)]}' { "log": [ { "commit": "840ef6c78e6a2f694b578ecb9063241c992aaa9e", "tree": "d5915e31458e709297d3487482288cde25dcca70", "parents": [ "09ca8dc7d634f69d0b43f82c244add44cf7885b4", "284ea3fb4f6715201e1d9ef3474c25e817ad70e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 18:36:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 18:36:41 2026 -0700" }, "message": "Merge tag \u0027nfs-for-7.2-1\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs\n\nPull NFS client updates from Anna Schumaker:\n \"New features:\n - XPRTRDMA: Decouple req recycling from RPC completion\n - NFS: Expose FMODE_NOWAIT for read-only files\n\n Bugfixes:\n - SUNRPC:\n - Fix sunrpc sysfs error handling\n - Fix uninitialized xprt_create_args structure\n - XPRTRDMA:\n - Harden connect and reply handling\n - NFS:\n - Fix EOF updates after fallocate/zero-range\n - Keep PG_UPTODATE clear after read errors in page groups\n - Use nfsi-\u003erwsem to protect traversal of the file lock list\n - Prevent resource leak in nfs_alloc_server()\n - NFSv4:\n - Clear exception state on successful mkdir retry\n - Don\u0027t skip revalidate when holding a dir delegation and attrs are stale\n - pNFS:\n - Fix use-after-free in pnfs_update_layout()\n - Defer return_range callbacks until after inode unlock\n - Fix LAYOUTCOMMIT retry loop on OLD_STATEID\n - Reject zero-length r_addr in nfs4_decode_mp_ds_addr\n - NFS/flexfiles:\n - Reject zero-length filehandle version arrays\n - Fix checking if a layout is striped\n - Fixes for honoring FF_FLAGS_NO_IO_THRU_MDS\n\n Other cleanups and improvements:\n - Remove the fileid field from struct nfs_inode\n - Move long-delayed xprtrdma work onto the system_dfl_long_wq\n - Convert xprtrdma send buffer free list to an llist\n - Show \"\u003credacted\u003e\" for cert_serial and privkey_serial mount options\"\n\n* tag \u0027nfs-for-7.2-1\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs: (42 commits)\n NFS: Use common error handling code in nfs_alloc_server()\n NFS: Prevent resource leak in nfs_alloc_server()\n NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr\n nfs: don\u0027t skip revalidate on directory delegation when attrs flagged stale\n xprtrdma: Return sendctx slot after Send preparation failure\n xprtrdma: Repost Receive buffers for malformed replies\n xprtrdma: Sanitize the reply credit grant after parsing\n xprtrdma: Fix bcall rep leak and unbounded peek\n xprtrdma: Resize reply buffers before reposting receives\n xprtrdma: Check frwr_wp_create() during connect\n xprtrdma: Initialize re_id before removal registration\n xprtrdma: Fix ep kref imbalance on ADDR_CHANGE\n xprtrdma: Convert send buffer free list to llist\n NFS: correct CONFIG_NFS_V4 macro name in #endif comment\n nfs: use nfsi-\u003erwsem to protect traversal of the file lock list\n NFSv4.1/pNFS: fix LAYOUTCOMMIT retry loop on OLD_STATEID\n nfs: expose FMODE_NOWAIT for read-only files\n nfs: add nowait version of nfs_start_io_direct\n NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write\n NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors\n ...\n" }, { "commit": "09ca8dc7d634f69d0b43f82c244add44cf7885b4", "tree": "5806badcecf53262458574ef7caa984c30c02c95", "parents": [ "bade58eb0651c84b9b2a074fe4c04f2bba6b933f", "4275b59673eb60b02eec3997816c83f1f4b909c4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 17:59:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 17:59:36 2026 -0700" }, "message": "Merge tag \u0027f2fs-for-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs\n\nPull f2fs updates from Jaegeuk Kim:\n \"The changes primarily focus on filesystem error reporting, reducing\n memory footprint by reverting in-memory data structures used for\n runtime validation, honoring FDP hints, and adding trace and debug\n logs. In addition, there are critical bug fixes resolving\n out-of-bounds read vulnerabilities in inline directory and ACL\n handling, potential deadlocks in balance_fs, use-after-free issues in\n atomic writes, and false data/node type assignments in large sections.\n\n Enhancements:\n - Revert in-memory sit version and block bitmaps\n - support to report fserror\n - add trace_f2fs_fault_report\n - add iostat latency tracking for direct IO\n - add logs in f2fs_disable_checkpoint()\n - honor per-I/O write streams for direct writes\n - map data writes to FDP streams\n - skip inode folio lookup for cached overwrite\n - skip direct I/O iostat context when disabled\n - revert \"check in-memory block bitmap\"\n - revert \"check in-memory sit version bitmap\"\n\n Fixes:\n - optimize representative type determination in GC\n - fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()\n - fix potential deadlock in f2fs_balance_fs()\n - fix potential deadlock in gc_merge path of f2fs_balance_fs()\n - atomic: fix UAF issue on f2fs_inode_info.atomic_inode\n - fix missing read bio submission on large folio error\n - pass correct iostat type for single node writes\n - fix to do sanity check on f2fs_get_node_folio_ra()\n - validate orphan inode entry count\n - keep atomic write retry from zeroing original data\n - read COW data with the original inode during atomic write\n - validate inline dentry name lengths before conversion\n - validate dentry name length before lookup compares it\n - reject setattr size changes on large folio files\n - revert \"remove non-uptodate folio from the page cache in move_data_block\"\n - validate ACL entry sizes in f2fs_acl_from_disk()\n - bound i_inline_xattr_size for non-inline-xattr inodes\n - fix listxattr handling of corrupted xattr entries\n - fix to round down start offset of fallocate for pin file\"\n\n* tag \u0027f2fs-for-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (42 commits)\n f2fs: fix to round down start offset of fallocate for pin file\n f2fs: fix listxattr handling of corrupted xattr entries\n f2fs: skip direct I/O iostat context when disabled\n f2fs: remove unneeded f2fs_is_compressed_page()\n f2fs: avoid unnecessary fscrypt_finalize_bounce_page()\n f2fs: avoid unnecessary sanity check on ckpt_valid_blocks\n f2fs: misc cleanup in f2fs_record_stop_reason()\n f2fs: fix wrong description in printed log\n f2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n f2fs: validate ACL entry sizes in f2fs_acl_from_disk()\n Revert \"f2fs: remove non-uptodate folio from the page cache in move_data_block\"\n f2fs: Split f2fs_write_end_io()\n f2fs: Rename f2fs_post_read_wq into f2fs_wq\n f2fs: Prepare for supporting delayed bio completion\n f2fs: reject setattr size changes on large folio files\n f2fs: validate dentry name length before lookup compares it\n f2fs: validate inline dentry name lengths before conversion\n f2fs: read COW data with the original inode during atomic write\n f2fs: skip inode folio lookup for cached overwrite\n f2fs: keep atomic write retry from zeroing original data\n ...\n" }, { "commit": "bade58eb0651c84b9b2a074fe4c04f2bba6b933f", "tree": "419d64b9a3721d2da302febdaeb53dabeaeea946", "parents": [ "541643982b95d1da4237676a1e01e988c3c3aef4", "2d36d3b451a94899db9c965adde15492ffe6027a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 17:16:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 17:16:31 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Prevent NULL dereference on theoretical missing IO bitmap (Li\n RongQing)\n\n* tag \u0027x86-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap\n" }, { "commit": "541643982b95d1da4237676a1e01e988c3c3aef4", "tree": "b9668ec2492aac9300d32a766f8e2eec15bc7322", "parents": [ "83db48fb03fc4b14bc1a66d3c189030552f0c8bc", "269f2b43fae692d1f3988c9f888a6301aa537b82" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:57:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:57:39 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc timer fixes from Ingo Molnar:\n\n - Fix timekeeping locking order bug in the timekeeping init code\n (Mikhail Gavrilov)\n\n - Fix u64 multiplication bug in the posix-cpu-timers code on 32-bit\n kernels (Zhan Xusheng)\n\n - Fix macro name in comment block (Ethan Nelson-Moore)\n\n - Fix off-by-one bug in the compat settimeofday() usecs validation code\n (Wang Yan)\n\n* tag \u0027timers-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n time: Fix off-by-one in compat settimeofday() usec validation\n hrtimer: Correct CONFIG_NO_HZ_COMMON macro name in comment\n posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()\n timekeeping: Register default clocksource before taking tk_core.lock\n" }, { "commit": "83db48fb03fc4b14bc1a66d3c189030552f0c8bc", "tree": "c62e53fa03495268679945a4a1c1b8821e09ed3a", "parents": [ "d88eb9b84343b5f8d1b39b6c83280ce8aaeab6d8", "86f436567f2516a0083b210bedc933544826a2c3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:43:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:43:24 2026 -0700" }, "message": "Merge tag \u0027smp-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc CPU hotplug fixes from Ingo Molnar:\n\n - Fix CPU hotplug error handling rollback bug (Bradley Morgan)\n\n - Fix possible output OOB write bug in the sysfs hotplug states\n printing code (Bradley Morgan)\n\n* tag \u0027smp-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n cpu: hotplug: Bound hotplug states sysfs output\n cpu: hotplug: Preserve per instance callback errors\n" }, { "commit": "d88eb9b84343b5f8d1b39b6c83280ce8aaeab6d8", "tree": "0bc63cbf685bdb75d5c92064e2a57c87bf74a7e8", "parents": [ "d1c4b50f88d7a85c5d028800778b21441673e2cc", "e62d4192e593630f355094adc467058a05bdc935" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:25:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:25:23 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf event fix from Ingo Molnar:\n\n - Fix event::addr_filter_ranges lifetime bug (Peter Zijlstra)\n\n* tag \u0027perf-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Fix addr_filter_ranges lifetime\n" }, { "commit": "d1c4b50f88d7a85c5d028800778b21441673e2cc", "tree": "58a8fcf0f2d01b5f8e66e657e56f13085ccf5dbb", "parents": [ "90ae888a372957765fb3523fbead3baca55264d1", "89038cc87d80c77e7aa6f42a64b2573b74af339f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:15:53 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:15:53 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fix from Ingo Molnar:\n\n - Fix the incorrect RCU protection in rt_spin_unlock() (Thomas\n Gleixner)\n\n* tag \u0027locking-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\n" }, { "commit": "90ae888a372957765fb3523fbead3baca55264d1", "tree": "b4ffcf1d94333007a2df603d4cdd36480ea71daa", "parents": [ "b59e4cae34bfc7f6770047e4dba05faa0780c745", "b81dde13cc163450dcb402dcc915ef13ba241e01" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:05:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:05:54 2026 -0700" }, "message": "Merge tag \u0027core-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc core fixes from Ingo Molnar:\n\n - Fix an MM-CID race that can cause an OOB write (Rik van Riel)\n\n - Fix a debugobjects OOM handling race (Thomas Gleixner)\n\n* tag \u0027core-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n debugobjects: Plug race against a concurrent OOM disable\n sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path\n" }, { "commit": "b59e4cae34bfc7f6770047e4dba05faa0780c745", "tree": "7117aa93aa718cce3f90d2b6b06786a30a35edfc", "parents": [ "558ef39aeb9a089a6be9dda8413b0b9d42e843ea", "865730eec5435ce40a5dc3c615077d04c8f95098" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:02:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 16:02:03 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc irqchip driver fixes from Ingo Molnar:\n\n - Fix indexing bug in the Crossbar irqchip driver (Bhargav Joshi)\n\n - Fix a parent domain resource leak in the Crossbar irqchip driver\n (Bhargav Joshi)\n\n - Fix resource leak in the ImgTec PDC irqchip driver\u0027s exit logic\n (Qingshuang Fu)\n\n - Fix macro name in comment block (Ethan Nelson-Moore)\n\n* tag \u0027irq-urgent-2026-06-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n genirq/msi: Correct CONFIG_PCI_MSI_ARCH_FALLBACKS macro name in comment\n irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove\n irqchip/crossbar: Fix parent domain resource leak\n irqchip/crossbar: Use correct index in crossbar_domain_free()\n" }, { "commit": "558ef39aeb9a089a6be9dda8413b0b9d42e843ea", "tree": "e1e74a1737d7599ad4f6954e1b0b171df18cc5c9", "parents": [ "62cf248de32f061d99cf7cd1675419d739031c5e", "7524fe142b5a772f8421aeee2132cf7e21a00103" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 15:51:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 15:51:14 2026 -0700" }, "message": "Merge tag \u0027dmaengine-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine\n\nPull dmaengine updates from Vinod Koul:\n \"Core:\n - New devm_of_dma_controller_register() API\n - Refactor devm_dma_request_chan() API\n\n New Support:\n - Loongson Multi-Channel DMA controller support\n - Renesas RZ/{T2H,N2H} support\n - Dw CV1800B DMA support\n - Switchtec DMA engine driver\n\n U pdates:\n - Xilinx AXI dma binding conversion\n - Renesas CHCTRL register read updates\n - AMD MDB Endpoint and non-LL mode Support\n - AXI dma handling of SW and HW cyclic transfers termination\n - Intel ioatdma and idxd driver updates\"\n\n* tag \u0027dmaengine-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (62 commits)\n dt-bindings: dma: snps,dw-axi-dmac: Add fallback compatible for CV1800B\n MAINTAINERS: dmaengine/ti: Remove myself and add Vignesh as maintainer\n dmaengine: qcom: Unify user-visible \"Qualcomm\" name\n dt-bindings: dma: qcom,gpi: Document GPI DMA engine for Shikra SoC\n dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks\n dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc\n dmaengine: dw-axi-dmac: drop redundant DMAC enable in block start\n dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes\n dt-bindings: dma: fsl-edma: add dma-channel-mask property description\n dmaengine: tegra: Fix burst size calculation\n dmaengine: iop32x-adma: Remove a leftover header file\n dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor\n dmaengine: dma-axi-dmac: Drop struct clk from main struct\n dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc\n dmaengine: Fix possible use after free\n dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK\n dmaengine: dw-edma-pcie: Reject devices without driver data\n dmaengine: sh: rz-dmac: Add DMA ACK signal routing support\n irqchip/renesas-rzv2h: Add DMA ACK signal routing support\n dmaengine: dw-edma: Remove dw_edma_add_irq_mask()\n ...\n" }, { "commit": "62cf248de32f061d99cf7cd1675419d739031c5e", "tree": "606dc919b1548413a4f5e5a882708661ac5d4425", "parents": [ "240303e47f48f434b5dd4a35d6d242856e23fa22", "2ace2e949979b82f82f12dd76d7c5a6145246ca3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 15:41:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 15:41:48 2026 -0700" }, "message": "Merge tag \u0027phy-for-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy\n\nPull phy updates from Vinod Koul:\n \"Bunch of new driver, device support in existing drivers/binding and\n few updates to existing drivers\n\n New Support:\n - Qualcomm Eliza QMP PHY, Eliza Synopsys eUSB2 support, Eliza PCIe\n phy support, Nord QMP UFS PHY, IPQ5210 USB3 PHY support\n - Econet EN751221 and EN7528 PCIe phy support\n - NXPs TJA1145 CAN transceiver phy support\n - TI DS125DF111 retimer phy support\n - Rockchip RK3528 usb phy support\n - TI J722S phy support\n - Axiado eMMC PHY driver\n - EyeQ5 Ethernet PHY driver\n - Generic PHY driver for Lynx 10G SerDes\n - Spacemit K3 USB2 PHY support\n\n Updates:\n - Tomi helping maintian zynqmp phys\n - lynx phy updates to support 25GBASER\n - Rockchip GRF for RK3568/RV1108 support\n - Qualcomm QSERDES COM v2 support\"\n\n* tag \u0027phy-for-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (87 commits)\n phy: rockchip: inno-usb2: Add missing clkout_ctl_phy kerneldoc\n phy: Move MODULE_DEVICE_TABLE next to the table itself\n phy: add basic support for NXPs TJA1145 CAN transceiver\n dt-bindings: phy: add support for NXPs TJA1145 CAN transceiver\n phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path\n dt-bindings: phy: qcom,qmp-usb: Add ipq5210 USB3 PHY\n dt-bindings: phy: qcom,qusb2: Document IPQ5210 compatible\n phy: freescale: phy-fsl-imx8qm-lvds-phy: Use synchronous PM runtime put in reset\n MAINTAINERS: expand Lynx 28G entry to cover Lynx 10G SerDes\n phy: lynx-10g: new driver\n dt-bindings: phy: lynx-10g: initial document\n phy: lynx-28g: improve phy_validate() procedure\n phy: lynx-28g: optimize read-modify-write operation\n phy: lynx-28g: add support for big endian register maps\n phy: lynx-28g: common probe() and remove()\n phy: lynx-28g: make lynx_28g_pll_read_configuration() callable per PLL\n phy: lynx-28g: move struct lynx_info definitions downwards\n phy: lynx-28g: provide default lynx_lane_supports_mode() implementation\n phy: lynx-28g: generalize protocol converter accessors\n phy: lynx-28g: common lynx_pll_get()\n ...\n" }, { "commit": "240303e47f48f434b5dd4a35d6d242856e23fa22", "tree": "139b6f7caa135df786ef45609900d161a3fbbd13", "parents": [ "7603d8e78023e5883e075b4625fbdf059c6384f7", "4dab2b904414fac53535c4e4cdad808132f4cdc2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 13:58:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 13:58:38 2026 -0700" }, "message": "Merge tag \u0027soundwire-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire\n\nPull soundwire updates from Vinod Koul:\n\n - Improvements in handling of soundwire groups\n\n - Additional checks flagged by various tools\n\n - Intel driver updates for ghost Realtek device handling in firmware\n and adding devices to wake lists\n\n* tag \u0027soundwire-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:\n soundwire: dmi-quirks: Disable ghost Realtek devices\n soundwire: only handle alert events when the peripheral is attached\n soundwire: intel_ace2x: release bpt_stream when close it\n soundwire: intel: Move suspend tracking from trigger to pm suspend\n soundwire: intel_auxdevice: Add es9356 to wake_capable_list\n soundwire: use krealloc_array to prevent integer overflow\n soundwire: increase group-\u003emax_size after allocation\n soundwire: fix bug in sdw_add_element_group_count found by syzkaller\n soundwire: don\u0027t program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral\n soundwire: validate DT compatible before parsing it\n soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list\n soundwire: stream: sdw_stream_remove_slave(): Check stream is valid\n" }, { "commit": "7603d8e78023e5883e075b4625fbdf059c6384f7", "tree": "be2df135ed8bacad0a458e1ee01401db028945a3", "parents": [ "a1a8bab74176eed204a3139ab7ad840caa3d73b8", "4437ad129cf5b37c00a5bc9fa5989d1da4d64d07" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 13:36:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 13:36:09 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext tree reorg from Tejun Heo:\n \"Pure source reorganization with no functional change:\n\n - the kernel/sched/ext* files move into a new kernel/sched/ext/\n subdirectory\n\n - the headers and sources are made self-contained so editor tooling\n can parse each file on its own\"\n\n* tag \u0027sched_ext-for-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Move shared helpers from ext.c into internal.h and cid.h\n sched_ext: Make kernel/sched/ext/ sources self-contained for clangd\n sched_ext: Move sources under kernel/sched/ext/\n" }, { "commit": "a1a8bab74176eed204a3139ab7ad840caa3d73b8", "tree": "b5cc4bbcac5ae4d7328aa4d8a088d7f6f2a465ab", "parents": [ "05d2a3da153bc08c5fe7937584b5d86505747b9e", "13a1e1a618858407fa12c391f664ea750651f6b2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 12:03:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 12:03:44 2026 -0700" }, "message": "Merge tag \u0027mm-stable-2026-06-23-08-55\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull more MM updates from Andrew Morton:\n\n - \"khugepaged: add mTHP collapse support\" (Nico Pache)\n\n Provide khugepaged with the capability to collapse anonymous memory\n regions to mTHPs\n\n - \"Remove CONFIG_READ_ONLY_THP_FOR_FS and enable file THP for writable\n files\" (Zi Yan)\n\n Remove the READ_ONLY_THP_FOR_FS check in file_thp_enabled(), so that\n khugepaged and MADV_COLLAPSE can run on filesystems with PMD THP\n pagecache support even without READ_ONLY_THP_FOR_FS enabled\n\n - \"make MM selftests more CI friendly\" (Mike Rapoport)\n\n General fixes and cleanups to the MM selftests. Also move more MM\n selftests under the kselftest framework, making them more amenable to\n ongoing CI testing\n\n - \"selftests/mm: fix failures and robustness improvements\" and\n \"selftests/mm: assorted fixes for hmm-tests\" (Sayali Patil)\n\n Fix several issues in MM selftests which were revealed by powerpc 64k\n pagesize\n\n* tag \u0027mm-stable-2026-06-23-08-55\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (118 commits)\n Revert \"mm: limit filemap_fault readahead to VMA boundaries\"\n mm/vmscan: pass NULL to trace vmscan node reclaim\n mm: use mapping_mapped to simplify the code\n selftests/mm: fix exclusive_cow test fork() handling\n selftests/mm: remove hardcoded THP sizing assumptions in hmm tests\n selftests/mm: allow PUD-level entries in compound testcase of hmm tests\n mm/gup_test: reject wrapped user ranges\n mm/page_frag: reject invalid CPUs in page_frag_test\n mm/damon/core: always put unsuccessfully committed target pids\n mm: page_isolation: avoid unsafe folio reads while scanning compound pages\n mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()\n selftests: mm: fix and speedup \"droppable\" test\n mm: merge writeout into pageout\n MAINTAINERS: add Hao Ge as reviewer for codetag and alloc_tag\n selftests/mm: clarify alternate unmapping in compaction_test\n selftests/mm: move hwpoison setup into run_test() and silence modprobe output for memory-failure category\n selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero\n selftests/mm: skip uffd-wp-mremap if UFFD write-protect is unsupported\n selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap\n selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap\n ...\n" }, { "commit": "05d2a3da153bc08c5fe7937584b5d86505747b9e", "tree": "69fe4a48b15fe7eb1b74d2298df710f4dbbd8b44", "parents": [ "f31c00c377ccf07c85442712f7c940a855cb3371", "3287a1881ca528b89b964d9fa6d28880d277d9e2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 11:34:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 11:34:49 2026 -0700" }, "message": "Merge tag \u0027perf-tools-for-v7.2-1-2026-06-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools\n\nPull perf tools updates from Arnaldo Carvalho de Melo:\n\n - Introduce \u0027perf inject --aslr\u0027 to remap ASLR-randomized addresses in\n perf.data files, enabling reproducible analysis across runs with\n different address space layouts\n\n - Refactor evsel out of sample processing paths: store evsel in struct\n perf_sample and remove the redundant evsel parameter from tool APIs,\n tracepoint handlers, hist entry iterators, and db-export, simplifying\n the entire tool callback chain\n\n - Switch architecture detection from string-based perf_env__arch()\n comparisons to the numeric ELF e_machine field across the codebase\n (capstone, print_insn, c2c, lock-contention, sort, sample-raw,\n machine, header), making cross-analysis more robust\n\n - Overhaul ARM CoreSight ETM tests: add deterministic and named_threads\n workloads, speed up basic and disassembly tests, add process\n attribution and concurrent threads tests, remove unused workloads and\n duplicate tests, queue context packets for the frontend decoder\n\n - Add ARM SPE IMPDEF event decoding for Arm Neoverse N1, store MIDR in\n arm_spe_pkt for per-CPU event mapping, handle missing CPU IDs\n gracefully\n\n - Refactor libunwind support: remove the libunwind-local backend, make\n register reading cross-platform, add RISC-V libunwind support, allow\n dynamic selection between libdw and libunwind unwinding at runtime\n\n - Extensive hardening of perf.data parsing against crafted files: add\n bounds checks and byte-swap validation for session records, feature\n sections, header attributes, BPF metadata, auxtrace errors,\n compressed events, CPU maps, build ID notes, and ELF program headers.\n Add minimum event size validation and file offset diagnostics\n\n - Fix libdw API contract violations across dwarf-aux, libdw,\n probe-finder, annotate-data, and debuginfo subsystems. Fix callchain\n parent update in ORDER_CALLER mode, support DWARF line 0 in inline\n lists, handle multiple address spaces in callchains\n\n - Fix numerous \u0027perf sched\u0027 bugs: thread reference leaks, memory leaks,\n heap overflows with cross-machine recordings, NULL dereferences,\n replace BUG_ON assertions with graceful error handling, bounds-check\n CPU indices, fix SIGCHLD vs pause() races in sched stats\n\n - Overhaul the build system: move BPF skeleton generation out of\n Makefile.perf into bpf_skel.mak, decouple pmu-events from the prepare\n target, make beauty generated C code standalone .o files, compile BPF\n skeletons with -mcpu\u003dv3, fix continuous rebuilds, various cleanups\n\n - Add \u0027perf test\u0027 JUnit XML reporting with -j/--junit option, split\n monolithic test suites into sub-tests, add summary reporting,\n refactor parallel poll loop, fix test failures on musl-based systems\n\n - Fix \u0027perf c2c\u0027 memory leaks in hist entry and format list handling,\n use-after-free in error paths, bounds-check CPU and node IDs\n\n - Fix \u0027perf bpf\u0027 metadata leaks on duplicate insert and alloc failure,\n bounds-check array offsets, validate event sizes and func_info\n fields, add NULL checks\n\n - Fix hwmon PMU: off-by-one null termination on sysfs reads, strlcpy\n buffer overflow in parse_hwmon_filename(), fd 0 check, empty label\n reads, scnprintf usage\n\n - Fix symbols subsystem: bounds-check ELF and sysfs build ID note\n iteration, validate p_filesz, fix 32-bit ELF bswap error, fix signed\n overflow in size checks, bounds-check .gnu_debuglink section\n\n - Fix tools lib api: null termination in filename__read_int/ull(),\n uninitialized stack data in filename__write_int(), snprintf\n truncation in mount_overload()\n\n - Replace libbabeltrace with babeltrace2-ctf-writer for CTF conversion\n in \u0027perf data\u0027\n\n - Add RISC-V SDT argument parsing for static tracepoints\n\n - Add \u0027perf trace --show-cpu\u0027 option to display CPU id\n\n - Add \u0027perf bench sched pipe --write-size\u0027 option\n\n - Add a perf-specific .clang-format that overrides some kernel style\n behaviors\n\n - Update Intel vendor events for Alder Lake, Arrow Lake, Clearwater\n Forest, Emerald Rapids, Granite Rapids, Grand Ridge, Lunar Lake,\n Meteor Lake, Panther Lake, Sapphire Rapids, Sierra Forest\n\n - Add IOMMU metrics for AMD and Intel\n\n - Fix AMD event: switch l2_itlb_misses to\n bp_l1_tlb_miss_l2_tlb_miss.all\n\n - Add AMD IBS improvements: decode Streaming-store and Remote-Socket\n flags, suppress bogus fields on Zen4+, skip privilege test on Zen6+\n\n - Fix \u0027perf lock contention\u0027 SIGCHLD vs pause() race, allow \u0027mmap_lock\u0027\n in -L filter, enable end-timestamp for cgroup aggregation, fix\n non-atomic data updates\n\n - Fix \u0027perf stat\u0027 false NMI watchdog warning in aggregation modes,\n bounds-check CPU index in topology callbacks, add aggr_nr metric\n parser support for uncore scaling\n\n - Fix \u0027perf timechart\u0027 memory leaks, CPU bounds checking,\n use-after-free on corrupted callchains\n\n - Fix \u0027perf inject\u0027 itrace branch stack synthesis, fix synthesized\n sample size with branch stacks\n\n - Fix DSO heap overflow on decompressed paths, uninitialized pathname\n on fallback, set proper error codes\n\n - Fix various snprintf/scnprintf usages to prevent buffer overflows and\n truncation across the codebase\n\n - Fix off-by-one stack buffer overflow in kallsyms__parse()\n\n - Fix \u0027perf kwork\u0027 memory management, address sanitizer issues, bounds\n check work-\u003ecpu\n\n - Fix \u0027perf tpebs\u0027 concurrent stop races and PID reuse hazards\n\n - Add O_CLOEXEC to open() calls and use mkostemp() for temporary files\n to prevent file descriptor leaks to child processes\n\n - Fix s390 Python extension TEXTREL by compiling as PIC\n\n - Fix build with ASAN for jitdump\n\n - Fix build failure due to btf_vlen() return type change\n\n* tag \u0027perf-tools-for-v7.2-1-2026-06-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (343 commits)\n perf bpf: Fix up build failure due to change of btf_vlen() return type\n perf dso: Set standard errno on decompression failure\n perf bpf: Validate array presence before casting BPF prog info pointers\n perf c2c: Fix hist entry and format list leaks in c2c_he_free()\n perf c2c: Free format list entries when c2c_hists__init() fails\n perf cs-etm: Bounds-check CPU in cs_etm__get_queue()\n perf cs-etm: Require full global header in auxtrace_info size check\n perf cs-etm: Validate num_cpu before metadata allocation\n perf machine: Use snprintf() for guestmount path construction\n perf machine: Propagate machine__init() error to callers\n perf trace: Guard __probe_ip suppression with evsel__is_probe()\n perf evsel: Add lazy-initialized probe type detection helpers\n perf evsel: Add no-libtraceevent stubs for evsel__field() and evsel__common_field()\n perf cs-etm: Reject CPU IDs that would overflow signed comparison\n perf c2c: Free format list entries when releasing c2c hist entries\n perf bpf: Bounds-check array offsets in bpil_offs_to_addr()\n perf bpf: Reject oversized BPF metadata events that truncate header.size\n perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()\n perf sched: Replace (void*)1 sentinel with proper runtime allocation\n perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()\n ...\n" }, { "commit": "f31c00c377ccf07c85442712f7c940a855cb3371", "tree": "b0b5057c5bf7783936bf130f26dfc7c539baf2d2", "parents": [ "515db262143e48f09b5dce07bc0db67b8b4d6a73", "50022e56dc89fbf1ec22826edf03dc2e5b9076cc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 08:31:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 08:31:33 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver updates from Ilpo Järvinen:\n\n - amd/hfi: Add support for dynamic ranking tables (version 3)\n\n - amd/pmc:\n - Add PMC driver support for AMD 1Ah M80H SoC\n - Delay suspend for some Lenovo Laptops to avoid keyboard and lid\n switch problems after s2idle\n\n - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver\n\n - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR\n\n - asus-wmi: add keystone dongle support\n\n - dell-dw5826e: Add reset driver for DW5826e\n\n - dell-laptop: Fix rollback path\n\n - hp-wmi:\n - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F\n\n - intel-hid:\n - Add HP ProBook x360 440 G1 5 button array support\n - Prevent racing ACPI notify handlers\n\n - intel/pmc:\n - Add Nova Lake support\n - Rate-limit LTR scale-factor warning\n\n - intel-uncore-freq:\n - Expose instance ID in the sysfs\n - Fix current_freq_khz after CPU hotplug\n\n - intel/vsec: Restore BAR fallback for header walk\n\n - ISST: Restore SST-PP control to all domains\n\n - lenovo-wmi-*:\n - Add more CPU tunable attributes\n - Add GPU tunable attributes\n - Add WMI battery charge limiting\n\n - oxpec: add support for OneXPlayer Super X\n\n - sel3350-platform: Retain LED state on load and unload\n\n - surface: SAM: Add support for Surface Pro 12in\n\n - uniwill-laptop: Add support for battery charge modes\n\n - tools/power/x86/intel-speed-select: Harden daemon pidfile open\n\n - Major refactoring efforts:\n - ACPI driver to platform driver conversion\n - Converting drivers to use the improved WMI API\n\n - Miscellaneous cleanups / refactoring / improvements\n\n* tag \u0027platform-drivers-x86-v7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (115 commits)\n platform/x86/intel/pmc: Add NVL PCI IDs for SSRAM telemetry discovery\n platform/x86/intel/pmc/ssram: Make PMT registration optional\n platform/x86/intel/pmc/ssram: Add ACPI discovery scaffolding\n platform/x86/intel/pmc/ssram: Switch to static array with per-index probe state\n platform/x86/intel/pmc/ssram: Refactor DEVID/PWRMBASE extraction into helper\n platform/x86/intel/pmc/ssram: Add PCI platform data\n platform/x86/intel/pmc/ssram: Rename probe and PCI ID table for consistency\n platform/x86/intel/pmc: Add ACPI PWRM telemetry driver for Nova Lake S\n platform/x86/intel/pmc: Add PMC SSRAM Kconfig description\n platform/x86/intel/pmt: Unify header fetch and add ACPI source\n platform/x86/intel/pmt: Cache the telemetry discovery header\n platform/x86/intel/pmt: Pass discovery index instead of resource\n platform/x86/intel/pmt/telemetry: Move overlap check to post-decode hook\n platform/x86/intel/pmt/crashlog: Split init into pre-decode\n platform/x86/intel/pmt: Add pre/post decode hooks around header parsing\n modpost: Handle malformed WMI GUID strings\n platform/wmi: Make sysfs attributes const\n platform/wmi: Make wmi_bus_class const\n hwmon: (dell-smm) Use new buffer-based WMI API\n platform/x86: dell-ddv: Use new buffer-based WMI API\n ...\n" }, { "commit": "515db262143e48f09b5dce07bc0db67b8b4d6a73", "tree": "5c61af225c1b95bbc18e96131ca7335866e7f552", "parents": [ "16b2087efdddd0bf042accdbdcc8eedc21bf9227", "36cac4b5101f8ecbc851356df175b99543c84ec6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 07:47:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 07:47:40 2026 -0700" }, "message": "Merge tag \u0027mailbox-v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox\n\nPull mailbox updates from Jassi Brar:\n \"Core:\n - add debugfs support for used channels\n - fix resource leak on startup failure\n - propagate tx error codes\n - clarify blocking mode thread support\n\n Drivers:\n - exynos: remove unused register definitions\n - imx: refactor IRQ handlers, migrate to devm helpers, and other\n minor improvements\n - mpfs: fix syscon presence check in inbox ISR\n - mtk-adsp: fix use-after-free during device teardown\n - qcom: add dt-bindings for QCOM Maili, Hawi, Shikra APCS, and Nord\n CPUCP platform support\"\n\n* tag \u0027mailbox-v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: (23 commits)\n mailbox: imx: Don\u0027t force-thread the primary handler\n mailbox: imx: Move the RXDB part of the mailbox into the threaded handler\n mailbox: imx: Move the RX part of the mailbox into the threaded handler\n mailbox: imx: Start splitting the IRQ handler in primary and threaded handler\n mailbox: imx: Use channel index instead of zero in imx_mu_specific_rx()\n mailbox: imx: use devm_of_platform_populate()\n mailbox: imx: Use devm_pm_runtime_enable()\n mailbox: imx: Add a channel shutdown field\n mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()\n dt-bindings: mailbox: qcom: Add IPCC support for Maili Platform\n mailbox: add list of used channels to debugfs\n mailbox: don\u0027t free the channel if the startup callback failed\n mailbox: Make mbox_send_message() return error code when tx fails\n mailbox: Clarify multi-thread is not supported in blocking mode\n mailbox: mtk-adsp: fix UAF during device teardown\n mailbox: qcom: Unify user-visible \"Qualcomm\" name\n mailbox: exynos: Drop unused register definitions\n dt-bindings: mailbox: qcom: Add IPCC support for Hawi Platform\n dt-bindings: mailbox: qcom,cpucp-mbox: Add Hawi compatible\n dt-bindings: mailbox: qcom: Add Shikra APCS compatible\n ...\n" }, { "commit": "16b2087efdddd0bf042accdbdcc8eedc21bf9227", "tree": "4a17759f672723b585b45bd8f4293402e8d3bacb", "parents": [ "3eb20a97b315a9fd5fea33c207c51823f22c2b4d", "1a58f6115bfb34eabcc7de8a3a9745b219179781" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 07:39:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 07:39:49 2026 -0700" }, "message": "Merge tag \u0027for-next-tpm-7.2-rc1-fixed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull tpm updates from Jarkko Sakkinen:\n \"Only bug fixes\"\n\n* tag \u0027for-next-tpm-7.2-rc1-fixed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n tpm: fix event_size output in tpm1_binary_bios_measurements_show\n tpm: tpm_crb_ffa: revert defered_probed when tpm_crb_ffa is built-in\n tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt\n tpm: tpm_tis: Add settle time for some TPMs\n tpm: tpm_tis: store entire did_vid\n tpm_crb: Check ACPI_COMPANION() against NULL during probe\n tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()\n tpm: Initialize name_size_alg for non-NULL name in tpm_buf_append_name()\n tpm: restore timeout for key creation commands\n tpm: svsm: constify tpm_chip_ops\n" }, { "commit": "3eb20a97b315a9fd5fea33c207c51823f22c2b4d", "tree": "2bb04b95d1b518b7e3586bfbbf3fc821b9ba84e9", "parents": [ "502d801f0ab03e4f32f9a33d203154ce84887921", "fbb7ad31ab376c5101b2ac7205fad0344fd2de60" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 07:35:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 23 07:35:37 2026 -0700" }, "message": "Merge tag \u0027linux_kselftest-next-7.2-rc1-second\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull more kselftest updates from Shuah Khan:\n \"Docs:\n -remove obsolete wiki link from kselftest.rst\n\n ftrace:\n - drop invalid top-level local in test_ownership\n - Fix trace_marker_raw test on 64K page kernels\"\n\n* tag \u0027linux_kselftest-next-7.2-rc1-second\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n docs: kselftest: remove link to obsolete wiki\n selftests/ftrace: Fix trace_marker_raw test on 64K page kernels\n selftests/ftrace: Drop invalid top-level local in test_ownership\n" }, { "commit": "502d801f0ab03e4f32f9a33d203154ce84887921", "tree": "8dd98de794f62fae7a0a5117ed232c6edc478fe2", "parents": [ "4708cac0e22cfd217f48f7cec3c35e5922efcccd", "803d09a554055aba160a62abd1e4b1260b899dc1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 18:44:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 18:44:48 2026 -0700" }, "message": "Merge tag \u0027erofs-for-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs updates from Gao Xiang:\n \"The most notable change is the removal of the fscache backend: it has\n been deprecated for almost two years, mainly because EROFS file-backed\n mounts and fanotify pre-content hooks (together with erofs-utils) now\n provide better functionality and simpler codebase. In addition,\n fscache has depended on netfslib for years, which is undesirable for\n EROFS since it is a local filesystem. More details in [1].\n\n In addition, sparse support has been added to the pcluster layout,\n which is helpful for large sparse AI datasets, and map requests for\n chunk-based inodes have been optimized to be more efficient as well.\n There are also the usual fixes and cleanups.\n\n Summary:\n\n - Report more consecutive chunks of the same type for\n each iomap request\n\n - Add sparse support for the pcluster layout\n\n - Update the EROFS documentation overview\n\n - Remove the deprecated fscache backend\n\n - Various fixes and cleanups\"\n\nLink: https://lore.kernel.org/r/20260622013622.934174-1-hsiangkao@linux.alibaba.com [1]\n\n* tag \u0027erofs-for-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: handle 48-bit blocks_hi for compressed inodes\n erofs: remove fscache backend entirely\n erofs: simplify RCU read critical sections\n erofs: add sparse support to pcluster layout\n erofs: add folio order to trace_erofs_read_folio\n erofs: introduce erofs_map_chunks()\n erofs: call erofs_exit_ishare() before rcu_barrier()\n erofs: update the overview of the documentation\n erofs: clean up erofs_ishare_fill_inode()\n" }, { "commit": "4437ad129cf5b37c00a5bc9fa5989d1da4d64d07", "tree": "a69f00dce59f6d66e1a621d90d113c8e1b38543a", "parents": [ "3cd1f76be638b7386201171e7bb4c88095774dd5" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Jun 22 07:29:39 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Jun 22 10:41:34 2026 -1000" }, "message": "sched_ext: Move shared helpers from ext.c into internal.h and cid.h\n\nidle.c and cid.c are included into build_policy.c together with ext.c and\nuse helpers that ext.c defines. Because the helpers live in ext.c, the two\nfiles can not parse as standalone units and clangd reports errors in them.\n\nMove the helpers to the headers they belong to. The op-dispatch macros and\nhelpers plus scx_parent() to internal.h, and scx_cpu_arg()/scx_cpu_ret() to\ncid.h. No functional change. idle.c and cid.c now parse clean standalone.\n\nSuggested-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "3cd1f76be638b7386201171e7bb4c88095774dd5", "tree": "8a05618fe2d5d1ab2a1d22f19279df61b559f9b9", "parents": [ "bba2c3615bd6cfee7456d1130f2e6b01b3f4e9ba" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Jun 22 07:29:39 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Jun 22 10:41:26 2026 -1000" }, "message": "sched_ext: Make kernel/sched/ext/ sources self-contained for clangd\n\nThe sources under kernel/sched/ext/ build as a single translation unit:\nbuild_policy.c includes the source files and headers. An LSP/clangd editor\nparses each as a standalone unit, sees no types, and reports a flood of\nerrors.\n\nGive each header its dependencies and include guard, and have each source\ninclude the headers it uses.\n\next.c, arena.c and the ext headers now parse clean standalone. idle.c and\ncid.c still reference a few macros and helpers defined in ext.c. The next\npatch moves those to shared headers.\n\nSuggested-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "865730eec5435ce40a5dc3c615077d04c8f95098", "tree": "8b87580ce2b6fc3cc198afb6aac8bcafc52b64ac", "parents": [ "37738fdf2ab1e504d1c63ce5bc0aeb6452d8f057" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Sat Jun 13 14:35:43 2026 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Jun 22 22:32:01 2026 +0200" }, "message": "genirq/msi: Correct CONFIG_PCI_MSI_ARCH_FALLBACKS macro name in comment\n\nA comment in kernel/irq/msi.c incorrectly refers to\nCONFIG_PCI_MSI_ARCH_FALLBACK instead of CONFIG_PCI_MSI_ARCH_FALLBACKS.\nCorrect it.\n\nDiscovered while searching for CONFIG_* symbols referenced in code but\nnot defined in any Kconfig file.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nLink: https://patch.msgid.link/20260613213544.90613-1-enelsonmoore@gmail.com\n" }, { "commit": "4275b59673eb60b02eec3997816c83f1f4b909c4", "tree": "26f2083c59c93074d4d3317397d87b9fcf217deb", "parents": [ "5ef5bc304f23c3fe255d4936472378dcb74d0e94" ], "author": { "name": "Sunmin Jeong", "email": "s_min.jeong@samsung.com", "time": "Mon Jun 22 14:28:17 2026 +0900" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:55:27 2026 +0000" }, "message": "f2fs: fix to round down start offset of fallocate for pin file\n\nCurrently, the length of fallocate for pin file is section-aligned to\nkeep allocated sections from being selected as victims of GC. However,\nfor the case that the start offset of fallocate is not aligned in\nsection, the allocated sections can\u0027t be fully utilized. It\u0027s because a\nnew section is allocated by f2fs_allocate_pinning_section() after using\nblks_per_sec blocks regardless of the start offset. As a result, several\nunexpected dirty segments may be created, including blocks assigned to\nthe pinned file.\n\nTo address this issue, let\u0027s round down the start offset of fallocate\nto the length of section.\n\nThe reproducing scenario is as below\n\nchunk\u003d$(((2\u003c\u003c20)+4096)) # 2MB + 4KB\ntouch test\nf2fs_io pinfile set test\nf2fs_io fallocate 0 0 $chunk test\nf2fs_io fallocate 0 $chunk $chunk test\nf2fs_io fallocate 0 $((chunk*2)) $chunk test\nf2fs_io fiemap 0 $((chunk*3)) test\n\nFiemap: offset \u003d 0 len \u003d 12288\n logical addr. physical addr. length flags\n0 0000000000000000 000000068c600000 0000000000400000 00001088\n1 0000000000400000 000000003d400000 0000000000001000 00001088\n2 0000000000401000 00000003eb200000 0000000000200000 00001088\n3 0000000000601000 00000005e4200000 0000000000001000 00001088\n4 0000000000602000 0000000605400000 0000000000200000 00001089\n\nCc: stable@vger.kernel.org\nFixes: f5a53edcf01e (\"f2fs: support aligned pinned file\")\nReviewed-by: Yunji Kang \u003cyunji0.kang@samsung.com\u003e\nReviewed-by: Yeongjin Gil \u003cyoungjin.gil@samsung.com\u003e\nReviewed-by: Sungjong Seo \u003csj1557.seo@samsung.com\u003e\nSigned-off-by: Sunmin Jeong \u003cs_min.jeong@samsung.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "5ef5bc304f23c3fe255d4936472378dcb74d0e94", "tree": "b3df8a93ba973ec0b8ebb188c55ed4aee23b2d14", "parents": [ "34636c6dcd6f75570c553a4188b5dbe0f758159a" ], "author": { "name": "Keshav Verma", "email": "iganschel@gmail.com", "time": "Mon Jun 22 20:44:21 2026 +0530" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:55:27 2026 +0000" }, "message": "f2fs: fix listxattr handling of corrupted xattr entries\n\nValidate the xattr entry before reading its fields in f2fs_listxattr().\nReturn -EFSCORRUPTED when the entry is outside the valid xattr storage\narea instead of returning a successful partial result.\n\nFixes: 688078e7f36c (\"f2fs: fix to avoid memory leakage in f2fs_listxattr\")\nCc: stable@kernel.org\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Keshav Verma \u003ciganschel@gmail.com\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "34636c6dcd6f75570c553a4188b5dbe0f758159a", "tree": "be26f8d3799e009178f5f1ad50305880508b792b", "parents": [ "70210492be5ac8e4f42b383b75dfa11810afab86" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Tue Jun 16 11:06:55 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:38 2026 +0000" }, "message": "f2fs: skip direct I/O iostat context when disabled\n\nF2FS iostat is optional and is disabled by default. Direct I/O still\nallocates and binds a bio_iostat_ctx, updates the submit timestamp, and\nreplaces bi_end_io for every DIO bio even when sbi-\u003eiostat_enable is\nfalse.\n\nThe byte accounting calls do not need an extra guard because\nf2fs_update_iostat() already checks sbi-\u003eiostat_enable. Only skip the\nDIO bio context setup when iostat is disabled. If iostat is enabled\nthrough sysfs before submission, the existing context allocation and\nlatency accounting path is still used.\n\nQEMU benchmark on a 1GiB F2FS virtio-blk image, with iostat_enable\u003d0,\n4KiB O_DIRECT I/O over a 64MiB file, 50000 iterations per run:\n\n baseline patched\n direct_read median 65264.50 ns 55470.95 ns\n direct_read recheck 65553.75 ns 55470.95 ns\n direct_write median 68054.62 ns 56309.44 ns\n direct_write recheck 66873.51 ns 56309.44 ns\n\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "70210492be5ac8e4f42b383b75dfa11810afab86", "tree": "15f56bfddc67b2011b1e0938d2e839c50a8ce7e1", "parents": [ "8b938ae6f0766559dfc4ad5acac958b1eff8664d" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon Jun 15 21:08:22 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:38 2026 +0000" }, "message": "f2fs: remove unneeded f2fs_is_compressed_page()\n\nWe have checked f2fs_is_compressed_page() before f2fs_compress_write_end_io(),\nso we don\u0027t need to check the status again, remove it.\n\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "8b938ae6f0766559dfc4ad5acac958b1eff8664d", "tree": "44d993bb3221188722ca068b7345b0465923f092", "parents": [ "cf716276b0dca934aad5fe3c46df04e1dc596734" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon Jun 15 21:08:20 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:38 2026 +0000" }, "message": "f2fs: avoid unnecessary fscrypt_finalize_bounce_page()\n\nfscrypt_finalize_bounce_page() should be called only if we use fs layer\ncrypto, let\u0027s avoid unnecessary fscrypt_finalize_bounce_page() in error\npath of f2fs_write_compressed_pages().\n\nBTW, fscrypt_finalize_bounce_page() will check mapping of bounced page\nbefore retrieving original page, so, previously it won\u0027t cause any issue\nw/ fscrypt_finalize_bounce_page(), but still we\u0027d better avoid coupling\nw/ any logic inside fscrypt_finalize_bounce_page().\n\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "cf716276b0dca934aad5fe3c46df04e1dc596734", "tree": "68353aacf9c1fc75fa9f2f611114245648bfe6d8", "parents": [ "d27e4431023770249a341aeb94cb40f4ff12b21e" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon Jun 15 21:08:19 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:38 2026 +0000" }, "message": "f2fs: avoid unnecessary sanity check on ckpt_valid_blocks\n\nThe calculation of sec-\u003eckpt_valid_blocks are the same in both\nset_ckpt_valid_blocks() and sanity_check_valid_blocks(), so it\ndoesn\u0027t necessary to call sanity_check_valid_blocks() right after\nset_ckpt_valid_blocks().\n\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "d27e4431023770249a341aeb94cb40f4ff12b21e", "tree": "2b5be474f43a76b1f3527fa558321eede41495fd", "parents": [ "98fd20b9cf472d7e0518517ea9e587a9a2b8b311" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon Jun 15 21:08:18 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:38 2026 +0000" }, "message": "f2fs: misc cleanup in f2fs_record_stop_reason()\n\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "98fd20b9cf472d7e0518517ea9e587a9a2b8b311", "tree": "22fe3a8ca342b6f6aaf68caaf69e4f3aed94ae18", "parents": [ "378acf3cf19b6af6cba55e8dd1154c4e1504bae8" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon Jun 15 21:08:17 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:38 2026 +0000" }, "message": "f2fs: fix wrong description in printed log\n\nThis patch fixes wrong description in printed log:\n\n\"SSA and SIT\" -\u003e \"SIT and SSA\"\n\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "378acf3cf19b6af6cba55e8dd1154c4e1504bae8", "tree": "8c50e6572028f465705c65389410919be011c524", "parents": [ "c4810ada31e80cbe4011467c4f3b1e93f94134f3" ], "author": { "name": "Bryam Vargas", "email": "hexlabsecurity@proton.me", "time": "Thu Jun 11 23:00:36 2026 -0500" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n\nWhen the flexible_inline_xattr feature is enabled, do_read_inode() loads\nthe on-disk i_inline_xattr_size unconditionally:\n\n\tif (f2fs_sb_has_flexible_inline_xattr(sbi))\n\t\tfi-\u003ei_inline_xattr_size \u003d le16_to_cpu(ri-\u003ei_inline_xattr_size);\n\nbut sanity_check_inode() only range-checks it when the inode also has the\nFI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline\ndata but not FI_INLINE_XATTR -- the normal layout for an inline\ndirectory -- therefore keeps a fully attacker-controlled\ni_inline_xattr_size from a crafted image.\n\nget_inline_xattr_addrs() returns that value with no flag gating, so it\nfeeds the inode geometry:\n\n\tMAX_INLINE_DATA() \u003d 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)\n\tNR_INLINE_DENTRY() \u003d MAX_INLINE_DATA() * BITS_PER_BYTE / (...)\n\taddrs_per_page() \u003d CUR_ADDRS_PER_INODE - i_inline_xattr_size\n\nA large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()\nnegative, so make_dentry_ptr_inline() sets d-\u003emax (int) to a negative\nvalue. The inline directory walk then compares an unsigned long bit_pos\nagainst that negative d-\u003emax, which is promoted to a huge unsigned bound,\nand reads far past the inline area:\n\n\twhile (bit_pos \u003c d-\u003emax)\t\t/* fs/f2fs/dir.c */\n\t\t... test_bit_le(bit_pos, d-\u003ebitmap) / d-\u003edentry[bit_pos] ...\n\nMounting a crafted image and reading such a directory triggers an\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also\ncorrupts ADDRS_PER_INODE for regular files.\n\nValidate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the\nflexible_inline_xattr feature is enabled -- i.e. whenever the value is\nloaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE\nbound gated on inodes that actually carry an inline xattr, so legitimate\ninodes with i_inline_xattr_size \u003d\u003d 0 are still accepted.\n\nCc: stable@vger.kernel.org\nFixes: 6afc662e68b5 (\"f2fs: support flexible inline xattr size\")\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "c4810ada31e80cbe4011467c4f3b1e93f94134f3", "tree": "4c4e4ab7b36b9dc4820e2df4b9923b23ec74f6f5", "parents": [ "ccaba785821970f422c47770331c7e3271763f17" ], "author": { "name": "Zhang Cen", "email": "rollkingzzc@gmail.com", "time": "Mon Jun 15 15:19:54 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "f2fs: validate ACL entry sizes in f2fs_acl_from_disk()\n\nf2fs_acl_count() only validates the aggregate ACL xattr length. A\nmalformed ACL can still place ACL_USER or ACL_GROUP in a slot that only\ncontains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk()\nthen reads entry-\u003ee_id before verifying that a full entry fits.\n\nRequire a short entry before reading e_tag and e_perm, and require a\nfull entry before reading e_id for ACL_USER and ACL_GROUP. Return\n-EFSCORRUPTED from these new truncated-entry checks, while keeping the\npre-existing -EINVAL paths unchanged.\n\nValidation reproduced this kernel report:\nKASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0\nRIP: 0033:0x7f4b835ea7aa\nThe buggy address belongs to the object at ffff888114589960 which belongs\nto the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes to the right of allocated 8-byte\nregion [ffff888114589960, ffff888114589968)\nRead of size 4\nCall trace:\n dump_stack_lvl+0x66/0xa0 (?:?)\n print_report+0xce/0x630 (?:?)\n __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x224/0x430 (?:?)\n kasan_report+0xe0/0x110 (?:?)\n __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169)\n __get_acl+0x281/0x380 (?:?)\n vfs_get_acl+0x10b/0x190 (?:?)\n do_get_acl+0x2a/0x410 (?:?)\n do_get_acl+0x9/0x410 (?:?)\n do_getxattr+0xe8/0x260 (?:?)\n filename_getxattr+0xd1/0x140 (?:?)\n do_getname+0x2d/0x2d0 (?:?)\n path_getxattrat+0x16c/0x200 (?:?)\n lock_release+0xc8/0x290 (?:?)\n cgroup_update_frozen+0x9d/0x320 (?:?)\n lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?)\n trace_hardirqs_on+0x1a/0x170 (?:?)\n _raw_spin_unlock_irq+0x28/0x50 (?:?)\n do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)\n\nCc: stable@kernel.org\nFixes: af48b85b8cd3 (\"f2fs: add xattr and acl functionalities\")\nAssisted-by: Codex:gpt-5.5\nSigned-off-by: Zhang Cen \u003crollkingzzc@gmail.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "ccaba785821970f422c47770331c7e3271763f17", "tree": "29f0413c1f21d12d1a7742f32ac0493910455a6c", "parents": [ "bdc7cfd780c79228099674d419de93be25971ff9" ], "author": { "name": "Zhaoyang Huang", "email": "zhaoyang.huang@unisoc.com", "time": "Mon Jun 08 17:09:39 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "Revert \"f2fs: remove non-uptodate folio from the page cache in move_data_block\"\n\nThis reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598.\n\nThe kernel panics are keeping to be reported especially when the f2fs\npartition get almost full. By investigation, we find that the reason is\none f2fs page got freed to buddy without being deleted from LRU and the\nroot cause is the race happened in [2] which is enrolled by this commit.\n\nThere are 3 race processes in this scenario, please find below for their\nmain activities.\n\nThe changed code in move_data_block() lets the GC path evict the tail-end\nfolio from the page cache through folio_end_dropbehind(). Once\nfolio_unmap_invalidate() removes the folio from mapping-\u003ei_pages, the\npage-cache references for all pages in the folio are dropped. The folio\nis then kept alive only by temporary external references, which allows a\nlater split to operate on a folio whose subpages are no longer protected\nby page-cache references.\n\nAfter the page-cache references are gone, split_folio_to_order() can\nsplit the big folio into individual pages and put the resulting subpages\nback on the LRU. For tail pages beyond EOF, split removes them from the\npage cache and drops their page-cache references. A tail page can then\nremain on the LRU with PG_lru set while holding only the split caller\u0027s\ntemporary reference. When free_folio_and_swap_cache() drops that final\nreference, the page enters the final folio_put() release path.\n\nIn parallel, folio_isolate_lru() can observe the same tail page with a\nnon-zero refcount and PG_lru set. It clears PG_lru before taking its own\nreference. If this races with the final folio_put() from the split path,\n__folio_put() sees PG_lru already cleared and skips lruvec_del_folio().\nThe page is then freed back to the allocator while its lru links are\nstill present in the LRU list. A later LRU operation on a neighboring\npage detects the stale link and reports list corruption.\n\n[1]\n[ 22.486082] list_del corruption. next-\u003eprev should be fffffffec10e0ac8, but was dead000000000122. (next\u003dfffffffec10e0a88)\n[ 22.486130] ------------[ cut here ]------------\n[ 22.486134] kernel BUG at lib/list_debug.c:67!\n[ 22.486141] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n[ 22.488502] Tainted: [W]\u003dWARN, [O]\u003dOOT_MODULE\n[ 22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT)\n[ 22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n[ 22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154\n[ 22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154\n[ 22.488539] sp : ffffffc08006b830\n[ 22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000\n[ 22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0\n[ 22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122\n[ 22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060\n[ 22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058\n[ 22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003\n[ 22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00\n[ 22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c\n[ 22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010\n[ 22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d\n[ 22.488647] Call trace:\n[ 22.488651] __list_del_entry_valid_or_report+0x14c/0x154 (P)\n[ 22.488661] __folio_put+0x2bc/0x434\n[ 22.488670] folio_put+0x28/0x58\n[ 22.488678] do_garbage_collect+0x1a34/0x2584\n[ 22.488689] f2fs_gc+0x230/0x9b4\n[ 22.488697] f2fs_fallocate+0xb90/0xdf4\n[ 22.488706] vfs_fallocate+0x1b4/0x2bc\n[ 22.488716] __arm64_sys_fallocate+0x44/0x78\n[ 22.488725] invoke_syscall+0x58/0xe4\n[ 22.488732] do_el0_svc+0x48/0xdc\n[ 22.488739] el0_svc+0x3c/0x98\n[ 22.488747] el0t_64_sync_handler+0x20/0x130\n[ 22.488754] el0t_64_sync+0x1c4/0x1c8\n\n[2]\nCPU0 (f2fs GC) CPU1 (split_folio_to_order) CPU2 (folio_isolate_lru)\n\nF: pagecache refs \u003d n\nF: extra refs \u003d GC + split\nF: PG_lru set\nmove_data_block()\nfolio \u003d f2fs_grab_cache_folio(F)\n...\n__folio_set_dropbehind(F)\nfolio_unlock(F)\nfolio_end_dropbehind(F)\n folio_unmap_invalidate(F)\n __filemap_remove_folio(F)\n folio_put_refs(F, n)\nfolio_put(F)\n split_folio_to_order(F)\n folio_ref_freeze(F, 1)\n ...\n lru_add_split_folio(T)\n list_add_tail(\u0026T-\u003elru, \u0026F-\u003elru)\n folio_set_lru(T)\n __filemap_remove_folio(T)\n folio_put_refs(T, 1)\n /* T refcount \u003d\u003d 1, PageLRU set */\n folio_isolate_lru(T)\n folio_test_clear_lru(T)\n free_folio_and_swap_cache(T)\n folio_put(T)\n /* refcount: 1 -\u003e 0 */\n __folio_put(T)\n __page_cache_release(T)\n folio_test_lru(T) \u003d\u003d false\n /* skip lruvec_del_folio(T) */\n free_frozen_pages(T)\n folio_get(T)\n lruvec_del_folio(T)\nlater:\n list_del(adjacent-\u003elru)\n next \u003d\u003d \u0026T-\u003elru\n next-\u003eprev \u003d\u003d LIST_POISON / PCP freelist\n BUG\n\nCc: stable@vger.kernel.org\nFixes: 9609dd704725 (\"f2fs: remove non-uptodate folio from the page cache in move_data_block\")\nSigned-off-by: Zhaoyang Huang \u003czhaoyang.huang@unisoc.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "bdc7cfd780c79228099674d419de93be25971ff9", "tree": "788a33656c1bc60104727a337af9ad8e0a098a34", "parents": [ "7ba36a9ea81c018c828138e8071c3658620e2f0f" ], "author": { "name": "Bart Van Assche", "email": "bvanassche@acm.org", "time": "Wed Jun 10 12:34:19 2026 -0700" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "f2fs: Split f2fs_write_end_io()\n\nPrepare for running most of the write completion work asynchronously.\n\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "7ba36a9ea81c018c828138e8071c3658620e2f0f", "tree": "b2d76a016eea1460ba238a67d8459723466bd720", "parents": [ "41b7928813b5db9f61bf55e0ce395f69eb0473eb" ], "author": { "name": "Bart Van Assche", "email": "bvanassche@acm.org", "time": "Wed Jun 10 12:34:18 2026 -0700" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "f2fs: Rename f2fs_post_read_wq into f2fs_wq\n\nRename f2fs_post_read_wq into f2fs_wq. Create it unconditionally.\nPrepare for using this workqueue for completing write bios.\n\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "41b7928813b5db9f61bf55e0ce395f69eb0473eb", "tree": "78cb6bea0decc83cd23b332f5c6e08216429301d", "parents": [ "242d30bfc0a84b8b5de0a88821b53c9ad7fd31c4" ], "author": { "name": "Bart Van Assche", "email": "bvanassche@acm.org", "time": "Wed Jun 10 12:34:17 2026 -0700" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "f2fs: Prepare for supporting delayed bio completion\n\nUse bio frontpadding to allocate memory for a work_struct when\nallocating a bio.\n\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "242d30bfc0a84b8b5de0a88821b53c9ad7fd31c4", "tree": "babf1718964e4d15cd04272d2342125d70acd536", "parents": [ "90e02a8e1b6863c41876473f844c8e24b06d55f7" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Wed Jun 10 22:37:35 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "f2fs: reject setattr size changes on large folio files\n\nF2FS large folios are only enabled for immutable non-compressed files.\nWritable open and writable mmap reject such mappings, but truncate(2)\nthrough f2fs_setattr() misses the same guard.\n\nIf FS_IMMUTABLE_FL is cleared while the inode is still cached, the mapping\ncan keep large-folio support and ATTR_SIZE can change i_size. Reject size\nchanges in that state.\n\nCc: stable@kernel.org\nFixes: 05e65c14ea59 (\"f2fs: support large folio for immutable non-compressed case\")\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "90e02a8e1b6863c41876473f844c8e24b06d55f7", "tree": "ae48360e6b25f68e1c164380cb6e5585ecae7982", "parents": [ "cfcd0e49a178b3dac2c0ece656079081dbf5da74" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Wed Jun 03 16:11:26 2026 +0000" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:37 2026 +0000" }, "message": "f2fs: validate dentry name length before lookup compares it\n\nThe f2fs dentry lookup path can use the on-disk name length before\nchecking that the name fits in the dentry filename area. A corrupted\ndentry can then make lookup read beyond the filename slots.\n\nThe bounds check needs to happen before any comparison that consumes\nthe name length from disk.\n\nReject dentries with invalid name lengths before comparing their names.\n\nAssisted-by: Codex:gpt-5.5-cyber-preview\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "cfcd0e49a178b3dac2c0ece656079081dbf5da74", "tree": "9530e49895ea945356dd4ed4abd95816b1f352c6", "parents": [ "a41075acde0124d2f8a5f563068a5d63e8ffd57b" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Wed Jun 03 15:11:40 2026 +0000" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:36 2026 +0000" }, "message": "f2fs: validate inline dentry name lengths before conversion\n\nInline dentry conversion copies names out of the inline dentry area\nbefore checking that each recorded name length fits in the available\nfilename slots.\n\nA corrupted image can therefore make the conversion path read past\nthe inline filename storage while building the regular dentry block.\n\nValidate each inline dentry name length against the inline filename\narea before copying it.\n\nAssisted-by: Codex:gpt-5.5-cyber-preview\nSigned-off-by: Samuel Moelius \u003csamuel.moelius@trailofbits.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "a41075acde0124d2f8a5f563068a5d63e8ffd57b", "tree": "7e0f0334e81637285aeba7a0f1f4863b52e7907f", "parents": [ "222bc257a151cc1b01d926199a0d5a7ba61d2e53" ], "author": { "name": "Mikhail Lobanov", "email": "m.lobanov@rosa.ru", "time": "Mon Jun 15 14:36:13 2026 +0300" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:36 2026 +0000" }, "message": "f2fs: read COW data with the original inode during atomic write\n\nWhen updating an atomic-write file, f2fs_write_begin() may read the\npreviously written data back from the COW inode:\nprepare_atomic_write_begin() locates the block in the COW inode and sets\nuse_cow, and the read bio is then built with the COW inode:\n\n\tf2fs_submit_page_read(use_cow ? F2FS_I(inode)-\u003ecow_inode : inode,\n\t\t\t ...);\n\nand f2fs_grab_read_bio() decides whether to schedule fs-layer decryption\n(STEP_DECRYPT) for the bio based on that inode via\nfscrypt_inode_uses_fs_layer_crypto().\n\nHowever, the folio being filled belongs to the original inode\n(folio-\u003emapping-\u003ehost \u003d\u003d inode), and the data stored in the COW block was\nencrypted (or left as plaintext) using the original inode\u0027s context, not\nthe COW inode\u0027s -- see f2fs_encrypt_one_page(), which keys off\nfio-\u003epage-\u003emapping-\u003ehost. fscrypt_decrypt_pagecache_blocks() likewise\noperates on folio-\u003emapping-\u003ehost.\n\nThe COW inode is created as a tmpfile in the parent directory and inherits\nits encryption policy from there. With test_dummy_encryption the newly\ncreated COW inode gets the dummy policy and becomes encrypted, while a\npre-existing regular file -- created before the policy applied, e.g.\nalready present in the on-disk image -- stays unencrypted. The read\npath then sets STEP_DECRYPT based on the encrypted COW inode and calls\nfscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted\noriginal inode) has a NULL -\u003ei_crypt_info, dereferencing it:\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n RIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310\n Workqueue: f2fs_post_read_wq f2fs_post_read_work\n Call Trace:\n fscrypt_decrypt_bio+0x1eb/0x340\n f2fs_post_read_work+0xba/0x140\n process_one_work+0x91c/0x1a40\n worker_thread+0x677/0xe90\n kthread+0x2bc/0x3a0\n\nThe COW inode is only needed to locate the on-disk block, and that block\naddress is already resolved into @blkaddr by prepare_atomic_write_begin()\nvia __find_data_block(cow_inode, ...); f2fs_submit_page_read() then reads\nfrom that physical @blkaddr directly, so the inode argument only selects\nthe post-read crypto context, not which block is fetched. Reading with\n@inode therefore returns the same (latest, not-yet-committed) COW data,\nwhile making both the fs-layer decryption decision and the inline crypto\npath use the correct (original inode\u0027s) key.\n\nWith the COW inode no longer used at the read site, the use_cow flag has no\nremaining consumer; drop it from f2fs_write_begin() and\nprepare_atomic_write_begin().\n\nFixes: 591fc34e1f98 (\"f2fs: use cow inode data when updating atomic write\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mikhail Lobanov \u003cm.lobanov@rosa.ru\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "222bc257a151cc1b01d926199a0d5a7ba61d2e53", "tree": "7ffbfb6c6197fadacdf07bbc7b7fc0e8f3ab9c94", "parents": [ "6d874b65aadce56ac78f76129dbcfc2599b638f8" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Fri May 29 10:29:24 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:36 2026 +0000" }, "message": "f2fs: skip inode folio lookup for cached overwrite\n\nprepare_write_begin() first gets the inode folio and builds a dnode,\nthen checks the read extent cache. For an ordinary overwrite of a\nnon-inline and non-compressed file, an extent-cache hit already gives the\ndata block address and the following path does not need to allocate or\nupdate any node state.\n\nCheck the read extent cache before fetching the inode folio for that\nnarrow case. Keep the existing paths for inline data, compressed files,\nand writes that may extend past EOF, where the helper may need inline\nconversion, compression preparation, or block reservation.\n\nThis avoids a node-folio lookup in the buffered overwrite fast path when\nthe mapping is already cached.\n\nIn a QEMU/KASAN x86_64 VM, using a small buffered overwrite workload on\nan existing 1MiB file, median time improved as follows:\n\n 64-byte overwrites: 1724.93 ns/write -\u003e 1560.24 ns/write\n 256-byte overwrites: 1713.38 ns/write -\u003e 1577.85 ns/write\n\nFunction profiling of 20k 64-byte overwrites showed\nf2fs_get_inode_folio() calls drop from 20004 to 4.\n\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "6d874b65aadce56ac78f76129dbcfc2599b638f8", "tree": "356a9f88e8cd854702d0fd91e91962e237393e96", "parents": [ "846c499a65816d13f1186e3090e825e8bb8bcb8b" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Wed May 27 20:06:28 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:36 2026 +0000" }, "message": "f2fs: keep atomic write retry from zeroing original data\n\nA partial atomic write reserves a block in the COW inode before reading the\noriginal data page for the untouched bytes in that page.\n\nIf that read fails, write_begin returns an error but leaves the COW inode\nentry as NEW_ADDR. A retry of the same partial write then finds the COW\nentry, treats it as existing COW data, and f2fs_write_begin() zeroes the\nwhole folio because blkaddr is NEW_ADDR.\n\nIf the retry is committed, the bytes outside the retried write range are\ncommitted as zeroes instead of preserving the original file contents.\n\nOnly use the COW inode as the read source when it already has a real data\nblock. If the COW entry is still NEW_ADDR, treat it as a reservation to\nreuse: keep reading the old data from the original inode and avoid\nreserving or accounting the same atomic block again.\n\nCc: stable@kernel.org\nFixes: 3db1de0e582c (\"f2fs: change the current atomic write way\")\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "846c499a65816d13f1186e3090e825e8bb8bcb8b", "tree": "4c3538fcc23d591aef30428403978ae580df14be", "parents": [ "28ebb922b99d415e8bf51bf8b065a14fd7672167" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Tue May 26 13:35:57 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:36 2026 +0000" }, "message": "f2fs: validate orphan inode entry count\n\nf2fs_recover_orphan_inodes() trusts the orphan block entry_count when\nreplaying orphan inodes from the checkpoint pack. A corrupted entry_count\nlarger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the\nino[] array and interpret footer or following data as inode numbers.\n\nOn a crafted image, mounting an unpatched kernel can drive orphan recovery\ninto f2fs_bug_on() and panic the kernel. Validate entry_count before\nconsuming entries so corrupted checkpoint data fails the mount with\n-EFSCORRUPTED and requests fsck instead.\n\nSet ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be\nrecorded in the superblock s_errors[] field. This gives fsck a persistent\nhint even though mount-time orphan recovery failure may leave no chance to\npersist SBI_NEED_FSCK through a checkpoint.\n\nCc: stable@kernel.org\nFixes: 127e670abfa7 (\"f2fs: add checkpoint operations\")\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "28ebb922b99d415e8bf51bf8b065a14fd7672167", "tree": "5da4aa3fcce3f34c6baf7fc9e40b2429f40214cd", "parents": [ "8712353ed80f87271d732297567dcdbe4b84e8c7" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Fri May 22 14:12:06 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:36 2026 +0000" }, "message": "f2fs: honor per-I/O write streams for direct writes\n\nio_uring can pass a per-I/O write stream through kiocb-\u003eki_write_stream,\nand block direct I/O propagates that value to bio-\u003ebi_write_stream.\n\nF2FS added FDP stream mapping for DATA writes, but its direct write\nsubmit hook always rewrites bio-\u003ebi_write_stream from the inode write\nhint and F2FS temperature. As a result, a direct write with an explicit\nio_uring write_stream is submitted to the F2FS-selected stream instead\nof the user-requested stream.\n\nValidate an explicit write stream before starting F2FS direct I/O, pass\nthe kiocb through the iomap private pointer, and preserve the per-I/O\nstream in the direct write bio. When no per-I/O stream is supplied, keep\nusing the existing F2FS temperature-to-stream mapping.\n\nFixes: 42f7a7a50a33 (\"f2fs: map data writes to FDP streams\")\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "8712353ed80f87271d732297567dcdbe4b84e8c7", "tree": "97ad760ab26564e0b5d5a228f4396a49deb8e8a3", "parents": [ "7967d563bcbaac60711f09d699bce95e91a7cb5c" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Fri May 22 15:53:29 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:36 2026 +0000" }, "message": "f2fs: fix to do sanity check on f2fs_get_node_folio_ra()\n\nkernel BUG at fs/f2fs/file.c:845!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:f2fs_do_truncate_blocks+0x1115/0x1140 fs/f2fs/file.c:845\nCode: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1 1a 8c e8 54 f1 fc fc 90 0f 0b e8 6c 9d 9a fd 90 \u003c0f\u003e 0b e8 64 9d 9a fd 90 0f 0b 90 e9 93 fd ff ff e8 56 9d 9a fd 90\nRSP: 0018:ffffc9000e4474c0 EFLAGS: 00010283\nRAX: ffffffff842b1d34 RBX: 0000000000000003 RCX: 0000000000100000\nRDX: ffffc9000f03a000 RSI: 0000000000035503 RDI: 0000000000035504\nRBP: ffffc9000e447608 R08: ffff8880123b0000 R09: 0000000000000002\nR10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000001\nR13: 0000000000000000 R14: 1ffff92001c88ea0 R15: 00000000ffff039c\nFS: 00007f7e02ee36c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ff0305c4000 CR3: 0000000012d4c000 CR4: 0000000000352ef0\nCall Trace:\n \u003cTASK\u003e\n f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:882\n f2fs_truncate+0x471/0x7c0 fs/f2fs/file.c:940\n f2fs_evict_inode+0xa3f/0x1ac0 fs/f2fs/inode.c:907\n evict+0x61e/0xb10 fs/inode.c:841\n f2fs_fill_super+0x5f43/0x78f0 fs/f2fs/super.c:5224\n get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694\n vfs_get_tree+0x92/0x2a0 fs/super.c:1754\n fc_mount fs/namespace.c:1193 [inline]\n do_new_mount_fc fs/namespace.c:3758 [inline]\n do_new_mount+0x341/0xd30 fs/namespace.c:3834\n do_mount fs/namespace.c:4167 [inline]\n __do_sys_mount fs/namespace.c:4383 [inline]\n __se_sys_mount+0x31d/0x420 fs/namespace.c:4360\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n\tcount \u003d ADDRS_PER_PAGE(dn.node_folio, inode);\n\n\tcount -\u003d dn.ofs_in_node;\n\tf2fs_bug_on(sbi, count \u003c 0);\n\nThe fuzz test will trigger above bug_on in f2fs.\n\nThe root cause should be: in the corrupted inode, there is a direct node\nwhich has the same ino and nid in its footer, so in f2fs_do_truncate_blocks(),\nafter f2fs_get_dnode_of_data() finds such dnode:\n1) ADDRS_PER_PAGE(dn.node_folio, inode) will return 923\n2) once dn.ofs_in_node points to addr[923, 1017]\nThen it will trigger the system panic.\n\nLet\u0027s introduce NODE_TYPE_NON_IXNODE to indicate current node should\nnot be an inode or xattr node, and then use it in below path to detect\ninconsistent node chain in inode mapping table:\n\n- f2fs_do_truncate_blocks\n - f2fs_get_dnode_of_data\n - f2fs_get_node_folio_ra\n - __get_node_folio\n - f2fs_sanity_check_node_footer\n - case NODE_TYPE_NON_IXNODE -\u003e check whether it is inode|xnode\n\nCc: stable@kernel.org\nReported-by: syzbot+2488d8d751b27f7ce268@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/69fa3697.170a0220.59368.0018.GAE@google.com\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "7967d563bcbaac60711f09d699bce95e91a7cb5c", "tree": "f151168f099240830d3fd66ac190dae41f1c4936", "parents": [ "a2b251259bf2bdf550893bac078e9ce0a10e76c9" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Fri May 22 14:59:12 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:35 2026 +0000" }, "message": "Revert: \"f2fs: check in-memory sit version bitmap\"\n\nCommit ae27d62e6bef (\"f2fs: check in-memory sit version bitmap\") added\na mirror for sit version bitmap, it expects to detect in-memory\ncorruption, however we never got any reports from the check points\nfor almost decade, let\u0027s remove the code, it can help to save\nmemories.\n\nCc: wallentx \u003cwilliam.allentx@gmail.com\u003e\nSuggested-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "a2b251259bf2bdf550893bac078e9ce0a10e76c9", "tree": "4866526caa1b673e634d9b5f5247e6f3ab6367c3", "parents": [ "484c84ecc1a497d09239ca3a12dff3cc832830ce" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Fri May 22 14:59:11 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:35 2026 +0000" }, "message": "Revert: \"f2fs: check in-memory block bitmap\"\n\nCommit 355e78913c0d (\"f2fs: check in-memory block bitmap\") added\na mirror for valid block bitmap, it expects to detect in-memory\ncorruption, however we never got any reports from the check points\nfor almost decade, let\u0027s remove the code, it can help to save\nmemories.\n\nCc: wallentx \u003cwilliam.allentx@gmail.com\u003e\nSuggested-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "484c84ecc1a497d09239ca3a12dff3cc832830ce", "tree": "962a1f5560ff6202e35881ebd0503471c4964e27", "parents": [ "5073c66a96a9c23c0c2533ed4ed06e42f9021208" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Thu May 21 18:37:48 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:35 2026 +0000" }, "message": "f2fs: avoid false shutdown fserror reports\n\nF2FS records image errors and checkpoint-stop reasons through the same\ns_error_work worker. The ordinary f2fs_handle_error() path only updates\ns_errors, but the worker still calls fserror_report_shutdown()\nunconditionally after committing the superblock.\n\nAs a result, a metadata corruption report can be followed by a synthetic\nFAN_FS_ERROR event with ESHUTDOWN and an invalid superblock file handle,\neven though no stop reason was recorded.\n\nTrack whether save_stop_reason() actually changed the stop_reason array\nand only report the shutdown fserror for that case. Pure s_errors updates\nstill commit the superblock, but no longer generate a false shutdown event.\n\nFixes: 50faed607d32 (\"f2fs: support to report fserror\")\nCc: stable@kernel.org\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "5073c66a96a9c23c0c2533ed4ed06e42f9021208", "tree": "8770edcfeb7a734dfe02f8e7c4ff244016807f7b", "parents": [ "fcb05c26c2a67953b420739b85f49386efc9b6c0" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Thu May 21 11:16:18 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:35 2026 +0000" }, "message": "f2fs: validate compress cache inode only when enabled\n\nF2FS_COMPRESS_INO() uses NM_I(sbi)-\u003emax_nid as the synthetic inode\nnumber for the compressed page cache inode. That inode only exists when\nthe compress_cache mount option is enabled.\n\nWhen compress_cache is disabled, max_nid is outside the valid inode\nrange. A corrupted directory entry that points to ino \u003d\u003d max_nid should\ntherefore be rejected by f2fs_check_nid_range(). However, is_meta_ino()\ncurrently treats F2FS_COMPRESS_INO() as a meta inode unconditionally,\nso f2fs_iget() bypasses do_read_inode() and its nid range check, and\ninstantiates a fake internal inode instead.\n\nGate the compressed cache inode case on COMPRESS_CACHE, matching\nf2fs_init_compress_inode(). With compress_cache disabled, ino \u003d\u003d\nmax_nid now follows the normal inode path and is rejected as an\nout-of-range nid.\n\nCc: stable@kernel.org\nFixes: 6ce19aff0b8c (\"f2fs: compress: add compress_inode to cache compressed blocks\")\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "fcb05c26c2a67953b420739b85f49386efc9b6c0", "tree": "88233dded6ea0fb06cb6b57c1fe5c8378b1acb52", "parents": [ "74c8d2ec95c59a5651ecd975c466998af1961fd4" ], "author": { "name": "Wenjie Qi", "email": "qwjhust@gmail.com", "time": "Wed May 20 20:07:05 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:35 2026 +0000" }, "message": "f2fs: pass correct iostat type for single node writes\n\nf2fs_write_single_node_folio() takes an io_type argument, but still\npasses FS_GC_NODE_IO to __write_node_folio() unconditionally.\n\nThis was harmless while the helper was only used by\nf2fs_move_node_folio(), whose caller passes FS_GC_NODE_IO. However,\ncommit fe9b8b30b971 (\"f2fs: fix inline data not being written to disk\nin writeback path\") made f2fs_inline_data_fiemap() call the helper with\nFS_NODE_IO for FIEMAP_FLAG_SYNC.\n\nHonor the caller supplied io_type so inline-data FIEMAP sync writeback is\naccounted as normal node IO instead of GC node IO, while the GC path\ncontinues to pass FS_GC_NODE_IO explicitly.\n\nCc: stable@kernel.org\nFixes: fe9b8b30b971 (\"f2fs: fix inline data not being written to disk in writeback path\")\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "74c8d2ec95c59a5651ecd975c466998af1961fd4", "tree": "c92c4b1cef3cbabbbbe253ba26adb9f6ee459ef0", "parents": [ "e0288584baa5dc41df4a829a023c4c1b33fe53d7" ], "author": { "name": "Wenjie Qi", "email": "qiwenjie@xiaomi.com", "time": "Wed May 20 17:52:04 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:35 2026 +0000" }, "message": "f2fs: fix missing read bio submission on large folio error\n\nf2fs_read_data_large_folio() can keep a read bio across multiple\nreadahead folios. If a later folio hits an error before any of its\nblocks are added to the bio, folio_in_bio is false and the current error\npath returns immediately after ending that folio.\n\nThis can leave the bio accumulated for earlier folios unsubmitted. Those\nfolios then never receive read completion, and readers can wait\nindefinitely on the locked folios.\n\nRoute errors through the common out path so any pending bio is submitted\nbefore returning. Stop consuming more readahead folios once an error is\nseen, and only wait on and clear the current folio when it was actually\nadded to the bio.\n\nCc: stable@kernel.org\nFixes: a5d8b9d94e18 (\"f2fs: fix to unlock folio in f2fs_read_data_large_folio()\")\nSigned-off-by: Wenjie Qi \u003cqiwenjie@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "e0288584baa5dc41df4a829a023c4c1b33fe53d7", "tree": "9d1727834165cba19ebd7ef60f194b7d97837165", "parents": [ "8b4468ec023d0d1b4669dfb867588997cc03a06b" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Thu May 21 10:15:05 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:35 2026 +0000" }, "message": "f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode\n\n- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE)\t\t- shrink\n - f2fs_gc\n - gc_data_segment\n - ra_data_block(cow_inode)\n - mapping \u003d F2FS_I(inode)-\u003eatomic_inode-\u003ei_mapping\n : f2fs_is_cow_file(cow_inode) is true\n\t\t\t\t\t\t - f2fs_evict_inode(atomic_inode)\n\t\t\t\t\t\t - clear_inode_flag(fi-\u003ecow_inode, FI_COW_FILE)\n\t\t\t\t\t\t - F2FS_I(fi-\u003ecow_inode)-\u003eatomic_inode \u003d NULL\n\t\t\t\t\t\t ...\n\t\t\t\t\t\t - truncate_inode_pages_final(atomic_inode)\n - f2fs_grab_cache_folio(mapping)\n : create folio in atomic_inode-\u003emapping\n\t\t\t\t\t\t - clear_inode(atomic_inode)\n\t\t\t\t\t\t - BUG_ON(atomic_inode-\u003ei_data.nrpages)\n\nWe need to add a reference on fi-\u003eatomic_inode before using its mapping\nfield during garbage collection, otherwise, it will cause UAF issue.\n\nCc: stable@kernel.org\nCc: Daeho Jeong \u003cdaehojeong@google.com\u003e\nCc: Sunmin Jeong \u003cs_min.jeong@samsung.com\u003e\nFixes: 3db1de0e582c (\"f2fs: change the current atomic write way\")\nFixes: f18d00769336 (\"f2fs: use meta inode for GC of COW file\")\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "8b4468ec023d0d1b4669dfb867588997cc03a06b", "tree": "eaefa3b0419b49a7acaefd8465d58e09370a686e", "parents": [ "47a60629caca7ea6475deb21d16112b35645b59f" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Tue May 19 01:14:38 2026 +0000" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:34 2026 +0000" }, "message": "f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()\n\nWhen we mount device w/ gc_merge mount option, we may suffer below\npotential deadlock:\n\nKworker\t\t\t\t\tGC trehad\t\t\tTruncator\n- f2fs_write_cache_pages\n - f2fs_write_single_data_page\n - f2fs_do_write_data_page\n - folio_start_writeback --- set writeback flag on folio\n - f2fs_outplace_write_data\n : cached folio in internal bio cache\n - f2fs_balance_fs\n - wake_up(gc_thread)\n : wake up gc thread to run foreground GC\n - finish_wait(fggc_wq)\n : wait on the waitqueue --- wait on GC thread to finish the work\n\t\t\t\t\t\t\t\t\t- truncate_inode_pages_range\n\t\t\t\t\t\t\t\t\t - __filemap_get_folio(, FGP_LOCK) --- lock folio\n\t\t\t\t\t\t\t\t\t - truncate_inode_partial_folio\n\t\t\t\t\t\t\t\t\t - folio_wait_writeback --- wait on writeback being cleared\n\t\t\t\t\t- do_garbage_collect\n\t\t\t\t\t - move_data_page\n\t\t\t\t\t - f2fs_get_lock_data_folio\n\t\t\t\t\t - lock on folio --- blocked on folio\u0027s lock\n\nIn order to avoid such deadlock, let\u0027s call below functions to commit\ncached bios in GC_MERGE path of f2fs_balance_fs() as the same as we did\nin NOGC_MERGE path.\n- f2fs_submit_merged_write(sbi, DATA);\n- f2fs_submit_all_merged_ipu_writes(sbi);\n\nCc: stable@kernel.org\nFixes: 351df4b20115 (\"f2fs: add segment operations\")\nCc: Ruipeng Qi \u003cruipengqi3@gmail.com\u003e\nReported: Sandeep Dhavale \u003cdhavale@google.com\u003e\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Chao Yu \u003cchaseyu@google.com\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "47a60629caca7ea6475deb21d16112b35645b59f", "tree": "1dfd05e2100f0e559c4ef6d72a32dbd67f779fb0", "parents": [ "caac757a3d2dddeb88d79a7524ca0033fc337b3d" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon May 11 00:30:33 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:34 2026 +0000" }, "message": "f2fs: add logs in f2fs_disable_checkpoint()\n\nIn order to troubleshoot in which step we may block on during\nmount w/ checkpoint_disable mount option.\n\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "caac757a3d2dddeb88d79a7524ca0033fc337b3d", "tree": "803c95ffb3f71e5e616b27442f424a7185bfd7b7", "parents": [ "5dfb768326b95c6dd6554f34dec71b44a01a0bc8" ], "author": { "name": "liujinbao1", "email": "liujinbao1@xiaomi.com", "time": "Wed May 13 22:14:36 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:34 2026 +0000" }, "message": "f2fs: add iostat latency tracking for direct IO\n\nF2FS did not collect iostat latency for direct IO reads and writes,\nhook iomap_dio_ops.submit_io to bind an iostat context and record the\nsubmission timestamp. Replace bi_end_io with f2fs_dio_end_bio() to\ncollect IO latency on completion before calling back to the original\niomap_dio_bio_end_io(), to add iostat latency tracking support for\nF2FS DIO.\n\nSigned-off-by: shengyong1 \u003cshengyong1@xiaomi.com\u003e\nSigned-off-by: liujinbao1 \u003cliujinbao1@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "5dfb768326b95c6dd6554f34dec71b44a01a0bc8", "tree": "58d936821ea21f375d0d8bb2ec0dd8455d0de5b7", "parents": [ "f6b24566035835dc22796f24b1e8738581840b17" ], "author": { "name": "Daeho Jeong", "email": "daehojeong@google.com", "time": "Thu May 14 13:55:13 2026 -0700" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:34 2026 +0000" }, "message": "f2fs: optimize representative type determination in GC\n\nIn large section mode, do_garbage_collect() previously determined the\nsection\u0027s representative type by looking only at the first segment of\nthe section. However, if data was fsynced into an area previously used\nas a node section, and this area is recovered during roll-forward\nrecovery after sudden power off (SPO), GC would incorrectly assume the\nsection\u0027s type based on an empty or obsolete first segment. This caused\nthe recovered data segment to be misunderstood as being stuck inside a\nnode section, triggering false inconsistency panics (Inconsistent\nsegment type in SSA and SIT) and subsequent mount failures.\n\nThis patch optimizes do_garbage_collect() to determine the section\u0027s\nrepresentative type by identifying the first segment that actually\ncontains valid blocks (valid_blocks \u003e 0) during the main GC loop. This\neliminates false alarms from empty/obsolete leading segments while\nmaintaining strict section-level type consistency checks for genuine\ncorruption.\n\nSigned-off-by: Daeho Jeong \u003cdaehojeong@google.com\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "f6b24566035835dc22796f24b1e8738581840b17", "tree": "b6ebd9c2a6f69123f52f069307f3230afa2d888f", "parents": [ "fb645a976f53b175a49bdf52cfcd2c56f4b1456a" ], "author": { "name": "liujinbao1", "email": "liujinbao1@xiaomi.com", "time": "Wed May 06 17:57:31 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:34 2026 +0000" }, "message": "f2fs: Add trace_f2fs_fault_report\n\nAdd trace_f2fs_fault_report to trigger reporting upon f2fs_bug_on,\nneed_fsck, stop_checkpoint, and handle_eio. Since f2fs_bug_on and\nneed_fsck can be triggered in hundreds of scenarios, define set_sbi_flag\nas a macro to help capture the effective fault function and line number.\n\nSigned-off-by: shengyong1 \u003cshengyong1@xiaomi.com\u003e\nSigned-off-by: liujinbao1 \u003cliujinbao1@xiaomi.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "fb645a976f53b175a49bdf52cfcd2c56f4b1456a", "tree": "d9f3b02adc35369eb53b5450cc91dad4c514ced0", "parents": [ "b952837f734c3a627877bf922408dac04588a643" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Tue May 05 20:55:10 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:34 2026 +0000" }, "message": "f2fs: annotate lockless NAT counter reads\n\nnat_cnt[] is updated while callers hold nat_tree_lock, but F2FS samples\nthe counters locklessly in f2fs_available_free_memory(),\nexcess_dirty_nats(), and excess_cached_nats(). Those helpers only steer\ncache reclaim and background sync heuristics; they do not control NAT\nentry lifetime or checkpoint correctness.\n\nDocument the intent with data_race(READ_ONCE()) and a short comment\ninstead of adding locking to the balance path.\n\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "b952837f734c3a627877bf922408dac04588a643", "tree": "1a7731dfa59503272fd8c3173c1e219ae372dfb6", "parents": [ "dd3114870771562036fdcf5abe813956f36d224d" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Wed May 06 09:07:09 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Jun 22 19:52:34 2026 +0000" }, "message": "f2fs: annotate lockless last_time[] accesses\n\nf2fs stores mount-wide activity timestamps in sbi-\u003elast_time[] and\nsamples them from background discard, GC, and balance paths without a\ndedicated lock. The timestamps are used as best-effort heuristics to\ndecide whether background work should run now or sleep a bit longer.\n\nThe current helpers use plain loads and stores, so KCSAN can report races\nbetween frequent foreground updates and background readers. Exact\nfreshness is not required here, but the intentional lockless accesses\nshould be marked explicitly.\n\nUse WRITE_ONCE() in f2fs_update_time() and READ_ONCE() in\nf2fs_time_over() and f2fs_time_to_wait(). This preserves the existing\nheuristic behavior and avoids adding locking to hot paths.\n\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "4708cac0e22cfd217f48f7cec3c35e5922efcccd", "tree": "f2b61bb7476baaa16a607ce5117f6c4173ec12a6", "parents": [ "0000d9ccbcfa90411c88f70850501723389312b9", "7cb1c5b32a2bfde961fff8d5204526b609bcb30a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:43:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:43:16 2026 -0700" }, "message": "Merge tag \u0027staging-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver updates from Greg KH:\n \"Here is the big set of staging driver updates for 7.2-rc1.\n\n Nothing major in here, just constant grind of tiny cleanups and coding\n style fixes and wrapper removals. Overall more code was removed than\n added, always a nice sign that things are progressing forward.\n\n Changes outside of drivers/staging/ was due to the octeon driver\n changes, which for some reason also lives partially in the mips\n subsystem, someday that all will be untangled and cleaned up, or just\n removed entirely, it\u0027s hard to tell which is going to be its fate.\n\n Other than octeon driver cleanups, in here are the usual:\n\n - rtl8723bs driver reworking and cleanups, being the bulk of this\n merge window given all of the issues and wrappers involved in that\n beast of a driver\n\n - most driver cleanups\n\n - sm750fb driver cleanups (which might be done, as this really should\n be moved to the drm layer one of these days...)\n\n - other tiny staging driver cleanups and fixes\n\n All of these have been in linux-next for many weeks with no reported\n issues\"\n\n* tag \u0027staging-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (199 commits)\n staging: most: video: avoid double free on video register failure\n staging: sm750: rename CamelCase variable Bpp to bpp\n staging: rtl8723bs: delete superfluous switch statement\n staging: sm750fb: Mark g_noaccel, g_nomtrr and g_dualview as __ro_after_init\n staging: rtl8723bs: propagate errno through hal xmit path\n staging: rtl8723bs: propagate errno through xmit enqueue path\n staging: rtl8723bs: convert rtw_xmit_classifier to return errno\n staging: rtl8723bs: make rtw_xmit_classifier static\n staging: rtl8723bs: simplify rtw_xmit_classifier control flow\n staging: rtl8723bs: make _rtw_enqueue_cmd return 0 on success\n staging: rtl8723bs: simplify rtw_enqueue_cmd control flow\n staging: rtl8723bs: make _rtw_enqueue_cmd static\n staging: rtl8723bs: simplify _rtw_enqueue_cmd control flow\n staging: rtl8723bs: fix multiple blank lines in more hal/ files\n staging: rtl8723bs: remove unused TXDESC_64_BYTES code\n staging: rtl8723bs: remove unused DBG_XMIT_BUF and DBG_XMIT_BUF_EXT code\n staging: rtl8723bs: fix multiple blank lines in hal/Hal* files\n staging: rtl8723bs: fix multiple blank lines in hal/ files\n staging: rtl8723bs: rtw_mlme: add blank line for readability\n staging: rtl8723bs: rtw_mlme: wrap rtw_sitesurvey_cmd condition\n ...\n" }, { "commit": "0000d9ccbcfa90411c88f70850501723389312b9", "tree": "d68ce425419c158d3a89cc04ba068057187997fe", "parents": [ "364f4a55c661641c02c86a849f0608d8fc3c0006", "b232fc005aec5fa5346d970f8986b8f0046f328b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:20:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:20:21 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull misc driver updates from Greg KH:\n \"Here is the big set of char, misc, iio, fpga, and other small driver\n subsystems changes for 7.2-rc1.\n\n Lots of little stuff in here, the majority being of course the IIO\n driver updates, as a list they are:\n\n - IIO driver updates and additions\n\n - GPIB driver bugfixes and cleanups\n\n - Android binder driver updates (rust and C version)\n\n - counter driver updates\n\n - MHI driver updates\n\n - mei driver updates\n\n - w1 driver updates\n\n - interconnect driver updates\n\n - Comedi driver fixes and updates\n\n - some obsolete char drivers removed (applicom and dtlk)\n\n - hwtracing driver updates\n\n - other tiny driver updates\n\n All of these have been in linux-next for a while with no reported\n issues\"\n\n* tag \u0027char-misc-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (406 commits)\n w1: ds2482: Use named initializers for arrays of i2c_device_data\n firmware: stratix10-svc: Add support to query Arm Trusted Firmware (ATF) version\n firmware: stratix10-rsu: avoid blocking reboot_image sysfs when busy\n coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()\n iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure\n iio: chemical: scd30: Replace manual locking with RAII locking\n iio: light: tsl2591: remove unneeded tsl2591_compatible_als_persist_cycle()\n iio: dac: ad5686: create bus ops struct\n iio: dac: ad5686: cleanup doc header of local structs\n iio: dac: ad5686: add control_sync() for single-channel devices\n iio: dac: ad5686: add helpers to handle powerdown masks\n iio: dac: ad5686: add of_match table to the spi driver\n iio: dac: ad5686: drop enum id\n iio: dac: ad5686: remove redundant register definition\n iio: dac: ad5686: refactor include headers\n iio: adc: ad4080: fix AD4880 chip ID\n iio: light: veml3328: add support for new device\n dt-bindings: iio: light: veml6030: add veml3328\n fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()\n fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()\n ...\n" }, { "commit": "364f4a55c661641c02c86a849f0608d8fc3c0006", "tree": "ac5a9c469b2244e9407e73a36d623c1f40a79101", "parents": [ "e4b4bfaa5090760925b98848aa3e0fc10b3c574f", "1c2b66a7d7257d2652aa41f9a860ecb96dde27dd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:09:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:09:47 2026 -0700" }, "message": "Merge tag \u0027usb-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB and Thunderbolt driver updates from Greg KH:\n \"Here is the big set of USB and Thunderbolt driver changes for 7.2-rc1.\n\n Lots of little stuff in here, major highlights include:\n\n - USB4STREAM support for Thunderbolt devices. A new way to send \"raw\"\n data very quickly over a USB4 connection to another system directly\n\n - Other thunderbolt updates and changes to make the stream code work\n\n - xhci driver updates and additions\n\n - typec driver updates and additions\n\n - usb gadget driver updates and fixes for reported issues\n\n - zh_CN documentation translation of the USB documentation\n\n - usb-serial driver updates\n\n - dts cleanups for some USB platforms\n\n - other minor USB driver updates and tweaks\n\n All of these have been in linux-next for over a week with no reported\n issues, most of them for many many weeks\"\n\n* tag \u0027usb-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (131 commits)\n usb: ucsi: huawei_gaokun: support mode switching\n thunderbolt: debugfs: Fix sideband write size check\n thunderbolt: debugfs: Fix margining error counter buffer leak\n usb: host: xhci-rcar: Split R-Car Gen2 and Gen3 .plat_start() handling\n usb: host: xhci-rcar: Remove SET_XHCI_PLAT_PRIV_FOR_RCAR() macro\n usb: xhci: allocate internal DCBAA mirror dynamically\n usb: xhci: allocate DCBAA based on host controller max slots\n usb: xhci: refactor DCBAA struct\n xhci: Prevent queuing new commands if xhci is inaccessible\n xhci: dbc: detect and recover hung DbC during enumeraton\n xhci: dbc: add timestamps to DbC state changes in a new helper.\n xhci: dbc: add helper to set and clear DbC DCE enable bit\n xhci: dbc: serialize enabling and disabling dbc\n xhci: dbc: Fix sysfs ABI Documentation for xhci dbc states\n usb: xhci: Improve Soft Retries after short transfers\n usb: xhci: Remove isochronous URB_SHORT_NOT_OK handling\n usb: xhci: Remove skip_isoc_td()\n usb: xhci: Simplify xhci_quiesce()\n usb: xhci: remove legacy \u0027num_trbs_free\u0027 tracking\n usb: xhci: fix typo in xhci_set_port_power() comment\n ...\n" }, { "commit": "e4b4bfaa5090760925b98848aa3e0fc10b3c574f", "tree": "1a67add78f7c9734602fa2816644a3db22ae86a0", "parents": [ "8a500fd09385a13ba598cda651f2e4ac40bfa578", "880bae5f1269b4d81bb2a254963e84377cd37bc1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:06:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 12:06:22 2026 -0700" }, "message": "Merge tag \u0027spdx-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx\n\nPull SPDX updates from Greg KH:\n \"Here is a \"big\" set of SPDX-like patches for 7.2-rc1. It is the\n addition of the ability for the kernel build process to generate a\n Software Bill of Materials (SBOM) in the SPDX format, that matches up\n exactly with just the files that are actually built for the specific\n kernel image generated.\n\n To generate a sbom, after the kernel has been built, just do:\n\tmake sbom\n and marvel at the JSON file that is generated...\n\n This is needed by users for environments in which a SBOM is required\n (medical, automotive, anything shipped in the EU, etc.) and cuts down\n by a massive size the \"naive\" SBOM solution that many vendors have\n done by just including _all_ of the kernel files in the resulting\n document.\n\n This result is still a giant JSON file, that I am told parses\n properly, so we just have to trust that it is properly inclusive as\n attempting to parse that thing by hand is impossible.\n\n The scripts here are self-contained python scripts, no additional\n libraries or tools to create the SBOM are needed, which is important\n for many build systems. Overall it\u0027s just a bit over 4000 lines of\n \"simple\" python code, the most complex part is the regex matching\n lines, but those are nothing compared to what we maintain in\n scripts/checkpatch.pl today...\n\n The various parts where the tool touches the kbuild subsystem have\n been acked by the kbuild maintainer, so all should be good here.\n\n All of these patches have been in linux-next for weeks with no\n reported problems\"\n\n* tag \u0027spdx-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx:\n scripts/sbom: add unit tests for SPDX-License-Identifier parsing\n scripts/sbom: add unit tests for command parsers\n scripts/sbom: add SPDX build graph\n scripts/sbom: add SPDX source graph\n scripts/sbom: add SPDX output graph\n scripts/sbom: collect file metadata\n scripts/sbom: add shared SPDX elements\n scripts/sbom: add JSON-LD serialization\n scripts/sbom: add SPDX classes\n scripts/sbom: add additional dependency sources for cmd graph\n scripts/sbom: add cmd graph generation\n scripts/sbom: add command parsers\n scripts/sbom: setup sbom logging\n scripts/sbom: integrate script in make process\n scripts/sbom: add documentation\n" }, { "commit": "3287a1881ca528b89b964d9fa6d28880d277d9e2", "tree": "571646792ffbf45e8c078153842dc9fc74444b09", "parents": [ "1a5f9334a45a6b0c1cd7341cc72a3b87adad1d27" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Jun 17 14:00:38 2026 +0100" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Mon Jun 22 15:53:34 2026 -0300" }, "message": "perf bpf: Fix up build failure due to change of btf_vlen() return type\n\nFix:\n\nutil/btf.c: In function \u0027__btf_type__find_member_by_name\u0027:\nutil/btf.c:19:43: error: comparison of integer expressions of different signedness: \u0027int\u0027 and \u0027__u32\u0027 {aka \u0027unsigned int\u0027} [-Werror\u003dsign-compare]\n 19 | for (i \u003d 0, m \u003d btf_members(t); i \u003c btf_vlen(t); i++, m++) {\n | ^\n\nbuiltin-trace.c: In function \u0027syscall_arg__strtoul_btf_enum\u0027:\nbuiltin-trace.c:967:27: error: comparison of integer expressions of different signedness: \u0027int\u0027 and \u0027__u32\u0027 {aka \u0027unsigned int\u0027} [-Werror\u003dsign-compare]\n 967 | for (int i \u003d 0; i \u003c btf_vlen(bt); ++i, ++be) {\n | ^\n\nby making the variable the same type as the function.\n\nCommitter note:\n\nAdd an extra hunk from Alan Maguire, fixing btf_enum_scnprintf().\n\nReviewed-by: Alan Maguire \u003calan.maguire@oracle.com\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nCc: Alexei Starovoitov \u003cast@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "8a500fd09385a13ba598cda651f2e4ac40bfa578", "tree": "64bd93a8edaeba023a913a4803f00df1f4dbba37", "parents": [ "1dc18801be29bc54709aa355b8acd80e183b03cd", "426e83cab1f5d53069ac7030cb03e2d7c6367ef1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 11:51:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 11:51:49 2026 -0700" }, "message": "Merge tag \u0027tty-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty / serial driver updates from Greg KH:\n \"Here is the big set of TTY and Serial driver updates for 7.2-rc1.\n\n Overall we end up removing more code than added, due to an obsolete\n synclink_gt driver being removed from the tree, always a nice thing to\n see happen.\n\n Other than that driver removal, major things included in here are:\n\n - max310x serial driver updates and fixes\n\n - 8250 driver updates and rework in places to make it more \"modern\"\n\n - dts file updates\n\n - serial driver core tweaks and updates\n\n - vt code cleanups\n\n - vc_screen crash fixes\n\n - other minor driver updates and cleanups\n\n All of these have been in linux-next for well over a week with no\n reported issues\"\n\n* tag \u0027tty-7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits)\n serial: 8250_pci: Don\u0027t specify conflicting values to pci_device_id members\n vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write\n serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero\n vt: merge ucs_is_zero_width()/ucs_is_double_width() into ucs_get_width()\n serial: 8250: fix possible ISR soft lockup\n dt-bindings: serial: rs485: remove deprecated .txt binding stub\n serial: qcom-geni: trace: Add tracepoint support for Qualcomm GENI serial\n tty: serial: Use named initializers for arrays of i2c_device_data\n serial: 8250_dw: remove clock-notifier infrastructure\n serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails\n amba/serial: amba-pl011: Bring back zx29 UART support\n serial: 8250: Add support for console flow control\n serial: 8250: Check LSR timeout on console flow control\n serial: 8250: Set cons_flow on port registration\n tty: serial: 8250: protect against NULL uart-\u003eport.dev in register\n arm64: dts: add support for A9 based Amlogic BY401\n dt-bindings: arm: amlogic: add A311Y3 support\n serial: max310x: fix compile errors if CONFIG_SPI_MASTER is disabled\n serial: qcom-geni: Avoid probing debug console UART without console support\n serial: max310x: add comments for PLL limits\n ...\n" }, { "commit": "1dc18801be29bc54709aa355b8acd80e183b03cd", "tree": "a67e9e860efc688419511e9abe9934687ac1d4a1", "parents": [ "9f333cb6b57c3f72073bf058f984b180cc00bf7b", "ac930b80c1e0eba283d7843180964e6d2a87369d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 09:30:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 09:30:31 2026 -0700" }, "message": "Merge tag \u0027i2c-7.2-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull more i2c updates from Andi Shyti:\n \"Cleanups:\n - generic cleanups in qcom, qcom-cci and pxa, plus core cleanups in\n algo-bit and atr\n\n Fixes:\n - davinci: clean up cpufreq notifier on probe failure\n - imx-lpi2c: suspend the adapter while hardware is powered down\n - ls2x-v2: return IRQ_HANDLED after servicing error interrupts\n - stm32f7: fix timing calculation accuracy\n\n DT bindings:\n - microchip: permit resets\n - i2c-mux-pinctrl: update maintainer entry\n - i2c-mux-reg: convert bindings to DT schema\"\n\n* tag \u0027i2c-7.2-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: pxa: Use named initializers for the platform_device_id array\n i2c: imx-lpi2c: mark I2C adapter when hardware is powered down\n i2c: stm32f7: truncate clock period instead of rounding it\n dt-bindings: i2c: microchip,corei2c: permit resets\n i2c: qcom: Unify user-visible \"Qualcomm\" name\n i2c: ls2x-v2: return IRQ_HANDLED after servicing an error\n i2c: atr: annotate i2c_atr_adap_desc-\u003ealiases with __counted_by_ptr\n i2c: algo: bit: use str_plural helper in bit_xfer\n dt-bindings: i2c: i2c-mux-pinctrl: change maintainer\n dt-bindings: i2c: convert i2c-mux-reg to DT schema\n i2c: davinci: Unregister cpufreq notifier on probe failure\n i2c: qcom-cci: Remove overcautious disable_irq() calls\n i2c: qcom-cci: Move cci_init() under cci_reset() function\n i2c: qcom-cci: Do not check return value of cci_init()\n" }, { "commit": "9f333cb6b57c3f72073bf058f984b180cc00bf7b", "tree": "fd6c48a518a23d030daa2f75f8f30329dc0c0a69", "parents": [ "335c347686e76df9d2c7d7f61b5ea627a4c5cb4c", "678e9409dd78d5c080607df15c6f346c7edb03d0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 09:24:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 09:24:22 2026 -0700" }, "message": "Merge tag \u0027i3c/for-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux\n\nPull i3c updates from Alexandre Belloni:\n \"This cycle, there was a lot of work around the mipi-i3c-hci driver\n that also led to improvements of the core. We also have support for a\n new SoC, the Microchip SAMA7D65. And of course, there are small fixes\n for the other controller drivers.\n\n Subsystem:\n - introduce dynamic address reconciliation after DAA\n - add preliminary API for hub support\n - fixes for dev_nack_retry_count handling\n - move hot-join support in the core instead of open coding in\n different drivers\n\n Drivers:\n - mipi-i3c-hci-pci: DMA abort, recovery and related improvements,\n hot-join support, Microchip SAMA7D65 support, fix possible race in\n IBI handling\n - dw-i3c-master: fix IBI count register selection for versalnet\n - svc: interrupt handling fixes for NPCM845\"\n\n* tag \u0027i3c/for-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (45 commits)\n i3c: mipi-i3c-hci: Use named initializers for platform_device_id\u0027s .driver_data\n i3c: master: Use unsigned int for dev_nack_retry_count consistently\n i3c: master: Add missing runtime PM get in dev_nack_retry_count_store()\n i3c: master: Update dev_nack_retry_count under maintenance lock\n i3c: master: Expose the APIs to support I3C hub\n i3c: master: rename i3c_master_reattach_i3c_dev() to *_locked\n i3c: mipi-i3c-hci: add microchip sama7d65 SoC compatible with the required quirk\n dt-bindings: i3c: mipi-i3c-hci: add Microchip SAMA7D65 compatible\n i3c: Consistently define pci_device_ids using named initializers\n i3c: master: Reconcile dynamic addresses after DAA\n i3c: master: Move DAA API functions after i3c_master_add_i3c_dev_locked()\n i3c: master: Make i3c_master_add_i3c_dev_locked() return void\n i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA\n i3c: master: Prevent reuse of dynamic address on device add failure\n i3c: mipi-i3c-hci: Ignore DISEC failures when disabling IBIs\n i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()\n i3c: mipi-i3c-hci: Add Hot-Join support\n i3c: master: Export i3c_master_enec_disec_locked()\n i3c: master: Defer new-device registration out of DAA caller context\n i3c: dw: Drop redundant Hot-Join cancel_work_sync() in shutdown\n ...\n" }, { "commit": "37738fdf2ab1e504d1c63ce5bc0aeb6452d8f057", "tree": "22f81a45101b14b6ac4b3f74ea6d801c4e6597ad", "parents": [ "a1074dd62faa6572921d387e8a21589ccea00efc" ], "author": { "name": "Qingshuang Fu", "email": "fuqingshuang@kylinos.cn", "time": "Thu Jun 18 10:13:52 2026 +0800" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Jun 22 18:09:56 2026 +0200" }, "message": "irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove\n\nThe driver allocates domain generic chips using\nirq_alloc_domain_generic_chips() during probe and sets up chained\nhandlers using irq_set_chained_handler_and_data(). However, on driver\nremoval, the generic chips are not freed and the chained handlers are\nnot removed.\n\nThe generic chips remain on the global gc_list and may later be accessed by\ngeneric interrupt chip suspend, resume, or shutdown callbacks after the\ndriver has been removed, potentially resulting in a use-after-free and\nkernel crash.\n\nThe chained handlers that were installed in probe for peripheral and\nsyswake interrupts are also left dangling, which can lead to spurious\ninterrupts accessing freed memory.\n\nFix these issues by:\n\n - Setting IRQ_DOMAIN_FLAG_DESTROY_GC flag in domain-\u003eflags, so the\n core code automatically removes generic chips when irq_domain_remove()\n is called\n\n - Clearing all chained handlers with NULL in pdc_intc_remove()\n\nFixes: b6ef9161e43a (\"irq-imgpdc: add ImgTec PDC irqchip driver\")\nSigned-off-by: Qingshuang Fu \u003cfuqingshuang@kylinos.cn\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260618021352.661773-1-fffsqian@163.com\n" }, { "commit": "bba2c3615bd6cfee7456d1130f2e6b01b3f4e9ba", "tree": "4bd939cfa89e8cc39ac1680a7e2f522ab270b0e4", "parents": [ "ef0c9f75a19532d7675384708fc8621e10850104" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Jun 22 05:32:54 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Jun 22 05:32:56 2026 -1000" }, "message": "sched_ext: Move sources under kernel/sched/ext/\n\nThe sched_ext sources had grown to ten ext* files directly under\nkernel/sched/. Move them into a new kernel/sched/ext/ subdirectory and drop\nthe now-redundant ext_ prefix. ext.c/h keep their names.\n\n kernel/sched/ext.{c,h} -\u003e kernel/sched/ext/ext.{c,h}\n kernel/sched/ext_internal.h -\u003e kernel/sched/ext/internal.h\n kernel/sched/ext_types.h -\u003e kernel/sched/ext/types.h\n kernel/sched/ext_idle.{c,h} -\u003e kernel/sched/ext/idle.{c,h}\n kernel/sched/ext_cid.{c,h} -\u003e kernel/sched/ext/cid.{c,h}\n kernel/sched/ext_arena.{c,h} -\u003e kernel/sched/ext/arena.{c,h}\n\nThe include paths in build_policy.c and sched.h, the MAINTAINERS glob, and a\nfew documentation and comment references are updated to match. No code or\nsymbol changes.\n\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "335c347686e76df9d2c7d7f61b5ea627a4c5cb4c", "tree": "7a24a824aaffdd0945a9c8578aec1ce32e5be0f0", "parents": [ "6e869de3a1b9ef9f096223e0e7f30c727de4f6bc", "892a7864730775c3dbee2a39e9ead4fa8d4256e7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 08:28:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 08:28:48 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.2-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull more slab updates from Vlastimil Babka:\n\n - Introduce and wire up a new alloc_flags parameter for modifying\n slab-specific behavior without adding or reusing gfp flags. Also\n introduce slab_alloc_context to keep function parameter bloat in\n check. Both are similar to what the page allocator does.\n kmalloc_flags() exposes alloc_flags for mm-internal users.\n\n - SLAB_ALLOC_NOLOCK flag is used to implement kmalloc_nolock()\n behavior without relying on lack of __GFP_RECLAIM, which caused\n false positives with workarounds like fd3634312a04 (\"debugobject:\n Make it work with deferred page initialization - again\").\n\n - SLAB_ALLOC_NO_RECURSE replaces __GFP_NO_OBJ_EXT, which could have\n been removed, but pending memory allocation profiling changes in\n mm tree have grown a new user - there is however a work ongoing\n to replace that too, so __GFP_NO_OBJ_EXT should eventually be\n removed. (Vlastimil Babka)\n\n - Add kmem_buckets_alloc_track_caller() with a user to be added in the\n net tree (Pedro Falcato)\n\n - Fixes for kernel-doc and slabinfo (Randy Dunlap, Yichong Chen)\n\n* tag \u0027slab-for-7.2-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n tools/mm/slabinfo: fix total_objects attribute name\n slab: recognize @GFP parameter as optional in kernel-doc\n mm/slab: add a node-track-caller variant for kmem buckets allocation\n mm/slab: replace __GFP_NO_OBJ_EXT with SLAB_ALLOC_NO_RECURSE for sheaves\n mm/slab: remove __GFP_NO_OBJ_EXT usage from alloc_slab_obj_exts()\n mm/slab: introduce kmalloc_flags()\n mm/slab: allow __GFP_NOMEMALLOC and __GFP_NOWARN for kmalloc_nolock()\n mm/slab: pass slab_alloc_context to __do_kmalloc_node()\n mm/slab: allow kmem_cache_alloc_bulk() with any gfp flags\n mm/slab: replace slab_alloc_node() parameters with slab_alloc_context\n mm/slab: pass alloc_flags through slab_post_alloc_hook() chain\n mm/slab: pass alloc_flags to new slab allocation\n mm/slab: add alloc_flags to slab_alloc_context\n mm/slab: replace struct partial_context with slab_alloc_context\n mm/slab: introduce alloc_flags and SLAB_ALLOC_NOLOCK\n mm/slab: introduce slab_alloc_context\n mm/slab: stop inlining __slab_alloc_node()\n mm/slab: do not init any kfence objects on allocation\n" }, { "commit": "6e869de3a1b9ef9f096223e0e7f30c727de4f6bc", "tree": "cf13b11e1715cdeaed82e11a08ac37da203cb396", "parents": [ "2580f89860460f38bcc13fce75db8626d555c0cd", "a4ffc59238be84dd1c26bf1c001543e832674fc6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 08:06:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 08:06:13 2026 -0700" }, "message": "Merge tag \u0027hyperv-next-signed-20260621\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux\n\nPull hyperv updates from Wei Liu:\n\n - Use wakeup mailbox to boot APs in Hyper-V VTL2 TDX guests (Yunhong\n Jiang, Ricardo Neri)\n\n - Move the Hyper-V IOMMU to its own subdirectory (Mukesh Rathor)\n\n - Cosmetic changes to mshv and balloon driver (Junrui Luo, Markus\n Elfring)\n\n* tag \u0027hyperv-next-signed-20260621\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:\n mshv: add bounds check on vp_index in mshv_intercept_isr()\n hv_balloon: Simplify data output in hv_balloon_debug_show()\n x86/hyperv: Cosmetic changes in irqdomain.c for readability\n iommu/hyperv: Create hyperv subdirectory under drivers/iommu\n x86/hyperv/vtl: Use the wakeup mailbox to boot secondary CPUs\n x86/hyperv/vtl: Mark the wakeup mailbox page as private\n x86/acpi: Add a helper to get the address of the wakeup mailbox\n x86/hyperv/vtl: Setup the 64-bit trampoline for TDX guests\n x86/realmode: Make the location of the trampoline configurable\n x86/hyperv/vtl: Set real_mode_header in hv_vtl_init_platform()\n x86/dt: Parse the Wakeup Mailbox for Intel processors\n dt-bindings: reserved-memory: Wakeup Mailbox for Intel processors\n x86/acpi: Add functions to setup and access the wakeup mailbox\n x86/topology: Add missing struct declaration and attribute dependency\n" }, { "commit": "2580f89860460f38bcc13fce75db8626d555c0cd", "tree": "896d08f70dbfcea9b94c225334b597c740dda652", "parents": [ "ef0c9f75a19532d7675384708fc8621e10850104", "1ac287e2af9a9112fe271427ef45eceb26bce8b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 07:43:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 22 07:43:48 2026 -0700" }, "message": "Merge tag \u0027s390-7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull more s390 updates from Alexander Gordeev:\n\n - consolidate s390 idle time accounting by moving all CPU time tracking\n to the architecture backend and eliminate the mix of architecture-\n specific and common code accounting\n\n - Add missing EXPORT_SYMBOL_GPL() to kcpustat_field_idle() and\n kcpustat_field_iowait() functions\n\n - Finalize ptep_get() conversion by replacing direct page table entry\n dereferencing with proper accessors (ptep_get(), pmdp_get(), etc.)\n\n - Explicitly check the buffer length in PKEY_VERIFYPROTK ioctl and\n pkey_pckmo implementations and fail if the length is exceeded\n\n* tag \u0027s390-7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/pkey: Check length in pkey_pckmo handler implementation\n s390/pkey: Check length in PKEY_VERIFYPROTK ioctl\n s390/idle: Add missing EXPORT_SYMBOL_GPL()\n s390/mm: Complete ptep_get() conversion\n s390/idle: Remove idle time and count sysfs files\n s390/idle: Provide arch specific kcpustat_field_idle()/kcpustat_field_iowait()\n s390/irq/idle: Use stcke instead of stckf for time stamps\n s390/timex: Move union tod_clock type to separate header\n" }, { "commit": "b81dde13cc163450dcb402dcc915ef13ba241e01", "tree": "b59c6fe09e368d031e648ef9e867463334105342", "parents": [ "de3ab9bd3133899efb92e4cd05ba4203e58fc0a3" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sun Jun 21 16:47:44 2026 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Jun 22 16:38:57 2026 +0200" }, "message": "debugobjects: Plug race against a concurrent OOM disable\n\nsyzbot reported a puzzling splat:\n\n WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20\n\nstub_timer() is installed as timer callback function in\nhrtimer_fixup_assert_init(), which is invoked when\ndebug_object_assert_init() can\u0027t find a shadow object. In that case debug\nobjects emits a warning about it before invoking the fixup.\n\nThough the provided console log lacks this warning and instead has the\nfollowing a few seconds before the splat:\n\n ODEBUG: Out of memory. ODEBUG disabled\n\nSo the object was looked up in debug_object_assert_init() and the lookup\nfailed due a concurrent out of memory situation which disabled debug\nobjects and freed the shadow objects:\n\ndebug_object_assert_init()\n if (!debug_objects_enabled)\n \treturn; obj \u003d alloc();\n \t\t\t\tif (!obj) {\n\t\t\t\t\t\t\t// Out of memory\n \tdebug_objects_enabled \u003d false;\n free_objects();\n obj \u003d lookup_or_alloc();\n\n // The lookup failed because the other side\n // removed the objects, so this returns\n // an error code as the object in question\n // is not statically initialized\n\n\tif (!IS_ERR_OR_NULL(obj))\n \treturn;\n if (!obj) {\n \tdebug_oom();\n return;\n }\n\n print(...)\n if (!debug_objects_enabled)\n return;\n\n fixup(...)\n\nThe debug object splat is skipped because debug_objects_enabled is false,\nbut the fixup callback is invoked unconditionally, which makes the timer\ndisfunctional.\n\nThis is only a problem in debug_object_assert_init() and\ndebug_object_activate() as both have to handle statically initialized\nobjects and therefore must handle the error pointer return case\ngracefully. All other places only handle the found/not found case and the\nNULL pointer return is a signal for OOM. Otherwise they get a valid shadow\nobject.\n\nPlug the hole by checking whether debug objects are still enabled before\ninvoking the print and fixup function in those two places.\n\nFixes: b84d435cc228 (\"debugobjects: Extend to assert that an object is initialized\")\nReported-by: syzbot+5e8dda76ca21dae314b6@syzkaller.appspotmail.com\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/874iiwlzlb.ffs@fw13\n" }, { "commit": "269f2b43fae692d1f3988c9f888a6301aa537b82", "tree": "5acc91ef13e2317d3de053aee2a3f85445fff6d4", "parents": [ "f8aceb1adb05896d66a3abbc1b0f41b90c9179ae" ], "author": { "name": "Wang Yan", "email": "wangyan01@kylinos.cn", "time": "Mon Jun 22 18:33:48 2026 +0800" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Jun 22 13:20:20 2026 +0200" }, "message": "time: Fix off-by-one in compat settimeofday() usec validation\n\nThe compat version of settimeofday() uses \u0027\u003e\u0027 instead of \u0027\u003e\u003d\u0027 when\nvalidating tv_usec against USEC_PER_SEC, allowing the value 1000000 to pass\nthe check. After the subsequent conversion to nanoseconds (tv_nsec *\u003d\nNSEC_PER_USEC), this results in tv_nsec \u003d\u003d NSEC_PER_SEC, which violates the\ntimespec invariant that tv_nsec must be strictly less than NSEC_PER_SEC.\n\nThe native settimeofday() was already fixed in commit ce4abda5e126 (\"time:\nFix off-by-one in settimeofday() usec validation\"), but the compat\ncounterpart was missed.\n\nFix it by using \u0027\u003e\u003d\u0027 to reject tv_usec values outside the valid range [0,\nUSEC_PER_SEC - 1].\n\nFixes: 5e0fb1b57bea (\"y2038: time: avoid timespec usage in settimeofday()\")\nSigned-off-by: Wang Yan \u003cwangyan01@kylinos.cn\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nAcked-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260622103348.120255-1-wangyan01@kylinos.cn\n" }, { "commit": "803d09a554055aba160a62abd1e4b1260b899dc1", "tree": "cc9dda475878227f23c94ea6fa22380006c36f61", "parents": [ "c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56" ], "author": { "name": "Zhan Xusheng", "email": "zhanxusheng@xiaomi.com", "time": "Mon Jun 22 16:11:36 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Mon Jun 22 18:50:36 2026 +0800" }, "message": "erofs: handle 48-bit blocks_hi for compressed inodes\n\nCombine i_nb.blocks_hi with i_u.blocks_lo when computing\ninode-\u003ei_blocks for compressed inodes, mirroring the startblk_hi\nhandling for unencoded inodes a few lines above. Also evaluate\nthe shift in u64 to avoid truncation.\n\nFixes: efb2aef569b3 (\"erofs: add encoded extent on-disk definition\")\nFixes: 1d191b4ca51d (\"erofs: implement encoded extent metadata\")\nReviewed-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\nSigned-off-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "c37460cd9b2fcb61ec66b7eb4fde737e65ec2a56", "tree": "4feab9bfc3cc5b83035ab5beca345bbb18c27e89", "parents": [ "59397c6b755a35e5a33dbcbe22240cd86ebb935b" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Mon Jun 22 09:36:22 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Mon Jun 22 11:00:06 2026 +0800" }, "message": "erofs: remove fscache backend entirely\n\nEROFS over fscache was introduced to provide image lazy pulling\nfunctionality. After the feature landed, the fscache subsystem made\nnetfs a new hard dependency, which is unexpected for a local filesystem\nand has an kernel-defined caching hierarchy which could be inflexible\ncompared to the fanotify pre-content hooks. Therefore, this feature has\nbeen deprecated for almost two years.\n\nAs EROFS file-backed mounts and fanotify pre-content hooks both upstream\nfor a while and already providing equivalent functionality (erofs-utils\nhas supported fanotify pre-content hooks), let\u0027s remove the fscache\nbackend now.\n\nThe main application of this feature is Nydus [1], and they plan to move\nto use fanotify pre-content hooks in the near future too.\n\nI hope this patch can be merged into Linux 7.2, which is also motivated\nby newly found implementation issues [2][3] that are not worth\ninvestigating given the deprecation and limited development resources.\nThe associated fscache/cachefiles cleanup patch will follow separately\nthrough the vfs tree (netfs) later: it seems fine since the codebase is\nisolated by CONFIG_CACHEFILES_ONDEMAND.\n\n[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md\n[2] https://github.com/dragonflyoss/nydus/pull/1824\n[3] https://lore.kernel.org/r/20260619135800.1594811-1-michael.bommarito@gmail.com\n\nAcked-by: Jingbo Xu \u003cjefflexu@linux.alibaba.com\u003e\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "59397c6b755a35e5a33dbcbe22240cd86ebb935b", "tree": "f3ae179b957b5a39c0bd6996376bf5c155117537", "parents": [ "e87827da8c351db0de504534e6aa17be3014bc25" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Fri Jun 19 16:34:03 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Mon Jun 22 06:49:14 2026 +0800" }, "message": "erofs: simplify RCU read critical sections\n\n - use scoped_guard() for RCU read critical section in\n z_erofs_decompress_kickoff();\n\n - simplify the RCU critical section loop in\n z_erofs_pcluster_begin().\n\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "e87827da8c351db0de504534e6aa17be3014bc25", "tree": "aaf2caba31c00e8f5663d837d0ccb48d57537107", "parents": [ "28c5d230980bdd8cb18c073225296c7747995935" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Mon Jun 22 03:44:14 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Mon Jun 22 06:48:59 2026 +0800" }, "message": "erofs: add sparse support to pcluster layout\n\nAlthough zeros can be compressed transparently on EROFS using fixed-size\noutput compression so that it is never prioritized in the Android use\ncases, indicating entire pclusters as holes is still useful to preserve\nholes in the sparse datasets; otherwise overlayfs will allocate more\nspace when copying up, and SEEK_HOLE won\u0027t report any hole.\n\nThis patch introduces two ways to mark a pcluster as a hole:\n\n - A new Z_EROFS_LI_HOLE compatible flag (bit 14) in the HEAD lcluster\n advise field for non-compact (full) indexes;\n\n - A 0-block CBLKCNT value on the first NONHEAD lcluster.\n\nThe hole tag is preferred for maximum compatibility since pre-existing\nkernels that do not understand Z_EROFS_LI_HOLE will decompress at the\nstored blkaddr (the same blkaddr will be shared among all sparse\npclusters). Only the 0-block CBLKCNT approach also works for compact\nindexes, but it is limited to big pclusters and new kernels.\n\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "ef0c9f75a19532d7675384708fc8621e10850104", "tree": "663df4f1349a5aaf9a5febc9018a1798ee51f434", "parents": [ "2e05544060b9fef5d4d0e0172944e6956c55080f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 21 14:09:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 21 14:09:49 2026 -0700" }, "message": "lib: Add stale \u0027raid6\u0027 directory to .gitignore file\n\nI keep having to do this, because people think they can just move\ndirectories around and move the gitignore files around with them.\n\nYou really can\u0027t do that - the old generated files stay around for\nothers, and still need to be ignored in the old location.\n\nSo when moving gitignore entries around because you moved the files (or\nwhen moving a whole gitignore file around because the directory it was\nin moved), the old gitignore situation needs to be dealt with.\n\nYes, those files may have moved in *your* tree when you moved the\ndirectory. And yes, new repositories will never even have seen them.\nBut all those other developers that see the result of your move still\nlikely have a working tree with the old state, and the files that were\nhidden from git by an old gitignore file do not suddenly become\nrelevant.\n\nFixes: 3626738bc714 (\"raid6: move to lib/raid/\")\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2e05544060b9fef5d4d0e0172944e6956c55080f", "tree": "34a973fce4a060e5f8148fa4418b158fc3ade1ef", "parents": [ "09e3b4a76bb6047ec0b99dc668b313469d8a73d0", "ff6f26c58421614b02694ac9d219ac61d924bc68" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 21 13:20:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 21 13:20:19 2026 -0700" }, "message": "Merge tag \u0027mm-nonmm-stable-2026-06-21-10-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull non-MM updates from Andrew Morton:\n\n - \"taskstats: fix TGID dead-thread stat retention\" (Yiyang Chen)\n\n Fix a taskstats TGID aggregation bug where fields added in the TGID\n query path were not preserved after thread exit, and adds a kselftest\n covering the regression.\n\n - \"lib/tests: string_helpers: Slight improvements\" (Andy Shevchenko)\n\n Improve lib/tests/string_helpers_kunit.c a little\n\n - \"lib/base64: decode fixes\" (Josh Law)\n\n Address minor issues in lib/base64.c\n\n - \"selftests/filelock: Make output more kselftestish\" (Mark Brown)\n\n Make the output from the ofdlocks test a bit easier for tooling to\n work with. Also ignore the generated file\n\n - \"uaccess: unify inline vs outline copy_{from,to}_user() selection\"\n (Yury Norov)\n\n Simplify the usercopy code by removing the selectability of inlining\n copy_{from,to}_user().\n\n - \"ocfs2: validate inline xattr header consumers\" (ZhengYuan Huang)\n\n Fix a number of possible issues in the ocfs2 xattr code\n\n - \"lib and lib/cmdline enhancements\" (Dmitry Antipov)\n\n Provide additional robustness checking in the cmdline handling code\n and its in-kernel testing and selftests\n\n - \"cleanup the RAID6 P/Q library\" (Christoph Hellwig)\n\n Clean up the RAID6 P/Q library to match the recent updates to the\n RAID 5 XOR library and other CRC/crypto libraries\n\n - \"ocfs2: harden inode validators against forged metadata\" (Michael\n Bommarito)\n\n Add three structural checks to OCFS2 dinode validation so malformed\n on-disk fields are rejected before ocfs2_populate_inode() copies them\n into the in-core inode\n\n - \"lib/raid: replace __get_free_pages() call with kmalloc()\" (Mike\n Rapoport)\n\n Clean up the lib/raid code by using kmalloc() in more places\n\n* tag \u0027mm-nonmm-stable-2026-06-21-10-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (108 commits)\n ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write\n ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits\n lib: interval_tree_test: validate benchmark parameters\n ocfs2: avoid moving extents to occupied clusters\n treewide: fix transposed \"sign\" typos and update spelling.txt\n ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec\n fat: reject BPB volumes whose data area starts beyond total sectors\n selftests/uevent: increase __UEVENT_BUFFER_SIZE to avoid ENOBUFS on busy systems\n lib/test_firmware: allocate the configured into_buf size\n fs: efs: remove unneeded debug prints\n checkpatch: cuppress warnings when Reported-by: is followed by Link:\n MAINTAINERS: add Alexander as a kcov reviewer\n mailmap: update Alexander Sverdlin\u0027s Email addresses\n fs: fat: inode: replace sprintf() with scnprintf()\n ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent\n ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()\n ocfs2/dlm: require a ref for locking_state debugfs open\n ocfs2: reject FITRIM ranges shorter than a cluster\n ocfs2: validate fast symlink target during inode read\n ocfs2: add journal NULL check in ocfs2_checkpoint_inode()\n ...\n" }, { "commit": "09e3b4a76bb6047ec0b99dc668b313469d8a73d0", "tree": "44b6a838649677298911ba27eee68861cb7a53ba", "parents": [ "8cd8cf7a07e5d141b0c75ce6cf470630e11aa11a", "49420dfdedd676befaa999b165a76d8d7eec4fab" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 21 12:25:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 21 12:25:17 2026 -0700" }, "message": "Merge tag \u0027mtd/for-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull mtd updates from Miquel Raynal:\n \"NAND changes:\n\n - Extend SPI NAND continuous read to Winbond devices, which requires\n numerous changes in the spi-{mem,nand} layers such as the need for\n a secondary read operation template\n\n - Continuous reads in general have also been enhanced/fixed for\n avoiding potential issues at probe time and at block boundaries\n\n SPI NOR changes:\n\n - Big set of cleanups and improvements to the locking support.\n\n This series contains some cleanups and bug fixes for code and\n documentation around write protection. Then support is added for\n complement locking, which allows finer grained configuration of\n what is considered locked and unlocked. Then complement locking is\n enabled on a bunch of Winbond W25 flashes\n\n - Fix die erase support on Spansion flashes.\n\n Die erase is only supported on multi-die flashes, but the die erase\n opcode was set for all. When the opcode is set, it overrides the\n default chip erase opcode which should be used for single-die\n flashes. Only set the opcode on multi-die flashes. Also, the opcode\n was not set on multi-die s28hx-t flashes. Set it so they can use\n die-erase correctly\n\n General changes:\n\n - A few drivers and mappings have been removed following SoCs support\n removal\n\n - And again, there is the usual load of misc improvements and fixes\"\n\n* tag \u0027mtd/for-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (63 commits)\n mtd: cfi: Use common error handling code in two functions\n mtd: slram: simplify register_device() cleanup\n mtd: slram: remove failed entries from the device list\n mtd: rawnand: ndfc: use ioread32be/iowrite32be and allow COMPILE_TEST\n mtd: spi-nor: spansion: add die erase support in s28hx-t\n mtd: spi-nor: spansion: use die erase for multi-die devices only\n mtd: spi-nor: winbond: Add W25Q02NWxxIM CMP locking support\n mtd: spi-nor: winbond: Add W25Q01NWxxIM CMP locking support\n mtd: spi-nor: winbond: Add W25Q01NWxxIQ CMP locking support\n mtd: spi-nor: winbond: Add W25H02NWxxAM CMP locking support\n mtd: spi-nor: winbond: Add W25H01NWxxAM CMP locking support\n mtd: spi-nor: winbond: Add W25H512NWxxAM CMP locking support\n mtd: spi-nor: Add steps for testing locking with CMP\n mtd: spi-nor: swp: Add support for the complement feature\n mtd: spi-nor: Add steps for testing locking support\n mtd: maps: remove obsolete impa7 map driver\n mtd: maps: remove uclinux map driver\n mtd: maps: remove AMD Élan specific drivers\n mtd: inftlmount: convert printk(KERN_WARNING) to pr_warn\n mtd: Consistently define pci_device_ids\n ...\n" }, { "commit": "86f436567f2516a0083b210bedc933544826a2c3", "tree": "aa671b2fef14701c1ee87dc90861297a52a2e8d2", "parents": [ "673db10729fb121ea1b16fe57791a0cb9eac1eb5" ], "author": { "name": "Bradley Morgan", "email": "include@grrlz.net", "time": "Fri Jun 19 16:37:18 2026 +0000" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sun Jun 21 20:44:00 2026 +0200" }, "message": "cpu: hotplug: Bound hotplug states sysfs output\n\nstates_show() adds CPU hotplug state names into a single sysfs buffer\nusing sprintf(). With enough registered states, this can write past the\nend of the PAGE_SIZE buffer.\n\nUse sysfs_emit_at() so output is bounded.\n\nFixes: 98f8cdce1db5 (\"cpu/hotplug: Add sysfs state interface\")\nSigned-off-by: Bradley Morgan \u003cinclude@grrlz.net\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net\n" }, { "commit": "673db10729fb121ea1b16fe57791a0cb9eac1eb5", "tree": "a60daf1d1cfe8eedb23711cb38aa7404272e583d", "parents": [ "c94291914b200e10c72cef23c8e4c67eb4fdbcd9" ], "author": { "name": "Bradley Morgan", "email": "include@grrlz.net", "time": "Fri Jun 19 16:37:17 2026 +0000" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sun Jun 21 20:44:00 2026 +0200" }, "message": "cpu: hotplug: Preserve per instance callback errors\n\ncpuhp_invoke_callback() unwinds earlier callbacks for the same\nhotplug state when one instance fails. The rollback path currently\nreuses ret, so a successful rollback can hide the original error and\nmake the failed transition look successful.\n\nKeep the rollback result separate from the original error.\n\nFixes: 724a86881d03 (\"smp/hotplug: Callback vs state-machine consistency\")\nSigned-off-by: Bradley Morgan \u003cinclude@grrlz.net\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260619163719.12103-1-include@grrlz.net\n" }, { "commit": "13a1e1a618858407fa12c391f664ea750651f6b2", "tree": "a37196f4677422ebfe2ab1a426a4a0583b14bfba", "parents": [ "44238b122ae834ac52748e59809a139a2cb8409b" ], "author": { "name": "Lorenzo Stoakes", "email": "ljs@kernel.org", "time": "Fri Jun 19 12:28:51 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:38 2026 -0700" }, "message": "Revert \"mm: limit filemap_fault readahead to VMA boundaries\"\n\nThis reverts commit 7b32f64bc512b40b268776c5ac4d354b325b3197.\n\nThis patch caused a significant performance regression, so revert it, and\nwe can determine whether the approach is sensible or not moving forwards,\nand if so how to avoid this.\n\nThere was a merge conflict with commit de97ae6222c1 (\"mm/readahead: no\nPG_readahead on EOF\"), care was taken to ensure that the revert retained\nthe behaviour of this patch and cleanly reverts commit 7b32f64bc512 (\"mm:\nlimit filemap_fault readahead to VMA boundaries\") only.\n\nLink: https://lore.kernel.org/20260619112852.104213-1-ljs@kernel.org\nFixes: 7b32f64bc512 (\"mm: limit filemap_fault readahead to VMA boundaries\")\nSigned-off-by: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nReported-by: kernel test robot \u003coliver.sang@intel.com\u003e\nCloses: https://lore.kernel.org/oe-lkp/202606181547.617a6967-lkp@intel.com\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Pedro Falcato \u003cpfalcato@suse.de\u003e\nReviewed-by: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Kalesh Singh \u003ckaleshsingh@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "44238b122ae834ac52748e59809a139a2cb8409b", "tree": "35fb28d75afcba5ad222fc30994a453e56b3fbf7", "parents": [ "c565c009d0c00aa1a2e813aef11cfc685f148d1a" ], "author": { "name": "Ben Dooks", "email": "ben.dooks@codethink.co.uk", "time": "Tue Jun 16 10:59:06 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:38 2026 -0700" }, "message": "mm/vmscan: pass NULL to trace vmscan node reclaim\n\nThe tracepoint for node relcaims takes a `struct mem_cgroup *`\nas the third argument, so pass NULL instead of 0 to fix warning\nabout using an integer as a pointer.\n\nFixes the following warnings:\n\nmm/vmscan.c:6753:66: warning: Using plain integer as NULL pointer\nmm/vmscan.c:6757:58: warning: Using plain integer as NULL pointer\nmm/vmscan.c:7818:60: warning: Using plain integer as NULL pointer\n\nLink: https://lore.kernel.org/20260616095906.210016-1-ben.dooks@codethink.co.uk\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "c565c009d0c00aa1a2e813aef11cfc685f148d1a", "tree": "3cdeefc542b1bd3ac79c0c21184661da28a558df", "parents": [ "cea5702144615878600d3a39b5d8b3cc34719012" ], "author": { "name": "Huang Shijie", "email": "huangsj@hygon.cn", "time": "Fri Jun 12 15:30:32 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:38 2026 -0700" }, "message": "mm: use mapping_mapped to simplify the code\n\nUse mapping_mapped() to simplify the code, make the code tidy and clean.\n\nLink: https://lore.kernel.org/20260612073032.33228-1-huangsj@hygon.cn\nSigned-off-by: Huang Shijie \u003chuangsj@hygon.cn\u003e\nReviewed-by: Pedro Falcato \u003cpfalcato@suse.de\u003e\nReviewed-by: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nReviewed-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nReviewed-by: Oscar Salvador (SUSE) \u003cosalvador@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "cea5702144615878600d3a39b5d8b3cc34719012", "tree": "2c5a57140418ee9a161346583725d162e391391c", "parents": [ "8edb0e769ce2a996774df83485781dd9f4bc2d44" ], "author": { "name": "Aboorva Devarajan", "email": "aboorvad@linux.ibm.com", "time": "Thu Jun 11 09:11:02 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:38 2026 -0700" }, "message": "selftests/mm: fix exclusive_cow test fork() handling\n\nThe test ignores the return value of fork(), so both the parent and the\n(newly created) child run the COW verification loops and then call\nhmm_buffer_free() before returning into the kselftest harness, which\n_exit()s each side. This duplicated teardown sequence has been observed\nto manifest as a SIGSEGV in the test child, e.g.:\n\n hmm-tests[360141]: segfault (11) at 0 nip 10006964 lr 1000ac3c code 1\n in hmm-tests[6964,10000000+30000]\n\nFix this by adopting the same fork()-then-wait pattern already used by the\nnearby anon_write_child / anon_write_child_shared tests in this file: the\nchild performs the COW verification and then _exit(0)s so it does not run\nthe test teardown, while the parent independently verifies COW, waits for\nthe child, and only then frees the buffer.\n\nLink: https://lore.kernel.org/20260611034102.1030738-4-aboorvad@linux.ibm.com\nFixes: b659baea75469 (\"mm: selftests for exclusive device memory\")\nSigned-off-by: Aboorva Devarajan \u003caboorvad@linux.ibm.com\u003e\nCc: Alex Sierra \u003calex.sierra@amd.com\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Balbir Singh \u003cbalbirs@nvidia.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nCc: Leon Romanovsky \u003cleon@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Ralph Campbell \u003crcampbell@nvidia.com\u003e\nCc: Sayali Patil \u003csayalip@linux.ibm.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "8edb0e769ce2a996774df83485781dd9f4bc2d44", "tree": "788bc0d271d47347860f80eec8bc41f4f57426e2", "parents": [ "224ed0e019b122d08580362abe57574a78f2b5fa" ], "author": { "name": "Sayali Patil", "email": "sayalip@linux.ibm.com", "time": "Thu Jun 11 09:11:01 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:37 2026 -0700" }, "message": "selftests/mm: remove hardcoded THP sizing assumptions in hmm tests\n\nmigrate_partial_unmap_fault() and migrate_remap_fault() use hardcoded\noffsets based on a 2MB PMD size. Similarly, benchmark_thp_migration()\nassumes a fixed 2MB THP size when generating test buffer sizes.\n\nDerive offsets and test sizes from the runtime PMD page size returned by\nread_pmd_pagesize(). If unavailable, fall back to TWOMEG. This allows\nthe tests to adapt correctly on systems where PMD-sized THP differs from\n2MB. Also replace the fixed 1MB unmap size with a PMD-relative value\nderived from the runtime PMD size.\n\nOn systems with larger PMD sizes, computed test buffer sizes can exceed\nINT_MAX. Skip such test cases to avoid overflow.\n\nLink: https://lore.kernel.org/20260611034102.1030738-3-aboorvad@linux.ibm.com\nFixes: 24c2c5b8ffbd (\"selftests/mm/hmm-tests: partial unmap, mremap and anon_write tests\")\nFixes: 271a7b2e3c13 (\"selftests/mm/hmm-tests: new throughput tests including THP\")\nSigned-off-by: Sayali Patil \u003csayalip@linux.ibm.com\u003e\nSigned-off-by: Aboorva Devarajan \u003caboorvad@linux.ibm.com\u003e\nAcked-by: Balbir Singh \u003cbalbirs@nvidia.com\u003e\nCc: Alex Sierra \u003calex.sierra@amd.com\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nCc: Leon Romanovsky \u003cleon@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Ralph Campbell \u003crcampbell@nvidia.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "224ed0e019b122d08580362abe57574a78f2b5fa", "tree": "0b62c011435e456988bc0bb2ac0c90d23e890fb5", "parents": [ "e8ae6fd67021fafa9205330b3b248c9fc7216e0b" ], "author": { "name": "Sayali Patil", "email": "sayalip@linux.ibm.com", "time": "Thu Jun 11 09:11:00 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:37 2026 -0700" }, "message": "selftests/mm: allow PUD-level entries in compound testcase of hmm tests\n\nPatch series \"selftests/mm: assorted fixes for hmm-tests\", v3.\n\nThis series fixes a few issues in hmm-tests that show up when page-size\nand huge-page configuration differ from the hardcoded assumptions the\ntests were written for (PMD/THP sizing, default hugepage size, and related\ncases).\n\nIt also includes a fix to exclusive_cow: the test ignored the return value\nof fork(), so both parent and child ran the same teardown path.\n\n\nThis patch (of 3):\n\nThe HMM compound testcase currently assumes only PMD-level mappings and\nfails on systems where default_hugepagesz\u003d1G is set, because the region is\nthen reported by the device at PUD level.\n\nDetermine the mapping level (PMD or PUD) the device reports for the first\npage of the range and require every page to match that level exactly via\nASSERT_EQ(). This accepts PUD-level mappings while preserving the\nexpected/observed protection values printed on failure, and rejects a\nfragmented mapping that mixes PMD- and PUD-level entries within the same\nrange (which a per-page OR check would have let pass).\n\nLink: https://lore.kernel.org/20260611034102.1030738-1-aboorvad@linux.ibm.com\nLink: https://lore.kernel.org/20260611034102.1030738-2-aboorvad@linux.ibm.com\nFixes: e478425bec93 (\"mm/hmm: add tests for hmm_pfn_to_map_order()\")\nSigned-off-by: Sayali Patil \u003csayalip@linux.ibm.com\u003e\nCo-developed-by: Aboorva Devarajan \u003caboorvad@linux.ibm.com\u003e\nSigned-off-by: Aboorva Devarajan \u003caboorvad@linux.ibm.com\u003e\nCc: Alex Sierra \u003calex.sierra@amd.com\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Balbir Singh \u003cbalbirs@nvidia.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nCc: Leon Romanovsky \u003cleon@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Ralph Campbell \u003crcampbell@nvidia.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "e8ae6fd67021fafa9205330b3b248c9fc7216e0b", "tree": "d18bc7aa9bca4ef921df99dcaffce97736bc5898", "parents": [ "5419cac89c0224b5acdbcda183a3c4809510ce95" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Tue Jun 09 00:48:15 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:37 2026 -0700" }, "message": "mm/gup_test: reject wrapped user ranges\n\ngup_test accepts an address and size from the debugfs ioctl and repeatedly\ncompares against addr + size. If that addition wraps, the loop can be\nskipped and the ioctl returns success with size rewritten to zero.\n\nCompute the end address once with overflow checking and use that checked\nend for the loop bounds.\n\nAssisted-by: Codex:gpt-5.5-cyber-preview\nLink: https://lore.kernel.org/20260609004814.1240586.6294d614ac80.gup-test-range-end-wrap@trailofbits.com\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nCc: John Hubbard \u003cjhubbard@nvidia.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "5419cac89c0224b5acdbcda183a3c4809510ce95", "tree": "6810521bc21bdc5430b4e509899eb401fd763285", "parents": [ "6a66c557a2ab2609575bafd15e093669c05f9711" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Fri Jun 05 18:41:52 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:37 2026 -0700" }, "message": "mm/page_frag: reject invalid CPUs in page_frag_test\n\nThe page_frag selftest module accepts test_push_cpu and test_pop_cpu as\nsigned module parameters, then validates them by passing them directly to\ncpu_active().\n\nThat validation is itself unsafe for negative or out-of-range CPU numbers.\nFor example, test_push_cpu\u003d-1 is converted to a very large unsigned CPU\nnumber before cpu_active() reaches cpumask_test_cpu(), which trips the\ncpumask range check with CONFIG_DEBUG_PER_CPU_MAPS enabled.\n\nReject CPU values outside [0, nr_cpu_ids) before asking whether the CPU is\nactive.\n\nAssisted-by: Codex:gpt-5.5-cyber-preview\nLink: https://lore.kernel.org/20260605184157.2490353-1-sam.moelius@trailofbits.com\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "6a66c557a2ab2609575bafd15e093669c05f9711", "tree": "b1e7f488f00689855381b28be678fb3d7a18bb41", "parents": [ "878f41243c0ddc8201856c1d0c530df47cdaec87" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Thu Jun 04 18:38:48 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:36 2026 -0700" }, "message": "mm/damon/core: always put unsuccessfully committed target pids\n\ndamon_commit_target() puts and gets the destination and the source target\npids. It puts the destination target pid because it will be overwritten\nby the source target pid. It gets the source pid because the caller is\nsupposed to eventually put the pids. In more detail, the caller will call\ndamon_destroy_ctx() after damon_commit_ctx() to destroy the entire source\ncontext. And in this case, [f]vaddr operation set\u0027s cleanup_target()\ncallback will put the pids.\n\nThe commit operation is made at the context level. The operation can fail\nin multiple places including in the middle and after the targets commit\noperations. For any such failures, immediately the error is returned to\nthe damon_commit_ctx() caller. If some or all of the source target pids\nwere committed to the destination during the unsuccessful context commit\nattempt, those pids should be put twice.\n\nThe source context will do the put operations using the above explained\nroutine. However, let\u0027s suppose the destination context was not\noriginally using [f]vaddr operation set and the commit failed before the\nops of the source context is committed. The destination does not have the\ncleanup_target() ops callback, so it cannot put the pids via the\ndamon_destroy_ctx().\n\nAs a result, the pids are leaked. The issue in the real world would be\nnot very common. The commit feature is for changing parameters of running\nDAMON context while inheriting internal status like the monitoring\nresults. The monitoring results of a physical address range ain\u0027t have\nthings that are beneficial to be inherited to a virtual address ranges\nmonitoring. So the problem-causing DAMON control would be not very common\nin the real world. That said, it is a supported feature. And\ndamon_commit_target() failure due to memory allocation is relatively\nrealistic [1] if there are a huge number of target regions.\n\nFix by putting the pids in the commit operation in case of the failures.\n\nThe issue was discovered [2] by Sashiko.\n\nLink: https://lore.kernel.org/20260605013849.83750-1-sj@kernel.org\nLink: https://lore.kernel.org/20260603112306.58490-1-akinobu.mita@gmail.com [1]\nLink: https://lore.kernel.org/20260320020056.835-1-sj@kernel.org [2]\nFixes: 83dc7bbaecae (\"mm/damon/sysfs: use damon_commit_ctx()\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 6.11.x\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "878f41243c0ddc8201856c1d0c530df47cdaec87", "tree": "85fce3bf08edc4587805d03e5393e791809f4ab0", "parents": [ "b902890c62d200b3509cb5e09cf1e0a66553c128" ], "author": { "name": "Kaitao Cheng", "email": "chengkaitao@kylinos.cn", "time": "Tue Jun 02 21:07:55 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:36 2026 -0700" }, "message": "mm: page_isolation: avoid unsafe folio reads while scanning compound pages\n\npage_is_unmovable() can inspect compound pages without holding a folio\nreference or any lock. The folio can therefore be freed, split or reused\nwhile the scanner is still looking at it.\n\nThe existing HugeTLB handling already avoids folio_hstate() for this\nreason, but it still derives the hstate from folio_size() and later\nderives the scan step from folio_nr_pages() and folio_page_idx(). These\nhelpers rely on the folio still being a valid folio head. If the folio\nchanged concurrently, the scanner can read inconsistent folio metadata and\ncompute a wrong step. In the worst case, folio_nr_pages() can return 1\nfor what used to be a tail page and the subtraction from folio_page_idx()\ncan underflow.\n\nThere is a similar issue for non-Hugetlb compound pages: folio_test_lru()\nexpects a valid folio. If the previously observed head page has been\nreused as a tail page of another compound page, the folio flag checks can\ntrigger VM_BUG_ON_PGFLAGS().\n\nRead the compound order once with compound_order(), reject obviously bogus\norders, and derive the hstate and scan step from that order instead of\nquerying folio size information again. Also use PageLRU(page), which is\nsafe for the page being scanned, instead of folio_test_lru() on a\npotentially stale folio pointer.\n\nTreat an unknown HugeTLB hstate as unmovable so the scanner does not try\nto skip over an unstable HugeTLB folio.\n\nLink: https://lore.kernel.org/20260602130755.38794-1-kaitao.cheng@linux.dev\nFixes: a0a9f2180b90 (\"mm: page_isolation: avoid calling folio_hstate() without hugetlb_lock\")\nSigned-off-by: Kaitao Cheng \u003cchengkaitao@kylinos.cn\u003e\nReviewed-by: Zi Yan \u003cziy@nvidia.com\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nAcked-by: Oscar Salvador (SUSE) \u003cosalvador@kernel.org\u003e\nCc: Brendan Jackman \u003cjackmanb@google.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Liu Shixin \u003cliushixin2@huawei.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Muchun Song \u003cmuchun.song@linux.dev\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "b902890c62d200b3509cb5e09cf1e0a66553c128", "tree": "634122c9a974b1206a214160b36b0141a8ce7af6", "parents": [ "cc13a7a618fe8354f16d74c06aaf9565a68e9ebd" ], "author": { "name": "Shakeel Butt", "email": "shakeel.butt@linux.dev", "time": "Wed Jun 10 16:20:48 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:36 2026 -0700" }, "message": "mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()\n\nReading the debugfs \"count\" file of a memcg-aware shrinker can sleep\ninside an RCU read-side critical section:\n\n BUG: sleeping function called from invalid context at kernel/cgroup/rstat.c:421\n RCU nest depth: 1, expected: 0\n css_rstat_flush\n mem_cgroup_flush_stats\n zswap_shrinker_count\n shrinker_debugfs_count_show\n\nshrinker_debugfs_count_show() invokes the -\u003ecount_objects() callback under\nrcu_read_lock(). The zswap callback flushes memcg stats via\ncss_rstat_flush(), which may sleep, so it must not run under RCU.\n\nThe RCU lock is not needed here. mem_cgroup_iter() takes RCU internally\nand returns a memcg holding a css reference (dropped on the next iteration\nor by mem_cgroup_iter_break()), so the memcg stays alive without it. The\nshrinker is kept alive by the open debugfs file: shrinker_free() removes\nthe debugfs entries via debugfs_remove_recursive(), which waits for\nin-flight readers to drain, before call_rcu(..., shrinker_free_rcu_cb). \nThe sibling \"scan\" handler already invokes the sleeping -\u003escan_objects()\ncallback with no RCU section.\n\nDrop the rcu_read_lock()/rcu_read_unlock().\n\nLink: https://lore.kernel.org/20260610232048.62930-1-shakeel.butt@linux.dev\nFixes: 5035ebc644ae (\"mm: shrinkers: introduce debugfs interface for memory shrinkers\")\nSigned-off-by: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nReported-by: Zenghui Yu \u003czenghui.yu@linux.dev\u003e\nCloses: https://lore.kernel.org/all/c052a064-cddb-494f-a0d8-f8a10b4b1c4d@linux.dev/\nSuggested-by: Nhat Pham \u003cnphamcs@gmail.com\u003e\nReviewed-by: SeongJae Park \u003csj@kernel.org\u003e\nReviewed-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nTested-by: Zenghui Yu (Huawei) \u003czenghui.yu@linux.dev\u003e\nReviewed-by: Nhat Pham \u003cnphamcs@gmail.com\u003e\nAcked-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nReviewed-by: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nCc: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "cc13a7a618fe8354f16d74c06aaf9565a68e9ebd", "tree": "2de495b4a7e785c1d6791a4a65b823111cf31523", "parents": [ "6f64c06f43098ea0aa0a67d0ad15124b5d2ba0fe" ], "author": { "name": "David Hildenbrand (Arm)", "email": "david@kernel.org", "time": "Thu Jun 11 12:01:55 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:36 2026 -0700" }, "message": "selftests: mm: fix and speedup \"droppable\" test\n\nThe droppable test currently relies on creating memory pressure in a child\nprocess to trigger dropping the droppable pages.\n\nThat not only takes a long time on some machines (allocating and filling\nall that memory), on large machines this will not work as we hardcode the\narea size to 134217728 bytes.\n\n... further, we rely on timeouts to detect that memory was not dropped,\nwhich is really suboptimal.\n\nInstead, let\u0027s just use MADV_PAGEOUT on a 2 MiB region. MADV_PAGEOUT\nworks with droppable memory even without swap.\n\nThere is the low chance of MADV_PAGEOUT failing to drop a page because of\nspeculative references. We\u0027ll wait 1s and retry 10 times to rule that\nunlikely case out as best as we can.\n\nOn a machine without swap:\n\n\t$ ./droppable\n\tTAP version 13\n\t1..1\n\tok 1 madvise(MADV_PAGEOUT) behavior\n\t# Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0\n\nLink: https://lore.kernel.org/20260611-droppable_test-v1-1-b6a73d99f658@kernel.org\nFixes: 9651fcedf7b9 (\"mm: add MAP_DROPPABLE for designating always lazily freeable mappings\")\nSigned-off-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReported-by: Aishwarya TCV \u003cAishwarya.TCV@arm.com\u003e\nTested-by: Sarthak Sharma \u003csarthak.sharma@arm.com\u003e\nTested-by: Lance Yang \u003clance.yang@linux.dev\u003e\nReviewed-by: Dev Jain \u003cdev.jain@arm.com\u003e\nReviewed-by: SeongJae Park \u003csj@kernel.org\u003e\nTested-by: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nReviewed-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nCc: Anthony Yznaga \u003canthony.yznaga@oracle.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Mark Brown \u003cbroonie@kernel.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "6f64c06f43098ea0aa0a67d0ad15124b5d2ba0fe", "tree": "516dcbffc91b801d93d421aa2545bdda39053137", "parents": [ "1d0ac576f34260e0b7878598c79c8b141039d799" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Mon Jun 01 13:34:28 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:35 2026 -0700" }, "message": "mm: merge writeout into pageout\n\nwriteout is only called from pageout, and a straight flow at the end, so\nmerge the two functions.\n\nLink: https://lore.kernel.org/20260601113449.3464734-3-hch@lst.de\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Baoquan He \u003cbaoquan.he@linux.dev\u003e\nReviewed-by: Nhat Pham \u003cnphamcs@gmail.com\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Chris Li \u003cchrisl@kernel.org\u003e\nCc: Kairui Song \u003ckasong@tencent.com\u003e\nCc: Kemeng Shi \u003cshikemeng@huaweicloud.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "1d0ac576f34260e0b7878598c79c8b141039d799", "tree": "f9946d468e376d6674e21679d71fa7dfeb7577ec", "parents": [ "69ba1d76d93ab818245333cf400928477ba72053" ], "author": { "name": "Hao Ge", "email": "hao.ge@linux.dev", "time": "Tue May 26 17:26:41 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:35 2026 -0700" }, "message": "MAINTAINERS: add Hao Ge as reviewer for codetag and alloc_tag\n\nI\u0027ve been contributing to the codetag and alloc_tag subsystems since 2024,\nMemory allocation profiling is indeed a great tool and I\u0027d like to stay\ninvolved as a reviewer to keep up with ongoing development and not miss\nany of the details. I\u0027m happy to help review patches and contribute to\nthe ongoing development of this subsystem.\n\nLink: https://lore.kernel.org/20260526092641.299399-1-hao.ge@linux.dev\nSigned-off-by: Hao Ge \u003chao.ge@linux.dev\u003e\nAcked-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\nCc: \"David Hildenbrand (Arm)\" \u003cdavid@kernel.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "69ba1d76d93ab818245333cf400928477ba72053", "tree": "02248b7e3400f5121a099a835d7c3e7068f636bd", "parents": [ "90c132f8379b788a0482dbeabc884d3ae5d82205" ], "author": { "name": "Sayali Patil", "email": "sayalip@linux.ibm.com", "time": "Thu May 21 12:17:53 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:35 2026 -0700" }, "message": "selftests/mm: clarify alternate unmapping in compaction_test\n\nAdd a comment explaining that every other entry in the list is unmapped to\nintentionally create fragmentation with locked pages before invoking\ncheck_compaction().\n\nLink: https://lore.kernel.org/da5e0a8d5152e54152c0d2f456aac2fac35af291.1779296493.git.sayalip@linux.ibm.com\nFixes: bd67d5c15cc1 (\"Test compaction of mlocked memory\")\nSigned-off-by: Sayali Patil \u003csayalip@linux.ibm.com\u003e\nTested-by: Venkat Rao Bagalkote \u003cvenkat88@linux.ibm.com\u003e\nCc: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Dev Jain \u003cdev.jain@arm.com\u003e\nCc: Liam Howlett \u003cliam.howlett@oracle.com\u003e\nCc: Miaohe Lin \u003clinmiaohe@huawei.com\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Oscar Salvador \u003cosalvador@suse.de\u003e\nCc: \"Ritesh Harjani (IBM)\" \u003critesh.list@gmail.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "90c132f8379b788a0482dbeabc884d3ae5d82205", "tree": "a2df3888da23c9a6ba2d7401301b6d581b879e7a", "parents": [ "f3bd00507f226a419125df6064632bcbd47d8e70" ], "author": { "name": "Sayali Patil", "email": "sayalip@linux.ibm.com", "time": "Thu May 21 12:17:52 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sun Jun 21 11:37:34 2026 -0700" }, "message": "selftests/mm: move hwpoison setup into run_test() and silence modprobe output for memory-failure category\n\nrun_vmtests.sh contains special handling to ensure the hwpoison_inject\nmodule is available for the memory-failure tests. This logic was\nimplemented outside of run_test(), making the setup category-specific but\nmanaged globally.\n\nMove the hwpoison_inject handling into run_test() and restrict it\nto the memory-failure category so that:\n1. the module is checked and loaded only when memory-failure tests run,\n2. the test is skipped if the module or the debugfs interface\n(/sys/kernel/debug/hwpoison/) is not available.\n3. the module is unloaded after the test if it was loaded by the script.\n\nThis localizes category-specific setup and makes the test flow\nconsistent with other per-category preparations.\n\nWhile updating this logic, fix the module availability check.\nThe script previously used:\n\n modprobe -R hwpoison_inject\n\nThe -R option prints the resolved module name to stdout, causing every\nrun to print:\n\n hwpoison_inject\n\nin the test output, even when no action is required, introducing\nunnecessary noise.\n\nReplace this with:\n\n modprobe -n hwpoison_inject\n\nwhich verifies that the module is loadable without producing output,\nkeeping the selftest logs clean and consistent.\n\nAlso, ensure that skipped tests do not override a previously recorded\nfailure. A skipped test currently sets exitcode to ksft_skip even if a\nprior test has failed, which can mask failures in the final exit status. \nUpdate the logic to only set exitcode to ksft_skip when no failure has\nbeen recorded.\n\nLink: https://lore.kernel.org/93441f34f7ef5add47d1a130d03daa79e21b5050.1779296493.git.sayalip@linux.ibm.com\nFixes: ff4ef2fbd101 (\"selftests/mm: add memory failure anonymous page test\")\nSigned-off-by: Sayali Patil \u003csayalip@linux.ibm.com\u003e\nReviewed-by: Miaohe Lin \u003clinmiaohe@huawei.com\u003e\nTested-by: Venkat Rao Bagalkote \u003cvenkat88@linux.ibm.com\u003e\nCc: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Dev Jain \u003cdev.jain@arm.com\u003e\nCc: Liam Howlett \u003cliam.howlett@oracle.com\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Oscar Salvador \u003cosalvador@suse.de\u003e\nCc: \"Ritesh Harjani (IBM)\" \u003critesh.list@gmail.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" } ], "next": "f3bd00507f226a419125df6064632bcbd47d8e70" }