)]}' { "log": [ { "commit": "70390501d1944d4e5b8f7352be180fceb3a44132", "tree": "e561144140b1684248dae01a3eb573eb1ca4fa7d", "parents": [ "6e1e5a33e809105f44401b6a962a2c63e360f561", "5772f6535227ebd104065d80afa8ed3478d34c5c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:28:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:28:45 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix memory map enumeration bug in the Xen e820 parsing code (Juergen\n Gross)\n\n - Re-enable e820 BIOS fallback if e820 table is empty (David Gow)\n\n* tag \u0027x86-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/boot/e820: Re-enable BIOS fallback if e820 table is empty\n x86/xen: Fix a potential problem in xen_e820_resolve_conflicts()\n" }, { "commit": "6e1e5a33e809105f44401b6a962a2c63e360f561", "tree": "6a249a35c63f47ce9e66862d9c30f3a4b9ae1f4f", "parents": [ "7f0023215262221ca08d56be2203e8a4770be033", "bd3c45dd01283ada23b0a388c578dcf5600deb8a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:03:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:03:39 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n \"Fix CPU hotplug activation race in the timer migration code, by\n Frederic Weisbecker\"\n\n* tag \u0027timers-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n timers/migration: Fix another hotplug activation race\n" }, { "commit": "7f0023215262221ca08d56be2203e8a4770be033", "tree": "33c8dec5486e41d6b1e29dbaab172b3cbc0ddc41", "parents": [ "e5cf0260a7472b4f34a46c418c14bec272aac404", "9f6d929ee2c6f0266edb564bcd2bd47fd6e884a8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:42:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:42:10 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix spurious failures in rseq self-tests (Mark Brown)\n\n - Fix rseq rseq::cpu_id_start ABI regression due to TCMalloc\u0027s creative\n use of the supposedly read-only field\n\n The fix is to introduce a new ABI variant based on a new (larger)\n rseq area registration size, to keep the TCMalloc use of rseq\n backwards compatible on new kernels (Thomas Gleixner)\n\n - Fix wakeup_preempt_fair() for not waking up task (Vincent Guittot)\n\n - Fix s64 mult overflow in vruntime_eligible() (Zhan Xusheng)\n\n* tag \u0027sched-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/fair: Fix wakeup_preempt_fair() for not waking up task\n sched/fair: Fix overflow in vruntime_eligible()\n selftests/rseq: Expand for optimized RSEQ ABI v2\n rseq: Reenable performance optimizations conditionally\n rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode\n selftests/rseq: Validate legacy behavior\n selftests/rseq: Make registration flexible for legacy and optimized mode\n selftests/rseq: Skip tests if time slice extensions are not available\n rseq: Revert to historical performance killing behaviour\n rseq: Don\u0027t advertise time slice extensions if disabled\n rseq: Protect rseq_reset() against interrupts\n rseq: Set rseq::cpu_id_start to 0 on unregistration\n selftests/rseq: Don\u0027t run tests with runner scripts outside of the scripts\n" }, { "commit": "e5cf0260a7472b4f34a46c418c14bec272aac404", "tree": "76b74ef486f2be0ae3b70a7561d3eb155921d663", "parents": [ "27a26ccfd528da725a999ea1e3102503c61eb655", "aa4384bc8f4360167f3c3d5322121fe892289ea2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:39:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:39:18 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix deadlock in the perf_mmap() failure path (Peter Zijlstra)\n\n - Intel ACR (Auto Counter Reload) fixes (Dapeng Mi):\n - Fix validation and configuration of ACR masks\n - Fix ACR rescheduling bug causing stale masks\n - Disable the PMI on ACR-enabled hardware\n - Enable ACR on Panther Cover uarch too\n\n* tag \u0027perf-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/intel: Enable auto counter reload for DMR\n perf/x86/intel: Disable PMI for self-reloaded ACR events\n perf/x86/intel: Always reprogram ACR events to prevent stale masks\n perf/x86/intel: Improve validation and configuration of ACR masks\n perf/core: Fix deadlock in perf_mmap() failure path\n" }, { "commit": "27a26ccfd528da725a999ea1e3102503c61eb655", "tree": "8aff9a1860c107d49f33dd9f77adb9299a2577a1", "parents": [ "678ede852f918581fbc43c61f4c4737a3df99cac", "5cbb61bf4168859d97c068d88d364f4f1f440325" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:18:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:18:35 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fix from Catalin Marinas:\n\n - ptrace(PTRACE_SETREGSET) fix to zero the target\u0027s fpsimd_state rather\n than the tracer\u0027s\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64/fpsimd: ptrace: zero target\u0027s fpsimd_state, not the tracer\u0027s\n" }, { "commit": "678ede852f918581fbc43c61f4c4737a3df99cac", "tree": "ac7075d034931918ad413ed7c62e439b16aa2222", "parents": [ "cbf457c584b5cbd0d44e8f05edaf3e189e894a68", "9ef40a09c5de18f0d275a451f5c2a7fd4f07158b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:08:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:08:58 2026 -0700" }, "message": "Merge tag \u0027pci-v7.1-fixes-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Don\u0027t fallback to bus reset after failed slot reset; a bus reset\n isn\u0027t safe if the .reset_slot() callback is implemented (Keith Busch)\n\n - Update saved_config_space upon resource assignment to fix passthrough\n regressions when x86 pcibios_assign_resources() updates BARs (Lukas\n Wunner)\n\n - Initialize a temporary pci_dev-\u003edev in sysfs \u0027new_id\u0027 attribute to\n fix a lockdep regression after driver_override was moved from PCI to\n device core (Samiullah Khawaja)\n\n - Update MAINTAINERS email addresses (Marek Vasut, Hans Zhang)\n\n - Add MAINTAINERS reviewer for PCIe Cadence IP (Aksh Garg)\n\n* tag \u0027pci-v7.1-fixes-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n MAINTAINERS: Add Aksh Garg as PCIe CADENCE reviewer\n MAINTAINERS: Update Hans Zhang email for PCIe CIX Sky1\n MAINTAINERS: Update Marek Vasut email for PCIe R-Car\n PCI: Initialize temporary device in new_id_store()\n PCI: Update saved_config_space upon resource assignment\n PCI: Don\u0027t fallback to bus reset after failed slot reset\n" }, { "commit": "9ef40a09c5de18f0d275a451f5c2a7fd4f07158b", "tree": "e8d643ee3a8c58bb949dcb6435f95957587ae9de", "parents": [ "78e115d806b0eea83a0e4df182a689823aa80511" ], "author": { "name": "Aksh Garg", "email": "a-garg7@ti.com", "time": "Fri May 08 11:39:51 2026 +0530" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:07 2026 -0500" }, "message": "MAINTAINERS: Add Aksh Garg as PCIe CADENCE reviewer\n\nI wish to contribute to the review process for Cadence PCIe IP drivers,\nhence add myself as a reviewer.\n\nSigned-off-by: Aksh Garg \u003ca-garg7@ti.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/20260508060951.840233-1-a-garg7@ti.com\n" }, { "commit": "78e115d806b0eea83a0e4df182a689823aa80511", "tree": "51fbdb1ed7b05de8ecc68a4475d08ce212ddd242", "parents": [ "bf5421b3d8d3d9216d045af89d4f7e2f75375554" ], "author": { "name": "Hans Zhang", "email": "18255117159@163.com", "time": "Fri May 08 10:30:06 2026 +0800" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "MAINTAINERS: Update Hans Zhang email for PCIe CIX Sky1\n\nUpdate my email address as my work email account is no longer in use.\n\nSigned-off-by: Hans Zhang \u003c18255117159@163.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/20260508023006.1787674-1-18255117159@163.com\n" }, { "commit": "bf5421b3d8d3d9216d045af89d4f7e2f75375554", "tree": "852dfa89cabc5a64dd41279a2779d77fd8e401b2", "parents": [ "f45a49a2380a47332817b7248c61a0ebbc6f0d00" ], "author": { "name": "Marek Vasut", "email": "marek.vasut+renesas@mailbox.org", "time": "Tue Apr 28 07:19:54 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "MAINTAINERS: Update Marek Vasut email for PCIe R-Car\n\nUse up to date address. No functional change.\n\nSigned-off-by: Marek Vasut \u003cmarek.vasut+renesas@mailbox.org\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/20260428052030.51101-1-marek.vasut+renesas@mailbox.org\n" }, { "commit": "f45a49a2380a47332817b7248c61a0ebbc6f0d00", "tree": "d7ef8e4ba7f470ca0eb563c22b0e3efcd4668d75", "parents": [ "909f7bf9b080c10df3c3b38533906dbf09ff1d8b" ], "author": { "name": "Samiullah Khawaja", "email": "skhawaja@google.com", "time": "Tue May 05 23:43:27 2026 +0000" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "PCI: Initialize temporary device in new_id_store()\n\nWhen setting new_id of a PCI device driver using sysfs a lockdep splat\noccurs. This is because new_id_store() builds a temporary pci_dev for\npci_match_device(), which calls device_match_driver_override(). That\ndepends on the driver_override.lock added by cb3d1049f4ea (\"driver core:\ngeneralize driver_override in struct device\").\n\nThe new driver_override.lock was not initialized in the temporary pci_dev,\nresulting in this lockdep splat.\n\nInitialize the temporary pci_dev to fix this.\n\nRepro:\n\n Build with CONFIG_LOCKDEP\u003dy, boot with QEMU, and add a new ID:\n\n # echo \"8086 10f5\" \u003e /sys/bus/pci/drivers/e1000e/new_id\n\n INFO: trying to register non-static key.\n The code is fine but needs lockdep annotation, or maybe\n you didn\u0027t initialize this object before use?\n turning off the locking correctness validator.\n CPU: 2 UID: 0 PID: 177 Comm: liveupdate-iomm Not tainted 7.0.0+ #9 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x5d/0x80\n register_lock_class+0x77e/0x790\n lock_acquire+0xbf/0x2e0\n pci_match_device+0x24/0x180\n new_id_store+0x189/0x1d0\n kernfs_fop_write_iter+0x14f/0x210\n vfs_write+0x263/0x5e0\n ksys_write+0x79/0xf0\n do_syscall_64+0x117/0xf80\n\nFixes: 10a4206a2401 (\"PCI: use generic driver_override infrastructure\")\nFixes: 8895d3bcb8ba (\"PCI: Fail new_id for vendor/device values already built into driver\")\nSigned-off-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\n[bhelgaas: add commit log details and repro, trim backtrace]\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nReviewed-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nLink: https://patch.msgid.link/20260505234327.716630-1-skhawaja@google.com\n" }, { "commit": "909f7bf9b080c10df3c3b38533906dbf09ff1d8b", "tree": "3f03f1ea366dca8a0f4064257197f466a856896d", "parents": [ "cfcbfe5cb11650d53f7cafd7adfd556690b77114" ], "author": { "name": "Lukas Wunner", "email": "lukas@wunner.de", "time": "Wed Apr 15 17:56:06 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "PCI: Update saved_config_space upon resource assignment\n\nBernd reports passthrough failure of a Digital Devices Cine S2 V6 DVB\nadapter plugged into an ASRock X570S PG Riptide board with BIOS version\nP5.41 (09/07/2023):\n\n ddbridge 0000:05:00.0: detected Digital Devices Cine S2 V6 DVB adapter\n ddbridge 0000:05:00.0: cannot read registers\n ddbridge 0000:05:00.0: fail\n\nBIOS assigns an incorrect BAR to the DVB adapter which doesn\u0027t fit into the\nupstream bridge window. The kernel corrects the BAR assignment:\n\n pci 0000:07:00.0: BAR 0 [mem 0xfffffffffc500000-0xfffffffffc50ffff 64bit]: can\u0027t claim; no compatible bridge window\n pci 0000:07:00.0: BAR 0 [mem 0xfc500000-0xfc50ffff 64bit]: assigned\n\nCorrection of the BAR assignment happens in an x86-specific fs_initcall,\npcibios_assign_resources(), after device enumeration in a subsys_initcall.\nThis order was introduced at the behest of Linus in 2004:\n\n https://git.kernel.org/tglx/history/c/a06a30144bbc\n\nNo other architecture performs such a late BAR correction.\n\nBernd bisected the issue to commit a2f1e22390ac (\"PCI/ERR: Ensure error\nrecoverability at all times\"), but it only occurs in the absence of commit\n4d4c10f763d7 (\"PCI: Explicitly put devices into D0 when initializing\").\nThis combination exists in stable kernel v6.12.70, but not in mainline,\nhence Bernd cannot reproduce the issue with mainline.\n\nSince a2f1e22390ac, config space is saved on enumeration, prior to BAR\ncorrection. Upon passthrough, the corrected BAR is overwritten with the\nincorrect saved value by:\n\n vfio_pci_core_register_device()\n vfio_pci_set_power_state()\n pci_restore_state()\n\nBut only if the device\u0027s current_state is PCI_UNKNOWN, as it was prior to\ncommit 4d4c10f763d7. Since the commit, it is PCI_D0, which changes the\nbehavior of vfio_pci_set_power_state() to no longer restore the state\nwithout saving it first.\n\nAlexandre is reporting the same issue as Bernd, but in his case, mainline\nis affected as well. The difference is that on Alexandre\u0027s system, the\nhost kernel binds a driver to the device which is unbound prior to\npassthrough, whereas on Bernd\u0027s system no driver gets bound by the host\nkernel.\n\nUnbinding sets current_state to PCI_UNKNOWN in pci_device_remove(), so when\nvfio-pci is subsequently bound to the device, pci_restore_state() is once\nagain called without invoking pci_save_state() first.\n\nTo robustly fix the issue, always update saved_config_space upon resource\nassignment.\n\nReported-by: Bernd Schumacher \u003cbernd@bschu.de\u003e\nCloses: https://lore.kernel.org/r/acfZrlP0Ua_5D3U4@eldamar.lan/\nReported-by: Alexandre N. \u003can.tech@mailo.com\u003e\nCloses: https://lore.kernel.org/r/dd3c3358-de0f-4a56-9c81-04aceaab4058@mailo.com/\nFixes: a2f1e22390ac (\"PCI/ERR: Ensure error recoverability at all times\")\nSigned-off-by: Lukas Wunner \u003clukas@wunner.de\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Bernd Schumacher \u003cbernd@bschu.de\u003e\nTested-by: Alexandre N. \u003can.tech@mailo.com\u003e\nCc: stable@vger.kernel.org # v6.12+\nLink: https://patch.msgid.link/febc3f354e0c1f5a9f5b3ee9ffddaa44caccf651.1776268054.git.lukas@wunner.de\n" }, { "commit": "cbf457c584b5cbd0d44e8f05edaf3e189e894a68", "tree": "a66d0b53c9cb283ee90048551f53c99233c59cab", "parents": [ "8be01e1280912a84f6bcf963ceed6c9f13ba1986", "f7700a4415afb3ac1767a556094e4ef8bd440e41" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:18:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:18:13 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Fix for ublk not doing an actual issue from the task_work fallback\n path. Any request hitting that should be canceled automatically\n\n - Fix for uring_cmd prep side handling, for the block side uring_cmd\n discard handling\n\n - Fix for missing validation of the io and physical block size shifts\n\n - Fix for a use-after-free in ublk\u0027s cancel command handling\n\n* tag \u0027block-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n ublk: fix use-after-free in ublk_cancel_cmd()\n ublk: validate physical_bs_shift, io_min_shift and io_opt_shift\n block: only read from sqe on initial invocation of blkdev_uring_cmd()\n ublk: don\u0027t issue uring_cmd from fallback task work\n" }, { "commit": "8be01e1280912a84f6bcf963ceed6c9f13ba1986", "tree": "2eafcd00bc9c5ce2b4e69c9c445c238d8e9f5f73", "parents": [ "81d6f7807536a0436dfada07e9292e3702d2bed4", "45d2b37a37ab98484693533496395c610a2cab96" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:12:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:12:48 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Ensure that the absolute timeouts for both the command side and the\n waiting side honor the callers time namespace\n\n - Ensure tracked NAPI entries are cleared at unregistration time, as\n the NAPI polling loop checks the list state rather than the general\n NAPI state. This can lead to NAPI polling even after unregistration\n has been done. If unregistered, all NAPI polling should be disabled\n\n - Fix for eventfd recursive invocation handling\n\n* tag \u0027io_uring-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/wait: honour caller\u0027s time namespace for IORING_ENTER_ABS_TIMER\n io_uring/timeout: honour caller\u0027s time namespace for IORING_TIMEOUT_ABS\n io_uring/eventfd: reset deferred signal state\n io_uring/napi: clear tracked NAPI entries on unregister\n" }, { "commit": "81d6f7807536a0436dfada07e9292e3702d2bed4", "tree": "6462eef5cf421a8b468913981ee0bc398c602179", "parents": [ "8bb44576c5ec0e6b29ee048b88235f6f407b6979", "f98b48151cc502ada59d9778f0112d21f2586ca3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:24:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:24:35 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Fix for two ACL issues (security fix to validate dacloffset better\n and chmod fix)\n\n - Fix out of bounds reads (in check_wsl_eas and smb2_check_msg for\n symlinks)\n\n - Two Kerberos fixes including an important one when AES-256 encryption\n chosen\n\n - Fix open_cached_dir problem when directory leases disabled\n\n* tag \u0027v7.1-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: validate dacloffset before building DACL pointers\n smb/client: fix out-of-bounds read in smb2_compound_op()\n smb/client: fix out-of-bounds read in symlink_data()\n smb: client: Zero-pad short GSS session keys per MS-SMB2\n smb: client: Use FullSessionKey for AES-256 encryption key derivation\n smb: client: use kzalloc to zero-initialize security descriptor buffer\n cifs: abort open_cached_dir if we don\u0027t request leases\n" }, { "commit": "8bb44576c5ec0e6b29ee048b88235f6f407b6979", "tree": "db53c2e02d5ba99a5faa25f47ae7cc69a8acef04", "parents": [ "4bdbce450f4273fcda6d5c2e22df7083421332cf", "4bacec2317527ba04b7172145848f1c206999ea1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:14:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:14:51 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"There\u0027s two main series here, fixing issues that came up in the\n Microchip QSPI and Freescale i.MX drivers. Both of those could result\n in some quite noticable issues if they were encountered in production.\n We also have one minor documentation fix in the ch341 driver\"\n\n* tag \u0027spi-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: ch341: correct company name in MODULE_DESCRIPTION\n spi: microchip-core-qspi: remove some inline markings\n spi: microchip-core-qspi: don\u0027t attempt to transmit during emulated read-only dual/quad operations\n spi: microchip-core-qspi: control built-in cs manually\n spi: imx: Propagate prepare_transfer() error from spi_imx_setupxfer()\n spi: imx: Fix UAF on package-1 prepare failure in spi_imx_dma_data_prepare()\n spi: imx: Fix precedence bug in spi_imx_dma_max_wml_find()\n" }, { "commit": "4bdbce450f4273fcda6d5c2e22df7083421332cf", "tree": "8aa7248bf06f17da3faea40d0a27db8dd16e4535", "parents": [ "51d24842acb9b8d643046c71314cc3d7a846a3cf", "628497e6d925d43efb56e3ffecef0a9d217926b3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:07:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:07:59 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"A straightforward fix for an incorrect description of one of the\n regulators on the Qualcomm PMH0101\"\n\n* tag \u0027regulator-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: qcom-rpmh: Fix index for pmh0101 ldo16\n" }, { "commit": "51d24842acb9b8d643046c71314cc3d7a846a3cf", "tree": "a8dedc1edb8802a637ec69529071540902e7d508", "parents": [ "fa7431eb99245e0a283d470101e44be1d2c2aeb3", "5e28b7b94408897e41c63477aabc9e1db439bc8c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:23:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:23:06 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-08-1\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes, lots of them but all pretty small, amdgpu and xe are the\n usual but then a large amount of fixes all over.\n\n core:\n - fix race condition in handle change ioctl\n\n fb-helper:\n - fix clipping\n\n rust:\n - fix unsound initialization\n - fix GEM state cleanup\n - fix wrong ARef import\n\n ttm:\n - update GPU MM stats on pool shrinking\n\n i915:\n - Re-enable ccs modifiers on dg2\n\n nova:\n - fix mailing list\n\n xe:\n - Add NULL check for media_gt in intel_hdcp_gsc_check_status\n - Fix EAGAIN sign in pf_migration_consume\n - Fix MMIO access using PF view instead of VF view during migration\n - Exclude indirect ring state page from ADS engine state size\n\n amdgpu:\n - GFX9 fixes\n - Hawaii SMU fixes\n - SDMA4 fix\n - GART fix\n - Userq fixes\n\n amdkfd:\n - GPUVM TLB flush fix\n - Hotplug fix\n\n radeon:\n - Hawaii SMU fixes\n\n bochs:\n - fix managed cleanup\n\n bridge:\n - tda998x: fix sparse warnings on type correctness\n\n etnaviv:\n - schedule armed jobs\n\n exynos:\n - managed bridge cleanup\n\n ivpu:\n - disallow reexport of GEM buffer objects\n\n noveau:\n - revert support for GA100\n\n panel:\n - boe-tv101wum-nl16: use correct MIPI_DSI mode\n - feyjang-fy07024di26a30d: fix error reporting\n - himax-hx83102: use correct MIPI_DSI mode\n - himax-hx83121a: fix error checks\n - himax-hx83121a: select DRM_DISPLAY_DSC_HELPER\n\n qaic:\n - fix RAS message handling\n\n qxl:\n - clean up polling\n\n sti:\n - managed bridge cleanup\n\n* tag \u0027drm-fixes-2026-05-08-1\u0027 of https://gitlab.freedesktop.org/drm/kernel: (37 commits)\n drm: Set old handle to NULL before prime swap in change_handle\n drm/bochs: Drop manual put on probe error path\n drm/xe/guc: Exclude indirect ring state page from ADS engine state size\n drm/xe/pf: Fix MMIO access using PF view instead of VF view during migration\n drm/xe/pf: Fix EAGAIN sign in pf_migration_consume()\n drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()\n drm/exynos: remove bridge when component_add fails\n drm/amdgpu: nuke amdgpu_userq_fence_slab v2\n drm/amdgpu/userq: fix access to stale wptr mapping\n drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count\n drm/amdgpu: zero-initialize GART table on allocation\n drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission\n drm/radeon: add missing revision check for CI\n drm/amdgpu/pm: align Hawaii mclk workaround with radeon\n drm/amdgpu/pm: add missing revision check for CI\n drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ\n drm/amdkfd: Make all TLB-flushes heavy-weight\n drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds\n drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds\n drm/panel: feiyang-fy07024di26a30d: return display-on error\n ...\n" }, { "commit": "fa7431eb99245e0a283d470101e44be1d2c2aeb3", "tree": "8935c264a00e3fd541b3e47902cb0da453861615", "parents": [ "917719c412c48687d4a176965d1fa35320ec457c", "10161b4a791d5c4b7ea16512c1ddb133c3f8f953" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:16:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:16:07 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"Core:\n - Cache-flushing fix for non-x86 platforms\n\n AMD-Vi:\n - Security fix when SEV-SNP is enabled\n - Operator precedence fix in DTE setting\"\n\n* tag \u0027iommu-fixes-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/amd: Fix precedence order in set_dte_passthrough()\n iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86\n iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19\n iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19\n" }, { "commit": "f7700a4415afb3ac1767a556094e4ef8bd440e41", "tree": "4ced987546c335d15f5e9949eb826357d60da84e", "parents": [ "86f33ca9bea30cf011f2b1edad4593faea9c6e98" ], "author": { "name": "Ming Lei", "email": "tom.leiming@gmail.com", "time": "Fri May 08 20:37:46 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri May 08 06:44:42 2026 -0600" }, "message": "ublk: fix use-after-free in ublk_cancel_cmd()\n\nWhen ublk_reset_ch_dev() clears io-\u003ecmd via ublk_queue_reinit()\nconcurrently with ublk_cancel_cmd(), ublk_cancel_cmd() can read a\nstale pointer and pass it to io_uring_cmd_done(), causing a\nuse-after-free.\n\nFix by synchronizing the two paths with ubq-\u003ecancel_lock:\n\n- ublk_cancel_cmd(): read and clear io-\u003ecmd under cancel_lock,\n then call io_uring_cmd_done() on the saved local copy outside\n the lock.\n\n- ublk_reset_ch_dev(): hold cancel_lock across ublk_queue_reinit()\n so that io-\u003ecmd and io-\u003eflags are cleared atomically with respect\n to ublk_cancel_cmd().\n\nFixes: 216c8f5ef0f2 (\"ublk: replace monitor with cancelable uring_cmd\")\nSigned-off-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nLink: https://patch.msgid.link/20260508123746.242018-1-tom.leiming@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "5e28b7b94408897e41c63477aabc9e1db439bc8c", "tree": "5e1e537c1489485035e638cb121f562da66e53d9", "parents": [ "d8a70292c3e1759804dcc1a60e53ead86b466a3a" ], "author": { "name": "Francis, David", "email": "David.Francis@amd.com", "time": "Tue Apr 28 19:25:50 2026 +0000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 17:53:59 2026 +1000" }, "message": "drm: Set old handle to NULL before prime swap in change_handle\n\nThere was a potential race condition in change_handle. The ioctl\nbriefly had a single object with two idr entries; a concurrent\ngem_close could delete the object and remove one of the handles\nwhile leaving the other one dangling, which could subsequently\nbe dereferenced for a use-after-free.\n\nTo fix this, do the same dance that gem_close itself does.\n(f6cd7daecff5 drm: Release driver references to handle before making it available again)\nFirst idr_replace the old handle to NULL. Later, if the prime\noperations are successful, actually close it.\n\ncreate_tail required a similar dance to avoid a similar problem.\n(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())\nIt idr_allocs the new handle with NULL, then swaps in the correct\nobject later to avoid races. We don\u0027t need to do that here, since\nthe only operations that could race are drm_prime, and\nchange_handle holds the prime lock for the entire duration.\n\nv2: cleanups of error paths\n\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nCo-authored-by: Dave Airlie \u003cairlied@gmail.com\u003e\nReported-by: Puttimet Thammasaeng \u003cpwn8official@gmail.com\u003e\nTested-by: Vitaly Prosyak \u003cVitaly.Prosyak@amd.com\u003e\nCc: Simona Vetter \u003csimona@ffwll.ch\u003e\nCc: stable@vger.kernel.org\nCc: Christian Koenig \u003cChristian.Koenig@amd.com\u003e\nFixes: 53096728b8910 (\"drm: Add DRM prime interface to reassign GEM handle\")\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n" }, { "commit": "d8a70292c3e1759804dcc1a60e53ead86b466a3a", "tree": "35f23cc5a9a70e2aae3dcd4ef0397dcc9c568d68", "parents": [ "765e717dfb751f9ccebb35fdb0773f929d50cb6f", "4e02e0afa95f691dc7cc17538cdd648089a843f0" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 16:13:07 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 17:50:12 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.1-2026-05-06\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.1-2026-05-06:\n\namdgpu:\n- GFX9 fixes\n- Hawaii SMU fixes\n- SDMA4 fix\n- GART fix\n- Userq fixes\n\namdkfd:\n- GPUVM TLB flush fix\n- Hotplug fix\n\nradeon:\n- Hawaii SMU fixes\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260506154631.1733034-1-alexander.deucher@amd.com\n" }, { "commit": "765e717dfb751f9ccebb35fdb0773f929d50cb6f", "tree": "c9b9116ba4c9a7a4f0857d13ed0f5078b0e38962", "parents": [ "22e170e9a37ea2155bdf0bb743483f2d455160ba", "b15838b03cd0c6cf35651cfde62d17f14bb1d566" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 12:03:01 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 12:11:16 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-07\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\nbochs:\n- fix managed cleanup\n\nbridge:\n- tda998x: fix sparse warnings on type correctness\n\netnaviv:\n- schedule armed jobs\n\nexynos:\n- managed bridge cleanup\n\nfb-helper:\n- fix clipping\n\nivpu:\n- disallow reexport of GEM buffer objects\n\nnoveau:\n- revert support for GA100\n\npanel:\n- boe-tv101wum-nl16: use correct MIPI_DSI mode\n- feyjang-fy07024di26a30d: fix error reporting\n- himax-hx83102: use correct MIPI_DSI mode\n- himax-hx83121a: fix error checks\n- himax-hx83121a: select DRM_DISPLAY_DSC_HELPER\n\nqaic:\n- fix RAS message handling\n\nqxl:\n- clean up polling\n\nsti:\n- managed bridge cleanup\n\nttm:\n- update GPU MM stats on pool shrinking\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260507115213.GA206508@linux.fritz.box\n" }, { "commit": "917719c412c48687d4a176965d1fa35320ec457c", "tree": "183392dde41e467c737e8162f67fcc357c732797", "parents": [ "fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0", "868f31e4061eca8c3cd607d79d954d5e54f204aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 17:26:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 17:26:43 2026 -0700" }, "message": "Merge tag \u0027selinux-pr-20260507\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fixes from Paul Moore:\n\n - Allow for multiple opens of /sys/fs/selinux/policy\n\n Prevent a single process from blocking others from reading the\n SELinux policy loaded in the kernel. This does have the side effect\n of potentially allowing userspace to trigger additional kernel memory\n allocations as part of the open/read operation, but this is mitigated\n by requiring the SELinux security/read_policy permission.\n\n - Reduce the critical sections where the SELinux policy mutex is held\n\n This includes the patch to the policy loader code where we move the\n permission checks and an allocation outside the mutex as well as the\n the patch to checkreqprot which drops the code/lock entirely.\n\n While the checkreqprot code had effectively been dropped in an\n earlier release, portions of the code still remained that would have\n triggered the mutex to perform an IMA measurement. This finally drops\n all of that while preserving the user visible behavior.\n\n - Eliminate potential sources of log spamming\n\n There were a few areas where processes could flood the system logs\n and hide other, more critical events. The previously disabled\n checkreqprot and runtime disable knobs in selinuxfs were two such\n areas that have now been greatly simplified and a pr_err() replaced\n with a pr_err_once().\n\n The third such place is the /sys/fs/selinux/user file, which hasn\u0027t\n been used by a userspace release since 2020 and was scheduled for\n removal after 2025; this effectively disables this functionality, but\n similar to checkreqprot, it is done in a way that should not break\n old userspace.\n\n* tag \u0027selinux-pr-20260507\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n selinux: shrink critical section in sel_write_load()\n selinux: allow multiple opens of /sys/fs/selinux/policy\n selinux: prune /sys/fs/selinux/user\n selinux: prune /sys/fs/selinux/disable\n selinux: prune /sys/fs/selinux/checkreqprot\n" }, { "commit": "22e170e9a37ea2155bdf0bb743483f2d455160ba", "tree": "a95590b703d859bade99591b2104fb3a40b6e7f0", "parents": [ "17dd4d44e99046a6e1676be8cef13ce85adc0750", "b29987dfd943e655df6e3b641ecffad5cc1509c2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:51:01 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:51:02 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-07\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nUAPI Changes:\n\nCross-subsystem Changes:\n\nCore Changes:\n\nDriver Changes:\n- Add NULL check for media_gt in intel_hdcp_gsc_check_status (Gustavo)\n- Fix EAGAIN sign in pf_migration_consume (Shuicheng)\n- Fix MMIO access using PF view instead of VF view during migration (Shuicheng)\n- Exclude indirect ring state page from ADS engine state size (Satya)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/afw5lsrjE4pStEml@gsse-cloud1.jf.intel.com\n" }, { "commit": "17dd4d44e99046a6e1676be8cef13ce85adc0750", "tree": "fafe4588548c9f61d12165da34842a71198862f7", "parents": [ "2c5d5ecda5f165c0c064f24b736d585db10098c6", "0a69ac25bd596d50823d530d0a2004336668c0df" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:34:34 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:50:23 2026 +1000" }, "message": "Merge tag \u0027drm-rust-fixes-2026-05-07\u0027 of https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes\n\nDRM Rust fixes for v7.1-rc3\n\n- Fix unsound initialization in drm::Device::new(); if pinned\n initialization of drm::Device::Data fails, make sure\n drm::Device::release() isn\u0027t called, so we don\u0027t run the data\u0027s\n destructor\n\n- Fix missing GEM state cleanup in the init failure case; call\n drm_gem_private_object_fini() if drm_gem_object_init() fails\n\n- Fix wrong ARef import in the DRM shmem GEM helper abstraction\n\n- Replace the nouveau mailing list with the new nova-gpu mailing list\n for both nova-core and nova-drm, and remove unused patchwork entries\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: \"Danilo Krummrich\" \u003cdakr@kernel.org\u003e\nLink: https://patch.msgid.link/DIBZJ40ZC4J3.Y1DLA7JTS2PC@kernel.org\n" }, { "commit": "2c5d5ecda5f165c0c064f24b736d585db10098c6", "tree": "4ce12fdc938bf8f2771837ccee7fe2ea5624e380", "parents": [ "7fd2df204f342fc17d1a0bfcd474b24232fb0f32", "aab3d205a086233c612fee86009265451793e0c2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:21:32 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:21:34 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-05-06\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Re-enable ccs modifiers on dg2 (Juha-Pekka Heikkila)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/aftSjG1D0-hKISDy@linux\n" }, { "commit": "f98b48151cc502ada59d9778f0112d21f2586ca3", "tree": "0008181319aa30c98bbe66095384e015e6affdc3", "parents": [ "8d09328dfda089675e4c049f3f256064a1d1996b" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Mon Apr 20 10:47:47 2026 -0400" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:36 2026 -0500" }, "message": "smb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points.\n\nFixes: bc3e9dd9d104 (\"cifs: Change SIDs in ACEs while transferring file ownership.\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4-6\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "8d09328dfda089675e4c049f3f256064a1d1996b", "tree": "8a2aa8a93ead70129a9c2bc7997c09f04b410b1a", "parents": [ "d62b8d236fab503c6fec1d3e9a38bea71feaca20" ], "author": { "name": "Zisen Ye", "email": "zisenye@stu.xidian.edu.cn", "time": "Wed May 06 11:49:08 2026 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:32 2026 -0500" }, "message": "smb/client: fix out-of-bounds read in smb2_compound_op()\n\nIf a server sends a truncated response but a large OutputBufferLength, and\nterminates the EA list early, check_wsl_eas() returns success without\nvalidating that the entire OutputBufferLength fits within iov_len.\n\nThen smb2_compound_op() does:\n memcpy(idata-\u003ewsl.eas, data[0], size[0]);\n\nWhere size[0] is OutputBufferLength. If iov_len is smaller than size[0],\nmemcpy can read beyond the end of the rsp_iov allocation and leak adjacent\nkernel heap memory.\n\nLink: https://lore.kernel.org/linux-cifs/d998240c-aca9-420d-9dbd-f5ba24af19e0@chenxiaosong.com/\nFixes: ea41367b2a60 (\"smb: client: introduce SMB2_OP_QUERY_WSL_EA\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zisen Ye \u003czisenye@stu.xidian.edu.cn\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "d62b8d236fab503c6fec1d3e9a38bea71feaca20", "tree": "fe51b8cdc8236c5f66fbf7b63bec9d9b8ae516a8", "parents": [ "8cb6fc3231500233ddaf63cb7fd5435008d9ed5f" ], "author": { "name": "Zisen Ye", "email": "zisenye@stu.xidian.edu.cn", "time": "Sat May 02 18:48:36 2026 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:29 2026 -0500" }, "message": "smb/client: fix out-of-bounds read in symlink_data()\n\nSince smb2_check_message() returns success without length validation for\nthe symlink error response, in symlink_data() it is possible for\niov-\u003eiov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\nonly contains the base SMB2 header (64 bytes), accessing\nerr-\u003eErrorContextCount (at offset 66) or err-\u003eByteCount later in\nsymlink_data() will cause an out-of-bounds read.\n\nLink: https://lore.kernel.org/linux-cifs/297d8d9b-adf7-42fd-a1c2-5b1f230032bc@chenxiaosong.com/\nFixes: 76894f3e2f71 (\"cifs: improve symlink handling for smb2+\")\nCc: Stable@vger.kernel.org\nSigned-off-by: Zisen Ye \u003czisenye@stu.xidian.edu.cn\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "8cb6fc3231500233ddaf63cb7fd5435008d9ed5f", "tree": "53976d5eb90f610ccb312028b1e5298766728997", "parents": [ "5be7a0cef3229fb3b63a07c0d289daf752545424" ], "author": { "name": "Piyush Sachdeva", "email": "s.piyush1024@gmail.com", "time": "Thu May 07 22:22:14 2026 +0530" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:01 2026 -0500" }, "message": "smb: client: Zero-pad short GSS session keys per MS-SMB2\n\nPer MS-SMB2 section 3.2.5.3, Session.SessionKey is the first 16 bytes\nof the GSS cryptographic key, right-padded with zero bytes if the key\nis shorter than 16 bytes.\n\nSMB2_auth_kerberos() copies the GSS session key from the cifs.upcall\nresponse using kmemdup(msg-\u003edata, msg-\u003esesskey_len, ...) and stores\nthe GSS-reported length verbatim in ses-\u003eauth_key.len. generate_key()\nreads SMB2_NTLMV2_SESSKEY_SIZE bytes from this buffer when feeding the\nHMAC-SHA256 KDF for signing key derivation. If a GSS mechanism returns\na session key shorter than 16 bytes (e.g. a deprecated single-DES\nKerberos enctype with an 8-byte session key), the KDF call performs an\nout-of-bounds slab read and derives keys that do not match the server,\nwhich pads per the spec.\n\nModern KDCs disable short-key enctypes by default, so this is latent\nrather than reachable in production, but it is still a kernel heap\nover-read.\n\nAllocate auth_key.response with kzalloc() at a length of\nmax(msg-\u003esesskey_len, SMB2_NTLMV2_SESSKEY_SIZE), copy the GSS key in,\nand rely on kzalloc()\u0027s zero initialization for the spec-mandated\npadding. Set ses-\u003eauth_key.len to the padded length. Larger GSS keys\n(e.g. the 32-byte aes256-cts-hmac-sha1-96 session key) continue to be\nstored at their natural length, preserving the FullSessionKey path.\n\nEmit a cifs_dbg(VFS, ...) message when a short key is encountered to\nsurface deprecated-enctype usage.\n\nNTLMv2 and NTLMSSP code paths produce a 16-byte session key by\nconstruction and are unaffected.\n\nSigned-off-by: Piyush Sachdeva \u003cpsachdeva@microsoft.com\u003e\nSigned-off-by: Piyush Sachdeva \u003cs.piyush1024@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "5be7a0cef3229fb3b63a07c0d289daf752545424", "tree": "8c90ee860cc7230f345595463c831f9ebd3c4131", "parents": [ "5e489c6c47a2ac15edbaca153b9348e42c1eacab" ], "author": { "name": "Piyush Sachdeva", "email": "s.piyush1024@gmail.com", "time": "Thu May 07 22:22:13 2026 +0530" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:01 2026 -0500" }, "message": "smb: client: Use FullSessionKey for AES-256 encryption key derivation\n\nWhen Kerberos authentication is used with AES-256 encryption (AES-256-CCM\nor AES-256-GCM), the SMB3 encryption and decryption keys must be derived\nusing the full session key (Session.FullSessionKey) rather than just the\nfirst 16 bytes (Session.SessionKey).\n\nPer MS-SMB2 section 3.2.5.3.1, when Connection.Dialect is \"3.1.1\" and\nConnection.CipherId is AES-256-CCM or AES-256-GCM, Session.FullSessionKey\nmust be set to the full cryptographic key from the GSS authentication\ncontext. The encryption and decryption key derivation (SMBC2SCipherKey,\nSMBS2CCipherKey) must use this FullSessionKey as the KDF input. The\nsigning key derivation continues to use Session.SessionKey (first 16\nbytes) in all cases.\n\nPreviously, generate_key() hardcoded SMB2_NTLMV2_SESSKEY_SIZE (16) as the\nHMAC-SHA256 key input length for all derivations. When Kerberos with\nAES-256 provides a 32-byte session key, the KDF for encryption/decryption\nwas using only the first 16 bytes, producing keys that did not match the\nserver\u0027s, causing mount failures with sec\u003dkrb5 and require_gcm_256\u003d1.\n\nAdd a full_key_size parameter to generate_key() and pass the appropriate\nsize from generate_smb3signingkey():\n - Signing: always SMB2_NTLMV2_SESSKEY_SIZE (16 bytes)\n - Encryption/Decryption: ses-\u003eauth_key.len when AES-256, otherwise 16\n\nAlso fix cifs_dump_full_key() to report the actual session key length for\nAES-256 instead of hardcoded CIFS_SESS_KEY_SIZE, so that userspace tools\nlike Wireshark receive the correct key for decryption.\n\nCc: \u003cstable@vger.kernel.org\u003e\nReviewed-by: Bharath SM \u003cbharathsm@microsoft.com\u003e\nSigned-off-by: Piyush Sachdeva \u003cpsachdeva@microsoft.com\u003e\nSigned-off-by: Piyush Sachdeva \u003cs.piyush1024@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0", "tree": "fc6254372916832b89cb60f94464d41a48b2f045", "parents": [ "19cbc75c56c0ed4fa3f637e3c41a98895a68dfae", "41ae14071cd7f6a7770e2fe1f8a0859d4c2c6ba4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 10:32:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 10:32:03 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Netfilter, IPsec, Bluetooth and WiFi.\n\n Current release - fix to a fix:\n\n - ipmr: add __rcu to netns_ipv4.mrt, make sure we hold the RCU lock\n in all relevant places\n\n Current release - new code bugs:\n\n - fixes for the recently added resizable hash tables\n\n - ipv6: make sure we default IPv6 tunnel drivers to \u003dm now that IPv6\n itself is built in\n\n - drv: octeontx2-af: fixes for parser/CAM fixes\n\n Previous releases - regressions:\n\n - phy: micrel: fix LAN8814 QSGMII soft reset\n\n - wifi:\n - cw1200: revert \"Fix locking in error paths\"\n - ath12k: fix crash on WCN7850, due to adding the same queue\n buffer to a list multiple times\n\n Previous releases - always broken:\n\n - number of info leak fixes\n\n - ipv6: implement limits on extension header parsing\n\n - wifi: number of fixes for missing bound checks in the drivers\n\n - Bluetooth: fixes for races and locking issues\n\n - af_unix:\n - fix an issue between garbage collection and PEEK\n - fix yet another issue with OOB data\n\n - xfrm: esp: avoid in-place decrypt on shared skb frags\n\n - netfilter: replace skb_try_make_writable() by skb_ensure_writable()\n\n - openvswitch: vport: fix race between tunnel creation and linking\n leading to invalid memory accesses (type confusion)\n\n - drv: amd-xgbe: fix PTP addend overflow causing frozen clock\n\n Misc:\n\n - sched/isolation: make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN\n (for relevant IPVS change)\"\n\n* tag \u0027net-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (190 commits)\n net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init()\n net: sparx5: fix wrong chip ids for TSN SKUs\n net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel()\n tcp: Fix dst leak in tcp_v6_connect().\n ipmr: Call ipmr_fib_lookup() under RCU.\n net: phy: broadcom: Save PHY counters during suspend\n net/smc: fix missing sk_err when TCP handshake fails\n af_unix: Reject SIOCATMARK on non-stream sockets\n veth: fix OOB txq access in veth_poll() with asymmetric queue counts\n eth: fbnic: fix double-free of PCS on phylink creation failure\n net: ethernet: cortina: Drop half-assembled SKB\n selftests: mptcp: pm: restrict \u0027unknown\u0027 check to pm_nl_ctl\n selftests: mptcp: check output: catch cmd errors\n mptcp: pm: prio: skip closed subflows\n mptcp: pm: ADD_ADDR rtx: return early if no retrans\n mptcp: pm: ADD_ADDR rtx: skip inactive subflows\n mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker\n mptcp: pm: ADD_ADDR rtx: free sk if last\n mptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n mptcp: pm: ADD_ADDR rtx: fix potential data-race\n ...\n" }, { "commit": "41ae14071cd7f6a7770e2fe1f8a0859d4c2c6ba4", "tree": "baf3da55b33fee0456b680154bd3a952c6d450f3", "parents": [ "b131dc93f7bf1b1461f5bde0c06c4c2384aa5b58" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed May 06 09:25:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 09:08:47 2026 -0700" }, "message": "net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init()\n\nsparx5_port_init() only invokes sparx5_serdes_set() and the associated\nshadow-device enable and low-speed device switch for SGMII and QSGMII.\nOn any port with a high-speed primary device (DEV5G/DEV10G/DEV25G)\nconfigured for 1000BASE-X the serdes is therefore left uninitialized,\nthe DEV2G5 shadow is never enabled, and the port stays pointed at its\nhigh-speed device rather than the DEV2G5. The PCS1G block looks\nhealthy in isolation, but no frames reach the link partner.\n\nAdd 1000BASE-X to the check so the same three steps run.\n\nNote: the same issue might apply to 2500BASE-X, but that will,\neventually, be addressed in a separate commit.\n\nReported-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nFixes: 946e7fd5053a (\"net: sparx5: add port module support\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260506-misc-fixes-sparx5-lan969x-v2-4-fb236aa96908@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b131dc93f7bf1b1461f5bde0c06c4c2384aa5b58", "tree": "64c5ef73c89dbb589355cd1cdcba3e6a4e9cc40e", "parents": [ "dedf6c90386d99b878763c183a08b61d3ce4824e" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed May 06 09:25:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 09:08:46 2026 -0700" }, "message": "net: sparx5: fix wrong chip ids for TSN SKUs\n\nThe TSN SKUs in enum spx5_target_chiptype have incorrect IDs:\n\n SPX5_TARGET_CT_7546TSN \u003d 0x47546,\n SPX5_TARGET_CT_7549TSN \u003d 0x47549,\n SPX5_TARGET_CT_7552TSN \u003d 0x47552,\n SPX5_TARGET_CT_7556TSN \u003d 0x47556,\n SPX5_TARGET_CT_7558TSN \u003d 0x47558,\n\nThe value read back from the chip is GCB_CHIP_ID_PART_ID, which is a\nGENMASK(27, 12) field, i.e. at most 16 bits wide. It can never match\nthese IDs, so probing a TSN part fails with a \"Target not supported\"\nerror.\n\nFix the enum to use the actual 16-bit part IDs returned by the\nhardware: 0x0546, 0x0549, 0x0552, 0x0556 and 0x0558.\n\nReported-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nFixes: 3cfa11bac9bb (\"net: sparx5: add the basic sparx5 driver\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260506-misc-fixes-sparx5-lan969x-v2-3-fb236aa96908@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19cbc75c56c0ed4fa3f637e3c41a98895a68dfae", "tree": "5dbb8e9287d0494e4fb67bbd636fc259a91c1dfa", "parents": [ "1e38f888f9f070591e54c690e78f2ff8affa8881", "06bc7ff0a1e0f2b0102e1314e3527a7ec0997851" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:55:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:55:15 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Again a collection of small fixes, mostly for device-specific ones.\n\n The only big LOC is about the removal of pretty old dead code in\n ab8500 codec driver, while the rest all nice small changes.\n\n Core / API:\n - Fix race in deferred fasync state checks\n - Fix UMP group filtering in sequencer\n\n ASoC:\n - cs35l56: fixes for driver cleanup and error paths\n - tas2764/2770: workaround for bogus temperature readings\n - wm_adsp: fixes for firmware unit tests\n - amd-yc: more DMI quirks for laptops\n - Minor fixes for fsl_xcvr and spacemit\n\n HD-Audio:\n - Mute LED and speaker quirks for HP, Lenovo, and Xiaomi laptops\n\n USB-audio:\n - New device-specific quirks (Motu, JBL, AlphaTheta, Razer)\n - Fix of MIDI2 playback on resume\n\n Others:\n - Firewire-tascam control event fix\n - Minor cleanups and fixes for sparc/dbri and pcmtest\"\n\n* tag \u0027sound-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (28 commits)\n ASoC: cs35l56: Destroy workqueue in probe error path\n ASoC: cs35l56: Don\u0027t use devres to unregister component\n ALSA: sparc/dbri: add missing fallthrough\n ALSA: core: Serialize deferred fasync state checks\n ALSA: hda/realtek: Add mute LED fixup for HP Pavilion 15-cs1xxx\n ALSA: seq: Fix UMP group 16 filtering\n ASoC: wm_adsp_fw_find_test: Clear searched_fw_files in find-by-index test\n ASoC: wm_adsp_fw_find_test: Redirect wm_adsp_release_firmware_files()\n ASoC: tas2770: Deal with bogus initial temperature value\n ASoC: tas2764: Deal with bogus initial temperature register value\n ALSA: usb-audio: add clock quirk for Motu 1248\n ALSA: usb-audio: midi2: Restart output URBs on resume\n ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx\n ALSA: usb-audio: Add quirk flags for JBL Pebbles\n ALSA: firewire-tascam: Do not drop unread control events\n ALSA: usb-audio: Add quirk flags for AlphaTheta EUPHONIA\n ASoC: fsl_xcvr: Fix event generation for cached controls\n ASoC: sdw_utils: avoid the SDCA companion function not supported failure\n ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table\n ASoC: cs35l56: Fix out-of-bounds in dev_err() in cs35l56_read_onchip_spkid()\n ...\n" }, { "commit": "1e38f888f9f070591e54c690e78f2ff8affa8881", "tree": "4245c06c44aa6772b5d10008607d7c4177d35064", "parents": [ "b3737eac0a0f70b2a6b6a872213f0f235624e487", "863810d4985ad214f70c1623f24384ccc850f2a2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:46:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:46:27 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - Silence unknown board warning for 8D41 (hp-wmi)\n\n - Fix uninitialized variable in fan RPM handling (lenovo/wmi-other)\n\n - Check min_size also when ACPI does not return an out object (wmi)\n\n* tag \u0027platform-drivers-x86-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: lenovo: wmi-other: Fix uninitialized variable in lwmi_om_hwmon_write()\n platform/x86: hp-wmi: silence unknown board warning for 8D41\n platform/wmi: Fix unchecked min_size in wmidev_invoke_method()\n" }, { "commit": "b3737eac0a0f70b2a6b6a872213f0f235624e487", "tree": "95b2e7c3b82566b33cd3bfab80ec9dcc5470a977", "parents": [ "8ab992f815d6736b5c7a6f5fd7bfe7bc106bb3dc", "ec1fcddb3117d9452210e838fd37389ee61e10e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:43:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:43:25 2026 -0700" }, "message": "Merge tag \u0027pmdomain-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - Fix detach procedure for virtual devices in genpd\n\n - mediatek: Fix use-after-free in scpsys_get_bus_protection_legacy()\n\n* tag \u0027pmdomain-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()\n pmdomain: core: Fix detach procedure for virtual devices in genpd\n" }, { "commit": "dedf6c90386d99b878763c183a08b61d3ce4824e", "tree": "e8b26e8dc2337596a4b3d4d6b06890bda83cba06", "parents": [ "ecddc523cfdb85b3e132f13e293224ebfdfab564" ], "author": { "name": "Joey Lu", "email": "a0987203069@gmail.com", "time": "Wed May 06 16:46:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:41:30 2026 -0700" }, "message": "net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel()\n\npriv-\u003edev was never initialized after devm_kzalloc() allocates the\nprivate data structure. When nvt_set_phy_intf_sel() is later invoked\nvia the phylink interface_select callback, it calls\nnvt_gmac_get_delay(priv-\u003edev, ...) which dereferences the NULL pointer.\n\nFix this by assigning priv-\u003edev \u003d dev immediately after allocation.\n\nFixes: 4d7c557f58ef (\"net: stmmac: dwmac-nuvoton: Add dwmac glue for Nuvoton MA35 family\")\nSigned-off-by: Joey Lu \u003ca0987203069@gmail.com\u003e\nLink: https://patch.msgid.link/20260506084614.192894-2-a0987203069@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ecddc523cfdb85b3e132f13e293224ebfdfab564", "tree": "c53ebfe64284fc4e9e5249f6a82c38ed76005901", "parents": [ "019c892e46544af0ae94ec833f79aa903c837666" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed May 06 07:04:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:39:15 2026 -0700" }, "message": "tcp: Fix dst leak in tcp_v6_connect().\n\nIf a socket is bound to a wildcard address, tcp_v[46]_connect()\nupdates it with a non-wildcard address based on the route lookup.\n\nAfter bhash2 was introduced in the cited commit, we must call\ninet_bhash2_update_saddr() to update the bhash2 entry as well.\n\nIf inet_bhash2_update_saddr() fails, we must release the refcount\nfor dst by ip_route_connect() or ip6_dst_lookup_flow().\n\nWhile tcp_v4_connect() calls ip_rt_put() in the error path,\ntcp_v6_connect() does not call dst_release().\n\nLet\u0027s call dst_release() when inet_bhash2_update_saddr() fails\nin tcp_v6_connect().\n\nFixes: 28044fc1d495 (\"net: Add a bhash2 table hashed by port and address\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260506070443.1699879-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "019c892e46544af0ae94ec833f79aa903c837666", "tree": "5c997721e6c4594f0614677e21225fb3e11c9f35", "parents": [ "32cd651d14fc72a93703ea2384cb5cd8998523a8" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed May 06 06:59:53 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:38:37 2026 -0700" }, "message": "ipmr: Call ipmr_fib_lookup() under RCU.\n\nYi Lai reported RCU splat in reg_vif_xmit() below. [0]\n\nWhen CONFIG_IP_MROUTE_MULTIPLE_TABLES\u003dn, ipmr_fib_lookup()\nuses rcu_dereference() without explicit rcu_read_lock().\n\nAlthough rcu_read_lock_bh() is already held by the caller\n__dev_queue_xmit(), lockdep requires explicit rcu_read_lock()\nfor rcu_dereference().\n\nLet\u0027s move up rcu_read_lock() in reg_vif_xmit() to\ncover ipmr_fib_lookup().\n\n[0]:\nWARNING: suspicious RCU usage\n7.1.0-rc2-next-20260504-9d0d467c3572 #1 Not tainted\n -----------------------------\nnet/ipv4/ipmr.c:329 suspicious rcu_dereference_check() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active \u003d 2, debug_locks \u003d 1\n2 locks held by syz.2.17/1779:\n #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]\n #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]\n #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x239/0x4140 net/core/dev.c:4792\n #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]\n #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4795 [inline]\n #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: __dev_queue_xmit+0x1d5d/0x4140 net/core/dev.c:4865\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 1779 Comm: syz.2.17 Not tainted 7.1.0-rc2-next-20260504-9d0d467c3572 #1 PREEMPT(lazy)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x121/0x150 lib/dump_stack.c:120\n dump_stack+0x19/0x20 lib/dump_stack.c:129\n lockdep_rcu_suspicious+0x15b/0x1f0 kernel/locking/lockdep.c:6878\n ipmr_fib_lookup net/ipv4/ipmr.c:329 [inline]\n reg_vif_xmit+0x2ee/0x3c0 net/ipv4/ipmr.c:540\n __netdev_start_xmit include/linux/netdevice.h:5382 [inline]\n netdev_start_xmit include/linux/netdevice.h:5391 [inline]\n xmit_one net/core/dev.c:3889 [inline]\n dev_hard_start_xmit+0x170/0x700 net/core/dev.c:3905\n __dev_queue_xmit+0x1df1/0x4140 net/core/dev.c:4871\n dev_queue_xmit include/linux/netdevice.h:3423 [inline]\n packet_xmit+0x252/0x370 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3082 [inline]\n packet_sendmsg+0x39ad/0x5650 net/packet/af_packet.c:3114\n sock_sendmsg_nosec net/socket.c:797 [inline]\n __sock_sendmsg net/socket.c:812 [inline]\n ____sys_sendmsg+0xa21/0xba0 net/socket.c:2716\n ___sys_sendmsg+0x121/0x1c0 net/socket.c:2770\n __sys_sendmsg+0x177/0x220 net/socket.c:2802\n __do_sys_sendmsg net/socket.c:2807 [inline]\n __se_sys_sendmsg net/socket.c:2805 [inline]\n __x64_sys_sendmsg+0x80/0xc0 net/socket.c:2805\n x64_sys_call+0x1d9c/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc1/0x1020 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f37e563ee5d\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48\nRSP: 002b:00007ffe5caa7fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00000000005c5fa0 RCX: 00007f37e563ee5d\nRDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004\nRBP: 00000000005c5fa0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00000000005c5fac R15: 00000000005c5fa0\n \u003c/TASK\u003e\n\nFixes: b3b6babf4751 (\"ipmr: Free mr_table after RCU grace period.\")\nReported-by: syzkaller \u003csyzkaller@googlegroups.com\u003e\nReported-by: Yi Lai \u003cyi1.lai@intel.com\u003e\nCloses: https://lore.kernel.org/netdev/afrY34dLXNUboevf@ly-workstation/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260506065955.1695753-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "32cd651d14fc72a93703ea2384cb5cd8998523a8", "tree": "041c5e83ffbe44bf298d0907759f2b33d7653fbe", "parents": [ "9032f7676935a13fd402608223d326c5f62da9c0" ], "author": { "name": "Justin Chen", "email": "justin.chen@broadcom.com", "time": "Tue May 05 10:39:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:36:47 2026 -0700" }, "message": "net: phy: broadcom: Save PHY counters during suspend\n\nThe PHY counters can be lost if the PHY is reset during suspend. We\nneed to save the values into the shadow counters or the accounting\nwill be incorrect over multiple suspend and resume cycles.\n\nFixes: 820ee17b8d3b (\"net: phy: broadcom: Add support code for reading PHY counters\")\nSigned-off-by: Justin Chen \u003cjustin.chen@broadcom.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260505173926.2870069-1-justin.chen@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9032f7676935a13fd402608223d326c5f62da9c0", "tree": "f77ab2af6c01765f231cd8402fdbf19b6f79a2bc", "parents": [ "d119775f2bad827edc28071c061fdd4a91f889a5" ], "author": { "name": "D. Wythe", "email": "alibuda@linux.alibaba.com", "time": "Wed May 06 09:41:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:36:34 2026 -0700" }, "message": "net/smc: fix missing sk_err when TCP handshake fails\n\nIn smc_connect_work(), when the underlying TCP handshake fails, the error\ncode (rc) must be propagated to sk_err to ensure userspace can correctly\nretrieve the error status via SO_ERROR. Currently, the code only handles\na restricted set of error codes (e.g., EPIPE, ECONNREFUSED). If other\nerrors occurs, such as EHOSTUNREACH, sk_err remains unset (zero).\n\nThis affects applications that rely on SO_ERROR to determine connect\noutcome. For example, higher versions of Go\u0027s netpoller treats\nSO_ERROR \u003d\u003d 0 combined with a failed getpeername() as a spurious wakeup\nand re-enters epoll_wait(). Under ET mode, no further edge will be\ngenerated since the socket is already in a terminal state, causing the\nconnect to hang indefinitely or until a user-specified timeout, if one\nis set.\n\nFixes: 50717a37db03 (\"net/smc: nonblocking connect rework\")\nSigned-off-by: D. Wythe \u003calibuda@linux.alibaba.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260506014105.27093-1-alibuda@linux.alibaba.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d119775f2bad827edc28071c061fdd4a91f889a5", "tree": "a8307d50171cc273deb9c6c7afa514c15aab5b32", "parents": [ "08f566e8f83bb70f04ad5aba5be352c490a01c8a" ], "author": { "name": "Jiexun Wang", "email": "wangjiexun2025@gmail.com", "time": "Wed May 06 22:08:23 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:36:02 2026 -0700" }, "message": "af_unix: Reject SIOCATMARK on non-stream sockets\n\nSIOCATMARK reports whether the receive queue is at the urgent mark for\nMSG_OOB.\n\nIn AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets.\nSOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(),\nso they should not support SIOCATMARK either.\n\nReturn -EOPNOTSUPP for non-stream sockets before checking the receive\nqueue.\n\nFixes: 314001f0bf92 (\"af_unix: Add OOB support\")\nCc: stable@kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSuggested-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Jiexun Wang \u003cwangjiexun2025@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260506140825.2987635-1-n05ec@lzu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "08f566e8f83bb70f04ad5aba5be352c490a01c8a", "tree": "675eeeb44f57a5c54254b4f8550b9872906bb99a", "parents": [ "593dfd40a94ca0ab20297ea4629d94268deed0ed" ], "author": { "name": "Jesper Dangaard Brouer", "email": "hawk@kernel.org", "time": "Tue May 05 15:21:53 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 07 16:24:07 2026 +0200" }, "message": "veth: fix OOB txq access in veth_poll() with asymmetric queue counts\n\nXDP redirect into a veth device (via bpf_redirect()) calls\nveth_xdp_xmit(), which enqueues frames into the peer\u0027s ptr_ring using\n smp_processor_id() % peer-\u003ereal_num_rx_queues\nas the ring index. With an asymmetric veth pair where the peer has\nfewer TX queues than RX queues, that index can exceed\npeer-\u003ereal_num_tx_queues.\n\nveth_poll() then resolves peer_txq for the ring via:\n\n peer_txq \u003d peer_dev ? netdev_get_tx_queue(peer_dev, queue_idx) : NULL;\n\nwhere queue_idx \u003d rq-\u003exdp_rxq.queue_index. When queue_idx exceeds\npeer_dev-\u003ereal_num_tx_queues this is an out-of-bounds (OOB) access\ninto the peer\u0027s netdev_queue array, triggering DEBUG_NET_WARN_ON_ONCE\nin netdev_get_tx_queue().\n\nThe normal ndo_start_xmit path is not affected: the stack clamps\nskb-\u003equeue_mapping via netdev_cap_txqueue() before invoking\nndo_start_xmit, so rxq in veth_xmit() never exceeds real_num_tx_queues.\n\nFix veth_poll() by clamping: only dereference peer_txq when queue_idx is\nwithin bounds, otherwise set it to NULL. The out-of-range rings are fed\nexclusively via XDP redirect (veth_xdp_xmit), never via ndo_start_xmit\n(veth_xmit), so the peer txq was never stopped and there is nothing to\nwake; NULL is the correct fallback.\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260502071828.616C3C19425@smtp.kernel.org/\nFixes: dc82a33297fc (\"veth: apply qdisc backpressure on full ptr_ring to reduce TX drops\")\nSigned-off-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nLink: https://patch.msgid.link/20260505132159.241305-2-hawk@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "593dfd40a94ca0ab20297ea4629d94268deed0ed", "tree": "43fe426f1d05fcdbec0353de83d9c24059304755", "parents": [ "b266bacba796ff5c4dcd2ae2fc08aacf7ab39153" ], "author": { "name": "Bobby Eshleman", "email": "bobbyeshleman@meta.com", "time": "Mon May 04 18:42:11 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 07 12:34:42 2026 +0200" }, "message": "eth: fbnic: fix double-free of PCS on phylink creation failure\n\nfbnic_phylink_create() stores the newly allocated PCS in fbn-\u003epcs and\nthen calls phylink_create(). When phylink_create() fails, the error path\ncorrectly destroys the PCS via xpcs_destroy_pcs(), but the caller,\nfbnic_netdev_alloc(), responds by invoking fbnic_netdev_free() which\ncalls fbnic_phylink_destroy(). That function finds fbn-\u003epcs non-NULL and\ncalls xpcs_destroy_pcs() a second time on the already-freed object,\ntriggering a refcount underflow use-after-free:\n\n[ 1.934973] fbnic 0000:01:00.0: Failed to create Phylink interface, err: -22\n[ 1.935103] ------------[ cut here ]------------\n[ 1.935179] refcount_t: underflow; use-after-free.\n[ 1.935252] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90, CPU#0: swapper/0/1\n[ 1.935389] Modules linked in:\n[ 1.935484] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-virtme-04244-g1f5ffc672165-dirty #1 PREEMPT(lazy)\n[ 1.935661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 1.935826] RIP: 0010:refcount_warn_saturate+0x59/0x90\n[ 1.935931] Code: 44 48 8d 3d 49 f9 a7 01 67 48 0f b9 3a e9 bf 1e 96 00 48 8d 3d 48 f9 a7 01 67 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 47 f9 a7 01 \u003c67\u003e 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 46 f9 a7 01 67 48 0f b9 3a\n[ 1.936274] RSP: 0000:ffffd0d440013c58 EFLAGS: 00010246\n[ 1.936376] RAX: 0000000000000000 RBX: ffff8f39c188c278 RCX: 000000000000002b\n[ 1.936524] RDX: ffff8f39c004f000 RSI: 0000000000000003 RDI: ffffffff96abab00\n[ 1.936692] RBP: ffff8f39c188c240 R08: ffffffff96988e88 R09: 00000000ffffdfff\n[ 1.936835] R10: ffffffff96878ea0 R11: 0000000000000187 R12: 0000000000000000\n[ 1.936970] R13: ffff8f39c0cef0c8 R14: ffff8f39c1ac01c0 R15: 0000000000000000\n[ 1.937114] FS: 0000000000000000(0000) GS:ffff8f3ba08b4000(0000) knlGS:0000000000000000\n[ 1.937273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1.937382] CR2: ffff8f3b3ffff000 CR3: 0000000172642001 CR4: 0000000000372ef0\n[ 1.937540] Call Trace:\n[ 1.937619] \u003cTASK\u003e\n[ 1.937698] xpcs_destroy_pcs+0x25/0x40\n[ 1.937783] fbnic_netdev_alloc+0x1e5/0x200\n[ 1.937859] fbnic_probe+0x230/0x370\n[ 1.937939] local_pci_probe+0x3e/0x90\n[ 1.938013] pci_device_probe+0xbb/0x1e0\n[ 1.938091] ? sysfs_do_create_link_sd+0x6d/0xe0\n[ 1.938188] really_probe+0xc1/0x2b0\n[ 1.938282] __driver_probe_device+0x73/0x120\n[ 1.938371] driver_probe_device+0x1e/0xe0\n[ 1.938466] __driver_attach+0x8d/0x190\n[ 1.938560] ? __pfx___driver_attach+0x10/0x10\n[ 1.938663] bus_for_each_dev+0x7b/0xd0\n[ 1.938758] bus_add_driver+0xe8/0x210\n[ 1.938854] driver_register+0x60/0x120\n[ 1.938929] ? __pfx_fbnic_init_module+0x10/0x10\n[ 1.939026] fbnic_init_module+0x25/0x60\n[ 1.939109] do_one_initcall+0x49/0x220\n[ 1.939202] ? rdinit_setup+0x20/0x40\n[ 1.939304] kernel_init_freeable+0x1b0/0x310\n[ 1.939449] ? __pfx_kernel_init+0x10/0x10\n[ 1.939560] kernel_init+0x1a/0x1c0\n[ 1.939640] ret_from_fork+0x1ed/0x240\n[ 1.939730] ? __pfx_kernel_init+0x10/0x10\n[ 1.939805] ret_from_fork_asm+0x1a/0x30\n[ 1.939886] \u003c/TASK\u003e\n[ 1.939927] ---[ end trace 0000000000000000 ]---\n[ 1.940184] fbnic 0000:01:00.0: Netdev allocation failed\n\nInstead of calling fbnic_phylink_destroy(), the prior initialization of\nnetdev should just be unrolled with free_netdev() and clearing\nfbd-\u003enetdev.\n\nClearing fbd-\u003enetdev to NULL avoids UAF in init_failure_mode where\ncallers guard by checking !fbd-\u003enetdev, such as fbnic_mdio_read_pmd().\nThese callers remain active even after a failed probe, so fdb-\u003enetdev\nstill needs to be cleared.\n\nFixes: d0fe7104c795 (\"fbnic: Replace use of internal PCS w/ Designware XPCS\")\nSigned-off-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nLink: https://patch.msgid.link/20260504-fbnic-pcs-fix-v2-1-de45192821d9@meta.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b15838b03cd0c6cf35651cfde62d17f14bb1d566", "tree": "4e9428f4ea3c460120417bb8c036e6be7a4908bf", "parents": [ "26f6654a9a60eb4d241f42a0ec85412e8821480b" ], "author": { "name": "Myeonghun Pak", "email": "mhun512@gmail.com", "time": "Fri Apr 24 21:34:28 2026 +0900" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Thu May 07 10:51:18 2026 +0200" }, "message": "drm/bochs: Drop manual put on probe error path\n\nbochs_pci_probe() allocates the DRM device with devm_drm_dev_alloc(),\nwhich registers a devres action to drop the initial DRM device reference\non driver detach or probe failure.\n\nThe error path currently calls drm_dev_put() manually. If probe then\nreturns an error, devres will run the registered release action and put\nthe same device again, after the first put may already have released it.\n\nReturn the probe error directly and let devres own the final put.\n\nSigned-off-by: Myeonghun Pak \u003cmhun512@gmail.com\u003e\nFixes: 04826f588682 (\"drm/bochs: Allocate DRM device in struct bochs_device\")\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nReviewed-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260424123506.32275-1-mhun512@gmail.com\n" }, { "commit": "5772f6535227ebd104065d80afa8ed3478d34c5c", "tree": "b1c8533a7eca2f93ed953564c41c44ee142ff8ae", "parents": [ "5f8719945244dd65b5fa06195f4600db62581610" ], "author": { "name": "David Gow", "email": "david@davidgow.net", "time": "Thu Apr 16 14:57:43 2026 +0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu May 07 10:04:54 2026 +0200" }, "message": "x86/boot/e820: Re-enable BIOS fallback if e820 table is empty\n\nIn commit:\n\n 157266edcc56 (\"x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables\")\n\nthe check on the number of entries in the e820 table was removed. The intention\nwas to support single-entry maps, but by removing the check entirely, we also\nskip the fallback (to, e.g., the BIOS 88h function).\n\nThis means that if no E820 map is passed in from the bootloader (which is the\ncase on some bootloaders, like linld), we end up with an empty memory map, and\nthe kernel fails to boot (either by deadlocking on OOM, or by failing to\nallocate the real mode trampoline, or similar).\n\nRe-instate the check in append_e820_table(), but only check that nr_entries is\nnon-zero. This allows e820__memory_setup_default() to fall back to other memory\nsize sources, and doesn\u0027t affect e820__memory_setup_extended(), as the latter\nignores the return value from append_e820_table().\n\nIn doing so, we also update the return values to be proper error codes, with\n-ENOENT for this case (there are no entries), and -EINVAL for the case where an\nentry appears invalid. Given none of the callers check the actual value -- just\nwhether it\u0027s nonzero -- this is largely aesthetic in practice.\n\nTested against linld, and the kernel boots again fine.\n\n[ mingo: Readability edits to the comment and the changelog. ]\n\nFixes: 157266edcc56 (\"x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables\")\nSigned-off-by: David Gow \u003cdavid@davidgow.net\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@intel.com\u003e\nCc: stable@vger.kernel.org\nCc: Arnd Bergmann \u003carnd@kernel.org\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nLink: https://patch.msgid.link/20260416065746.1896647-1-david@davidgow.net\n" }, { "commit": "8ab992f815d6736b5c7a6f5fd7bfe7bc106bb3dc", "tree": "52c66a9d4530ea90af3e1a5fdc1e219f2e48b9c8", "parents": [ "b625e47f04274538e32e99fe6d3dc01edc93d280", "996454bc0da84d5a1dedb1a7861823087e01a7ae" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 22:02:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 22:02:28 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix memory leak in connection free\n\n - Fix inherited ACL ACE validation\n\n - Minor cleanup\n\n - Fix for share config\n\n - Fix durable handle cleanup race\n\n - Fix close_file_table_ids in session teardown\n\n - smbdirect fixes:\n - Fix memory region registration\n - Two fixes for out-of-tree builds\n\n* tag \u0027v7.1-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: validate inherited ACE SID length\n ksmbd: fix kernel-doc warnings from ksmbd_conn_get/put()\n ksmbd: fail share config requests when path allocation fails\n ksmbd: close durable scavenger races against m_fp_list lookups\n ksmbd: harden file lifetime during session teardown\n ksmbd: centralize ksmbd_conn final release to plug transport leak\n smb: smbdirect: fix MR registration for coalesced SG lists\n smb: smbdirect: introduce and use include/linux/smbdirect.h\n smb: smbdirect: make use of DEFAULT_SYMBOL_NAMESPACE and EXPORT_SYMBOL_GPL\n" }, { "commit": "b625e47f04274538e32e99fe6d3dc01edc93d280", "tree": "191d8d8bb209685ab792053cfe3e2f30282902e5", "parents": [ "5862221fddede6bb15566ab3c1f23a3c353da5e1", "525cb7ba6661074c1c5cc3772bccc6afab6791ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 20:44:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 20:44:03 2026 -0700" }, "message": "Merge tag \u0027chrome-platform-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux\n\nPull chrome-platform fix from Tzung-Bi Shih:\n\n - Fix a NULL dereference in cros_ec_typec\n\n* tag \u0027chrome-platform-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:\n platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration\n" }, { "commit": "b266bacba796ff5c4dcd2ae2fc08aacf7ab39153", "tree": "81d8b06d4509d00465b01170b2daaae6b22f173c", "parents": [ "2b1f48cc0f31abd1115a8c4b74b6425aba46eae4" ], "author": { "name": "Andreas Haarmann-Thiemann", "email": "eitschman@nebelreich.de", "time": "Tue May 05 23:52:17 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:43:41 2026 -0700" }, "message": "net: ethernet: cortina: Drop half-assembled SKB\n\nIn gmac_rx() (drivers/net/ethernet/cortina/gemini.c), when\ngmac_get_queue_page() returns NULL for the second page of a multi-page\nfragment, the driver logs an error and continues — but does not free the\npartially assembled skb that was being assembled via napi_build_skb() /\nnapi_get_frags().\n\nFree the in-progress partially assembled skb via napi_free_frags()\nand increase the number of dropped frames appropriately\nand assign the skb pointer NULL to make sure it is not lingering\naround, matching the pattern already used elsewhere in the driver.\n\nFixes: 4d5ae32f5e1e (\"net: ethernet: Add a driver for Gemini gigabit ethernet\")\nSigned-off-by: Andreas Haarmann-Thiemann \u003ceitschman@nebelreich.de\u003e\nSigned-off-by: Linus Walleij \u003clinusw@kernel.org\u003e\nReviewed-by: Alexander Lobakin \u003caleksander.lobakin@intel.com\u003e\nLink: https://patch.msgid.link/20260505-gemini-ethernet-fix-v2-1-997c31d06079@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2b1f48cc0f31abd1115a8c4b74b6425aba46eae4", "tree": "5aa3af72025501df785192808a303899c3f9db99", "parents": [ "c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5", "53705ddfa18408f8e1f064331b6387509fa19f7f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:50 2026 -0700" }, "message": "Merge branch \u0027mptcp-pm-misc-fixes-for-v7-1-rc3\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: pm: misc. fixes for v7.1-rc3\n\nHere are various fixes, mainly related to ADD_ADDRs:\n\n- Patch 1: save ADD_ADDR for rtx with ID0 when needed. A fix for v6.1.\n\n- Patch 2: remove unneeded exception for ID 0. A fix for v5.10.\n\n- Patches 3-5: fix potential data-race and leaks during ADD_ADDR rtx. A\n fix for v5.10.\n\n- Patch 6: resched blocked ADD_ADDR rtx after a more appropriated\n timeout, not after 15 seconds. A fix for v5.10.\n\n- Patch 7: skip inactive subflows when when looking at the max RTO. A\n fix for v6.18.\n\n- Patch 8: avoid iterating over all subflows when there is no need to. A\n fix for v6.18.\n\n- Patch 9: skip closed subflows when looking at sending MP_PRIO. A fix\n for v5.17.\n\n- Patch 10: properly catch errors when using check_output() in the\n selftests. A fix for v6.9.\n\n- Patch 11: skip the \u0027unknown\u0027 flag test when \u0027ip mptcp\u0027 is used. A fix\n for v6.10.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-0-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "53705ddfa18408f8e1f064331b6387509fa19f7f", "tree": "5aa3af72025501df785192808a303899c3f9db99", "parents": [ "65db7b27b90e2ea8d4966935aa9a50b6a60c31ac" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:59 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "selftests: mptcp: pm: restrict \u0027unknown\u0027 check to pm_nl_ctl\n\nWhen pm_netlink.sh is executed with \u0027-i\u0027, \u0027ip mptcp\u0027 is used instead of\n\u0027pm_nl_ctl\u0027. IPRoute2 doesn\u0027t support the \u0027unknown\u0027 flag, which has only\nbeen added to \u0027pm_nl_ctl\u0027 for this specific check: to ensure that the\nkernel ignores such unsupported flag.\n\nNo reason to add this flag to \u0027ip mptcp\u0027. Then, this check should be\nskipped when \u0027ip mptcp\u0027 is used.\n\nFixes: 0cef6fcac24d (\"selftests: mptcp: ip_mptcp option for more scripts\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-11-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "65db7b27b90e2ea8d4966935aa9a50b6a60c31ac", "tree": "a8dd2ff2e188abbecb8a2dffaa0709da5b511a08", "parents": [ "166b78344031bf7ac9f55cb5282776cfd85f220e" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:58 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "selftests: mptcp: check output: catch cmd errors\n\nUsing \u0027${?}\u0027 inside the if-statement to check the returned value from\nthe command that was evaluated as part of the if-statement is not\ncorrect: here, \u0027${?}\u0027 will be linked to the previous instruction, not\nthe one that is expected here (${cmd}).\n\nInstead, simply mark the error, except if an error is expected. If\nthat\u0027s the case, 1 can be passed as the 4th argument of this helper.\nThree checks from pm_netlink.sh expect an error.\n\nWhile at it, improve the error message when the command unexpectedly\nfails or succeeds.\n\nNote that we could expect a specific returned value, but the checks\ncurrently expecting an error can be used with \u0027ip mptcp\u0027 or \u0027pm_nl_ctl\u0027,\nand these two tools don\u0027t return the same error code.\n\nFixes: 2d0c1d27ea4e (\"selftests: mptcp: add mptcp_lib_check_output helper\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-10-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "166b78344031bf7ac9f55cb5282776cfd85f220e", "tree": "a7e938e19f4b039c4959103e80680a8be597b44b", "parents": [ "62a9b19dce77e72426f049fb99b9d1d032b9a8ea" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: prio: skip closed subflows\n\nWhen sending an MP_PRIO, closed subflows need to be skipped.\n\nThis fixes the case where the initial subflow got closed, re-opened\nlater, then an MP_PRIO is needed for the same local address.\n\nNote that explicit MP_PRIO cannot be sent during the 3WHS, so it is fine\nto use __mptcp_subflow_active().\n\nFixes: 067065422fcd (\"mptcp: add the outgoing MP_PRIO support\")\nCc: stable@vger.kernel.org\nFixes: b29fcfb54cd7 (\"mptcp: full disconnect implementation\")\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-9-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "62a9b19dce77e72426f049fb99b9d1d032b9a8ea", "tree": "2451d51f9f35a6715bb2ffb6bf210d6b84d1d2f9", "parents": [ "c6d395e2de1306b5fef0344a3c3835fbbfaa18be" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:56 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: return early if no retrans\n\nNo need to iterate over all subflows if there is no retransmission\nneeded.\n\nExit early in this case then.\n\nFixes: 30549eebc4d8 (\"mptcp: make ADD_ADDR retransmission timeout adaptive\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-8-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c6d395e2de1306b5fef0344a3c3835fbbfaa18be", "tree": "018c6723e3b0a22c0b5753c67d808eebd09b4b14", "parents": [ "3cf12492891c4b5ff54dda404a2de4ec54c9e1b5" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:55 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: skip inactive subflows\n\nWhen looking at the maximum RTO amongst the subflows, inactive subflows\nwere taken into account: that includes stale ones, and the initial one\nif it has been already been closed.\n\nUnusable subflows are now simply skipped. Stale ones are used as an\nalternative: if there are only stale ones, to take their maximum RTO and\navoid to eventually fallback to net.mptcp.add_addr_timeout, which is set\nto 2 minutes by default.\n\nFixes: 30549eebc4d8 (\"mptcp: make ADD_ADDR retransmission timeout adaptive\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-7-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3cf12492891c4b5ff54dda404a2de4ec54c9e1b5", "tree": "491e4a06ac34538778a0fb3b704f569fb6d1a82d", "parents": [ "b7b9a461569734d33d3259d58d2507adfac107ed" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:54 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker\n\nWhen an ADD_ADDR needs to be retransmitted and another one has already\nbeen prepared -- e.g. multiple ADD_ADDRs have been sent in a row and\nneed to be retransmitted later -- this additional retransmission will\nneed to wait.\n\nIn this case, the timer was reset to TCP_RTO_MAX / 8, which is ~15\nseconds. This delay is unnecessary long: it should just be rescheduled\nat the next opportunity, e.g. after the retransmission timeout.\n\nWithout this modification, some issues can be seen from time to time in\nthe selftests when multiple ADD_ADDRs are sent, and the host takes time\nto process them, e.g. the \"signal addresses, ADD_ADDR timeout\" MPTCP\nJoin selftest, especially with a debug kernel config.\n\nNote that on older kernels, \u0027timeout\u0027 is not available. It should be\nenough to replace it by one second (HZ).\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-6-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7b9a461569734d33d3259d58d2507adfac107ed", "tree": "64a46f9b0c0787c4c5a7a41f64fab2ad0ba8b7ca", "parents": [ "9634cb35af17019baec21ca648516ce376fa10e6" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:53 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: free sk if last\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(),\nand released at the end.\n\nIf at that moment, it was the last reference being held, the sk would\nnot be freed. sock_put() should then be called instead of __sock_put().\n\nBut that\u0027s not enough: if it is the last reference, sock_put() will call\nsk_free(), which will end up calling sk_stop_timer_sync() on the same\ntimer, and waiting indefinitely to finish. So it is needed to mark that\nthe timer is done at the end of the timer handler when it has not been\nrescheduled, not to call sk_stop_timer_sync() on \"itself\".\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-5-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9634cb35af17019baec21ca648516ce376fa10e6", "tree": "550d609a82ffe93c7776ab55392d4607cc52a33f", "parents": [ "5cd6e0ad79d2615264f63929f8b457ad97ae550d" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:52 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new \u0027exit\u0027 label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the \u0027!msk\u0027 check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\".\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-4-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5cd6e0ad79d2615264f63929f8b457ad97ae550d", "tree": "2377b3a62992b0e5e779e012e8f7f893090931f6", "parents": [ "03f324f3f1f7619a47b9c91282cb12775ab0a2f1" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:51 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: fix potential data-race\n\nThis mptcp_pm_add_timer() helper is executed as a timer callback in\nsoftirq context. To avoid any data races, the socket lock needs to be\nheld with bh_lock_sock().\n\nIf the socket is in use, retry again soon after, similar to what is done\nwith the keepalive timer.\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-3-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "03f324f3f1f7619a47b9c91282cb12775ab0a2f1", "tree": "225eda8e8e24dc7f53dc9118dd816c1b042965dd", "parents": [ "b12014d2d36eaed4e4bec5f1ac7e91110eeb100d" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:50 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: allow ID 0\n\nADD_ADDR can be sent for the ID 0, which corresponds to the local\naddress and port linked to the initial subflow.\n\nIndeed, this address could be removed, and re-added later on, e.g. what\nis done in the \"delete re-add signal\" MPTCP Join selftests. So no reason\nto ignore it.\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-2-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b12014d2d36eaed4e4bec5f1ac7e91110eeb100d", "tree": "dec7b7d2d8b8e2e1c02d87d0d9807237c1dcb05d", "parents": [ "c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0\n\nWhen adding the ADD_ADDR to the list, the address including the IP, port\nand ID are copied. On the other hand, when the endpoint corresponds to\nthe one from the initial subflow, the ID is set to 0, as specified by\nthe MPTCP protocol.\n\nThe issue is that the ID was reset after having copied the ID in the\nADD_ADDR entry. So the retransmission was done, but using a different ID\nthan the initial one.\n\nFixes: 8b8ed1b429f8 (\"mptcp: pm: reuse ID 0 after delete and re-add\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-1-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5", "tree": "410de56141b25893ef9a03f0c23982d512c9eabd", "parents": [ "770b136ff9bf3e319d19875da59c4f7f4853da3a" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 15:39:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:11:33 2026 -0700" }, "message": "tcp: tcp_child_process() related UAF\n\ntcp_child_process( .. child ...) currently calls sock_put(child).\n\nUnfortunately @child (named @nsk in callers) can be used after\nthis point to send a RST packet.\n\nTo fix this UAF, I remove the sock_put() from tcp_child_process()\nand let the callers handle this after it is safe.\n\nRemove @rsk variable in tcp_v4_do_rcv() and change tcp_v6_do_rcv()\nso that both functions look the same.\n\nFixes: cfb6eeb4c860 (\"[TCP]: MD5 Signature Option (RFC2385) support.\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260505153927.3435532-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "770b136ff9bf3e319d19875da59c4f7f4853da3a", "tree": "a6b1b39ef131d5b234aba3d9245c469e913cd64a", "parents": [ "67ef49047d312be692c8c439145f4514174e517f" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 09:11:33 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:46:05 2026 -0700" }, "message": "net/sched: sch_sfq: annotate data-races from sfq_dump_class_stats()\n\nsfq_dump_class_stats() runs locklessly, add needed READ_ONCE()\nand WRITE_ONCE() annotations.\n\nFixes: edb09eb17ed8 (\"net: sched: do not acquire qdisc spinlock in qdisc/class stats dump\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260505091133.2452510-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "67ef49047d312be692c8c439145f4514174e517f", "tree": "a65655486018a571d0e1345b0986ac1693f3538c", "parents": [ "701ea57feaabdea403cf299ee5cd0445083bc0ac" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 13:32:33 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:44:13 2026 -0700" }, "message": "inetpeer: add a missing read_seqretry() in inet_getpeer()\n\nWhen performing a lockless lookup over the inet_peer rbtree,\nif a matching node is found, inet_getpeer() returns it immediately\nwithout validating the seqlock sequence.\n\nThis missing check introduces a race condition:\n\nTrigger Path: When a host receives an incoming fragmented IPv4 packet,\nip4_frag_init() (in net/ipv4/ip_fragment.c) calls inet_getpeer_v4()\nto track the peer.\n\nThe Race: If the packet is from a new source IP, CPU A acquires the\nwrite_seqlock, allocates a new inet_peer node (p), sets its IP address\n(daddr), and links it to the rbtree (rb_link_node).\n\nUninitialized Access: Due to the lack of memory barriers between\nrb_link_node and the initialization of the rest of the struct\n(like refcount_set(\u0026p-\u003erefcnt, 1)), CPU A can make the node visible\nto readers before its refcnt is initialized.\nThis is especially true on weakly-ordered architectures like ARM64\nwhere the CPU can reorder the memory stores.\n\nLockless Reader: Concurrently, CPU B processes a second fragmented packet\nfrom the same source IP. CPU B does a lockless lookup, finds the newly\ninserted node, and returns it immediately.\n\nUse-After-Free (UAF): CPU B reads p-\u003erefcnt as uninitialized garbage\n(left over from previous kmalloc-128/192 allocations).\nIf the garbage is \u003e 0, refcount_inc_not_zero(\u0026p-\u003erefcnt) succeeds.\nCPU A then executes refcount_set(\u0026p-\u003erefcnt, 1), overwriting CPU B\u0027s increment.\nWhen CPU B finishes with the fragment queue, it calls inet_putpeer(),\nwhich drops the refcount to 0 and frees the node via RCU.\nThe node is now freed but remains linked in the rbtree,\nresulting in a Use-After-Free in the rbtree.\n\nFixes: b145425f269a (\"inetpeer: remove AVL implementation in favor of RB tree\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260505133233.3039575-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "701ea57feaabdea403cf299ee5cd0445083bc0ac", "tree": "603afe28b3c73cb4adbe3ed3d98e82b243abdc12", "parents": [ "e4182739363b32c33012daf3b77a8cab3cd160be" ], "author": { "name": "Shitalkumar Gandhi", "email": "shital.gandhi45@gmail.com", "time": "Tue May 05 18:02:36 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:42:50 2026 -0700" }, "message": "net: rtsn: fix mdio_node leak in rtsn_mdio_alloc()\n\nof_get_child_by_name() takes a reference. The rtsn_reset() and\nrtsn_change_mode() failure paths jump to out_free_bus and leak\nmdio_node.\n\nAdd out_put_node to drop it before falling through.\n\nFixes: b0d3969d2b4d (\"net: ethernet: rtsn: Add support for Renesas Ethernet-TSN\")\nSigned-off-by: Shitalkumar Gandhi \u003cshitalkumar.gandhi@cambiumnetworks.com\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nReviewed-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nLink: https://patch.msgid.link/20260505123236.406000-1-shitalkumar.gandhi@cambiumnetworks.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e4182739363b32c33012daf3b77a8cab3cd160be", "tree": "a256a46bc8fc92a5ee81952c40f6582e8c61a09d", "parents": [ "7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1", "07bdec3fc737aac7f4c273aafa803d353174c43e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:22 2026 -0700" }, "message": "Merge branch \u0027netdevsim-psp-fix-init-and-uninit-bugs\u0027\n\nDaniel Zahka says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetdevsim: psp: fix init and uninit bugs\n\nThis series has three fixes. The first is a straightforward NULL\npointer dereference that is reachable by creating and destroying some\nvfs on a kernel with INET_PSP enabled.\n\nThe last two patches deal with nsim_psp_rereg_write(), which is a\ndebugfs handler that reregisters netdevsim\u0027s psp_dev without\naquiescing and disabling tx/rx processing. This was added to enable\nsome tests in psp.py where a psp device is unregistered while it still\nreferenced by tcp socket state.\n\nThere are two issues with this code:\n1. Calls to nsim_psp_uninit() are not properly serialized\n2. netdevsim\u0027s psp_dev refcount can be released while nsim_do_psp() is\n reading from it.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-0-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "07bdec3fc737aac7f4c273aafa803d353174c43e", "tree": "a256a46bc8fc92a5ee81952c40f6582e8c61a09d", "parents": [ "24c96a42006ee27a078ec8c631c906dea8a3ca6d" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue May 05 03:42:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:20 2026 -0700" }, "message": "netdevsim: psp: rcu protect psp_dev reference\n\nThere are two issues with the way psp_dev is used in nsim_do_psp():\n\n1. There is no check for IS_ERR() on the peers psp_dev, before\n dereferencing.\n2. The refcount on this psp_dev can be dropped by\n nsim_psp_rereg_write()\n\nTo fix this, we can make netdevsim\u0027s reference to its psp_dev an rcu\nreference, and then nsim_do_psp() can read the fields it needs from an\nrcu critical section.\n\nFixes: f857478d6206 (\"netdevsim: a basic test PSP implementation\")\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-3-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "24c96a42006ee27a078ec8c631c906dea8a3ca6d", "tree": "249ea6ab2da44c302fef8073e406377688543070", "parents": [ "7ce3f1bedaac88880594720ba0f687da3bd7fc8a" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue May 05 03:42:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:20 2026 -0700" }, "message": "netdevsim: psp: serialize calls to nsim_psp_uninit()\n\nThe debugfs write handler, nsim_psp_rereg_write(), can race against\nnsim_destroy() and against itself, causing nsim_psp_uninit() to run\nmore than once concurrently. Two complementary changes serialize all\ncallers:\n\n1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before\n doing the actual teardown. debugfs_remove() drains any in-flight\n writers and prevents new ones from starting.\n\n2. Add a mutex around the body of nsim_psp_rereg_write() so that two\n concurrent userspace writers cannot both enter the teardown path\n at once.\n\nThe teardown work itself is moved into a new __nsim_psp_uninit() that\nthe rereg handler calls under the mutex, while the public\nnsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy()\npair so nsim_destroy() doesn\u0027t have to know about the psp internals.\n\nFixes: f857478d6206 (\"netdevsim: a basic test PSP implementation\")\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-2-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7ce3f1bedaac88880594720ba0f687da3bd7fc8a", "tree": "6ac156d24a69336812d79baf1f065b5aa1b99a90", "parents": [ "7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue May 05 03:42:23 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:20 2026 -0700" }, "message": "netdevsim: psp: only call nsim_psp_uninit() on PFs\n\nVFs go through nsim_init_netdevsim_vf() which never calls\nnsim_psp_init(), so ns-\u003epsp.dev stays NULL. nsim_psp_uninit() guards\nwith !IS_ERR(ns-\u003epsp.dev), so destroying a VF reaches\npsp_dev_unregister(NULL) and dereferences NULL on the first\nmutex_lock(\u0026psd-\u003elock):\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:mutex_lock+0x1c/0x30\n Call Trace:\n psp_dev_unregister+0x2a/0x1a0\n nsim_psp_uninit+0x1f/0x40 [netdevsim]\n nsim_destroy+0x61/0x1e0 [netdevsim]\n __nsim_dev_port_del+0x47/0x90 [netdevsim]\n nsim_drv_configure_vfs+0xc9/0x130 [netdevsim]\n nsim_bus_dev_numvfs_store+0x79/0xb0 [netdevsim]\n\nGate nsim_psp_uninit() on nsim_dev_port_is_pf(), matching the pattern\nalready used for nsim_exit_netdevsim() and the bpf/ipsec/macsec/queue\nteardowns.\n\nReproducer:\n modprobe netdevsim\n echo \"10 1\" \u003e /sys/bus/netdevsim/new_device\n echo 1 \u003e /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\n devlink dev eswitch set netdevsim/netdevsim10 mode switchdev\n echo 0 \u003e /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\n\nFixes: f857478d6206 (\"netdevsim: a basic test PSP implementation\")\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-1-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1", "tree": "a32967d41a88fefdc7f1694b3d5ed4b6f636dbc5", "parents": [ "0e1368a28dd5231ae0dbe240dfe0ff2657de5647" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 13:00:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:29:23 2026 -0700" }, "message": "ipv6: fix potential UAF caused by ip6_forward_proxy_check()\n\nip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate\nskb-\u003ehead.\n\nReload ipv6_hdr() after the pskb_may_pull() call to avoid using\nthe freed memory.\n\nFixes: e21e0b5f19ac (\"[IPV6] NDISC: Handle NDP messages to proxied addresses.\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0e1368a28dd5231ae0dbe240dfe0ff2657de5647", "tree": "09f8c9c799205299a8ba45b01507bee96c663f95", "parents": [ "dc61989e37726e0ff3d669e6ad94e62b97149329" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:22:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:22:24 2026 -0700" }, "message": "selftests: drv-net: fix sort order of makefile and config\n\nRecent changes added configs and tests in the wrong spot.\n\nLink: https://lore.kernel.org/20260506170435.34984dfc@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dc61989e37726e0ff3d669e6ad94e62b97149329", "tree": "3c3f92340762c577852554e4a50960c598cc28f3", "parents": [ "f4eac70d1e0c1fb6b3b4743ff12753c9fedb88e4", "f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 16:49:41 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 16:49:42 2026 -0700" }, "message": "Merge tag \u0027ipsec-2026-05-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-05-05\n\n1. Fix an IPv6 encapsulation error path that leaked route references\n when UDPv6 ESP decapsulation resolved to an error route.\n From Yilin Zhu.\n\n2. Fix AH with ESN on async crypto paths by accounting for the extra\n high-order sequence number when reconstructing the temporary\n authentication layout in the completion callbacks.\n From Michael Bomarito.\n\n3. Fix XFRM output so it does not overwrite already-correct inner header\n pointers when a tunnel layer such as VXLAN has already saved them.\n The fix comes with new selftests. From Cosmin Ratiu.\n\n4. Add the missing native payload size entry for XFRM_MSG_MAPPING in the\n compat translation path. From Ruijie Li.\n\n5. Harden __xfrm_state_delete() against repeated or inconsistent unhashing\n of state list nodes by keying the removal on actual list membership and\n using delete-and-init helpers. From Michal Kosiorek.\n\n6. Prevent ESP from decrypting shared splice-backed skb fragments in place\n by marking UDP splice frags as shared and forcing copy-on-write in ESP\n input when needed. From Kuan-Ting Chen.\n\n* tag \u0027ipsec-2026-05-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n xfrm: esp: avoid in-place decrypt on shared skb frags\n xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n xfrm: provide message size for XFRM_MSG_MAPPING\n xfrm: Don\u0027t clobber inner headers when already set\n tools/selftests: Add a VXLAN+IPsec traffic test\n tools/selftests: Use a sensible timeout value for iperf3 client\n xfrm: ah: account for ESN high bits in async callbacks\n ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260505132326.1362733-1-steffen.klassert@secunet.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f4eac70d1e0c1fb6b3b4743ff12753c9fedb88e4", "tree": "1a7fa6e7f81cdb0dc46d7415dae36f6601c3b512", "parents": [ "bd75e1003d3ec295fcadca62ee5a4280a22c7e29", "201ba706318d460a2ea660e3652610be62532a70" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 16:10:02 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 16:10:03 2026 -0700" }, "message": "Merge tag \u0027ovpn-net-20260504\u0027 of https://github.com/OpenVPN/ovpn-net-next\n\nAntonio Quartulli says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIncludes changes:\n\n* ensure MAC header offset is reset before delivering packet\n* ensure gro_cells_receive() and dstats_dev_add() are called\n with BH disabled\n* reduce ping count in selftest to ensure it completes within\n timeout\n\n* tag \u0027ovpn-net-20260504\u0027 of https://github.com/OpenVPN/ovpn-net-next:\n selftests: ovpn: reduce ping count in test.sh\n ovpn: ensure packet delivery happens with BH disabled\n ovpn: reset MAC header before passing skb up\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260504230305.2681646-1-antonio@openvpn.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bd75e1003d3ec295fcadca62ee5a4280a22c7e29", "tree": "80688a0a862f6a446ef6d6cd0117a46ffb8aeb22", "parents": [ "b89e0100a5f6885f9748bbacc3f4e3bcff654e4c", "c5d415596cb6fbdf6334b06cc87a1a5a268d8725" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 15:43:33 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 15:43:34 2026 -0700" }, "message": "Merge tag \u0027for-net-2026-05-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - hci_conn: fix potential UAF in create_big_sync\n - hci_event: fix memset typo\n - hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt\n - L2CAP: fix MPS check in l2cap_ecred_reconf_req\n - L2CAP: defer conn param update to avoid conn-\u003elock/hdev-\u003elock inversion\n - L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\n - L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()\n - L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()\n - RFCOMM: pull credit byte with skb_pull_data()\n - SCO: fix sleeping under spinlock in sco_conn_ready\n - SCO: hold sk properly in sco_conn_ready\n - ISO: Fix data-race on dst in iso_sock_connect()\n - ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths\n - bnep: fix incorrect length parsing in bnep_rx_frame() extension handling\n - hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized\n - virtio_bt: clamp rx length before skb_put\n - virtio_bt: validate rx pkt_type header length\n - HIDP: serialise l2cap_unregister_user via hidp_session_sem\n - btintel_pcie: treat boot stage bit 12 as warning\n - btmtk: validate WMT event SKB length before struct access\n\n* tag \u0027for-net-2026-05-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem\n Bluetooth: hci_event: fix memset typo\n Bluetooth: RFCOMM: pull credit byte with skb_pull_data()\n Bluetooth: virtio_bt: validate rx pkt_type header length\n Bluetooth: virtio_bt: clamp rx length before skb_put\n Bluetooth: btmtk: validate WMT event SKB length before struct access\n Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths\n Bluetooth: ISO: Fix data-race on dst in iso_sock_connect()\n Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized\n Bluetooth: btintel_pcie: treat boot stage bit 12 as warning\n Bluetooth: SCO: hold sk properly in sco_conn_ready\n Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()\n Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()\n Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\n Bluetooth: l2cap: defer conn param update to avoid conn-\u003elock/hdev-\u003elock inversion\n Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req\n Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling\n Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt\n Bluetooth: hci_conn: fix potential UAF in create_big_sync\n Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260506204553.58686-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c5d415596cb6fbdf6334b06cc87a1a5a268d8725", "tree": "80688a0a862f6a446ef6d6cd0117a46ffb8aeb22", "parents": [ "72d97cae2a83cecf6f47208646675ecd066d0a3e" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Sat May 02 12:43:03 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:27:53 2026 -0400" }, "message": "Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem\n\nCommit dbf666e4fc9b (\"Bluetooth: HIDP: Fix possible UAF\") made\nhidp_session_remove() drop the L2CAP reference and set\nsession-\u003econn \u003d NULL once the session is considered removed, and\nadded a bare if (session-\u003econn) guard around the kthread-exit\nl2cap_unregister_user() call in hidp_session_thread(). The sibling\nioctl site in hidp_connection_del() still reads session-\u003econn\nunlocked and unguarded, and the kthread-exit guard itself is a\nlockless double-read.\n\nhidp_session_find() drops hidp_session_sem before returning, so\nhidp_session_remove() can null session-\u003econn between the lookup and\nthe call in hidp_connection_del(). Worse, since commit 752a6c9596dd\n(\"Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user\")\ntakes mutex_lock(\u0026conn-\u003elock) inside l2cap_unregister_user(), a\nstale non-NULL snapshot also UAFs on conn-\u003elock. v1 only added an\nif (session-\u003econn) guard at the ioctl site, which doesn\u0027t address\neither race; Luiz suggested snapshotting session-\u003econn under the\nsem and clearing it before the call.\n\nTaking hidp_session_sem across l2cap_unregister_user() would be\nwrong: l2cap_conn_del() already establishes the lock order\n\n conn-\u003elock -\u003e hidp_session_sem\n\nvia l2cap_unregister_all_users() -\u003e user-\u003eremove \u003d\u003d\nhidp_session_remove(), so taking hidp_session_sem before conn-\u003elock\nwould AB/BA deadlock.\n\nFactor a helper hidp_session_unregister_conn() that under\ndown_write(\u0026hidp_session_sem) snapshots session-\u003econn and clears\nthe member, then outside the sem calls l2cap_unregister_user() and\nl2cap_conn_put() on the snapshot. Call it from both\nhidp_connection_del() and hidp_session_thread()\u0027s exit path. At\nmost one consumer wins the write-sem; later callers observe\nsession-\u003econn \u003d\u003d NULL and skip the unregister and put, so the\nreference hidp_session_new() took via l2cap_conn_get() is consumed\nexactly once. session_free() already tolerates a NULL session-\u003econn.\n\nFixes: dbf666e4fc9b (\"Bluetooth: HIDP: Fix possible UAF\")\nSuggested-by: Luiz Augusto von Dentz \u003cluiz.dentz@gmail.com\u003e\nLink: https://lore.kernel.org/all/20260422011437.176643-1-michael.bommarito@gmail.com/\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "72d97cae2a83cecf6f47208646675ecd066d0a3e", "tree": "acb47f0120d3b9315816038c506489de334ca53b", "parents": [ "8f59d17b18a78fdfdbb67d693b3d3eb03db184e0" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Wed Apr 29 15:40:46 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:27:29 2026 -0400" }, "message": "Bluetooth: hci_event: fix memset typo\n\nhci_le_big_sync_established_evt() currently does:\n\n conn-\u003enum_bis \u003d 0;\n memset(conn-\u003ebis, 0, sizeof(conn-\u003enum_bis));\n\nsizeof(conn-\u003enum_bis) is wrong - it would make sense to either use\nconn-\u003enum_bis (before setting that to 0) or sizeof(conn-\u003ebis).\nFix it by using sizeof(conn-\u003ebis), the least intrusive change.\n\nLuckily, nothing actually depends on this memset() working properly:\nNothing seems to ever read from conn-\u003ebis beyond conn-\u003enum_bis, and when\nconn-\u003enum_bis is increased, the corresponding elements of conn-\u003ebis are\ninitialized. So I think this line could also just be removed.\n\nThis is a purely theoretical fix and should have no impact on actual\nbehavior.\n\nFixes: 42ecf1947135 (\"Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "8f59d17b18a78fdfdbb67d693b3d3eb03db184e0", "tree": "6fdf0b512a4182b84e91c2f1f95eaeaa25b617c4", "parents": [ "daf23014e5d975e72ea9c02b5160d3fcf070ea47" ], "author": { "name": "Pengpeng Hou", "email": "pengpeng@iscas.ac.cn", "time": "Thu Apr 23 23:31:00 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:23:20 2026 -0400" }, "message": "Bluetooth: RFCOMM: pull credit byte with skb_pull_data()\n\nrfcomm_recv_data() treats the first payload byte as a credit field when\nthe UIH frame carries PF and credit-based flow control is enabled.\n\nAfter the header has been stripped, the PF/CFC path consumes that byte\nwith a direct skb-\u003edata dereference followed by skb_pull(). A malformed\nshort frame can reach this path without a byte available.\n\nUse skb_pull_data() so the length check and pull happen together before\nthe returned credit byte is consumed.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Pengpeng Hou \u003cpengpeng@iscas.ac.cn\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "daf23014e5d975e72ea9c02b5160d3fcf070ea47", "tree": "83e06248e1d3b9adc9c15d5f95983cc274a7855a", "parents": [ "21bd244b6de5d2fe1063c23acc93fbdd2b20d112" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Tue Apr 21 13:08:45 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:22:33 2026 -0400" }, "message": "Bluetooth: virtio_bt: validate rx pkt_type header length\n\nvirtbt_rx_handle() reads the leading pkt_type byte from the RX skb\nand forwards the remainder to hci_recv_frame() for every\nevent/ACL/SCO/ISO type, without checking that the remaining payload\nis at least the fixed HCI header for that type.\n\nAfter the preceding patch bounds the backend-supplied used.len to\n[1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches\nhci_recv_frame() with skb-\u003elen already pulled to 0. If the byte\nhappened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification\nfast-path in hci_dev_classify_pkt_type() dereferences\nhci_acl_hdr(skb)-\u003ehandle whenever the HCI device has an active\nCIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of\nuninitialized RX-buffer data. The same hazard exists for every\npacket type the driver accepts because none of the switch cases in\nvirtbt_rx_handle() check skb-\u003elen against the per-type minimum HCI\nheader size before handing the frame to the core.\n\nAfter stripping pkt_type, require skb-\u003elen to cover the fixed\nheader size for the selected type (event 2, ACL 4, SCO 3, ISO 4)\nbefore calling hci_recv_frame(); drop ratelimited otherwise.\nUnknown pkt_type values still take the original kfree_skb() default\npath.\n\nUse bt_dev_err_ratelimited() because both the length and pkt_type\nvalues come from an untrusted backend that can otherwise flood the\nkernel log.\n\nFixes: 160fbcf3bfb9 (\"Bluetooth: virtio_bt: Use skb_put to set length\")\nCc: stable@vger.kernel.org\nCc: Soenke Huster \u003csoenke.huster@eknoes.de\u003e\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "21bd244b6de5d2fe1063c23acc93fbdd2b20d112", "tree": "a161811179d1a13cc0654294f82297d698c9cc6d", "parents": [ "634a4408c0615c523cf7531790f4f14a422b9206" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Tue Apr 21 13:08:44 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:22:25 2026 -0400" }, "message": "Bluetooth: virtio_bt: clamp rx length before skb_put\n\nvirtbt_rx_work() calls skb_put(skb, len) where len comes directly\nfrom virtqueue_get_buf() with no validation against the buffer we\nposted to the device. The RX skb is allocated in virtbt_add_inbuf()\nand exposed to virtio as exactly 1000 bytes via sg_init_one().\n\nChecking len against skb_tailroom(skb) is not sufficient because\nalloc_skb() can leave more tailroom than the 1000 bytes actually\nhanded to the device. A malicious or buggy backend can therefore\nreport used.len between 1001 and skb_tailroom(skb), causing skb_put()\nto include uninitialized kernel heap bytes that were never written by\nthe device.\n\nThe same path also accepts len \u003d\u003d 0, in which case skb_put(skb, 0)\nleaves the skb empty but virtbt_rx_handle() still reads the pkt_type\nbyte from skb-\u003edata, consuming uninitialized memory.\n\nDefine VIRTBT_RX_BUF_SIZE once and reuse it in alloc_skb() and\nsg_init_one(), and gate virtbt_rx_work() on that same constant so\nthe bound checked matches the buffer actually exposed to the device.\nReject used.len \u003d\u003d 0 in the same gate so an empty completion can\nno longer reach virtbt_rx_handle().\n\nUse bt_dev_err_ratelimited() because the length value comes from an\nuntrusted backend that can otherwise flood the kernel log.\n\nSame class of bug as commit c04db81cd028 (\"net/9p: Fix buffer\noverflow in USB transport layer\"), which hardened the USB 9p\ntransport against unchecked device-reported length.\n\nFixes: 160fbcf3bfb9 (\"Bluetooth: virtio_bt: Use skb_put to set length\")\nCc: stable@vger.kernel.org\nCc: Soenke Huster \u003csoenke.huster@eknoes.de\u003e\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "634a4408c0615c523cf7531790f4f14a422b9206", "tree": "a0c3529588fea3d1f5469b501e3ae11636504b2b", "parents": [ "f958c7805b18e9d69f6b322b231ecee46ec6f331" ], "author": { "name": "Tristan Madani", "email": "tristan@talencesecurity.com", "time": "Tue Apr 21 11:14:54 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:22:19 2026 -0400" }, "message": "Bluetooth: btmtk: validate WMT event SKB length before struct access\n\nbtmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to\nstruct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc\n(9 bytes) without first checking that the SKB contains enough data.\nA short firmware response causes out-of-bounds reads from SKB tailroom.\n\nUse skb_pull_data() to validate and advance past the base WMT event\nheader. For the FUNC_CTRL case, pull the additional status field bytes\nbefore accessing them.\n\nFixes: d019930b0049 (\"Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tristan Madani \u003ctristan@talencesecurity.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "f958c7805b18e9d69f6b322b231ecee46ec6f331", "tree": "0b90dd95276ffa11b3a3ece4194a0697a2c44ddf", "parents": [ "ca40d481079c05c6891a14a798c79596fd2d5f0c" ], "author": { "name": "SeungJu Cheon", "email": "suunj1331@gmail.com", "time": "Tue Apr 21 11:51:22 2026 +0900" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:22:05 2026 -0400" }, "message": "Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths\n\nSeveral iso_pi(sk) fields (qos, qos_user_set, bc_sid, base, base_len,\nsync_handle, bc_num_bis) are written under lock_sock in\niso_sock_setsockopt() and iso_sock_bind(), but read and written under\nhci_dev_lock only in two other paths:\n\n - iso_connect_bis() / iso_connect_cis(), invoked from connect(2),\n read qos/base/bc_sid and reset qos to default_qos on the\n qos_user_set validation failure -- all without lock_sock.\n\n - iso_connect_ind(), invoked from hci_rx_work, writes sync_handle,\n bc_sid, qos.bcast.encryption, bc_num_bis, base and base_len on\n PA_SYNC_ESTABLISHED / PAST_RECEIVED / BIG_INFO_ADV_REPORT /\n PER_ADV_REPORT events. The BIG_INFO handler additionally passes\n \u0026iso_pi(sk)-\u003eqos together with sync_handle / bc_num_bis / bc_bis\n to hci_conn_big_create_sync() while setsockopt may be mutating\n them.\n\nAcquire lock_sock around the affected accesses in both paths.\n\nThe locking order hci_dev_lock -\u003e lock_sock matches the existing\niso_conn_big_sync() precedent, whose comment documents the same\nrequirement for hci_conn_big_create_sync(). The HCI connect/bind\nhelpers do not wait for command completion -- they enqueue work via\nhci_cmd_sync_queue{,_once}() / hci_le_create_cis_pending() and\nreturn -- so the added hold time is comparable to iso_conn_big_sync().\n\nKCSAN report:\n\nBUG: KCSAN: data-race in iso_connect_cis / iso_sock_setsockopt\n\nread to 0xffffa3ae8ce3cdc8 of 1 bytes by task 335 on cpu 0:\n iso_connect_cis+0x49f/0xa20\n iso_sock_connect+0x60e/0xb40\n __sys_connect_file+0xbd/0xe0\n __sys_connect+0xe0/0x110\n __x64_sys_connect+0x40/0x50\n x64_sys_call+0xcad/0x1c60\n do_syscall_64+0x133/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nwrite to 0xffffa3ae8ce3cdc8 of 60 bytes by task 334 on cpu 1:\n iso_sock_setsockopt+0x69a/0x930\n do_sock_setsockopt+0xc3/0x170\n __sys_setsockopt+0xd1/0x130\n __x64_sys_setsockopt+0x64/0x80\n x64_sys_call+0x1547/0x1c60\n do_syscall_64+0x133/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 334 Comm: iso_setup_race Not tainted 7.0.0-10949-g8541d8f725c6 #44 PREEMPT(lazy)\n\nThe iso_connect_ind() races were found by inspection.\n\nFixes: ccf74f2390d6 (\"Bluetooth: Add BTPROTO_ISO socket type\")\nSigned-off-by: SeungJu Cheon \u003csuunj1331@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "ca40d481079c05c6891a14a798c79596fd2d5f0c", "tree": "f187dff0bae48fcaf61918fd06ea757a39c42610", "parents": [ "902fe40bce7059722f7ffa1c378e577675cf1918" ], "author": { "name": "SeungJu Cheon", "email": "suunj1331@gmail.com", "time": "Tue Apr 21 11:51:21 2026 +0900" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:21:58 2026 -0400" }, "message": "Bluetooth: ISO: Fix data-race on dst in iso_sock_connect()\n\niso_sock_connect() copies the destination address into\niso_pi(sk)-\u003edst under lock_sock, then releases the lock and reads\nit back with bacmp() to decide between the CIS and BIS connect\npaths:\n\n lock_sock(sk);\n bacpy(\u0026iso_pi(sk)-\u003edst, \u0026sa-\u003eiso_bdaddr);\n iso_pi(sk)-\u003edst_type \u003d sa-\u003eiso_bdaddr_type;\n release_sock(sk);\n\n if (bacmp(\u0026iso_pi(sk)-\u003edst, BDADDR_ANY)) // \u003c- no lock held\n\nThis read after release_sock() races with any concurrent write to\niso_pi(sk)-\u003edst on the same socket.\n\nFix by reading the destination address directly from the local\nsockaddr argument (sa-\u003eiso_bdaddr) instead of iso_pi(sk)-\u003edst.\nSince sa is a function-local argument, reading it requires no\nlocking and avoids the race.\n\nThis patch addresses only the bacmp() race in iso_sock_connect();\nother unprotected iso_pi(sk) accesses are fixed separately in the\nnext patch.\n\nKCSAN report:\n\nBUG: KCSAN: data-race in memcmp+0x39/0xb0\n\nrace at unknown origin, with read to 0xffff8f96ea66dde3 of 1 bytes by task 549 on cpu 1:\n memcmp+0x39/0xb0\n iso_sock_connect+0x275/0xb40\n __sys_connect_file+0xbd/0xe0\n __sys_connect+0xe0/0x110\n __x64_sys_connect+0x40/0x50\n x64_sys_call+0xcad/0x1c60\n do_syscall_64+0x133/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00 -\u003e 0xee\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 549 Comm: iso_race_combin Not tainted 7.0.0-08391-g1d51b370a0f8 #40 PREEMPT(lazy)\n\nFixes: ccf74f2390d6 (\"Bluetooth: Add BTPROTO_ISO socket type\")\nSigned-off-by: SeungJu Cheon \u003csuunj1331@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "902fe40bce7059722f7ffa1c378e577675cf1918", "tree": "2061022d61838d5efa946ef0aa3596c9df67a1fa", "parents": [ "5917dd39db2bfc8b1b4c6ea8ed99adb4badef707" ], "author": { "name": "Aurelien DESBRIERES", "email": "aurelien@hackers.camp", "time": "Tue Apr 21 15:53:31 2026 +0200" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:21:43 2026 -0400" }, "message": "Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized\n\nWhen a fault is injected during hci_uart line discipline setup, the\nproto open() callback may fail leaving hu-\u003epriv as NULL. A subsequent\nTIOCSTI ioctl can trigger the recv() callback before priv is\ninitialized, causing a NULL pointer dereference.\n\nFix all four affected HCI UART protocol drivers by adding a NULL check\non hu-\u003epriv at the start of their recv() callbacks: h4, h5, ath and\nbcsp.\n\nReported-by: syzbot+ff30eeab8e07b37d524e@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dff30eeab8e07b37d524e\nSigned-off-by: Aurelien DESBRIERES \u003caurelien@hackers.camp\u003e\nAssisted-by: Claude:claude-sonnet-4-6\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "5917dd39db2bfc8b1b4c6ea8ed99adb4badef707", "tree": "9de8a837577e32372f757c278d565a4a0bab2da3", "parents": [ "4e37f6452d586b95c346a9abdd2fb80b67794f39" ], "author": { "name": "Sai Teja Aluvala", "email": "aluvala.sai.teja@intel.com", "time": "Mon Apr 20 23:07:35 2026 +0530" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:21:34 2026 -0400" }, "message": "Bluetooth: btintel_pcie: treat boot stage bit 12 as warning\n\nCSR boot stage register bit 12 is documented as a device warning,\nnot a fatal error. Rename the bit definition accordingly and stop\nincluding it in btintel_pcie_in_error().\n\nThis keeps warning-only boot stage values from being classified as\nerrors while preserving abort-handler state as the actual error\ncondition.\n\nFixes: 190377500fde (\"Bluetooth: btintel_pcie: Dump debug registers on error\")\nSigned-off-by: Kiran K \u003ckiran.k@intel.com\u003e\nSigned-off-by: Sai Teja Aluvala \u003caluvala.sai.teja@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4e37f6452d586b95c346a9abdd2fb80b67794f39", "tree": "132ad649148c0e11b69a5de91082f05f46244dcd", "parents": [ "0a120d96166301d7a95be75b52f843837dbd1219" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Sat Apr 18 18:41:12 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:21:25 2026 -0400" }, "message": "Bluetooth: SCO: hold sk properly in sco_conn_ready\n\nsk deref in sco_conn_ready must be done either under conn-\u003elock, or\nholding a refcount, to avoid concurrent close. conn-\u003esk and parent sk is\ncurrently accessed without either, and without checking parent-\u003esk_state:\n\n [Task 1] [Task 2]\n sco_sock_release\n sco_conn_ready\n sk \u003d conn-\u003esk\n lock_sock(sk)\n conn-\u003esk \u003d NULL\n lock_sock(sk)\n release_sock(sk)\n sco_sock_kill(sk)\n UAF on sk deref\n\nand similarly for access to sco_get_sock_listen() return value.\n\nFix possible UAF by holding sk refcount in sco_conn_ready() and making\nsco_get_sock_listen() increase refcount. Also recheck after lock_sock\nthat the socket is still valid. Adjust conn-\u003esk locking so it\u0027s\nprotected also by lock_sock() of the associated socket if any.\n\nFixes: 27c24fda62b60 (\"Bluetooth: switch to lock_sock in SCO\")\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "0a120d96166301d7a95be75b52f843837dbd1219", "tree": "bf22aa3447538d499049cdf2e00c5aa381a4cc31", "parents": [ "78a88d43dab8d23aeef934ed8ce34d40e6b3d613" ], "author": { "name": "Siwei Zhang", "email": "oss@fourdim.xyz", "time": "Wed Apr 15 16:49:59 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:21:09 2026 -0400" }, "message": "Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb().\n\nFixes: 80808e431e1e (\"Bluetooth: Add l2cap_chan_ops abstraction\")\nCc: stable@kernel.org\nSigned-off-by: Siwei Zhang \u003coss@fourdim.xyz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "78a88d43dab8d23aeef934ed8ce34d40e6b3d613", "tree": "dd7a6422dcff4a895fba1fabd5a96a2272f527f7", "parents": [ "2ff1a41a912de8517b4482e946dd951b7d80edbf" ], "author": { "name": "Siwei Zhang", "email": "oss@fourdim.xyz", "time": "Wed Apr 15 16:53:36 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:21:07 2026 -0400" }, "message": "Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb().\n\nFixes: 8d836d71e222 (\"Bluetooth: Access sk_sndtimeo indirectly in l2cap_core.c\")\nCc: stable@kernel.org\nSigned-off-by: Siwei Zhang \u003coss@fourdim.xyz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "2ff1a41a912de8517b4482e946dd951b7d80edbf", "tree": "41868e40fe3a72da58372d0787fe1d71dc47ee60", "parents": [ "91b5a598b5285da794b72619f31777b62dd336f8" ], "author": { "name": "Siwei Zhang", "email": "oss@fourdim.xyz", "time": "Wed Apr 15 16:51:36 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:21:04 2026 -0400" }, "message": "Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb().\n\nFixes: 89bc500e41fc (\"Bluetooth: Add state tracking to struct l2cap_chan\")\nCc: stable@kernel.org\nSigned-off-by: Siwei Zhang \u003coss@fourdim.xyz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "91b5a598b5285da794b72619f31777b62dd336f8", "tree": "0b384f03e6f10d96e47a551c96faabdf1ae21d54", "parents": [ "4f42363c814f28fe3f59847c35acf1ed033bedd4" ], "author": { "name": "Mikhail Gavrilov", "email": "mikhail.v.gavrilov@gmail.com", "time": "Wed Apr 15 02:52:37 2026 +0500" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:20:51 2026 -0400" }, "message": "Bluetooth: l2cap: defer conn param update to avoid conn-\u003elock/hdev-\u003elock inversion\n\nWhen a BLE peripheral sends an L2CAP Connection Parameter Update Request\nthe processing path is:\n\n process_pending_rx() [takes conn-\u003elock]\n l2cap_le_sig_channel()\n l2cap_conn_param_update_req()\n hci_le_conn_update() [takes hdev-\u003elock]\n\nMeanwhile other code paths take the locks in the opposite order:\n\n l2cap_chan_connect() [takes hdev-\u003elock]\n ...\n mutex_lock(\u0026conn-\u003elock)\n\n l2cap_conn_ready() [hdev-\u003elock via hci_cb_list_lock]\n ...\n mutex_lock(\u0026conn-\u003elock)\n\nThis is a classic AB/BA deadlock which lockdep reports as a circular\nlocking dependency when connecting a BLE MIDI keyboard (Carry-On FC-49).\n\nFix this by making hci_le_conn_update() defer the HCI command through\nhci_cmd_sync_queue() so it no longer needs to take hdev-\u003elock in the\ncaller context. The sync callback uses __hci_cmd_sync_status_sk() to\nwait for the HCI_EV_LE_CONN_UPDATE_COMPLETE event, then updates the\nstored connection parameters (hci_conn_params) and notifies userspace\n(mgmt_new_conn_param) only after the controller has confirmed the update.\n\nA reference on hci_conn is held via hci_conn_get()/hci_conn_put() for\nthe lifetime of the queued work to prevent use-after-free, and\nhci_conn_valid() is checked before proceeding in case the connection was\nremoved while the work was pending. The hci_dev_lock is held across\nhci_conn_valid() and all conn field accesses to prevent a concurrent\ndisconnect from invalidating the connection mid-use.\n\nFixes: f044eb0524a0 (\"Bluetooth: Store latency and supervision timeout in connection params\")\nSigned-off-by: Mikhail Gavrilov \u003cmikhail.v.gavrilov@gmail.com\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4f42363c814f28fe3f59847c35acf1ed033bedd4", "tree": "026032f05fbae0e4b6af9dd9c70b9b008ad0ca5e", "parents": [ "72b8deccff17a7644e0367e1aaf1a36cfb014324" ], "author": { "name": "Dudu Lu", "email": "phx0fer@gmail.com", "time": "Wed Apr 15 18:43:55 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:20:38 2026 -0400" }, "message": "Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req\n\nThe L2CAP specification states that if more than one channel is being\nreconfigured, the MPS shall not be decreased. The current check has\ntwo issues:\n\n1) The comparison uses \u003e\u003d (greater-than-or-equal), which incorrectly\n rejects reconfiguration requests where the MPS stays the same.\n Since the spec says MPS \"shall be greater than or equal to the\n current MPS\", only a strict decrease (remote_mps \u003e mps) should be\n rejected. Keeping the same MPS is valid.\n\n2) The multi-channel guard uses `\u0026\u0026 i` (loop index) to approximate\n \"more than one channel\", but this incorrectly allows MPS decrease\n for the first channel (i\u003d\u003d0) even when multiple channels are being\n reconfigured. Replace with `\u0026\u0026 num_scid \u003e 1` which correctly\n checks whether the request covers more than one channel.\n\nFixes: 7accb1c4321a (\"Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ\")\nSigned-off-by: Dudu Lu \u003cphx0fer@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "72b8deccff17a7644e0367e1aaf1a36cfb014324", "tree": "c916dcd5d16fe2ac26989d260152bee0d92da32a", "parents": [ "5ddb8014261137cadaf83ab5617a588d80a22586" ], "author": { "name": "Dudu Lu", "email": "phx0fer@gmail.com", "time": "Wed Apr 15 17:39:53 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:19:09 2026 -0400" }, "message": "Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling\n\nIn bnep_rx_frame(), the BNEP_FILTER_NET_TYPE_SET and\nBNEP_FILTER_MULTI_ADDR_SET extension header parsing has two bugs:\n\n1) The 2-byte length field is read with *(u16 *)(skb-\u003edata + 1), which\n performs a native-endian read. The BNEP protocol specifies this field\n in big-endian (network byte order), and the same file correctly uses\n get_unaligned_be16() for the identical fields in\n bnep_ctrl_set_netfilter() and bnep_ctrl_set_mcfilter().\n\n2) The length is multiplied by 2, but unlike BNEP_SETUP_CONN_REQ where\n the length byte counts UUID pairs (requiring * 2 for two UUIDs per\n entry), the filter extension length field already represents the total\n data size in bytes. This is confirmed by bnep_ctrl_set_netfilter()\n which reads the same field as a byte count and divides by 4 to get\n the number of filter entries.\n\n The bogus * 2 means skb_pull advances twice as far as it should,\n either dropping valid data from the next header or causing the pull\n to fail entirely when the doubled length exceeds the remaining skb.\n\nFix by splitting the pull into two steps: first use skb_pull_data() to\nsafely pull and validate the 3-byte fixed header (ctrl type + length),\nthen pull the variable-length data using the properly decoded length.\n\nFixes: bf8b9a9cb77b (\"Bluetooth: bnep: Add support to extended headers of control frames\")\nSigned-off-by: Dudu Lu \u003cphx0fer@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "5ddb8014261137cadaf83ab5617a588d80a22586", "tree": "3055535bb754f9b38827814d2b463860ee38ad17", "parents": [ "0beddb0c380bed5f5b8e61ddbe14635bb73d0b41" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Apr 10 15:29:52 2026 -0400" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 16:18:22 2026 -0400" }, "message": "Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt\n\nhci_le_create_big_complete_evt() iterates over BT_BOUND connections for\na BIG handle using a while loop, accessing ev-\u003ebis_handle[i++] on each\niteration. However, there is no check that i stays within ev-\u003enum_bis\nbefore the array access.\n\nWhen a controller sends a LE_Create_BIG_Complete event with fewer\nbis_handle entries than there are BT_BOUND connections for that BIG,\nor with num_bis\u003d0, the loop reads beyond the valid bis_handle[] flex\narray into adjacent heap memory. Since the out-of-bounds values\ntypically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()\nrejects them and the connection remains in BT_BOUND state. The same\nconnection is then found again by hci_conn_hash_lookup_big_state(),\ncreating an infinite loop with hci_dev_lock held.\n\nFix this by terminating the BIG if in case not all BIS could be setup\nproperly.\n\nFixes: a0bfde167b50 (\"Bluetooth: ISO: Add support for connecting multiple BISes\")\nCc: stable@vger.kernel.org\nSigned-off-by: ZhiTao Ou \u003chkbinbinbin@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "0beddb0c380bed5f5b8e61ddbe14635bb73d0b41", "tree": "45e09636320185b480c45465e990f68b05e129ac", "parents": [ "b819db93d73f4593636299e229914052b89e3ef2" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Sun Apr 12 21:29:16 2026 +0100" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 15:58:40 2026 -0400" }, "message": "Bluetooth: hci_conn: fix potential UAF in create_big_sync\n\nAdd hci_conn_valid() check in create_big_sync() to detect stale\nconnections before proceeding with BIG creation. Handle the\nresulting -ECANCELED in create_big_complete() and re-validate the\nconnection under hci_dev_lock() before dereferencing, matching the\npattern used by create_le_conn_complete() and create_pa_complete().\n\nKeep the hci_conn object alive across the async boundary by taking\na reference via hci_conn_get() when queueing create_big_sync(), and\ndropping it in the completion callback. The refcount and the lock\nare complementary: the refcount keeps the object allocated, while\nhci_dev_lock() serializes hci_conn_hash_del()\u0027s list_del_rcu() on\nhdev-\u003econn_hash, as required by hci_conn_del().\n\nhci_conn_put() is called outside hci_dev_unlock() so the final put\n(which resolves to kfree() via bt_link_release) does not run under\nhdev-\u003elock, though the release path would be safe either way.\n\nWithout this, create_big_complete() would unconditionally\ndereference the conn pointer on error, causing a use-after-free\nvia hci_connect_cfm() and hci_conn_del().\n\nFixes: eca0ae4aea66 (\"Bluetooth: Add initial implementation of BIS connections\")\nCc: stable@vger.kernel.org\nCo-developed-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "b819db93d73f4593636299e229914052b89e3ef2", "tree": "0fabf2cbbcbcf88da9db872b7f365e7bc773b8ea", "parents": [ "b89e0100a5f6885f9748bbacc3f4e3bcff654e4c" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Sun Apr 12 21:47:42 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Wed May 06 15:58:29 2026 -0400" }, "message": "Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready\n\nsco_conn_ready calls sleeping functions under conn-\u003elock spinlock.\n\nThe critical section can be reduced: conn-\u003ehcon is modified only with\nhdev-\u003elock held. It is guaranteed to be held in sco_conn_ready, so\nconn-\u003elock is not needed to guard it.\n\nMove taking conn-\u003elock after lock_sock(parent). This also follows the\nlock ordering lock_sock() \u003e conn-\u003elock elsewhere in the file.\n\nFixes: 27c24fda62b60 (\"Bluetooth: switch to lock_sock in SCO\")\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "5862221fddede6bb15566ab3c1f23a3c353da5e1", "tree": "b1b4f9a5694d431af89279c3c066a7bb08518def", "parents": [ "adc1e5c6203cf13fe05a1ead08edcb3d3a3baae8", "37b0dc5e279f35036fb638d1e187197b6c05a76d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 12:51:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 12:51:07 2026 -0700" }, "message": "Merge tag \u0027parisc-for-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nPull parisc fixes from Helge Deller:\n\n - Revert \"parisc: led: fix reference leak on failed device\n registration\"\n\n - Fix build failures introduced when allowing to build 32-/64-bit only\n VDSO\n\n - Switch to dynamic parisc root device to avoid upcoming warnings\n\n - Fix IRQ leak in LASI driver\n\n* tag \u0027parisc-for-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n parisc: Fix IRQ leak in LASI driver\n parisc: Fix 64-bit kernel build when CONFIG_COMPAT\u003dn\n parisc: Fix build failure for 32-bit kernel with PA2.0 instruction set\n parisc: drivers: switch to dynamic root device\n Revert \"parisc: led: fix reference leak on failed device registration\"\n" }, { "commit": "9f6d929ee2c6f0266edb564bcd2bd47fd6e884a8", "tree": "8d2c487fb8e4a993c470836a58701a7708d65d2c", "parents": [ "b6eee96843e8d088200f01b035da98e72067c5fe" ], "author": { "name": "Vincent Guittot", "email": "vincent.guittot@linaro.org", "time": "Sun May 03 12:45:03 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed May 06 17:41:18 2026 +0200" }, "message": "sched/fair: Fix wakeup_preempt_fair() for not waking up task\n\nMake sure to only call pick_next_entity() on an non-empty cfs_rq.\n\nThe assumption that p is always enqueued and not delayed, is only true for\nwakeup. If p was moved while delayed, pick_next_entity() will dequeue it and\nthe cfs might become empty. Test if there are still queued tasks before trying\nagain to determine if p could be the next one to be picked.\n\nThere are at least 2 cases:\n\nWhen cfs becomes idle, it tries to pull tasks but if those pulled tasks are\ndelayed, they will be dequeued when attached to cfs. attach_tasks() -\u003e\nattach_task() -\u003e wakeup_preempt(rq, p, 0);\n\nA misfit task running on cfs A triggers a load balance to be pulled on a better\ncpu, the load balance on cfs B starts an active load balance to pulled the\nrunning misfit task. If there is a delayed dequeue task on cfs A, it can be\npulled instead of the previously running misfit task. attach_one_task() -\u003e\nattach_task() -\u003e wakeup_preempt(rq, p, 0);\n\nFixes: ac8e69e69363 (\"sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue\")\nSigned-off-by: Vincent Guittot \u003cvincent.guittot@linaro.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20260503104503.1732682-1-vincent.guittot@linaro.org\n" }, { "commit": "b6eee96843e8d088200f01b035da98e72067c5fe", "tree": "798bc58aca22e0ace6e3e82e7778ef965e6bf81a", "parents": [ "e744060076871eebc2647b24420b550ff44b2b65" ], "author": { "name": "Zhan Xusheng", "email": "zhanxusheng@xiaomi.com", "time": "Fri May 01 12:40:06 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed May 06 17:41:17 2026 +0200" }, "message": "sched/fair: Fix overflow in vruntime_eligible()\n\nZhan Xusheng reported running into sporadic a s64 mult overflow in\nvruntime_eligible().\n\nWhen constructing a worst case scenario:\n\nIf you have cgroups, then you can have an entity of weight 2 (per\ncalc_group_shares()), and its vlag should then be bounded by: (slice+TICK_NSEC)\n* NICE_0_LOAD, which is around 44 bits as per the comment on entity_key().\n\nThe other extreme is 100*NICE_0_LOAD, thus you get:\n\n{key, weight}[] :\u003d {\n puny: { (slice + TICK_NSEC) * NICE_0_LOAD, 2 },\n max: { 0, 100*NICE_0_LOAD },\n}\n\nThe avg_vruntime() would end up being very close to 0 (which is\nzero_vruntime), so no real help making that more accurate.\n\nvruntime_eligible(puny) ends up with:\n\n avg \u003d 2 * puny.key (+ 0)\n load \u003d 2 + 100 * NICE_0_LOAD\n\n avg \u003e\u003d puny.key * load\n\nAnd that is: (slice + TICK_NSEC) * NICE_0_LOAD * NICE_0_LOAD * 100, which will\noverflow s64.\n\nZhan suggested using __builtin_mul_overflow(), however after staring at\ncompiler output for various architectures using godbolt, it seems that using an\n__int128 multiplication often results in better code.\n\nSpecifically, a number of architectures already compute the __int128 product to\ndetermine the overflow. Eg. arm64 already has the \u0027smulh\u0027 instruction used. By\nexplicitly doing an __int128 multiply, it will emit the \u0027mul; smulh\u0027 pattern,\nwhich modern cores can fuse (armv8-a clang-22.1.0). x86_64 has less branches\n(no OF handling).\n\nSince Linux has ARCH_SUPPORTS_INT128 to gate __int128 usage, also provide the\n__builtin_mul_overflow() variant as a fallback.\n\n[peterz: Changelog and __int128 bits]\nFixes: 556146ce5e94 (\"sched/fair: Avoid overflow in enqueue_entity()\")\nReported-by: Zhan Xusheng \u003czhanxusheng1024@gmail.com\u003e\nCloses: https://patch.msgid.link/20260415145742.10359-1-zhanxusheng%40xiaomi.com\nSigned-off-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20260505103155.GN3102924%40noisy.programming.kicks-ass.net\n" }, { "commit": "e744060076871eebc2647b24420b550ff44b2b65", "tree": "33c1a43e3e0ccdf17cb337687ee232cfe2b67f99", "parents": [ "99428157dcf32fdac97355aa1cc1364dbc9e073c" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sat Apr 25 14:48:23 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed May 06 17:41:08 2026 +0200" }, "message": "selftests/rseq: Expand for optimized RSEQ ABI v2\n\nUpdate the selftests so they are executed for legacy (32 bytes RSEQ region)\nand optimized RSEQ ABI v2 mode.\n\nFixes: d6200245c75e (\"rseq: Allow registering RSEQ with slice extension\")\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nLink: https://patch.msgid.link/20260428224428.009121296%40kernel.org\nCc: stable@vger.kernel.org\n" }, { "commit": "99428157dcf32fdac97355aa1cc1364dbc9e073c", "tree": "bce49604929cee04b1347f411453e115fb7b8e61", "parents": [ "82f572449cfe75f12ea985986da60e11f308f77d" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sun Apr 26 10:01:56 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed May 06 17:40:27 2026 +0200" }, "message": "rseq: Reenable performance optimizations conditionally\n\nDue to the incompatibility with TCMalloc the RSEQ optimizations and\nextended features (time slice extensions) have been disabled and made\nrun-time conditional.\n\nThe original RSEQ implementation, which TCMalloc depends on, registers a 32\nbyte region (ORIG_RSEG_SIZE). This region has a 32 byte alignment\nrequirement.\n\nThe extension safe newer variant exposes the kernel RSEQ feature size via\ngetauxval(AT_RSEQ_FEATURE_SIZE) and the alignment requirement via\ngetauxval(AT_RSEQ_ALIGN). The alignment requirement is that the registered\nRSEQ region is aligned to the next power of two of the feature size. The\nkernel currently has a feature size of 33 bytes, which means the alignment\nrequirement is 64 bytes.\n\nThe TCMalloc RSEQ region is embedded into a cache line aligned data\nstructure starting at offset 32 bytes so that bytes 28-31 and the\ncpu_id_start field at bytes 32-35 form a 64-bit little endian pointer with\nthe top-most bit (63 set) to check whether the kernel has overwritten\ncpu_id_start with an actual CPU id value, which is guaranteed to not have\nthe top most bit set.\n\nAs this is part of their performance tuned magic, it\u0027s a pretty safe\nassumption, that TCMalloc won\u0027t use a larger RSEQ size.\n\nThis allows the kernel to declare that registrations with a size greater\nthan the original size of 32 bytes, which is the cases since time slice\nextensions got introduced, as RSEQ ABI v2 with the following differences to\nthe original behaviour:\n\n 1) Unconditional updates of the user read only fields (CPU, node, MMCID)\n are removed. Those fields are only updated on registration, task\n migration and MMCID changes.\n\n 2) Unconditional evaluation of the criticial section pointer is\n removed. It\u0027s only evaluated when user space was interrupted and was\n scheduled out or before delivering a signal in the interrupted\n context.\n\n 3) The read/only requirement of the ID fields is enforced. When the\n kernel detects that userspace manipulated the fields, the process is\n terminated. This ensures that multiple entities (libraries) can\n utilize RSEQ without interfering.\n\n 4) Todays extended RSEQ feature (time slice extensions) and future\n extensions are only enabled in the v2 enabled mode.\n\nRegistrations with the original size of 32 bytes operate in backwards\ncompatible legacy mode without performance improvements and extended\nfeatures.\n\nUnfortunately that also affects users of older GLIBC versions which\nregister the original size of 32 bytes and do not evaluate the kernel\nrequired size in the auxiliary vector AT_RSEQ_FEATURE_SIZE.\n\nThat\u0027s the result of the lack of enforcement in the original implementation\nand the unwillingness of a single entity to cooperate with the larger\necosystem for many years.\n\nImplement the required registration changes by restructuring the spaghetti\ncode and adding the size/version check. Also add documentation about the\ndifferences of legacy and optimized RSEQ V2 mode.\n\nThanks to Mathieu for pointing out the ORIG_RSEQ_SIZE constraints!\n\nFixes: d6200245c75e (\"rseq: Allow registering RSEQ with slice extension\")\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nLink: https://patch.msgid.link/20260428224427.927160119%40kernel.org\nCc: stable@vger.kernel.org\n" } ], "next": "82f572449cfe75f12ea985986da60e11f308f77d" }