misc.\n\nReported-by: kernel test robot \u003cyi1.lai@intel.com\u003e\nCloses: https://lore.kernel.org/oe-lkp/202611020115.2281e158-lkp@intel.com\nFixes: a518e63c3775 (\"ovl: return EINVAL instead of EIO in case of mismatched user_ns\")\nCc: stable@vger.kernel.org\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\n" }, { "commit": "520ef67f47f69255695859b0008281a384d0bc20", "tree": "d5f596aa17c9f40cee2692144498b13428106c3d", "parents": [ "9ff338af0e002fe217cfa16b1289b76f6b21fc72" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Fri Oct 16 21:17:22 2026 +0000" }, "committer": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Wed Nov 04 21:34:20 2026 +0100" }, "message": "ovl: look up the index by the decoded origin\n\nA file opened by file handle on an overlay with nfs_export\u003don can show\nthe stale lower data of a file that was copied up to the upper layer.\nWhile the file opened this way stays in the inode cache, a lookup of the\ncopied up file by path fails with ESTALE for all users. The open can\nalso succeed for a file that was removed, where it has to fail with\nESTALE. This happens with a handle that has one byte changed. The handle\ncomes from an NFS client, or from a process that calls\nopen_by_handle_at() with CAP_DAC_READ_SEARCH in the initial user\nnamespace.\n\nWhen a file in a lower layer is about to be modified, overlayfs first\ncopies it to the upper layer (copy up). With nfs_export\u003don, each copy up\nalso creates an entry in the index directory, a directory that overlayfs\nkeeps for itself on the upper filesystem.\n\nThe handle of an overlay file that comes from a lower layer wraps the\nhandle of its lower inode. Overlayfs calls this lower inode the origin.\nThe overlay handle stays valid after a copy up.\n\nTo decode such a handle, ovl_lower_fh_to_d() first decodes the wrapped\nhandle to the origin. If no overlay inode is cached for the origin, it\nlooks in the index directory:\n\n- An index entry there leads to the upper file.\n- A whiteout, the marker that overlayfs uses for a removed file, means\n that the overlay file was removed.\n\nThe name of an index entry is the handle that copy up encoded for the\norigin, as a hex string.\n\novl_lower_fh_to_d() builds the name for this lookup from the bytes that\nthe caller passed in. But handles with different bytes can decode to the\nsame inode:\n\n- Overlayfs ignores some flag bits of the handle.\n- A lower filesystem can accept a different fid type, extra bytes, or\n generation 0 for any generation.\n\nSuch a handle decodes to the origin but misses the index entry or the\nwhiteout. So the decode returns an overlay inode that has only the lower\nfile.\n\nWhile that inode is cached, a path lookup of a copied up file fails with\nESTALE, since the upper file that the lookup finds does not match the\ncached inode, which has none.\n\nReproduced on tmpfs and on ext4 with open_by_handle_at(), after a copy\nup and a mount cycle. A handle in which one flag bit, the fid type, the\nlength or the generation was changed read the old lower data, and path\nlookups returned ESTALE.\n\nFix this by re-encoding the decoded origin and building the index name\nfrom that handle.\n\nFixes: f71bd9cfb692 (\"ovl: decode indexed non-dir file handles\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\n" }, { "commit": "c64d9b2c1f4fd1d8fa52dab37b48428a99c4d58d", "tree": "e6f3636bc684676393bb55bf5f288483ced4d1e8", "parents": [ "29b8758b4700357909f06705a0c48c7a60c556d5" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Wed Nov 04 07:18:16 2026 -0500" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Wed Nov 04 10:47:26 2026 -0800" }, "message": "nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d\n\nThe KIOXIA XG10d reads past the end of a PRP list that completely fills\na 256 byte small pool block. When that block is the last one in its\ndmapool page, the read lands on the next page, which usually isn\u0027t\nmapped. The IOMMU faults it and the controller craps itself:\n\n arm-smmu-v3 arm-smmu-v3.0.auto: event: F_TRANSLATION client: 0001:09:00.0 sid: 0x20900 ssid: 0x0 iova: 0xff7fe000 ipa: 0x0\n nvme nvme0: controller is down; will reset: CSTS\u003d0xffffffff, PCI_STATUS\u003d0xffff\n\nFilling the block requires a slightly larger write, and those became common\nwith commit 2e8e30b3cf9f (\"Revert \"nvme-pci: clamp max_hw_sectors based on\nDMA optimized limitation\"\").\n\nDo what we do for other disks and use 512 byte aligned small pool blocks\nfor this controller.\n\nCc: stable@vger.kernel.org # 6.4.x\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "b0958b1397fb5ffdb995c0ccc74349841929c08d", "tree": "2774c9a4c8c81dbeac0d3c7ea72ab48adbcf8a23", "parents": [ "beeec04046227eba42b7cc5ab32498aa43da9632" ], "author": { "name": "Zhao Gongyi", "email": "zhaogongyi@bytedance.com", "time": "Mon Nov 02 01:10:30 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Wed Nov 04 18:46:10 2026 +0000" }, "message": "arm64: mm: validate /dev/mem mmap ranges without overflow\n\nAn arm64 syzkaller reproducer creates a FUSE character device with\nmajor:minor 1:1, so opening it uses the /dev/mem file operations. It\nmaps one page from offset 0xfffffffffffff000 at user address zero.\nThe next openat() with a NULL pathname triggers a synchronous external\nabort (SEA, ESR 0x96000010) in strncpy_from_user() via do_getname(),\npanicking the kernel.\n\nvalid_mmap_phys_addr_range() checks the exclusive end by adding the\nmapping size to the starting address. For this offset, the sum wraps\nto zero and passes the PHYS_MASK test, allowing an out-of-range PFN to\nreach remap_pfn_range(). The inclusive-end overflow check in\nmmap_mem_prepare() does not catch it because the end is ULONG_MAX.\n\nReject starting PFNs outside PHYS_MASK and compare the inclusive length\nagainst the remaining physical range without overflowing. This also\nallows mappings that end exactly at PHYS_MASK, which the old check\nincorrectly rejects.\n\nFixes: 1d18c47c735e (\"arm64: MMU fault handling and page table management\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zhao Gongyi \u003czhaogongyi@bytedance.com\u003e\n[catalin.marinas@arm.com: changed the check to look more like __access_ok()]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "beeec04046227eba42b7cc5ab32498aa43da9632", "tree": "ef326da43e491b52bdac0aa0ece2650d3c38e29c", "parents": [ "6628e7d4c6b25c8d18f1345e3a20d21829aae7e4" ], "author": { "name": "Wei Wang", "email": "wvw@google.com", "time": "Tue Nov 03 17:59:41 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Wed Nov 04 18:21:16 2026 +0000" }, "message": "arm64: suspend: Save and restore TPIDR2_EL0 across CPU suspend\n\nTPIDR2_EL0 is a live EL0 register on systems with SME, but\ncpu_do_suspend()/cpu_do_resume() don\u0027t preserve it. Its value is\nUNKNOWN after a warm reset, so the task that initiates suspend can\nreturn to userspace with a corrupted TPIDR2_EL0.\n\nSave and restore it alongside TPIDR_EL0 and TPIDRRO_EL0. The new slot\nfits in existing padding, so sizeof(struct cpu_suspend_ctx) is\nunchanged.\n\nFixes: a9d691585950 (\"arm64/sme: Implement support for TPIDR2\")\nCc: stable@vger.kernel.org\nAcked-by: Will Deacon \u003cwill@kernel.org\u003e\nReviewed-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Wei Wang \u003cwvw@google.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "29b8758b4700357909f06705a0c48c7a60c556d5", "tree": "c8a440ad074bc986eda7bbd18bedf77d0f5e471c", "parents": [ "f4ae106069982da3e36293d8e627cb9a540034a0" ], "author": { "name": "Ewan D. Milne", "email": "emilne@redhat.com", "time": "Wed Nov 04 12:28:33 2026 -0500" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Wed Nov 04 09:52:50 2026 -0800" }, "message": "nvmet: don\u0027t return memory contents beyond valid data when reading ANA log page\n\nThe host side does not know how much valid data will be returned by the target\nso it will typically provide a buffer larger than the amount of valid data in\nthe ANA log page. The memory allocation used by the target does not guarantee\nthat prior kernel memory contents will not be returned past the end of the valid\npage data. Fix this to ensure that the SGL is zeroed before copying the data.\n\nFixes: 72efd25dcf4f (\"nvmet: add minimal ANA support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ewan D. Milne \u003cemilne@redhat.com\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "cf6542493e35ab9e72ac07da10a178ac78db5a16", "tree": "8a5c60b18c0b7b2b2c7894f2198f8a6b057664df", "parents": [ "21662435a5ee49c49a5ff05f2ddcde87acb7b293" ], "author": { "name": "Orkun Emin Sarı", "email": "sariorkunemin@gmail.com", "time": "Wed Nov 04 19:51:42 2026 +0300" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Nov 04 10:25:14 2026 -0700" }, "message": "io_uring: only wait for in-flight requests if the closing task uses the ring\n\nSince commit 13d3783a55b7 (\"io_uring: wait for in-flight requests on\nring release\"), the task dropping the last reference to a ring waits\nfor every request on it to complete. A process that only received the\nring fd, e.g. over a UNIX socket, can then block in close(2) on\nrequests owned by other tasks, such as a read from an unresponsive\nFUSE server.\n\nSkip the wait for tasks that never attached to the ring and leave those\nrequests to io_ring_exit_work(), as before.\n\nFixes: 13d3783a55b7 (\"io_uring: wait for in-flight requests on ring release\")\nSigned-off-by: Orkun Emin Sarı \u003csariorkunemin@gmail.com\u003e\nLink: https://patch.msgid.link/20261104-io-uring-wait-inflight-v2-1-f38f29fe8018@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "21662435a5ee49c49a5ff05f2ddcde87acb7b293", "tree": "abebed9c296bccbbf5550569317f4f9b847c5454", "parents": [ "99b6efa810675d99c04216574a189aa4bf031cfd" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Wed Nov 04 00:10:49 2026 +0000" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Nov 04 09:18:05 2026 -0700" }, "message": "io_uring: add feature flag for dma-buf support\n\nAdd IORING_FEAT_REGBUF_TYPES, a feature flag that tells whether extended\nbuffer registration and dma-buf buffers are available (see\nIO_REGBUF_TYPE_* and struct io_uring_regbuf_desc).\n\nFixes: 62e4bf5b25d44 (\"io_uring/rsrc: add dmabuf backed registered buffers\")\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nLink: https://patch.msgid.link/1b3ca4acc350aa5a397325d066533c4e5743a0f7.1793623347.git.asml.silence@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "99b6efa810675d99c04216574a189aa4bf031cfd", "tree": "e7fe28c2d913949810443a23c86ca9192293f9fb", "parents": [ "d7c7037253f6935af243570635d71b4920b5a4ea" ], "author": { "name": "Ioannis Coward", "email": "ioanniscrd@gmail.com", "time": "Wed Nov 04 10:47:07 2026 +0000" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Nov 04 09:10:25 2026 -0700" }, "message": "io_uring/wait: don\u0027t sleep on an already expired timeout\n\nWhen io_cqring_wait() gets to the point of sleeping and the wait\u0027s timeout\nhas already passed, io_cqring_schedule_timeout() still arms an hrtimer\nfor it and calls schedule(). The timer fires right away, but only after\nthe task has switched to idle, so getting -ETIME back costs a round trip\nthrough idle plus a timer interrupt.\n\nNAPI busy polling hits this on every wait that times out.\n__io_napi_busy_loop() caps the busy poll at the remaining timeout, so when\nthe loop runs to its end without a completion, the timeout has expired by\nthe time we get here. The task then stops polling for several usec, and\npackets that arrive meanwhile are left to the device interrupt. This\naffects one of our production workloads, which currently works around it\nby having another thread signal an eventfd on the ring before the timeout\nexpires.\n\nA wait with a zero timeout, or one that runs out before the task gets to\nsleep, pays the same cost. io_uring_wait_cqe_timeout() with nothing to\nreap and a zero timeout takes ~11 usec and a voluntary context switch on\na Zen 5 desktop.\n\nReturn -ETIME without arming the timer once the timeout has passed, as\nep_poll() already does with ep_schedule_timeout(). A passed timeout ends\nthe wait with -ETIME whether or not a min_timeout is set, so the check\ncovers both. It costs one io_get_time() per wait that is about to sleep\nwith a timeout.\n\nSigned-off-by: Ioannis Coward \u003cioanniscrd@gmail.com\u003e\nLink: https://patch.msgid.link/20261104104707.2031280-1-ioanniscrd@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "d7c7037253f6935af243570635d71b4920b5a4ea", "tree": "538a00991b4999ecc2155bfabba0a98981d2d2b8", "parents": [ "699e7ba5915c8b2c76e257e157464f2bfe7ab8bb" ], "author": { "name": "Yuansheng Yang", "email": "0xbeac@gmail.com", "time": "Wed Nov 04 23:46:55 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Nov 04 08:51:32 2026 -0700" }, "message": "io_uring/rsrc: hold uring_lock across index-alloc put_user\n\nio_files_update_with_index_alloc() installs a fixed file via\nio_fixed_fd_install(), which drops -\u003euring_lock when the request runs on\nio-wq, then put_user()s the allocated slot back to userspace. If that\nfaults, the error path calls __io_close_fixed() by slot index after\nre-taking the lock.\n\nThe slot can be closed and reused between the install and that cleanup:\nanother fixed CLOSE plus open/accept/pipe/socket, or a FILES_UPDATE, can\nput an unrelated file into the same slot. The error path then removes\nthat file instead of the one this request installed, ending an unrelated\nfile\u0027s fixed-table reference early. This is a correctness/DoS issue, not\na use-after-free: fixed-file requests hold an io_rsrc_node reference, so\nthe node and file stay alive until they are done.\n\nHold -\u003euring_lock across __io_fixed_fd_install() and put_user(), and do\nthe failure cleanup with io_fixed_fd_remove() under the same lock. This\nis the same class as the io_pipe_fixed() fix in a3d7ee11289f. Faulting\nwhile holding -\u003euring_lock is fine, the registration paths already do\nit.\n\nFixes: a7c41b4687f5 (\"io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots\")\nSigned-off-by: Yuansheng Yang \u003c0xbeac@gmail.com\u003e\nLink: https://patch.msgid.link/20261104154655.81876-1-0xbeac@gmail.com\n[axboe: various touch-ups]\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "f4ae106069982da3e36293d8e627cb9a540034a0", "tree": "a33042d6922f15667f0a8d75be7d7508a8c9ed81", "parents": [ "1ac7efbea82562f4b1eded4de7cb37540061fb05" ], "author": { "name": "Hugo Deco", "email": "hugodeco@sufficit.com.br", "time": "Tue Nov 03 10:12:04 2026 -0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Wed Nov 04 07:51:11 2026 -0800" }, "message": "nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE\n\nOn the ADATA XPG GAMMIX S70 BLADE (PCI 1cc1:5370, firmware 03020P5E)\nevery Write with the FUA bit set takes 200, 400 or 600 ms to complete,\nalways a multiple of ~200 ms, while a plain Write completes in\n0.0-0.4 ms and a Flush in ~1.3 ms. Tracing nvme_setup_cmd and\nnvme_complete_rq shows the whole delay is between submission and\ncompletion, i.e. inside the device (e.g. FUA write, control 0x4000:\n598.3 ms).\n\nBecause ext4/jbd2 issue FUA for every journal commit, fsync() on this\ndrive stalls for 250-890 ms and desktop applications freeze.\n\nAdd NVME_QUIRK_NO_FUA, which stops advertising BLK_FEAT_FUA while\nkeeping the volatile write cache enabled, so the block layer emulates\nFUA with a Write followed by a Flush. Durability semantics are\nunchanged. Apply it to the S70 BLADE through nvme_id_table.\n\nWith the quirk applied, 4 KiB O_DIRECT|O_DSYNC writes and\ncreate+write+fsync drop from 250-890 ms to a 0.82-0.85 ms median\n(30 samples, two partitions on the same drive).\n\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Hugo Deco \u003chugodeco@sufficit.com.br\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "1ac7efbea82562f4b1eded4de7cb37540061fb05", "tree": "d67396d23732841ec62b010e16ba7eda144fcc4c", "parents": [ "404a8f6caa63822c1d2a45adbf07fd9c0567a7ef" ], "author": { "name": "Qiliang Yuan", "email": "odys.yuan@gmail.com", "time": "Wed Nov 04 01:31:28 2026 -0500" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Wed Nov 04 07:51:11 2026 -0800" }, "message": "nvmet: drop the extra RCU grace period in nvmet_ns_disable()\n\nnvmet_ns_disable() kills the namespace\u0027s percpu ref, waits in\nsynchronize_rcu() for anyone looking the namespace up under\nrcu_read_lock(), and then waits for the ref to drop to zero.\n\nKilling a percpu ref that is still in percpu mode, as the namespace\nref always is until then, switches it to atomic mode from an RCU\ncallback, so the ref can\u0027t drop to zero before a grace period has\npassed since the kill. synchronize_rcu() thus adds a second grace\nperiod in a row, about 4 ms here, and disabling the namespaces of a\nsubsystem one by one takes about 9 ms each.\n\nDrop synchronize_rcu() and rely on the wait for the ref to cover the\nRCU readers as well.\n\nDisabling 64 namespaces through configfs, median of 3 runs on each of\ntwo boots per kernel:\n\n host connected before after\n none 588 / 590 ms 409 / 409 ms\n nvme-tcp 617 / 619 ms 542 / 511 ms\n\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Qiliang Yuan \u003codys.yuan@gmail.com\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "404a8f6caa63822c1d2a45adbf07fd9c0567a7ef", "tree": "c361fb82dda8b679357b6fbe1a701d0aac288ed8", "parents": [ "a4387799d4228866dc1746b466cd17e1c638d050" ], "author": { "name": "Jarkko Sakkinen", "email": "jarkko@kernel.org", "time": "Tue Nov 03 05:02:07 2026 +0200" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Wed Nov 04 07:51:10 2026 -0800" }, "message": "nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()\n\nCall key_put() before returning -EKEYREVOKED, as the reference count gets\nincremented by key_lookup().\n\nCc: stable@vger.kernel.org # v6.12+\nFixes: 5bc46b49c828 (\"nvme-tcp: check for invalidated or revoked key\")\nReviewed-by: Hannes Reinecke \u003chare@kernel.org\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "699e7ba5915c8b2c76e257e157464f2bfe7ab8bb", "tree": "09f1999e9775933858beaa006a5d0afca7d4706e", "parents": [ "edeac4546a71b6c1db4ba006a2dbf7c863f54e9a" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Wed Nov 04 09:46:23 2026 -0500" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Nov 04 08:06:12 2026 -0700" }, "message": "selftests/io_uring: cast optval through uintptr_t in mini_liburing.h\n\nio_uring_prep_cmd() puts the optval pointer into the 64-bit optval field\nof the SQE with a plain cast, which warns on 32-bit architectures:\n\n mini_liburing.h:272:23: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]\n\nCast through uintptr_t, and include \u003cstdint.h\u003e for it.\n\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nLink: https://patch.msgid.link/20261104144623.3803717-1-sashal@kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "e6ac1da6a53c5f670bf09e60a2500d15be68d2fc", "tree": "6fb026374d889f35f70a64935a3657c19f053c35", "parents": [ "3197517875fdcfae1e9b5a4dcaf35cbbd66c413c" ], "author": { "name": "Yitang Yang", "email": "yi1tang.yang@gmail.com", "time": "Tue Sep 01 22:24:38 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Nov 04 07:58:57 2026 -0700" }, "message": "ublk: add missing DEL_DEV_ASYNC to unprivileged permission check\n\nublk_ctrl_uring_cmd_permission() is missing the UBLK_CMD_DEL_DEV_ASYNC\ncase, causing the command to always return -EINVAL for unprivileged\nublk devices. Fix it by adding the missing case.\n\nFixes: 13fe8e6825e4 (\"ublk: add UBLK_CMD_DEL_DEV_ASYNC\")\nCc: stable@vger.kernel.org\nSigned-off-by: Yitang Yang \u003cyi1tang.yang@gmail.com\u003e\nReviewed-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nLink: https://patch.msgid.link/20260901142438.237586-1-yi1tang.yang@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "3197517875fdcfae1e9b5a4dcaf35cbbd66c413c", "tree": "a090f4aff72fafee8e552f45fb8f35ee833e9ad4", "parents": [ "801bddbf1e4147a69b811c548c35a06a157941b4" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Tue Nov 03 11:39:28 2026 -0500" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed Nov 04 07:57:44 2026 -0700" }, "message": "selftests: ublk: fix the build and file offsets on 32-bit\n\nkublk puts pointers into 64-bit UAPI and SQE fields with a plain (__u64)\ncast. ublk builds with -Werror, so it fails to build on 32-bit\narchitectures:\n\n batch.c:379:42: error: cast from pointer to integer of different size [-Werror\u003dpointer-to-int-cast]\n\nCast through uintptr_t. kublk also passes 64-bit user copy offsets,\nwhich start at UBLKSRV_IO_BUF_OFFSET (2 GB), to pread() and pwrite(),\nand with glibc those are truncated to a 32-bit off_t there. Build with\n-D_FILE_OFFSET_BITS\u003d64 as well.\n\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nReviewed-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nLink: https://patch.msgid.link/20261103163928.641519-1-sashal@kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "03897066069fd47caf2908183edf3b22b822ea73", "tree": "444b64b7d4ceeb218d5154c53fff8880cd25e472", "parents": [ "6d2cf411aba2aa0bd641b49be5b1964ac5097a50" ], "author": { "name": "Joas Antonio dos Santos", "email": "joasantonio108@gmail.com", "time": "Fri Oct 30 20:53:04 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:55:53 2026 +0100" }, "message": "tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead\n\nA peer can lower the link MTU to TIPC_MIN_BEARER_MTU (100 bytes, plus\nthe UDP encapsulation header) with the max_pkt field of a RESET or\nACTIVATE message; tipc_link_proto_rcv() only checks the lower bound\nreturned by tipc_bearer_min_mtu(). The same bound is applied to the\ndevice MTU when a bearer is enabled.\n\nThat bound predates two later reductions of the link MSS:\n\n tipc_link_mss() \u003d mtu - INT_H_SIZE (tunnel header)\n - EMSG_OVERHEAD (CONFIG_TIPC_CRYPTO)\n\nWith CONFIG_TIPC_CRYPTO\u003dy, which is the default, an MTU of 100 gives an\nMSS of 28. Once the link comes up, tipc_named_node_up() calls\nnamed_distribute(), which computes\n\n msg_dsz \u003d ((tipc_node_get_mtu() - INT_H_SIZE) / ITEM_SIZE) * ITEM_SIZE;\n\nFor an MSS of 28 the subtraction is negative and the result truncates to\n0xfffffff0; for an MSS between 40 and 59 it is 0. named_prepare_buf()\nthen allocates a buffer with no room for any item (the u32 size wraps),\nand msg_rem never reaches zero, so every cluster-scope publication on\nthe node is written with publ_to_item() past the end of that one skb,\nover skb_shared_info and into adjacent memory.\n\nWithout crypto the MSS is at least 60, which still does not hold the\nfirst fragment built by tipc_msg_build(): INT_H_SIZE fragment header\nplus a message header of up to MAX_H_SIZE. With pktmax below that, the\nheader copies run past the pktmax bytes allocated for the fragment.\n\nRaise TIPC_MIN_BEARER_MTU to MAX_H_SIZE + 2 * INT_H_SIZE so the MSS can\nalways hold INT_H_SIZE + MAX_H_SIZE, which also leaves room for name\ntable items, and add tipc_bearer_mtu_floor(), which adds EMSG_OVERHEAD\non top for CONFIG_TIPC_CRYPTO\u003dy. Use it for the device MTU check\n(tipc_mtu_bad()), the UDP MTU check, the netlink MTU setting and\ntipc_bearer_min_mtu(), which also bounds the max_pkt negotiation.\n\nFound by manual code review and reproduced with KASAN using two network\nnamespaces joined by a veth pair (see below).\n\nFixes: fc1b6d6de220 (\"tipc: introduce TIPC encryption \u0026 authentication\")\nFixes: 2320bcdae628 (\"tipc: fix changeover issues due to large packet\")\nSuggested-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nSigned-off-by: Joas Antonio dos Santos \u003cjoasantonio108@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/179340438471.4412.6707287163192409104@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6d2cf411aba2aa0bd641b49be5b1964ac5097a50", "tree": "77e530d688357d82ea63785dac50cb40d7b239e5", "parents": [ "8e069fd3fd396b89af417e50b359bc9892dd41cd" ], "author": { "name": "Yilin Zhang", "email": "yilinzhang@moonshot.ai", "time": "Fri Oct 30 23:03:51 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:49:14 2026 +0100" }, "message": "mptcp: do not use Fast Open on MP_JOIN subflows\n\ntcp_fastopen_create_child() hands the SYN packet itself to\nsubflow_syn_recv_sock(). For an MP_JOIN request this takes the\nfatal fallback: the cloned child is destroyed and handed back with\ndrop_req flagged, but tcp_fastopen_create_child() does not check\nthe flag and queues it, so accept() can expose the freed child.\n\nMP_JOIN cannot use Fast Open: data on a subflow requires the\ncompleted HMAC exchange (RFC 8684, sec. 3.2). Refuse it (only the\nTFO path passes a SYN skb here) and let tcp_conn_request() fall\nback to the regular MP_JOIN handshake; also strip the Fast Open\ncookie from MP_JOIN SYN/ACKs.\n\nFixes: 90bf45134d55 (\"mptcp: add new sock flag to deal with join subflows\")\nCc: stable@vger.kernel.org\nReported-by: Kimi Security Team \u003cbug-report@moonshot.ai\u003e\nSuggested-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Yilin Zhang \u003cyilinzhang@moonshot.ai\u003e\n[ Moving code to avoid clearing TS and consolidating checks. ]\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20261030-mptcp-tfo-mpj-v4-1-e6eff2027342@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e395bbf3ddf1b3175fd3bddaead63a2909b33694", "tree": "d4f9abb982022e034c4cf44a8f7108315d4f8ee5", "parents": [ "e6b96b76d7074ae64f0d37d880794c71d3ce277e" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Tue Nov 03 19:45:08 2026 -0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Nov 04 06:43:35 2026 -0800" }, "message": "hwmon: (asus_rog_ryujin) Fix timeout when reading 0% duty cycle\n\nThe device uses the same zero-duty report format for both legitimate 0%\nduty GET responses and SET confirmation ACKs on cooler and controller\nduty channels. To distinguish them, rog_ryujin_raw_event() checks\n!completion_done() on cooler_duty_set and controller_duty_set, assuming\nthis is only true while a SET command is awaiting confirmation.\n\nHowever, init_completion() initializes the completion count to zero, so\n!completion_done() evaluates to true from probe until the first SET\ncommand completes. Likewise, if rog_ryujin_execute_cmd() fails to send a\ncommand, times out, or is interrupted after reinit_completion(), the\ncompletion remains uncompleted. When a valid 0% duty GET response then\narrives, rog_ryujin_raw_event() consumes it as a SET confirmation and\nleaves the pending *_duty_received completion uncompleted, causing\nrog_ryujin_execute_cmd() to wait 1.5 seconds and fail with -ETIMEDOUT.\n\nMark all completions as done with complete_all() after initialization in\nrog_ryujin_probe(), and complete status_completion on error in\nrog_ryujin_execute_cmd(), so !completion_done() is only true while a\ncommand is actively awaiting a response.\n\nFixes: ed3e03790c5c (\"hwmon: Add driver for ASUS ROG RYUJIN II 360 AIO cooler\")\nCc: Aleksa Savic \u003csavicaleksa83@gmail.com\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "8e069fd3fd396b89af417e50b359bc9892dd41cd", "tree": "9c96664a703d98b51c8b4486b80cb0e46c69a867", "parents": [ "58fa96691c1b63bce27b58f32d2b490e89441d5e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Mon Nov 02 08:54:41 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:42:05 2026 +0100" }, "message": "tcp: ipv6: do not read ireq-\u003epktopts from tcp_v6_send_synack()\n\nWhen IPV6_FL_F_REFLECT is set on a listener, or the\nnet.ipv6.flowlabel_reflect sysctl has FLOWLABEL_REFLECT_ESTABLISHED,\ntcp_v6_send_synack() reflects the flowlabel of the SYN packet,\nreading it from the skb stored in ireq-\u003epktopts.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock. A cpu can then process a retransmitted SYN for a\nrequest socket, and send a SYNACK from tcp_check_req(), while another\ncpu receives the ACK completing the 3WHS. tcp_v6_syn_recv_sock()\nconsumes ireq-\u003epktopts when it wins the hashdance, and the first cpu\nreads a freed skb:\n\n BUG: KASAN: slab-use-after-free in tcp_v6_send_synack (include/linux/skbuff.h:3152 include/linux/ipv6.h:110 net/ipv6/tcp_ipv6.c:582)\n Read of size 8 at addr ffff88802b08b608 by task poc-ipv6-pktopt/5076\n\n Call Trace:\n \u003cIRQ\u003e\n tcp_v6_send_synack (include/linux/skbuff.h:3152 include/linux/ipv6.h:110 net/ipv6/tcp_ipv6.c:582)\n tcp_rtx_synack (net/ipv4/tcp_output.c:4719)\n tcp_check_req (net/ipv4/tcp_minisocks.c:762)\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1826)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n ip6_input (include/linux/netfilter.h:325 include/linux/netfilter.h:319 net/ipv6/ip6_input.c:545)\n ipv6_rcv (include/net/dst.h:481 net/ipv6/ip6_input.c:119 include/linux/netfilter.h:325 include/linux/netfilter.h:319 net/ipv6/ip6_input.c:351)\n\n Freed by task 5074 on cpu 0 at 15.412249s:\n kmem_cache_free (include/linux/kasan.h:235 mm/slub.c:2780 mm/slub.c:6630 mm/slub.c:6757)\n tcp_v6_syn_recv_sock (net/ipv6/tcp_ipv6.c:1528)\n tcp_check_req (net/ipv4/tcp_minisocks.c:934)\n tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1826)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n\nRequest socket migration has the same issue: reqsk_migrate_reset()\ntransfers ireq-\u003epktopts to the clone, which can be freed while\nanother cpu holding a reference on the old request socket is still\nsending a SYNACK.\n\nThe SYNACK timer itself is not an issue, because\ninet_csk_reqsk_queue_drop() calls timer_delete_sync().\n\nSave the flowlabel of the SYN in the request socket instead, so that\ntcp_v6_send_synack() no longer needs ireq-\u003epktopts.\n\nAs a side effect, the flowlabel is also reflected for SYN packets\nreusing a TIME_WAIT socket, as ireq-\u003epktopts is not set in this case.\n\nFixes: e994b2f0fb92 (\"tcp: do not lock listener to process SYN packets\")\nFixes: 079096f103fa (\"tcp/dccp: install syn_recv requests into ehash table\")\nFixes: c905dee62232 (\"tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.\")\nReported-by: Anvik Loitongbam \u003cpermissiontogallop@gmail.com\u003e\nReported-by: Yingjie Wang \u003cx-professor@outlook.com\u003e\nCloses: https://lore.kernel.org/netdev/82c31e4d5043f3dbd11b44177cfba779d335aae3.1793599929.git.x-professor@outlook.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261102075441.3771550-1-edumazet@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "58fa96691c1b63bce27b58f32d2b490e89441d5e", "tree": "965093fccbda20157737b2454c99492eb3fcdb67", "parents": [ "d5e912448cd98b261eba8e35ab838f2dc69a79f5", "4019af3afd72864ec6abbfde2d76e416a64456c2" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:34:53 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:34:53 2026 +0100" }, "message": "Merge branch \u0027ip-fix-route-leak-and-unregister_netdevice-stuck\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nip: Fix route leak and unregister_netdevice() stuck.\n\nJason Zhang fed commit 0346ec2f080b (\"ipv6: Prevent\nrt6_insert_exception() for dying fib6_info.\") to LLM to\nfind tricks to cause the same symptom:\n\n unregister_netdevice: waiting for gre6 to become free. Usage count \u003d 4\n ref_tracker: netdev@000000009652f190 has 1/3 users at\n dst_alloc+0x14b/0x490\n ip6_rt_cache_alloc+0x27b/0x670\n __ip6_rt_update_pmtu+0x572/0x850\n\nThis series treats them.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261101064418.2055158-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4019af3afd72864ec6abbfde2d76e416a64456c2", "tree": "965093fccbda20157737b2454c99492eb3fcdb67", "parents": [ "a0fe1a3f390a75152c7395fdf63fc39da77d7838" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sun Nov 01 06:35:24 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:34:50 2026 +0100" }, "message": "ipv4: Call rt_add_uncached_list() if !do_cache in ip_route_input_slow().\n\nSince the cited commit, ip_route_input_slow() could call\nrt_dst_alloc() with vrf in the local_input: path.\n\nIf res-\u003efi !\u003d NULL and one of the following is true,\n\n - a non-zero itag from fib_validate_source_reason()\n (realms/classid)\n - RTN_BROADCAST with BC_FORWARDING enabled\n\ndo_cache is set to false.\n\nThen, the route is not added to rt_uncached_list, so the\nroute cannot be removed from rt_flush_dev().\n\nIf the route is cached in sk-\u003esk_rx_dst, removing the\nvrf device gets stuck. [0]\n\nLet\u0027s call rt_add_uncached_list() if !do_cache in\nip_route_input_slow().\n\n[0]:\nunregister_netdevice: waiting for vrf0 to become free. Usage count \u003d 2\nref_tracker: netdev@000000008b304ac4 has 1/1 users at\n dst_alloc+0x14b/0x490\n ip_route_input_rcu+0x1540/0x2530\n ip_route_input_noref+0x5a/0x90\n ip_rcv_finish_core+0x4b0/0x1140\n ip_rcv_finish+0xe6/0x190\n ip_rcv+0x6c/0x130\n __netif_receive_skb+0x121/0x300\n process_backlog+0x2df/0x5e0\n __napi_poll+0x8c/0x380\n net_rx_action+0x43c/0xab0\n handle_softirqs+0x19f/0x520\n do_softirq+0x46/0x60\n __local_bh_enable_ip+0x79/0x80\n __dev_queue_xmit+0x1b0e/0x24c0\n ip_finish_output2+0x8b2/0xcd0\n ip_output+0xf2/0x1e0\n\nFixes: f5a0aab84b74 (\"net: ipv4: dst for local input routes should use l3mdev if relevant\")\nReported-by: Jason Zhang \u003cjdz@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261101064418.2055158-4-kuniyu@google.com\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a0fe1a3f390a75152c7395fdf63fc39da77d7838", "tree": "7f0a38ff69c51ba0c86227baf46f65fa3fc5a3fd", "parents": [ "9401b428b5d4dfe1fd5752973fd02b4e9cd05536" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sun Nov 01 06:35:23 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:34:50 2026 +0100" }, "message": "ipv6: Flush rt-\u003efrom in rt6_uncached_list_flush_dev().\n\nWhen a device is unregistered, rt6_uncached_list_flush_dev()\niterates over uncached routes and switches the dying dev\nwith blackhole_netdev.\n\nHowever, rt-\u003efrom could be cached via sk-\u003esk_rx_dst and\nhold the device reference.\n\nThen, unregister_netdevice() gets stuck with the splat\nbelow. [0]\n\nLet\u0027s release rt-\u003efrom in rt6_uncached_list_flush_dev().\n\nNote that ip6_rt_copy_init() could set rt-\u003efrom even if\nin6_dev_get() returns NULL (e.g. mtu \u003c IPV6_MIN_MTU is\nset concurrently).\n\nAlso, rt-\u003efrom-\u003enh could be replaced with another device\nthan rt_dev and rt_idev-\u003edev, and in such a case,\nnexthop_flush_dev() sets fib6_destroying before\nrt6_uncached_list_flush_dev().\n\n[0]:\nunregister_netdevice: waiting for dummy2 to become free. Usage count \u003d 2\nref_tracker: netdev@000000006fb9da8c has 1/1 users at\n netdev_get_by_index+0x14c/0x170\n fib6_nh_init+0x1ae/0x1950\n ip6_route_info_create_nh+0x15d/0x780\n ip6_route_add+0x55/0x150\n inet6_rtm_newroute+0x15d/0x1360\n rtnetlink_rcv_msg+0x606/0x710\n netlink_rcv_skb+0x14f/0x2f0\n netlink_unicast+0x71b/0x940\n netlink_sendmsg+0x595/0x840\n __sock_sendmsg+0x119/0x150\n ____sys_sendmsg+0x3e9/0x5c0\n ___sys_sendmsg+0x157/0x1a0\n __x64_sys_sendmsg+0x119/0x170\n do_syscall_64+0x109/0x330\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFixes: 93531c674315 (\"net/ipv6: separate handling of FIB entries from dst based routes\")\nReported-by: Jason Zhang \u003cjdz@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261101064418.2055158-3-kuniyu@google.com\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9401b428b5d4dfe1fd5752973fd02b4e9cd05536", "tree": "3313c7b2fc132418b3f0ac0258f6e7ae35289b31", "parents": [ "d5e912448cd98b261eba8e35ab838f2dc69a79f5" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sun Nov 01 06:35:22 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:34:50 2026 +0100" }, "message": "ipv6: Flush exception route while replacing nexthop.\n\nThe following creates a cyclic reference between IPv6 route\nand nexthop:\n\n 1. create a nexthop A\n 2. create a nexthop group w/ A\n 3. create an IPv6 route with the nexthop group\n 4. create an exception route w/ A\n 5. replace A with a new nexthop B in the nexthop group\n 6. remove the IPv6 route\n 7. replace B with A in the nexthop group\n 8. remove the nexthop group\n\nThen, removing a device tied to the route gets stuck and\ntriggers the splat below. [0]\n\nAt 5., fib6_nh_release_dsts() is called, but it does not\nflush exception routes, so the nexthop A continues to grab\nthe IPv6 route reference.\n\n nh_A-\u003ert6i_exception_bucket[] -\u003e rt6_ex-\u003ert6i-\u003efrom\n\nAt 6., fib6_purge_rt() calls rt6_flush_exceptions(), but it\nonly purges exceptions tied to nexthop B. Also, the route is\nunlinked from the nexthop group by list_del_init(\u0026rt-\u003enh_list).\n\n -\u003e f6i-\u003enh -\u003e nhg-\u003enh_entries[]\n\nAt 8., __remove_nexthop_fib() cannot find the IPv6 route, and\nremove_nexthop_group() calls list_del_init(\u0026nhge-\u003enh_list) to\nunlink the group from the nexthop A\u0027s nhe-\u003egrp_list.\n\n nhg-\u003enh_entries[] -\u003e nh_A -\u003e ... -\u003e f6i\n\nHere, the nexthop A is reachable from net-\u003enexthop.devhash[],\nbut remove_nexthop_from_groups() cannot find the nexthop group,\nleaking the whole chain.\n\nLet\u0027s call fib6_nh_flush_exceptions() in fib6_nh_release_dsts().\n\n[0]:\nunregister_netdevice: waiting for gre6 to become free. Usage count \u003d 4\nref_tracker: netdev@000000009652f190 has 1/3 users at\n dst_alloc+0x14b/0x490\n ip6_rt_cache_alloc+0x27b/0x670\n __ip6_rt_update_pmtu+0x572/0x850\n ip6_tnl_xmit+0x8c5/0x1b70\n __gre6_xmit+0x7af/0xaa0\n ip6gre_tunnel_xmit+0x685/0xdc0\n dev_hard_start_xmit+0x204/0x5a0\n __dev_queue_xmit+0xe8a/0x2550\n ip6_finish_output+0x232/0x570\n ip6_output+0x226/0x3b0\n ip6_send_skb+0x133/0x250\n rawv6_push_pending_frames+0x503/0x6f0\n rawv6_sendmsg+0xdf0/0x1310\n sock_sendmsg_nosec+0xde/0x130\n __sys_sendto+0x27f/0x320\n __x64_sys_sendto+0xd9/0xf0\n\nFixes: 7bf4796dd099 (\"nexthops: add support for replace\")\nReported-by: Jason Zhang \u003cjdz@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261101064418.2055158-2-kuniyu@google.com\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d5e912448cd98b261eba8e35ab838f2dc69a79f5", "tree": "391b9cbfbd20f86fa8a25b723ed11321a0fdd965", "parents": [ "24614e72df484ad50ecba98aaa88c7df2448c122" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Mon Oct 05 08:51:01 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:23:27 2026 +0100" }, "message": "vhost/vsock: size receive SKBs from declared payload\n\nvhost_vsock_alloc_skb() sizes the skb from iov_length(), the total guest\ndescriptor length. virtio_transport_inc_rx_pkt() instead adds hdr-\u003elen to\nrx_bytes and buf_used, and budgets each queued skb as SKB_TRUESIZE(0). The\nguest controls the descriptor length and hdr-\u003elen independently.\n\nA guest can therefore provide a 64 KiB descriptor while declaring a zero\npayload. The descriptor-sized skb remains queued, rx_bytes and buf_used\nremain unchanged, and only the fixed queue-entry budget limits retention.\nThis is not a lifetime leak: the skb is freed when dequeued or at socket\nteardown. Repeating this across connections can nevertheless exhaust host\nmemory. On Linux v7.2, 455 such descriptors retained 30,255,680 bytes for\na 262,144-byte receive buffer; a full-payload control retained 265,984\nbytes.\n\nVhost previously read hdr-\u003elen and allocated pkt-\u003ebuf from that value. The\nconversion from virtio_vsock_pkt to sk_buff instead allocated receive skbs\nfrom the descriptor length, introducing the allocation-accounting mismatch.\n\nCopy the header into a stack object and validate hdr-\u003elen before allocating\nthe skb. Size the allocation as sizeof(hdr) + payload_len so descriptor\ncapacity no longer determines queued memory. Check payload_len against\nlen - sizeof(hdr) to avoid addition overflow on 32-bit hosts.\n\nFixes: 71dc9ec9ac7d (\"virtio/vsock: replace virtio_vsock_pkt with sk_buff\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20261004235101.1464007-1-4ncienth@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "24614e72df484ad50ecba98aaa88c7df2448c122", "tree": "f9e31a312e979483740ed35d2e31da1e6716bf12", "parents": [ "c4328134f3f7c2ce141121a8f82a5ec0cc8a709c" ], "author": { "name": "Avi Weiss", "email": "thnkslprpt@gmail.com", "time": "Sat Oct 31 13:41:35 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:21:07 2026 +0100" }, "message": "net: skbuff: reject zero MPLS TTL before decrementing\n\nskb_mpls_dec_ttl() decrements the u8 TTL before checking whether it\nexpired. An incoming TTL of zero wraps to 255, causing the TC MPLS\ndec_ttl action to pass an expired packet instead of dropping it.\n\nReject a zero TTL before the decrement while preserving the existing\nbehavior for TTL one and valid TTL values.\n\nFixes: 2a2ea50870ba (\"net: sched: add mpls manipulation actions to TC\")\nSigned-off-by: Avi Weiss \u003cthnkslprpt@gmail.com\u003e\nReviewed-by: Xia Yan \u003cyanxia@cmss.chinamobile.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261031114135.3784868-2-thnkslprpt@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c4328134f3f7c2ce141121a8f82a5ec0cc8a709c", "tree": "5466f349364e948811db63cc227002b85fb845d5", "parents": [ "11140c51df12e594d6bf2c8d2af5dec63b0219ac", "25e73f1d6868c759c8eb56cad4e411692c5341b4" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:00:49 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 15:00:50 2026 +0100" }, "message": "Merge tag \u0027wireless-2026-11-02\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nA few fixes to start with:\n - wext: fix notifier netns interaction\n - rsi: avoid TID OOB access\n - mac80211: reload pointer, fix A-MPDU flags\n - brcmfmac: fix DMA regression\n - cfg80211: fix regdb validation\n\n* tag \u0027wireless-2026-11-02\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n wifi: mac80211: reinstate IEEE80211_TX_CTL_AMPDU flag in ieee80211_tx_prep_agg()\n wifi: cfg80211: fix out-of-bounds read in valid_rule()\n wifi: rsi: Skip TX aggregation setup for non-QoS frames\n wifi: wext: Limit notifier event flushes to the device\u0027s netns\n wifi: brcmfmac: map msgbuf RX packet IDs bidirectional\n wifi: mac80211: reload TDLS header pointer after skb_linearize()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261102104649.727621-3-johannes@sipsolutions.net\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "11140c51df12e594d6bf2c8d2af5dec63b0219ac", "tree": "06459ab6d7a345438be4b09e7845d10b0bc7ccd3", "parents": [ "35d2d6e5ac0d22428b2a0216061f3330c095393c" ], "author": { "name": "Guillaume Nault", "email": "gnault@redhat.com", "time": "Wed Oct 28 21:32:35 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 14:46:35 2026 +0100" }, "message": "tcp: Fix dup-ack detection on non-SACK bidirectional data transfer.\n\nWhen receiving a pure ack from a peer that also sends data, we can\nhave SEG.SEQ \u003e SND.WL1, even though the segment contains no data. This\nmakes tcp_may_update_window() return true (because of the\n\"after(ack_seq, tp-\u003esnd_wl1)\" condition), and tcp_ack_update_window()\nthen adds FLAG_WIN_UPDATE to the segment set of flags, even when\nthere\u0027s no window update.\n\nSince FLAG_WIN_UPDATE prevents the segment from being considered as\ndup-ack (as it\u0027s part of FLAG_NOT_DUP), this can inhibit fast\nretransmit on non-SACK connections, making recovery very slow as it\nnow entirely relies on RTO.\n\nThe \"DUPLICATE ACKNOWLEDGMENT\" definition of RFC 5681, section 2,\nsays that lack of window update is a necessary condition for a dup ack:\n\"(e) the advertised window in the incoming acknowledgment equals the\nadvertised window in the last incoming acknowledgment.\". Spurious\nwindow updates can thus prevent dup ack detection and, in the end, fast\nretransmit.\n\nAvoid this scenario by setting FLAG_WIN_UPDATE only when a window\nupdate actually occurs. Pure acks with SEG.SEQ \u003e SND.WL1 can now\nbe detected as dup-ack and trigger fast retransmission.\n\nAlso, stop setting FLAG_WIN_UPDATE in tcp_ack()\u0027s header prediction\npath. One of the conditions for header prediction to happen is that\nreceived segments don\u0027t trigger a window update. This flag update was\nthus wrong to begin with. Now that tcp_ack_update_window() sets\nFLAG_WIN_UPDATE only if a window update actually occurred, we need the\nheader prediction path to stop reporting spurious window updates too.\nOtherwise BPF programs would get inconsistent window update information\n(CA_ACK_WIN_UPDATE) between fast an slow paths.\n\nFinally, add FLAG_SND_UNA_ADVANCED to the definition of FLAG_NOT_DUP.\nThis is necessary for the case where an incoming segment acknowledges\nless than a full segment of the retransmit queue. Such segments were\nnot considered dubious by tcp_ack_is_dubious() because of the spurious\nFLAG_WIN_UPDATE flag, which prevented the segment from being seen as a\nduplicate ack. Now that FLAG_WIN_UPDATE doesn\u0027t cover this scenario\nanymore, we need another way to mark these acks as non-duplicate.\nAdding FLAG_SND_UNA_ADVANCED to FLAG_NOT_DUP is the natural way of\ndoing this, since, by definition, a segment advancing SND.UNA, even by\na small amount, cannot be a duplicate ack.\n\nA side effect of this patch is that repeated zero window acks received\nfrom peer can now be considered duplicate acks (because of the the\n\"|| !win\" condition in tcp_may_update_window()). Therefore, they can\nnow trigger fast retransmission and fast recovery, including congestion\nwindow reduction, when the peer is stalled. This is RFC compliant and\nshouldn\u0027t have any negative effect.\n\nAdd packetdrill selftest. Before this patch, the 1001:2001 segment was\nretransmitted upon RTO, now it\u0027s sent right after reception of the\nthird duplicate ack.\n\nThanks to Tom Williams for the investigation help and initial\nreproducer.\n\nReported-by: Tom Williams \u003cTom.D.Williams@MorganStanley.com\u003e\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Guillaume Nault \u003cgnault@redhat.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/6426d558e45fc6ab724c40af62e4a8793215dd8a.1793219189.git.gnault@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "35d2d6e5ac0d22428b2a0216061f3330c095393c", "tree": "79ddc7f70087396a6f589c5ab2311d8aa2e315a4", "parents": [ "241dec6f9ab74d8c3ef246764f3611666b96b9e1" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Sun Nov 01 19:44:33 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 04 13:25:05 2026 +0100" }, "message": "net: reject a negative TCP header offset in qdisc_pkt_len_segs_init()\n\nqdisc_pkt_len_segs_init() stores skb_transport_offset(), or the inner\noffset, in the unsigned hdr_len. A header in front of skb-\u003edata gives a\nnegative offset. For an offset a little below zero, pskb_may_pull() gets a\nsmall length and succeeds. Then a 64-bit kernel reads the TCP header far\nafter the skb and can crash. Further below zero pskb_may_pull() fails.\n\nCommit 28a57fb2c5df (\"net: iptunnel: fix stale transport header during\ntunnel decapsulation\") fixed one source of such offsets. Other code that\nremoves bytes from the front of a packet can leave the same stale header.\n\nReturn SKB_DROP_REASON_SKB_BAD_GSO for a negative offset in the TCP branch.\nSKB_GSO_UDP_L4 and the other GSO types read no header and still get a wrong\nqdisc_pkt_len(). On a 64-bit kernel only packets that cause the read after\nthe skb today get a new result. Then __dev_queue_xmit() drops them and\nreturns -EINVAL, but sch_handle_ingress() ignores the result. Their content\ncan be valid. Thus the code that leaves the header stale needs its own fix.\n\nFixes: 7fb4c1967011 (\"net: pull headers in qdisc_pkt_len_segs_init()\")\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nCC: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261101194433.2637113-1-alexei.starovoitov@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0cbfc16fe49629f5c1fc3628405661c2b938ec61", "tree": "37a8eed973e75530afb313fa89f106d09dd4ba1c", "parents": [ "3f57fc2c49ed05ccfc56e4dc9eda41be95925bbd" ], "author": { "name": "Hungyu Lin", "email": "dennylin0707@gmail.com", "time": "Thu Oct 29 00:49:02 2026 +0000" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Wed Nov 04 13:23:30 2026 +0100" }, "message": "isofs: handle Rock Ridge long-form dates before 1900\n\niso_date() stores the year relative to 1900 and rejects negative values.\nRock Ridge LONG_FORM timestamps encode calendar years from 1 to 9999,\nso valid years before 1900 are returned as seconds since the Unix epoch\nequal to zero instead of their recorded dates. For example, an 1899\ntimestamp on an image produced by xorriso is reported as 1970 by stat,\nand cp -p preserves that incorrect time.\n\nUse the calendar year for both timestamp formats and pass it directly\nto mktime64(). Keep the epoch fallback for year zero, while allowing\nvalid long-form years before 1900. Short-form dates are unchanged.\n\nFixes: 5ea45f54c8d6 (\"isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry\")\nSigned-off-by: Hungyu Lin \u003cdennylin0707@gmail.com\u003e\nLink: https://patch.msgid.link/20261029004902.76944-1-dennylin0707@gmail.com\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "57d94d26ed42773d6378da45eed9de03b116e7f7", "tree": "aee4a684fce2db8dc0bf47dfcd47e3a97bb9fdca", "parents": [ "05441d697f7f9a927264f4058cbbc6a03dfcac9d" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Tue Nov 03 09:16:27 2026 -0500" }, "committer": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Wed Nov 04 03:09:57 2026 -0800" }, "message": "selftests/configfs: fix the build on 32-bit architectures\n\nThe fixture setup checks the result of mkdtemp() with ASSERT_NE(), which\nhands the pointer to the harness. The harness casts both operands to\nintmax_t to print them, and on 32-bit architectures gcc warns about the\ncast from a pointer to an integer of a different size. The configfs\ntest builds with -Werror, so it fails to build there:\n\n kselftest_harness.h:797:49: error: cast from pointer to integer of different size [-Werror\u003dpointer-to-int-cast]\n\nCompare the result against NULL inside ASSERT_TRUE(), so that the\nharness only sees an int.\n\nFixes: a7fdcb2edd0f (\"selftests/configfs: add tests for the userspace interface\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20261103141627.30838-1-sashal@kernel.org\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\n" }, { "commit": "241dec6f9ab74d8c3ef246764f3611666b96b9e1", "tree": "96b19cc438c9d6d74cc476c1972158fe0bc1dbbc", "parents": [ "3f1054a0cb09552dd54db024694f74747f9f1d49" ], "author": { "name": "Joseph Kain", "email": "jkain@nuro.ai", "time": "Thu Oct 29 14:11:01 2026 -0700" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Nov 04 08:43:21 2026 +0000" }, "message": "net: stop defer_count outliving the deferred-free list\n\nAfter the llist conversion, rejected frees retain their counter\nincrements. A producer racing the counter reset and list detach can\nalso leave a count for an skb already drained. Deferred freeing can\nthen remain disabled while the list is empty.\n\nUndo rejected reservations and subtract only the number of skbs\ndrained. Allow admission up to the configured limit. Retain the\nhalfway notification and also notify when the reserved count reaches\nthe limit, covering reservations published after an earlier purge.\n\nFixes: 844c9db7f7f5 (\"net: use llist for sd-\u003edefer_list\")\nSigned-off-by: Joseph Kain \u003cjkain@nuro.ai\u003e\nAssisted-by: LLM\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "3f1054a0cb09552dd54db024694f74747f9f1d49", "tree": "b508807b670ba6ac5cf8fae5a8c9d09c98e1a7f3", "parents": [ "787268686c64be60023743b527645a907e38ccca" ], "author": { "name": "James Clark", "email": "jjc@jclark.com", "time": "Thu Oct 29 20:55:56 2026 +0700" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Nov 04 07:57:26 2026 +0000" }, "message": "net: ethernet: ti: am65-cpts: adjust perout genf following ptp changes\n\nA periodic output requested by PTP_PEROUT_REQUEST2 drifts away from\nthe PHC as soon as the PHC frequency is adjusted, for example by ptp4l\nor ts2phc: at +10 ppm each edge is 10 us later than the one before.\n\nThe GenF that generates the output counts its period in ref_clk\ncycles, which the PPM correction of the CPTS clock does not reach;\neach GenF has its own PPM registers. am65_cpts_ptp_adjfine() programs\nthem only for the GenF used for PPS, and am65_cpts_perout_enable_hw()\nstarts every GenF with them cleared, so a GenF used for a periodic\noutput is never corrected.\n\nCommit eb9233ce6751 (\"net: ethernet: ti: am65-cpts: adjust pps following\nptp changes\") added the correction for the PPS GenF, and\ncommit 7849c42da2ca (\"net: ethernet: ti: am65-cpts: adjust estf following\nptp changes\") passed the same values to the ESTFs.\n\nIn am65_cpts_ptp_adjfine(), update every enabled GenF the way the PPS\nGenF was updated: read its control register, set or clear the PPM\ndirection bit and write it back with the PPM value. The PPS GenF and the\nESTFs get exactly the values they got before. In\nam65_cpts_perout_enable_hw(), start a GenF with the current correction\ninstead of none; this applies to the PPS GenF too.\n\nTested on a BeagleY-AI (J722S) with the GENF0 output looped back to\nthe HW1_TS_PUSH input (EXTTS 0). With the PHC frequency adjusted by\n+10 ppm before the periodic output is started, the edges drift 10 us\nper second against the PHC without this patch (290 us after 29 s);\nwith it, they stay 20 to 23 ns after the PHC second. This also works\nif the frequency is adjusted after the periodic output has started.\n\nFixes: f6bd59526ca5 (\"net: ethernet: ti: introduce am654 common platform time sync driver\")\nSigned-off-by: James Clark \u003cjjc@jclark.com\u003e\nReviewed-by: Jacob Keller \u003cJacob.e.keller@intel.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "9ff338af0e002fe217cfa16b1289b76f6b21fc72", "tree": "4a6bc17a7c567c067f66c2fcce06749a5e69c676", "parents": [ "323899b4ed233d5b6e2fc160c16fbf39cf0317da" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Fri Oct 30 18:07:02 2026 +0100" }, "committer": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Wed Nov 04 08:05:13 2026 +0100" }, "message": "ovl: inherit FMODE_NONOTIFY when reading directory layers\n\nListing a merged or impure overlay directory opens the real layer\ndirectories from ovl_dir_read(), when the readdir cache is filled.\nThose opens use plain ovl_path_open(), so when the directory fd is\none that fanotify created for a permission event, they can still raise\nFS_OPEN_PERM. A listener that also marks the backing filesystem and\ncalls getdents() on the event fd before answering then deadlocks the\nsame way as with the directory open fixed by the previous commit.\n\nStore the overlay user file in struct ovl_readdir_data and pass it to\novl_path_open_realfile() from ovl_dir_read(), for both the merged and\nthe impure cache. Internal readers such as ovl_check_empty_dir() and\nthe mount-time workdir cleanup still pass no user file.\n\nA note about severity and real world impact: The FAN_OPEN_PERM event is\ntraditionally used by anti-malware protection agents and security/audit\nagents. The scope that is often used in those use cases is FAN_MARK_MOUNT\nand agents typically monitor multiple mounts in a mount namespace.\nFAN_OPEN_PERM from directory open requires user opt-in with FAN_ONDIR.\nIt is often not the case that anti-malware agents monitor open of\ndirectories. Security/audit engines are more likely to opt-into\nFAN_OPEN_PERM on directories, but are less likely to list the content\nof a directory within the scope of FAN_OPEN_PERM event, so the real\nworld impact of this bug is likely not significant.\n\nReported-by: Edvard Conrad \u003cedvard@tuta.io\u003e\nCloses: https://lore.kernel.org/all/P5Qu3co--N-9@tuta.io/\nCc: stable@vger.kernel.org\nTested-by: Edvard Conrad \u003cedvard@tuta.io\u003e\nLink: https://lore.kernel.org/ltp/P5WKBbq--F-9@tuta.io/\nCo-developed-by: Edvard Conrad \u003cedvard@tuta.io\u003e\nSigned-off-by: Edvard Conrad \u003cedvard@tuta.io\u003e\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\n" }, { "commit": "323899b4ed233d5b6e2fc160c16fbf39cf0317da", "tree": "d4d95ea1a5060e59418753a262e6b0cfe2067a60", "parents": [ "e803c82dcdd15e87b48fca1ea8d2cfe6a7ed83d4" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Fri Oct 30 18:07:02 2026 +0100" }, "committer": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Wed Nov 04 07:52:46 2026 +0100" }, "message": "ovl: inherit FMODE_NONOTIFY when opening directory realfiles\n\nWhen fanotify hands a listener an fd for a permission event on an\noverlay directory, ovl_dir_open_realfile() opens the real directory via\ndentry_open(), not backing_file_open(), so the lower open could still\nraise FS_OPEN_PERM and deadlock a listener that also marks the backing\nfilesystem.\n\nExport dentry_open_nonotify() and call it from ovl_path_open_realfile()\nwhen the overlay user file must not generate events. Ordinary\novl_path_open() callers are unchanged.\n\nReported-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20261030-welpen-anbinden-nullen-b2432cee1d10@brauner/\nFixes: 130fdbc3d1f99 (\"ovl: pass correct flags for opening real directory\")\nCc: stable@vger.kernel.org\nTested-by: Edvard Conrad \u003cedvard@tuta.io\u003e\nLink: https://lore.kernel.org/ltp/P5Iny41--F-9@tuta.io/\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\n" }, { "commit": "a4387799d4228866dc1746b466cd17e1c638d050", "tree": "2e85667116bca0f7d9e6ef6bdb4c704adfcfeb29", "parents": [ "80095787f776967361cca76357f19e5445e0cd75" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Wed Oct 28 10:42:30 2026 -0600" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Tue Nov 03 14:27:06 2026 -0800" }, "message": "nvmet-rdma: disconnect a queue on device removal\n\ncma_remove_one() sends DEVICE_REMOVAL to the owner of every cm_id on\nthe device and then waits, without timeout, until they\u0027re all\ndestroyed. nvmet_rdma_device_removal() does nothing for a queue cm_id\nand leaves the queues to nvmet_rdma_remove_one(), which only works if\nthat runs first. As a module it does, nvmet-rdma registers after\nrdma_cm. Built in, both register at the same initcall level and\ndrivers/Makefile lists nvme/ ahead of infiniband/, so cma_remove_one()\nruns first and waits for cm_ids that only the later callback would\ndestroy. Since the RDMA CM drops all later events for a cm_id once it\nhas sent DEVICE_REMOVAL, a peer closing its connection doesn\u0027t help\neither. One connection from anyone who can reach the port hangs \"rdma\nlink delete\" until something else ends the queue.\n\nCall nvmet_rdma_queue_disconnect() for the queue. It unlists the queue\nand queues the release work, which destroys the cm_id. Don\u0027t wait for\nit, rdma_destroy_id() waits for the handler to return, which was the\ndeadlock before commit f1d4ef7d8883.\n\nFixes: f1d4ef7d8883 (\"nvmet-rdma: register ib_client to not deadlock in device removal\")\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: Sagi Grimberg \u003csagi@grimberg.me\u003e\nCc: Chaitanya Kulkarni \u003ckch@nvidia.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "80095787f776967361cca76357f19e5445e0cd75", "tree": "fb1ae1862963b519e587636bc6b2f7c02ceda761", "parents": [ "86ae3841aea4e29d7ac08d5614ca3823dc8dfbc9" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Wed Oct 28 10:42:29 2026 -0600" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Tue Nov 03 14:21:57 2026 -0800" }, "message": "nvmet-rdma: queue the release work under the mutex\n\nnvmet_rdma_remove_one() takes the queue mutex, unlists each queue of\nthe device and queues its release work, then flushes nvmet-wq. So a\nqueue that still holds objects on the device must either be on the\nlist or have its release work queued. nvmet_rdma_queue_disconnect()\nbreaks that: it unlists the queue under the mutex, drops it, and only\nthen calls __nvmet_rdma_queue_disconnect() to queue the work. A device\nremoval in that window finds nothing to wait for, and the release work\nthen destroys the QP and CQ share on a freed device.\n\nQueue the work before dropping the mutex, as nvmet_rdma_remove_one()\nitself does. That\u0027s safe now that rdma_disconnect() no longer sleeps on\nan iWARP event that needs the same mutex.\n\nFixes: f1d4ef7d8883 (\"nvmet-rdma: register ib_client to not deadlock in device removal\")\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: Sagi Grimberg \u003csagi@grimberg.me\u003e\nCc: Chaitanya Kulkarni \u003ckch@nvidia.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "86ae3841aea4e29d7ac08d5614ca3823dc8dfbc9", "tree": "d00c7a51bd5deb18803aa3b6bd469edaec1c466f", "parents": [ "a029f1b2fb13e6ac6e1c2f27fba1d80b6e7cac51" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Wed Oct 28 10:42:28 2026 -0600" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Tue Nov 03 14:20:22 2026 -0800" }, "message": "nvmet-rdma: take a device off the list last\n\nnvmet_rdma_remove_one() disconnects the queues of a device and flushes\nnvmet-wq, but since commit a3dd7d0022c3 it returns right away if the\ndevice isn\u0027t on device_list. nvmet_rdma_free_dev(), run by the release\nwork of the last queue, takes the device off that list first and frees\nthe SRQs and the PD afterwards. A device removal in between finds\nnothing on the list, returns, and the RDMA core frees the device under\nib_dealloc_pd().\n\nFree the SRQs and the PD first and unlist the device last, so the\nremove callback finds it and its flush waits for the release work.\n\nFixes: a3dd7d0022c3 (\"nvmet-rdma: Don\u0027t flush system_wq by default during remove_one\")\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: Sagi Grimberg \u003csagi@grimberg.me\u003e\nCc: Chaitanya Kulkarni \u003ckch@nvidia.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" } ], "next": "a029f1b2fb13e6ac6e1c2f27fba1d80b6e7cac51" }