)]}' { "log": [ { "commit": "7076f684d5132e6a6145e1da2fa74771ecd052e5", "tree": "036042e3bc3bf95da3e49ffca93e8878034bc4dd", "parents": [ "c43c1c24f3cdc0d2d3f59e5686573ac3129637aa" ], "author": { "name": "Dudu Lu", "email": "phx0fer@gmail.com", "time": "Wed Oct 21 23:54:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 17:04:27 2026 -0700" }, "message": "net/sched: etf: initialise the sock_exterr_skb before filling it\n\nreport_sock_error() clones the transmitted skb, overlays a\nstruct sock_exterr_skb on its control block and fills in the seven\nstruct sock_extended_err fields, but never clears addr_offset and port.\nskb_clone() copies cb[] verbatim, so the errqueue entry carries the TX\nskb\u0027s stale control block to the receive side, and the ipv4 error-queue\nreader trusts those bytes:\n\n net/ipv4/ip_sockglue.c:556\n\tsin-\u003esin_addr.s_addr \u003d *(__be32 *)(skb_network_header(skb) +\n\t\t\t\t\t serr-\u003eaddr_offset);\n\tsin-\u003esin_port \u003d serr-\u003eport;\n\nThe gate that is supposed to guard that read only asks whether an\naddress was requested at all:\n\n net/ipv4/ip_sockglue.c:484\n\treturn serr-\u003eee.ee_origin \u003d\u003d SO_EE_ORIGIN_ICMP ||\n\t serr-\u003eee.ee_origin \u003d\u003d SO_EE_ORIGIN_LOCAL || serr-\u003eport;\n\nSO_EE_ORIGIN_TXTIME is neither ICMP nor LOCAL, so for sch_etf the gate is\ndecided by serr-\u003eport alone -- by the stale byte pair. When it is\nnon-zero the reader dereferences skb_network_header() + addr_offset with\nan arbitrary offset. On the TCP path cb[40..44) is not zero: the\ntransmit path stored delivered_mstamp there (tcp_rate_skb_sent()), which\nis exactly where addr_offset/port sit in the arm64 struct layout.\n\nReached with an unmodified 7.3-rc4 (arm64, KASAN, in-tree modules): a TCP\nsocket enables TX-timestamp error reporting (SO_TXTIME with\nSOF_TXTIME_REPORT_ERRORS), a sch_etf qdisc drops the packet, and a\nrecvmsg() reaches ip_recv_error():\n\n BUG: KASAN: slab-out-of-bounds in ip_recv_error+0x970/0xa0c\n Read of size 4 at addr ffff0000158ffdd5 by task A-227-A227-1_S2/113\n ip_recv_error+0x970/0xa0c\n inet_recv_error+0x94/0xdc\n tcp_recvmsg+0x378/0x408\n ...\n The buggy address is located 149 bytes to the right of\n allocated 704-byte region\n\nZero the whole overlay rather than the two fields individually: the\nerrqueue entry is handed to the receive side as a self-contained record,\nwhich is what every other producer in the tree already does (sch_etf was\nthe only error-queue producer that cleared neither field). This does not\nchange what the in-tree selftest observes -- so_txtime.c reads only\nee_origin/ee_errno/ee_code/ee_data/ee_info, never msg_name or sin_port.\n\nFixes: 4b15c7075352 (\"net/sched: Make etf report drops on error_queue\")\nSigned-off-by: Dudu Lu \u003cphx0fer@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261021155401.65997-1-phx0fer@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c43c1c24f3cdc0d2d3f59e5686573ac3129637aa", "tree": "d95ff047d4a0f3bf67faada8d7e6933b8dd6f6d8", "parents": [ "c955325db639e9503941227e14e1f1ccc99442a1" ], "author": { "name": "Nandor Kracser", "email": "nandor@riptides.io", "time": "Wed Oct 21 09:32:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 16:05:59 2026 -0700" }, "message": "tls: avoid field-spanning write when copying crypto info\n\ndo_tls_setsockopt_conf() copies the cipher-specific part of the crypto\ninfo to crypto_info + 1, where crypto_info points at the 4-byte info\nmember of union tls_crypto_context. When optval is a kernel sockptr,\ncopy_from_sockptr_offset() is a memcpy(), and FORTIFY_SOURCE bounds the\ndestination by that member:\n\n [ 6.948348] memcpy: detected field-spanning write (size 52) of single field \"dst\" at include/linux/sockptr.h:49 (size 0)\n [ 6.948480] WARNING: include/linux/sockptr.h:49 at tls_setsockopt+0x9b2/0xa30, CPU#1: init/1\n [ 7.001355] Call Trace:\n [ 7.003146] do_sock_setsockopt+0xb0/0x190\n [ 7.003975] __sys_setsockopt+0x76/0xc0\n [ 7.005368] do_syscall_64+0xda/0x4b0\n\ntls_setsockopt() gets a kernel sockptr whenever a cgroup setsockopt BPF\nprogram is attached, even one that leaves the option alone, because\n__cgroup_bpf_run_filter_setsockopt() passes optval on in a kernel\nbuffer. With a no-op program on the root cgroup, a plain TLS_TX\nsetsockopt() with AES-GCM-256 triggers the warning above on an x86_64\nbuild with CONFIG_FORTIFY_SOURCE.\n\nCopy into the union at offset sizeof(struct tls_crypto_info) instead.\ncrypto_ctx already points at the right union for both the first set\nand the TLS 1.3 rekey (tmp) case, and the address is unchanged.\n\nFixes: a7b75c5a8c41 (\"net: pass a sockptr_t into -\u003esetsockopt\")\nSigned-off-by: Nandor Kracser \u003cnandor@riptides.io\u003e\nLink: https://patch.msgid.link/20261021073233.16720-1-nandor@riptides.io\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c955325db639e9503941227e14e1f1ccc99442a1", "tree": "6f8d25087c1e119335336d3a97c0e69e40c60c16", "parents": [ "5536d5553f274c8baa77c44854c9091657213970" ], "author": { "name": "yanxia", "email": "yanxia@cmss.chinamobile.com", "time": "Tue Oct 20 10:01:47 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 16:00:53 2026 -0700" }, "message": "veth: fix stale peer max_mtu on XDP program replacement\n\nveth_xdp_set() calculates the peer MTU limit from the incoming program\u0027s\nXDP fragment capability, but only stores it when no program was attached.\nReplacing a program with one having a different fragment capability\ntherefore leaves the peer\u0027s max_mtu stale.\n\nReplacing a regular program with an xdp.frags program keeps rejecting\notherwise valid jumbo MTUs. The opposite replacement leaves a larger\nlimit in place and permits MTUs which a fresh attachment of the regular\nprogram would reject.\n\nUpdate peer-\u003emax_mtu after every successful attachment or replacement.\nKeep the GSO feature update conditional on the first attachment.\n\nFound during review of the XDP replacement path and confirmed with\nnative XDP on an isolated veth pair. Before the fix, direct replacement\nrejects MTU 9000 after switching to xdp.frags, and accepts it after\nswitching back to a regular program. Detaching and attaching instead\nproduces the expected results in both directions.\n\nUML tests on net reproduce the problem before this change and match the\ndetach/attach controls afterwards, with both devices up or down and\nwith either endpoint receiving XDP. Failed replacements preserve the\nprevious state; same-type replacements and detach also behave as\nexpected. Small-frame traffic passes in the devices-up cases.\n\nFixes: 7cda76d858a4 (\"veth: Allow jumbo frames in xdp mode\")\nCc: stable@vger.kernel.org\nSigned-off-by: yanxia \u003cyanxia@cmss.chinamobile.com\u003e\nLink: https://patch.msgid.link/20261020020147.790274-1-yanxia@cmss.chinamobile.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5536d5553f274c8baa77c44854c9091657213970", "tree": "b431d9a4f2303b8c3fb4bc7582ed66e09ca512f4", "parents": [ "73e7b4fbe879a949f0dc88eeb955370f5f41a053" ], "author": { "name": "Greg Thelen", "email": "gthelen@google.com", "time": "Wed Oct 21 08:26:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 15:33:55 2026 -0700" }, "message": "selftests/net: tcp_mmap: remove unused -k option and keepflag\n\nCommit aacb0c2e524c (\"selftests: net: tcp_mmap must use\nTCP_ZEROCOPY_RECEIVE\") removed the only read of keepflag in child_thread(),\nleaving the file-scope keepflag variable set by the -k option in main() but\nnever read. This triggers a Clang 23 warning:\n\n tcp_mmap.c:91:12: error: variable \u0027keepflag\u0027 set but not used\n [-Werror,-Wunused-but-set-global]\n\nRemove the unused keepflag variable and the dead -k getopt option.\n\nFixes: aacb0c2e524c (\"selftests: net: tcp_mmap must use TCP_ZEROCOPY_RECEIVE\")\nSigned-off-by: Greg Thelen \u003cgthelen@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261021152658.2618709-1-gthelen@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "73e7b4fbe879a949f0dc88eeb955370f5f41a053", "tree": "8626abf8028c8d78906b8d767b64c71613e2a283", "parents": [ "520631554a689d2cd52452578f3140f045730ee0", "3fe64a5f670dbd6c7c84c2345b0b9726b3b79b31" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 15:16:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 15:16:45 2026 -0700" }, "message": "Merge branch \u0027net-rds-scope-aware-sendmsg-connection-cache\u0027\n\nAllison Henderson says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/rds: scope-aware sendmsg connection cache\n\nPatch 1 compares c_dev_if with the request\u0027s scope in the cache-hit\ntest, so the cache uses the same key as rds_conn_lookup().\n\nPatch 2 gives the connected peer\u0027s link-local scope its own field.\nrds_connect() used to store it in rs_bound_scope_id, the scope of\nthe socket\u0027s own bound address, which a later bind() to a\nnon-link-local address resets to 0 and which a later connect()\npollutes for a globally bound socket.A send without a destination\nand getpeername() take the connected peer\u0027s scope from that field;\nrecvmsg() reports a link-local sender with the interface recorded\non its connection.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261020002816.3087414-1-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3fe64a5f670dbd6c7c84c2345b0b9726b3b79b31", "tree": "8626abf8028c8d78906b8d767b64c71613e2a283", "parents": [ "b7dfff5e3eb3984d42026a6d653ec2a3d5cec729" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Mon Oct 19 17:28:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 15:16:44 2026 -0700" }, "message": "net/rds: keep the connected peer\u0027s scope id apart from the bound one\n\nrds_connect() has nowhere to keep the scope of a link-local peer, so\nit stores it in rs_bound_scope_id, the scope of the socket\u0027s own\nbound address, for rds_bind() to check a later link-local bind\nagainst. That field is then also what a send without a destination\nuses as the request\u0027s scope, what getpeername() and recvmsg() report\nas the peer\u0027s scope, and what a later bind() overwrites:\nrds_add_bound() stores the bound address\u0027s scope unconditionally,\nwhich for a non-link-local address is 0.\n\nSo after connect(fe80::x%ifA) followed by bind(global), a send() with\nno destination asks for fe80::x with scope 0. rds_conn_lookup() keys\non the interface, so that finds or creates a connection with c_dev_if\n0, which the TCP transport then tries to connect through\nsin6_scope_id 0 and tcp_v6_connect() rejects for a link-local peer:\nthe connected socket\u0027s data is queued on a connection that can never\ncome up. In the other order, bind(global) then connect(fe80::x%ifB),\nthe connect leaves a global-bound socket with rs_bound_scope_id ifB,\nso sends to other link-local peers are refused as off-link and sends\nto global peers inherit a meaningless interface.\n\nGive the connected peer its own rs_conn_scope_id. rds_connect()\nrecords it there and leaves the bound scope alone, rds_bind()\u0027s\nconnected-socket check compares against it, and the destination-less\nsend takes its scope from it - falling back to the bound scope for a\nnon-link-local peer, so that send() and sendto() to the connected\npeer compute the same scope, and so the same connection.\ngetpeername() reports the connected peer with its own scope.\nrecvmsg() used to report every sender with the socket\u0027s bound scope;\na connected socket receives from any peer, so neither the bound scope\nnor the connected peer\u0027s scope is right for an arbitrary sender. It\nnow reports a link-local sender with the interface recorded on its\nconnection, c_dev_if: the TCP accept path takes it from the incoming\nsocket, and the IB passive side resolves it from the local address,\nthe closest the CM gets to the arrival interface. Any other sender\nis reported with scope 0, the inet6 convention. Either way, a reply\nto the address an application was given reaches the same connection.\n\nFound by inspection while reworking the sendmsg connection cache; not\nobserved in the field.\n\nFixes: 1e2b44e78eea (\"rds: Enable RDS IPv6 support\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20261020002816.3087414-3-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7dfff5e3eb3984d42026a6d653ec2a3d5cec729", "tree": "498ea0f9b0a99fd03f8a39d7b530efeff6dfddfc", "parents": [ "520631554a689d2cd52452578f3140f045730ee0" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Mon Oct 19 17:28:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 15:16:44 2026 -0700" }, "message": "net/rds: include the scope id in the sendmsg connection cache check\n\nrds_sendmsg() reuses the connection cached in rs-\u003ers_conn when its\npeer address and ToS match the request. The interface index is part\nof a connection\u0027s identity as well: rds_conn_create_outgoing() passes\nthe request\u0027s scope_id down as dev_if, and rds_conn_lookup() compares\nc_dev_if, so sends to the same link-local address through two\ninterfaces are two different connections. The cache-hit test never\nlooked at it.\n\nA socket bound to a non-link-local address has rs_bound_scope_id 0,\nand the scope check at the top of rds_sendmsg() accepts any non-zero\ndestination scope for such a socket. So after a send to fe80::x%ifA,\na send to fe80::x%ifB hits the cached ifA connection and the datagram\nleaves through ifA, to whichever peer answers to that address there.\n\nCompare c_dev_if with the request\u0027s scope_id in the cache test, so\nthat such a send takes the lookup path and finds, or creates, the ifB\nconnection - the same key the lookup uses. A send without a\ndestination takes its scope from the socket, and the connection it\ncreated was keyed on that same scope, so the comparison holds for it\ntoo; the next patch gives that send the connected peer\u0027s own scope.\n\nFound by inspection while reworking this cache for the connection\nlifetime series on net-next; not observed in the field.\n\nFixes: 1e2b44e78eea (\"rds: Enable RDS IPv6 support\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20261020002816.3087414-2-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "520631554a689d2cd52452578f3140f045730ee0", "tree": "420039211b36962b0e2ce84b1b23be777c18730d", "parents": [ "46bd2bf65b93573f3b73ce8c61f862ac901c076d" ], "author": { "name": "Gal Pressman", "email": "gal@nvidia.com", "time": "Wed Oct 21 09:42:31 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 14:29:50 2026 -0700" }, "message": "net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys\n\nmlx5e_ipsec_netevent_event() keeps the L2 headers of offloaded tunnel\nmode SAs up to date: on every neighbour change it looks for SAs whose\nendpoint matches the neighbour\u0027s address. The compare width, 4 bytes for\nIPv4 or 16 for IPv6, is chosen from the SA\u0027s address family, with no\ncheck that the neighbour is of the same family.\n\nAn ARP entry only stores a 4-byte key, so with an IPv6 tunnel mode SA\noffloaded, any IPv4 neighbour update in the system is compared as if it\nwere a 16-byte IPv6 address, reading past the end of the object:\n\n BUG: KASAN: slab-out-of-bounds in mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]\n Read of size 4 at addr ff110001260a4ad8 by task swapper/8/0\n Call Trace:\n \u003cIRQ\u003e\n mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]\n notifier_call_chain+0x97/0x2b0\n atomic_notifier_call_chain+0x5d/0x130\n neigh_timer_handler+0x35c/0x1140\n call_timer_fn+0x164/0x490\n __run_timers+0x5b9/0x960\n run_timer_softirq+0xf0/0x1d0\n handle_softirqs+0x189/0x8a0\n __irq_exit_rcu+0x10d/0x250\n ...\n\n Allocated by task 1015:\n __kmalloc_noprof+0x2e6/0x8b0\n ___neigh_create+0xcc9/0x24c0\n ip_finish_output2+0xfc7/0x1e80\n ip_output+0x172/0x3b0\n ip_send_skb+0xa5/0x1b0\n udp_send_skb+0x852/0x10f0\n udp_sendmsg+0x1333/0x2150\n ...\n\nThe opposite mix (IPv4 SA with IPv6 neighbour) stays in bounds, but only\nthe first 32 bits of the IPv6 address are compared, so an unrelated\nneighbour can match.\n\nSkip neighbours whose address family doesn\u0027t match the SA.\n\nFixes: 4c24272b4e2b (\"net/mlx5e: Listen to ARP events to update IPsec L2 headers in tunnel mode\")\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nReviewed-by: Yael Chemla \u003cychemla@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20261021064231.3466989-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "46bd2bf65b93573f3b73ce8c61f862ac901c076d", "tree": "6f734956d617d354c795ddb19bcb3f8a0a9b9492", "parents": [ "546daf344420b5dce27eded3ad15be12628dd185" ], "author": { "name": "Cosmin Ratiu", "email": "cratiu@nvidia.com", "time": "Wed Oct 21 09:28:05 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 14:28:59 2026 -0700" }, "message": "net/mlx5e: SHAMPO: Do not merge PSP packets\n\nPSP packets are UDP-encapsulated, and enabling HW GRO (SHAMPO in mlx5)\nmakes it possible to merge those packets in a silly way:\nIP|UDP|PSP1|payload1|PSP2|payload2|...\n\nThat happens because the HW GRO machinery doesn\u0027t know about PSP and\nconsiders it part of the UDP payload.\n\nReject merging when the incoming CQE has PSP marker or the pending skb\nhas the PSP extension.\n\nFixes: 29d7f433fcec (\"net/mlx5e: Add Rx data path offload\")\nSigned-off-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20261021062805.3466208-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "546daf344420b5dce27eded3ad15be12628dd185", "tree": "f58bcde80a681d28dbf1bda0ff4d1d6dcb1c0031", "parents": [ "c3a1ddd5e116540912441606a2cd4b944be1622a" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 21 18:18:58 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 14:26:14 2026 -0700" }, "message": "net: fix frag_list leak in skb_segment_list() error path\n\nskb_segment_list() detaches the frag_list from the head skb and moves\nits members one by one to the skb-\u003enext chain. On error, err_linearize\nfrees that chain with kfree_skb_list(skb-\u003enext), relying on the members\nnot yet processed to still be linked after the current one.\n\nThis does not hold when the current member was shared: it is replaced\nby skb_clone(), and __skb_clone() clears -\u003enext. If __skb_linearize()\nthen fails on that clone, the remaining members are no longer reachable\nfrom skb-\u003enext nor from skb_shinfo(skb)-\u003efrag_list, and they leak.\n\nThe skb_shared() error branch already relinks nskb-\u003enext to list_skb\nbefore jumping to err_linearize. Do it unconditionally right after nskb\nis added to the chain, so every error exit sees the remaining members.\nOn the last member list_skb is NULL, which still terminates the chain.\n\nFixes: 53475c5dd856 (\"net: fix use-after-free when UDP GRO with shared fraglist\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nCc: Simon Polack \u003cspolack+git@mailbox.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Wang Zhan \u003cwang.zhan@smartx.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20261021161858.761205-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c3a1ddd5e116540912441606a2cd4b944be1622a", "tree": "62f02756abe6140b5244a94646460602542b8f17", "parents": [ "ed642349d87dd7067a44c30319f0cffd22780376" ], "author": { "name": "Hanson Wang", "email": "hanson.wang@ugreen.com", "time": "Fri Oct 16 20:48:58 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 14:21:52 2026 -0700" }, "message": "net: usb: aqc111: fix set_mac_address return value\n\naqc111_set_mac_addr() returns the result of aqc111_write_cmd() on\nsuccess. That function wraps usb_control_msg(), which returns the\nnumber of bytes transferred (6 for ETH_ALEN) rather than zero.\n\nCallers such as netif_set_mac_address() and bonding treat any\nnon-zero return value as failure when setting the MAC address.\n\nReturn 0 on success and propagate negative error codes on failure.\n\nSigned-off-by: Hanson Wang \u003chanson.wang@ugreen.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261016124858.1939743-1-hanson.wang@ugreen.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ed642349d87dd7067a44c30319f0cffd22780376", "tree": "a5eb563886182dc44c5197789f23be851955e02c", "parents": [ "86537a8fb24750fc25a96a27ff29400054d052b5" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Tue Oct 20 20:12:39 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 14:09:01 2026 -0700" }, "message": "tls: fix the open record check in the max payload size setsockopt\n\ndo_tls_setsockopt_tx_payload_len() refuses to resize records while one is\nopen, but the check is broken in two ways.\n\nIt reaches for the open record through tls_sw_ctx_tx(), an unchecked cast\nof ctx-\u003epriv_ctx_tx. Under device offload that pointer is a\ntls_offload_context_tx, so the check reads a field of the wrong struct: it\nreturns EBUSY on whatever happens to be there, and never sees the record\nthat really is open. Dispatch on tx_conf.\n\nThe socket lock alone is also not enough to tell no sender is in flight.\nThe device tx path drops it in sk_stream_wait_memory() after\ntls_push_record() cleared open_record, so setsockopt can slip in\nmid-sendmsg and shrink the limit. tls_push_data() latches the limit once\nper call, and a record left open by MSG_MORE can then be bigger than the\nnew limit, making the u32 subtraction in the copy clamp wrap around and\nbuild an oversized record. Take tx_lock like the sendmsg paths do so\nsetsockopt waits for in-flight senders. Re-reading the limit inside the\ntls_push_data() loop could close the wrap too, but a parked sender would\nstill finish with the old limit, so serializing on tx_lock is simpler.\n\nTake tx_lock interruptible, as tls_sw_sendmsg() does. Both sendmsg paths\nkeep it across sk_stream_wait_memory(), which sleeps until the peer reads,\nso a plain mutex_lock() could park setsockopt in D state for as long as\nthe sender waits. The lock_sock() after it is fine uninterruptible: a\nsender sleeping for memory has released the socket lock, so that wait only\ncovers short critical sections, like every other setsockopt.\n\nFixes: 82cb5be6ad64 (\"net/tls: support setting the maximum payload size\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20261020121240.29082-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "86537a8fb24750fc25a96a27ff29400054d052b5", "tree": "b3747e6ef656b6c977b55ac0a059484a7a5f5d59", "parents": [ "1df26063ab9ba64f5fb11049fa4be686b7fc309e" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@kylinos.cn", "time": "Thu Oct 22 11:09:35 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 14:04:21 2026 -0700" }, "message": "selftests: gro: remove unused variable total_data\n\nI hit a build warning when building the net selftests.\n\n gro.c: In function \u0027check_capacity_pkts\u0027: gro.c:1249:13: warning: variable \u0027total_data\u0027 set but not used [-Wunused-but-set-variable\u003d]\n 1249 | int total_data \u003d 0;\n | ^~~~~~~~~~\n\nRemove the total_data variable, as it is no longer used.\n\nFixes: d97348474708 (\"selftests: drv-net: gro: always wait for FIN in the capacity test\")\nSigned-off-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nReviewed-by: Antoine Tenart \u003catenart@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261022-self_unused_var-v1-1-8ab10a6b7f44@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1df26063ab9ba64f5fb11049fa4be686b7fc309e", "tree": "da46be6a5013ee0e51b997d16178e186c90ae42c", "parents": [ "9642ce6cb51ebd596d0a02074ba9b2a387e974b0" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed Oct 21 16:04:59 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:59:01 2026 -0700" }, "message": "net: sparx5: fix tx DCB index drift in fdma xmit\n\nsparx5_fdma_xmit() advances dcb_index before checking that the FDMA is\ndone with the DCB, and does not undo the advance when the check fails.\nBefore commit f4aa7e361ae2 (\"net: sparx5: use FDMA library for adding\nDCB\u0027s in the tx path\") the next DCB was always the one after last_dcb.\nSince then dcb_index drifts one DCB further away from last_dcb on every\nfailed transmit.\n\nWhile the ring is full, this drops frames even though completed DCBs\nsit behind dcb_index. After a run of failures, dcb_index can also land\non last_dcb itself. Re-adding last_dcb loses the frame, because the\nFDMA has already passed the tail of the chain, and that DCB is never\ncompleted again.\n\nFix this by making dcb_index the next DCB to use, and advancing it only\nafter the DCB has been added, as the rx path does. dcb_index and\nlast_dcb now only move together, so dcb_index always points at the DCB\nafter last_dcb.\n\nThe issue was found by an AI code review agent. It was reproduced on a\nsparx5 PCB135 board with a modified kernel that forces 63 consecutive\ntransmit failures. Afterwards, about 1 in 64 frames is lost for good.\nWith the fix, the same test loses no frames.\n\nFixes: f4aa7e361ae2 (\"net: sparx5: use FDMA library for adding DCB\u0027s in the tx path\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261021-sparx5-fdma-last-dcb-v2-1-7b8fabdb9239@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9642ce6cb51ebd596d0a02074ba9b2a387e974b0", "tree": "726f7f1a0b6ade0e6aebc513621affbd446a1aa2", "parents": [ "45e0a63f9c86a558afc70d79b6df38f8ec7f502a" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed Oct 21 12:48:26 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:57:01 2026 -0700" }, "message": "net: sparx5/lan969x: do not read past skb-\u003elen when injecting a frame\n\nsparx5_inject() writes the frame to the injection FIFO one 32-bit word\nat a time, and pads frames shorter than 60 bytes with zero words.\n\nBefore this patch, the last word is loaded whole even when skb-\u003elen is\nnot a multiple of four, so 1 to 3 bytes past the end of the frame are\nread. For a frame shorter than 60 bytes those bytes are also\ntransmitted, as VLD_BYTES marks the whole last word valid and the\npadding starts at the next word.\n\nWrite the trailing bytes from a zeroed word. The number of words written\nand VLD_BYTES are unchanged.\n\nFound by an AI code review agent, and reproduced on lan969x and sparx5\nwith register injection: bytes 57 to 59 of a 57 byte frame were not\nzero. With the fix they are zero, and traffic still passes on both\nchips.\n\nFixes: f3cad2611a77 (\"net: sparx5: add hostmode with phylink support\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261021-sparx5-inject-tail-bytes-v1-1-7dcc035c8ddf@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "45e0a63f9c86a558afc70d79b6df38f8ec7f502a", "tree": "6ff4a029f7684692f902a45873218205ad66610b", "parents": [ "f62e18ccc68e188e2ff9df1588d91c2d5596bb99" ], "author": { "name": "Aamir Ahmed", "email": "elb12345@hotmail.co.uk", "time": "Tue Oct 20 23:33:46 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:53:53 2026 -0700" }, "message": "gve: fix out-of-bounds read in gve_get_flow_rule_entry()\n\ngve_get_flow_rule_entry() checks the requested location against the\nfirst and last cached rules, but rules_cache_num can be 0 while\nrules_cache_synced is true: GVE_FLOW_RULE_QUERY_RULES returns the rules\nfrom the requested location onwards, so a request past the last\ninstalled rule - or any request when no rules are installed - returns\nzero rules, which the driver accepts and marks as synced.\n\nThe next query evaluates rules_cache[*cache_num - 1] with\n*cache_num \u003d\u003d 0. The zero-initialised cache does not trip the earlier\ncomparison, *cache_num - 1 wraps to 0xFFFFFFFF in u32, and the read\nfaults about 352 GiB past the cache. ETHTOOL_GRXCLSRULE needs no\ncapability, so an unprivileged user can trigger it:\n\n BUG: unable to handle page fault for address: ff240996c4c64fa8\n #PF: supervisor read access in kernel mode\n RIP: gve_get_flow_rule_entry+0xd4/0x110 [gve]\n\nTreat an empty cache as a cache miss and re-query.\n\nFixes: 6f3bc487565d (\"gve: Add flow steering ethtool support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aamir Ahmed \u003celb12345@hotmail.co.uk\u003e\nReviewed-by: Eugene Lee \u003ceugenehlee@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/AS8P251MB0001135AF3233180DC42DCD1C8672@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f62e18ccc68e188e2ff9df1588d91c2d5596bb99", "tree": "45873dcfdcc6ee171ab575568fba53bc1f30a2f7", "parents": [ "286154ae6998a32cca698abd713e1d4728e81924", "110eb808324fd9713b04d874c97283d965e43d2a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:51:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:51:18 2026 -0700" }, "message": "Merge branch \u0027net-pse-pd-si3474-two-driver-fixes\u0027\n\nPiotr Kubik says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: pse-pd: si3474: two driver fixes\n\nTwo fixes for the Si3474 PSE driver, found while preparing 2-pair and\nsemi-auto support for it.\n\nPatch 1 stops si3474_pi_enable() from clearing detection and\nclassification of the other PI in the same quad. Without it, a PD on\nthat PI gets no power after a later plug-in.\n\nPatch 2 rejects a channel number of 8 and a 4-pair PI whose channels\nare not one channel pair of a quad.\n\nBoth were tested on an SDG-9000 board (MediaTek MT7988A, two Si3474)\nwith a Linux 6.18 kernel that carries the same patches, and build-tested\non the net tree.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261019162453.1244120-1-piotr@kubik.pl\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "110eb808324fd9713b04d874c97283d965e43d2a", "tree": "45873dcfdcc6ee171ab575568fba53bc1f30a2f7", "parents": [ "b530456be77160b13efe8dececb6c826538bd4a2" ], "author": { "name": "Piotr Kubik", "email": "piotr@kubik.pl", "time": "Mon Oct 19 18:24:53 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:51:16 2026 -0700" }, "message": "net: pse-pd: si3474: validate the channels of a PI\n\nsi3474_get_of_channels() accepted channel 8, one past the last channel.\nThe driver then accessed channel 4 instead: quad 1, channel index 0.\n\nIt also accepted a 4-pair PI whose two channels are not a channel pair\nof one quad. The chip forms a 4-pair port only from channels 0+1 or 2+3\nof a quad (2P/4P mode bit in POWER_ALLOCATION, PORT_REMAP default), and\nthe driver sends every register access of a PI to the quad of its first\nchannel, so such a PI enabled and measured the wrong channels.\n\nReject both at probe.\n\nDiscovered by an AI code review agent; no shipped device tree triggers\nit. Validated and tested on an SDG-9000 board (MediaTek MT7988A, two\nSi3474) with Linux 6.18 and a modified device tree: one chip with a\nchannel at reg 8, the other with a 4-pair PI on channels 1 and 2. The\ndriver now rejects both at probe, and the unmodified device tree still\nprobes all eight PIs. No kernel selftest covers PSE hardware.\n\nFixes: a2317231df4b (\"net: pse-pd: Add Si3474 PSE controller driver\")\nSigned-off-by: Piotr Kubik \u003cpiotr@kubik.pl\u003e\nReviewed-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nLink: https://patch.msgid.link/20261019162453.1244120-3-piotr@kubik.pl\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b530456be77160b13efe8dececb6c826538bd4a2", "tree": "377533bac69aa0f18af9af9ddacc86f1755ba216", "parents": [ "286154ae6998a32cca698abd713e1d4728e81924" ], "author": { "name": "Piotr Kubik", "email": "piotr@kubik.pl", "time": "Mon Oct 19 18:24:52 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:51:16 2026 -0700" }, "message": "net: pse-pd: si3474: keep detection enabled on the other PIs\n\nDETECT_CLASS_ENABLE holds the detection and classification bits of\nall four channels of a quad. si3474_pi_enable() wrote the register\nwith the bits of its own PI only, so it cleared them for the other PI\nof the quad. In AUTO mode that PI keeps its admin state and a PD that\nalready has power keeps it, but the port runs no new detection: a PD\nplugged in later, or one waiting for detection when the other PI is\nenabled, gets no power.\n\nRead the register and set the PI bits, as the PORT_MODE update above\nalready does.\n\nDiscovered by an AI code review agent. Confirmed on an SDG-9000 board\n(MediaTek MT7988A, two Si3474 in AUTO pin mode) with Linux 6.18:\nwith both PIs of one quad disabled, enabling PI A and then PI B left\nDETECT_CLASS_ENABLE with the bits of PI B only, and a PD on PI A never\ngot power. No kernel change was needed to reproduce it.\n\nTested on the same board with the same sequence in both orders:\nDETECT_CLASS_ENABLE keeps the bits of both PIs, and the PD gets power.\nNo kernel selftest covers PSE hardware.\n\nFixes: a2317231df4b (\"net: pse-pd: Add Si3474 PSE controller driver\")\nSigned-off-by: Piotr Kubik \u003cpiotr@kubik.pl\u003e\nReviewed-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nLink: https://patch.msgid.link/20261019162453.1244120-2-piotr@kubik.pl\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "286154ae6998a32cca698abd713e1d4728e81924", "tree": "ca89f763c3b1b960f1dc5308929dc729cf107835", "parents": [ "e3aaeebbef56ceaa27001d1d5a0c1d73d648e6f4" ], "author": { "name": "Dimitri Daskalakis", "email": "daskald@meta.com", "time": "Tue Oct 20 10:27:06 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:43:05 2026 -0700" }, "message": "eth: fbnic: Correct packet header prefetch\n\nThe existing call to net_prefetch() fetched a stale address. The data\npointer is not initialized until after the call to xdp_prepare_buff().\nThus, making the prefetch ineffective.\n\nOpen code the address calcuation to give the prefetch as much time\nas possible.\n\nThis was found by manual code inspection. No issues have been observed\nfrom this.\n\nFixes: 9064ab485f04 (\"eth: fbnic: Prefetch packet headers on Rx\")\nSigned-off-by: Dimitri Daskalakis \u003cdaskald@meta.com\u003e\nReviewed-by: Björn Töpel \u003cbjorn@kernel.org\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261020172706.1090951-1-dimitri.daskalakis1@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e3aaeebbef56ceaa27001d1d5a0c1d73d648e6f4", "tree": "721b24c1a4c1f09614c117576226d5c52467807a", "parents": [ "79dc34beb1fdb3da79753e51e15c68591a2561fe" ], "author": { "name": "James Clark", "email": "jjc@jclark.com", "time": "Tue Oct 20 07:35:25 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 13:35:22 2026 -0700" }, "message": "net: ethernet: ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl\n\nCommit 7c571ac57d9d (\"net: ptp: introduce .supported_extts_flags to\nptp_clock_info\") modified the PTP core to validate the supported flags\nof external timestamp requests, rather than relying on each driver to\ncheck them.\n\nam65_cpts_extts_enable() ignores the flags, and am65-cpts was not given\nany .supported_extts_flags. Since PTP_EXTTS_REQUEST2 always implies\nPTP_STRICT_FLAGS, the core now rejects every PTP_EXTTS_REQUEST2 for this\ndriver with -EOPNOTSUPP, where before that commit the same requests\nsucceeded. Only the PTP_EXTTS_REQUEST ioctl still works.\n\nTests on a BeagleY-AI (J722S) show that the CPTS hardware timestamp push\ninputs timestamp just the rising edge. Encode this in\n.supported_extts_flags. A PTP_EXTTS_REQUEST2 for the rising edge then\nsucceeds, and one for the falling edge or for both edges fails with\n-EOPNOTSUPP.\n\nFixes: 7c571ac57d9d (\"net: ptp: introduce .supported_extts_flags to ptp_clock_info\")\nSigned-off-by: James Clark \u003cjjc@jclark.com\u003e\nAcked-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nLink: https://patch.msgid.link/20261020003525.1237742-1-jjc@jclark.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "79dc34beb1fdb3da79753e51e15c68591a2561fe", "tree": "914a671f044ca50a3d6e22acec828b7c3162bab1", "parents": [ "94a6736bb5abe6b2ef38490d0cab19c1c6a7c71f" ], "author": { "name": "Zizhen Liu", "email": "pointerliu@126.com", "time": "Thu Oct 22 18:42:17 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 12:41:58 2026 -0700" }, "message": "net: skbuff: propagate shared-frag marker in skb_zerocopy()\n\nskb_zerocopy() moves frag descriptors from @from into @to and takes a\nreference on each frag, but it does not copy skb_shinfo(from)-\u003eflags into\nskb_shinfo(to)-\u003eflags. A destination skb holding the same page-cache\nbacked frags as the source therefore reports skb_has_shared_frag() as\nfalse.\n\nThat breaks the invariant relied on by later in-place writers. ESP input\nchecks skb_has_shared_frag() before deciding whether an uncloned\nnonlinear skb can skip skb_cow_data(); with the marker lost, an skb that\nskb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is\ndecrypted in place, letting an unprivileged user write into the page\ncache of a root-owned read-only file.\n\nPropagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for\nthe other frag-transfer helpers.\n\nFixes: af2806f8f90a (\"net: Export skb_zerocopy() to zerocopy from one skb to another\")\nFixes: f4c50a4034e6 (\"xfrm: esp: avoid in-place decrypt on shared skb frags\")\nCc: stable@kernel.org\nSigned-off-by: Zizhen Liu \u003cpointerliu@126.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261022104217.1852191-1-pointerliu@126.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "94a6736bb5abe6b2ef38490d0cab19c1c6a7c71f", "tree": "1ba64cd6f187fd94a3a1f72ff0a03fae9b4c0ad1", "parents": [ "89b9db72918bc209029fad8cccc42191b498d511" ], "author": { "name": "Zhiling Zou", "email": "zhilinz@nebusec.ai", "time": "Tue Oct 20 14:39:36 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 10:47:14 2026 -0700" }, "message": "ipmr: only copy pktinfo to cache reports\n\nipmr_cache_report() prepares IP_PKTINFO on the original skb. The\nipv4_pktinfo_prepare() helper updates skb-\u003ecb and clears the pktinfo fields\nwhen packet info is disabled. Since the skb can continue through the data\npath, preserve and restore its original control block around the helper.\n\nThe original implementation copies the entire control block to the report\nskb. For synthetic RTM_GETROUTE packets, NETLINK_CB data is interpreted as\nIPCB by the raw IPv4 receive path. With IP_RECVOPTS or IP_RETOPTS enabled,\ncorrupted option offsets cause out-of-bounds reads or a stack buffer\noverflow. WHOLEPKT and WRVIFWHOLE reports also inherit stale IP option\noffsets when their header is prepended.\n\nClear the report skb control block. Only prepare and copy pktinfo when the\ninput skb has an IPv4 header. Synthetic route-query skbs use NETLINK_CB,\nnot IPCB, so leave their report control block zeroed. Restore pkt-\u003ecb after\npreparing pktinfo for regular IPv4 packets.\n\nFixes: bb7403655b3c (\"ipmr: support IP_PKTINFO on cache report IGMP msg\")\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nLink: https://lore.kernel.org/netdev/20260903113055.GA90787@shredder/\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Zhiling Zou \u003czhilinz@nebusec.ai\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/0545f0c83f5ee2f6696210f87268e811ef655715.1792476357.git.zhilinz@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "89b9db72918bc209029fad8cccc42191b498d511", "tree": "186e4339cc1060308fd61f7ab56527b6ccb7a502", "parents": [ "9802123ceca818aa69284c615114ca55b9cc94a1" ], "author": { "name": "Kaifeng Wang", "email": "kaifengw@google.com", "time": "Mon Oct 19 17:45:22 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 10:45:56 2026 -0700" }, "message": "tcp: reject devmem tx with fastopen and repair\n\ntcp_sendmsg_locked() enforces that devmem TX can only proceed if the\nzero-copy path is active and a valid dmabuf binding exists. However,\nsubsequent branches in tcp_sendmsg_locked() can still intercept the\nmessage before it reaches the devmem zero-copy loop:\n\n1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT):\n If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with\n NETIF_F_SG (so zc \u003d\u003d MSG_ZEROCOPY and binding is present), but\n tcp_sendmsg_fastopen() -\u003e tcp_send_syn_data() will use\n copy_page_from_iter() to byte-copy from the iterator. Since iov_base\n represents dma-buf offsets rather than user virtual addresses, this\n misinterprets offsets as user pointers and copies the caller\u0027s memory\n at those addresses into the SYN packet.\n\n2. TCP repair mode:\n If tp-\u003erepair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly\n calls skb_copy_datagram_from_iter(), byte-copying from the iterator.\n\nNeither path supports or makes sense for devmem transmission. Reject\ndevmem sends inside the Fast Open and TCP repair branches when a devmem\nbinding is present. Checking inside the tp-\u003erepair branch also covers\nthe case where repair mode is enabled while sk_stream_wait_connect()\ndrops the socket lock.\n\nAdditionally, drop the !sockc_err gate from the devmem validation check\nand return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is\nfollowed by a failing cmsg, sockc.dmabuf_id remains set while binding is\nnot acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to\nproceed and return before sockc_err is checked.\n\nThis pre-existing issue was identified by Sashiko AI review on commit\n125755776bc6 (\"tcp: reject non zerocopy devmem tx\") and has not been\nhit in production.\n\nFixes: 125755776bc6 (\"tcp: reject non zerocopy devmem tx\")\nFixes: bd61848900bf (\"net: devmem: Implement TX path\")\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\nSigned-off-by: Kaifeng Wang \u003ckaifengw@google.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nLink: https://patch.msgid.link/20261019174522.55644-1-kaifengw@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9802123ceca818aa69284c615114ca55b9cc94a1", "tree": "eaf19af832488433c7bcacc9961adcc84998c4ed", "parents": [ "734bef548a96e8774d6eef5dfa2026c6edc4e80b" ], "author": { "name": "Xingyuan Mo", "email": "hdthky0@gmail.com", "time": "Mon Oct 19 15:37:57 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 23 10:43:38 2026 -0700" }, "message": "sctp: reject forged cookie peer_addr with unknown address family\n\nWhen cookie authentication is disabled, COOKIE-ECHO peer_addr is\nattacker-controlled. An invalid sa_family made sctp_get_af_specific()\nreturn NULL and crash in sctp_transport_init() on\naf_specific-\u003esockaddr_len. Validate it with af-\u003eaddr_valid() in\nsctp_unpack_cookie(), which also rejects a mismatched family, e.g.\nan AF_INET6 peer_addr on an IPv4 socket that would later crash in\nsctp_v6_get_dst() on inet6_sk(sk)-\u003eopt. Validate a copy of peer_addr,\nsince addr_valid() rewrites a v4-mapped v6 address in place and the\ncookie still lives in the received skb, which is not guaranteed to\nbe unshared. Store the validated copy in the new association and\npass it to sctp_process_init() instead of the raw cookie, so a\nv4-mapped v6 address is normalised to AF_INET before the association\nand its primary transport are built from it.\n\nFor that, sctp_v6_addr_valid() has to return 0 for a non-v4-mapped\naddress when it is called with a socket that is not PF_INET6, so that\nIPv6 addresses are never used on IPv4 sockets. The check is done after\nthe v4-mapped handling, so v4-mapped addresses passed to an IPv4\nsocket through the socket API keep being accepted. As addr_valid()\nnow also checks sk_family and ipv6_only_sock, simplify the address\nhandling in sctp_process_param() with it, as it additionally filters\nout non-unicast addresses. As a side effect, a v4-mapped address in\nan IPv6 address parameter is now normalised to AF_INET before the\ntransport is created, matching what the socket API paths already do.\n\nAlso add the missing !af check in sctp_process_init(), as\nsctp_get_af_specific(AF_INET6) returns NULL on CONFIG_IPV6\u003dn builds.\n\n BUG: KASAN: null-ptr-deref in sctp_transport_new+0xa7/0x350\n Read of size 4 at addr 00000000000000b4 by task poc/682\n Call Trace:\n \u003cIRQ\u003e\n sctp_transport_new+0xa7/0x350\n sctp_assoc_add_peer+0x153/0x850\n sctp_process_init+0xf9/0x1180\n sctp_sf_do_5_1D_ce+0x464/0xbc0\n sctp_do_sm+0x114/0x2990\n sctp_endpoint_bh_rcv+0x280/0x430\n sctp_inq_push+0xdd/0x100\n sctp_rcv+0x17f5/0x1ae0\n sctp4_rcv+0x2b/0x40\n ip_protocol_deliver_rcu+0x25b/0x270\n ip_local_deliver+0xd1/0xe0\n \u003c/IRQ\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Xingyuan Mo \u003chdthky0@gmail.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20261019073747.178626-1-hdthky0@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "734bef548a96e8774d6eef5dfa2026c6edc4e80b", "tree": "ce2520b2602ce3b82f9842490d21836f9838d441", "parents": [ "864c07de0c7dcbca58b61625dfa2e461ae63b242", "1a2c35c49cc7c6be860038b8442b52424a8f123c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:58:00 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:58:00 2026 -1000" }, "message": "Merge tag \u0027net-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next\n\nPull networking updates from Paolo Abeni:\n \"This includes a significant number of low-priority fixes - especially\n in the NIC drivers area - that we deferred from the last few RCs in\n the previous cycle, which can\u0027t be easily outlined in the synopsis\n below.\n\n Core \u0026 protocols:\n\n - Continue the work on removing rtnl_lock dependencies:\n - per-netns ARP and ND neighbour tables, with the default settings\n now configurable per netns (inheritance from init_net is\n controlled by the new net.core.neigh_inherit_init_net sysctl)\n - RCU-protected configuration and rtnl_lock-less fill_info() for\n hsr, netkit, sit, vlan and vxlan devices\n - per-netns device unregistration for ip tunnel and gre devices\n - use the netdev instance lock instead of rtnl_lock when reading\n speed and duplex via sysfs\n - batch the flushing of uncached routes at device unregistration\n time, relieving rtnl_lock contention on netns dismantle.\n\n - Add hardware pacing offload support, admin-controlled via a new\n rtnetlink attribute, with sch_fq integration (implemented in idpf).\n\n - Re-segment BIG TCP GSO packets into GSO packets fitting the egress\n device limits instead of plain MSS-sized segments, improving\n throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.\n\n - Generate RSS keys that spread flows over all the RX queues; the\n previous random keys could leave some queues unused.\n\n - Optimize the bridge VLAN forwarding paths: cache the port-VLAN in\n fdb entries and consider only VLAN members when flooding, for ~10%\n more Mpps in the fdb forwarding path.\n\n - A few TCP/IP performance improvements aimed at efficient cache\n usage and reducing contention.\n\n - Add the TCP ROCCET congestion control, a CUBIC variant aimed at\n avoiding bufferbloat in cellular networks.\n\n - Continue the conversion of getsockopt callbacks to sockopt_t.\n\n - Add an ethtool command to list the front-facing ports of an\n interface, including SFP cages and modules, using the phy_port\n representation.\n\n - Enable BIG TCP support for bareudp tunnels.\n\n - Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state\n transitions (listen() + shutdown() + connect() and connect() +\n connect(AF_UNSPEC) + listen()).\n\n - Remove most BUG_ON()s from core packet processing, replacing them\n with error paths.\n\n Wireless:\n\n - Latency improvements, including lockless station get/dump and\n beacon updates, plus RTNL reduction and locking cleanups.\n\n - Infrastructure for non-station TX/RX with MLO.\n\n - NAN (Wi-Fi Aware) Instant Communication support and other NAN\n improvements.\n\n - Control frame Integrity Protocol (CIP) and protected TWT support.\n\n - Improvements for AP regulatory checks.\n\n Netfilter:\n\n - Disable br_netfilter in user namespaces and schedule it for removal\n in 2027.\n\n - Restrict the raw table in nft_compat to the specific family, hook\n and priority.\n\n - Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice\n versa).\n\n - Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better\n integration with memcg.\n\n - Allow discovering conntrack zone filtering support in ctnetlink\n dumps, and fix nfnetlink_hook handling of large dumps.\n\n Deletions:\n\n - Move the LLC type 2 sockets out of tree. There are no known users\n and the code attracts a never-ending stream of LLM-driven fixes.\n\n Device drivers:\n\n - New drivers:\n - Meta Platforms NIC (mpnic), the second-generation NIC from Meta\n - initial skeleton of the Nebula-matrix NICs driver (nbl)\n - X-Powers AC200/AC300 Fast Ethernet PHYs\n\n - Ethernet high-speed NICs:\n - Intel:\n - i40e: XDP metadata support for RX hash and VLAN tag\n - ice: expose the E825 TSPLL state via the DPLL subsystem\n - nVidia/Mellanox:\n - move the data direct infrastructure from IB to core, in\n preparation for netdev support.\n - reduce the memory used per offloaded TC rule\n - Meta (fbnic):\n - support large io_uring zero-copy RX buffers\n - Microsoft vNIC (mana):\n - add BQL support\n\n - Ethernet NICs consumer, and embedded:\n - Airoha:\n - LRO offload support\n - Cadence (macb):\n - context swapping for ringparam and MTU changes, avoiding\n buffer loss under memory pressure\n - Mucse (rnpgbe):\n - TX/RX and link status support\n - NXP (enetc):\n - SR-IOV improvements and VF support for ENETC v4\n - Qualcomm (ppe):\n - IPQ5424 support\n - Realtek PCI (r8169):\n - phylink support\n - RSS support for RTL8127\n - Renesas (ravb):\n - gPTP support for R-Car Gen4\n - Synopsys (stmmac):\n - XDP multi-buffer support on the TX side\n - tc mqprio hw queue priority offload\n - support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC\n DP1000 and Qualcomm sa8255p\n\n - Ethernet switches:\n - Mediatek (mt7530):\n - fast age and change conduit support\n - Microchip (ksz):\n - support for KSZ8995XA/KS8995XA\n - Microchip (lan966x):\n - PCIe FDMA support, ~20x throughput increase in PCIe endpoint\n - Microchip (sparx5):\n - Time Aware Shaper (taprio) offload\n - Motorcomm (yt921x):\n - LED and SerDes PCS support\n - Realtek (rtl8365mb):\n - EEE support\n\n - Ethernet PHYs:\n - Broadcom:\n - enable jumbo frames on BCM54xx\n - Realtek:\n - support for RTL8261CE_CG and RTL8261D_VM\n - MDIO support for RTL838x and RTL839x\n\n - WiFi drivers:\n - Broadcom (brcmfmac):\n - FT/OKC roaming offload\n - Intel (iwlwifi):\n - UHR sniffer support\n - support for newer UEFI/BIOS tables\n - MediaTek (mt76):\n - mt7925 NAN improvements\n - offchannel/scan improvements and MLO fixes\n - Morse Micro (mm81x):\n - monitor mode support\n - Qualcomm (ath12k):\n - IPQ5332 platform infrastructure\n - Realtek (rtw88):\n - RTL8723BS support\n - SDIO TX performance improvements\n - Realtek (rtw89):\n - P2P_DEVICE support\n - BT-coex updates for RTL8922D\n\n - Bluetooth:\n - move H:4 reassembly into the Bluetooth core\n - add generic support for vendor packets\n - MGMT: add security level changed event\n\n - Bluetooth drivers:\n - btusb: support Bulk Serialization Mode\n - Intel: support Draco and Titan Lake, allow unsigned firmware\n - Mediatek: MT7928 support\n - Qualcomm: QCC2072 support\n - Broadcom: Synaptics 4384 support\"\n\n* tag \u0027net-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)\n Bluetooth: btusb: disable by default Qualcomm multi-subsystem\n tipc: fix broadcast sender hang on last acker departure\n tipc: fix use-after-free of broadcast reception link at node release\n r8169: clear TX LPI on RTL8168h at link up after phylink conversion\n tun: Require CAP_NET_ADMIN to attach to an ownerless device\n net/sched/sch_cake: drop dead nla_nest_end() error check\n net/sched/sch_cake: widen buffer_used to u64\n net/sched/sch_cake: reduce parent backlog when clearing a tin\n net/sched/sch_cake: serialize reconfiguration with the datapath\n tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table\n net/mlx5e: Stop asserting for RTNL when closing channels\n net: shrink the payload-only part of skb dataref to one bit\n net: wwan: iosm: validate msg_head before indexing msg_ring\n net: bgmac: rate limit RX error messages\n selftests: net: veth: test XDP_TX to a peer with GRO enabled\n veth: schedule the peer\u0027s NAPI after XDP_TX when only GRO is enabled\n pppoe: delete session hash entries by pointer match\n net: lan969x: don\u0027t disable hardirqs in fdma tx clear\n net: sparx5/lan969x: do not clobber the PSFP cycle timer update period\n net: lan969x: fix DSM calendar for empty taxis\n ...\n" }, { "commit": "864c07de0c7dcbca58b61625dfa2e461ae63b242", "tree": "4d2c5f0962b95b99c8f5b04f62ff729086ac5f34", "parents": [ "5b193d6a8973655f19de87a7873ce31dee2d5fe6", "2f70a9b7e9c74b92a85a2584090f0f5c4cbaa4be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:01:57 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:01:57 2026 -1000" }, "message": "Merge tag \u0027hardening-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull hardening updates from Kees Cook:\n\n - Provide kmalloc_obj*-style API for devm_kmalloc()\n\n - Improve seq_buf API for saner C String handling with several bug\n fixes along the way (Kees Cook, Bill Wendling)\n\n - Overflow helper readability improvements (Bill Wendling)\n\n - Unexport native_write_cr4() (Dennis Chen)\n\n - um: fix CONFIG_GCOV for built-in code (Johannes Berg)\n\n - Improve stackinit test coverage (Justin Stitt)\n\n - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)\n\n - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)\n\n - signalfd: don\u0027t dequeue the forced fatal signals (Oleg Nesterov)\n\n - Fix randstruct to recognize new container_of() behavior\n\n - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too\n\n - Fix a couple remaining allocation return type mismatches\n\n* tag \u0027hardening-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)\n overflow: Match arithmetic in both parts of __builtin_choose_expr\n lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()\n extcon: realtek: Remove const from type_c_cfg allocation type\n coresight: cti: Add const to con_groups allocation type\n docs: core-api: Document the seq_buf API\n nvdimm: ndtest: Return the string length from flags_show()\n powerpc/papr_scm: Return the string length from the sysfs show functions\n seq_buf: Add seq_buf_init_append()\n bpf: Remove dead newline stripping from format_disasm_line()\n seq_buf: Add seq_buf_terminate()\n seq_buf: Add seq_buf_strlen()\n seq_buf: Clear what a writer did not claim when a seq_buf overflows\n seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow\n scsi: lpfc: Print rx monitor records straight into the seq_buf\n seq_buf: Do not pop from an overflowed seq_buf\n seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()\n .get_maintainer.ignore: Add Kees Cook\n devres: Provide kmalloc_obj*-style API for devm_kmalloc\n mm: Move default_gfp() into gfp_types.h\n kunit/stackinit: Clean up XFAIL under instrumentation\n ...\n" }, { "commit": "5b193d6a8973655f19de87a7873ce31dee2d5fe6", "tree": "e4028271892aa34ad12ffae196b884401412646b", "parents": [ "79132ddf81d78d9b84d9b8f05c7c5c3a3e912537", "b36b990c50b1f581b9a7f35ae256f5542415fa69" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:57:31 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:57:31 2026 -1000" }, "message": "Merge tag \u0027execve-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull execve update Kees Cook:\n \"Make CIs happier about the execve tests: report the skipped\n binfmt_misc_bpf test on stderr (Sasha Levin)\"\n\n* tag \u0027execve-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n selftests/exec: report the skipped binfmt_misc_bpf test on stderr\n" }, { "commit": "79132ddf81d78d9b84d9b8f05c7c5c3a3e912537", "tree": "024dee3cf10e3d1f2da0f95c83884f5ba7dd0c3b", "parents": [ "075e3396ebf5dfd0030bfe12642fa82cecd0c6ee", "e32008340585a12783045c4426fbb963cfa11b7e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:49:03 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:49:03 2026 -1000" }, "message": "Merge tag \u0027seccomp-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull seccomp updates from Kees Cook:\n\n - allow addfd to transfer O_PATH descriptors (Cong Wang)\n\n - allow restarting interrupted unreceived notifications (Cong Wang)\n\n - fix SECCOMP_ADDFD_FLAG_SEND when interrupted (Hui Peng)\n\n - Various docs and test clean-ups\n\n* tag \u0027seccomp-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n selftests/seccomp: Split fork_and_close into clone and close tests\n seccomp: Document RESTART_BEFORE_RECV and O_PATH addfd\n selftests/seccomp: test addfd with an O_PATH descriptor\n seccomp: allow addfd to transfer O_PATH descriptors\n docs/seccomp: describe the SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV flag\n selftests/seccomp: cover restart of unreceived notifications\n seccomp: allow restarting interrupted unreceived notifications\n seccomp: restore knotif-\u003estate when SECCOMP_ADDFD_FLAG_SEND is interrupted\n" }, { "commit": "075e3396ebf5dfd0030bfe12642fa82cecd0c6ee", "tree": "24b207306f24350761a0bfec7cb5914c6e875917", "parents": [ "3ac032ef6ca8e47bb06d1e189dfcf88fa0a09c75", "7c756181175d50200be487affa905e973f6cbaf5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:45:56 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:45:56 2026 -1000" }, "message": "Merge tag \u0027pstore-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull pstore updates from Kees Cook:\n\n - don\u0027t leave an ERR_PTR in the ramoops zone pointer (Andrea Parri)\n\n - reject persistent RAM zones too small for the buffer header (Andrea Parri)\n\n - publish big_oops_buf after max_compressed_size (Jaidev Shastri)\n\n* tag \u0027pstore-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n pstore: publish big_oops_buf after max_compressed_size\n pstore: reject persistent RAM zones too small for the buffer header\n pstore: don\u0027t leave an ERR_PTR in the ramoops zone pointer\n" }, { "commit": "3ac032ef6ca8e47bb06d1e189dfcf88fa0a09c75", "tree": "7dd7d10849e50e38721db3bce4285e585e0e77c7", "parents": [ "fcb92ecd733e11f37c32e7485da976a40d878e72", "bc6f2a284c63313e789d8cd294531e1cc2dc8c99" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:56:36 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:56:36 2026 -1000" }, "message": "Merge tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl\n\nPull fwctl update from Jason Gunthorpe:\n\n - One bug fix for a CFI issue in the Rust bindings\n\n* tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:\n rust: fwctl: declare cfi_encoding for fwctl_rpc_scope\n" }, { "commit": "fcb92ecd733e11f37c32e7485da976a40d878e72", "tree": "a890fddbbb6804eb812cc3b7c7e605fc8ddbe12f", "parents": [ "1021679bed5acc46e1b2dac78bdd006bd50970f4", "c3e8e9451e6f1b69f685b75e0fbf14f3d0fb2539" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:51:18 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:51:18 2026 -1000" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma updates from Jason Gunthorpe:\n \"A smaller cycle for features, still mostly AI and tool found bug fixes\n for long standing issues:\n\n - Bug fixes and minor cleanups across bnxt_re, cxgb4, EFA, ERDMA,\n HFI1, HNS, ionic, iRDMA, mlx4/mlx5, rdmavt, rtrs, RXE, SIW, SRP,\n isert and IPoIB. Lots of error unwind leaks, integer overflows, and\n use after free during teardown from timers/work that was not\n cancelled\n\n - Core fixes for uverbs DMABUF lifetime, RMPP reassembly use after\n free, multicast rb-tree corruption, restrack, and a user\n triggerable NULL deref when creating a WQ without a CQ\n\n - Prevent userspace from getting a writable mmap of the cxgb4 status\n page and the mlx4 clock page\n\n - Many rxe hardening fixes for bad user and network input, plus\n netdev and tunnel socket lifetime fixes\n\n - Peer supplied values are now validated in rtrs-clt, which is remote\n triggerable\n\n - umem now picks the DMA direction from the access flags instead of\n always using DMA_BIDIRECTIONAL, so an IOMMU can stop the device\n from writing to read-only memory. Several drivers were fixed to pin\n CQ and queue memory as writable to go along with this\n\n - SRQ support, firmware assigned CQ IDs and RCQ userspace support for\n ionic\n\n - RC QP improvements in MANA: MMQ creation, fixed size send WQEs and\n power of two send queues. Also multi-port GSI QPs and a rework of\n the UD send/receive and CQ polling paths\n\n - Relaxed ordering MRs for EFA\n\n - Non-contiguous kernel QP and CQ buffers for ERDMA\n\n - Move the mlx5 data direct infrastructure from mlx5_ib to mlx5_core\n so netdev can use it too. The data direct PCI driver is now named\n \"mlx5_dd\"\n\n - debugfs knob in hns to fix the SL used by the GSI QP, working\n around a HW problem with dropped CQEs\n\n - Selftest fixes, removal of the qib sysfs ABI docs, DT schema\n conversion for hns, and MANA maintainer handover\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (153 commits)\n RDMA/irdma: Bound in-flight CQP ops across deferred completions\n RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler\n RDMA/mlx5: Fix CQ resize destination index mask\n RDMA/usnic: Bound buffer size to sizeof(buf) in flowinfo_read()\n RDMA/rxe: Clear pkt-\u003eqp before the early drop exits in rxe_rcv()\n dt-bindings: infiniband: Convert hisilicon,hns-roce-v1 to DT schema\n RDMA/srp: Avoid reading uninitialized has_port on srp_parse_in() failure\n RDMA/irdma: Fix PBLE_LEVEL_2 FRWR generation\n RDMA/core: Reject LAG selection when source MAC lookup fails\n RDMA/core: Free unpublished port statistics after initial-read failure\n RDMA/core: Preserve the selected source GID on failed AH modification\n RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup\n RDMA/uverbs: Fix uobject leak in DMABUF release\n RDMA/irdma: Fix FRWR IRDMAQPSQ_PBLADDR field population\n IB/rdmavt: Fix error unwind path for qp_priv_init() in rvt_create_qp()\n RDMA/irdma: Check MR contiguity before PBLE alloc\n IB/mlx4: Avoid requeueing executing CM timeout work\n RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]\n RDMA/rxe: Fix out-of-range unsigned-to-signed conversion for RDMA message in 2GiB size\n RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]\n ...\n" }, { "commit": "1021679bed5acc46e1b2dac78bdd006bd50970f4", "tree": "d5fecc3721d2041d1798a6ff003dac481e54f634", "parents": [ "a1c2b1da93f5f612aa7a33190c4900c98e51f6da", "04bcf84613346b973a8cc0c59238b6b5bc902688" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:48:30 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:48:30 2026 -1000" }, "message": "Merge tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd\n\nPull iommufd updates from Jason Gunthorpe:\n \"Several bug fixes, probably found by AI based on the emails:\n\n - Several edge cases in the self test\n\n - Reject malformed invalidation commands in case the VMM let them\n through\n\n - Rework how the invalidation interface works to the drivers to be\n more robust and fix several Sashiko issues\n\n - Correct several error unwind paths\n\n - UAF during eventq file release\n\n - Reject more malformed usage of the dirty tracking by the VMM\"\n\n* tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:\n iommupt: Do not allow PTEs to be split when dirty logging\n iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA\n iommufd: Reject a zero-length dirty bitmap request\n iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned\n iommufd: Fix event queue release use-after-free\n iommufd: Keep dmabuf PFNs MMIO when filling another domain\n iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails\n iommufd: Fix iommufd_hw_capabilities reference in kernel-doc\n iommu/vt-d: Convert nested cache invalidation to the core array loop\n iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop\n iommufd/selftest: Convert cache invalidation mocks to the core array loop\n iommufd: Iterate the cache invalidation array in the core\n iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands\n iommufd/selftest: Skip when the mock device is not there\n iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again\n" }, { "commit": "a1c2b1da93f5f612aa7a33190c4900c98e51f6da", "tree": "d321c6eb9b42aa7a9b7f9a14056760b9530400cc", "parents": [ "98aec86f8c6bf2e1091fefb99eaba8b910e8eef1", "47193113641e5e1f9b5758b73d7b7a0273acb836" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:41:18 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:41:18 2026 -1000" }, "message": "Merge tag \u0027for-linus-tsm\u0027 of https://github.com/jgunthorpe/linux\n\nPull TSM update from Jason Gunthorpe:\n \"One patch to update the maintainers file following Dan\u0027s passing for\n TSM subsystem. Three people have volunteered to help complete this\n work\"\n\n* tag \u0027for-linus-tsm\u0027 of https://github.com/jgunthorpe/linux:\n coco/tsm: Update maintainership\n" }, { "commit": "98aec86f8c6bf2e1091fefb99eaba8b910e8eef1", "tree": "262edefdccfcca1df2cd15ffef6bfc7563ad48ef", "parents": [ "77f77fb7923feab3edd0accf793235623ef4b342", "1f5dde349ac2fca1f119ae8de3f0d2f1c2a8d338" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:37:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:37:35 2026 -1000" }, "message": "Merge tag \u0027sched_ext-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext updates from Tejun Heo:\n\n - Proxy execution can now be enabled together with sched_ext. A BPF\n scheduler can opt in to receive mutex-blocked tasks that donate their\n scheduling context to the lock owner and place them itself.\n\n - Lazy preemption: a BPF scheduler can preempt or kick a CPU lazily,\n deferring the switch to the next return to user space or tick, as the\n fair class can.\n\n - Sub-schedulers: a parent now learns which child runs on each CPU it\n delegated and when a cap change takes effect. A detaching child loses\n its caps before the parent restores the CPUs.\n\n - New kfuncs re-enqueue single tasks from a dispatch queue iteration\n and report a cgroup\u0027s CPU count and a CID\u0027s NUMA node. The CID\n topology now includes clusters.\n\n - Hot path optimizations: dispatch queue and task lookups compare keys\n inline, remote task moves no longer take a dispatch queue lock twice,\n and sub-scheduler hooks cost nothing without sub-schedulers.\n\n - Kfuncs callable from tracing programs are hardened against NMI and\n IRQ nesting, which could hard-lock the CPU or pick a wrong idle CPU.\n\n - Built-in dispatch queues no longer allocate per-CPU state that grew\n with the square of the CPU count.\n\n - Header syncs with the scx repo, a BTF workaround for pahole 1.32, and\n selftest fixes and coverage.\n\n* tag \u0027sched_ext-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (69 commits)\n sched_ext: Drop the locks periodically while walking a user DSQ for re-enqueue\n sched_ext: scx_qmap: Also re-enqueue stranded tasks with scx_bpf_dsq_reenq_task()\n sched_ext: Add scx_bpf_dsq_reenq_task() to re-enqueue single tasks from a DSQ iteration\n sched_ext: Factor out the rq lock switch of scx_dsq_move()\n sched_ext: Don\u0027t queue balance callbacks from a core-sched pick\n sched_ext: Don\u0027t leave balance callbacks queued across a pick retry\n sched_ext: Fix a bypassed task stalling on a cpu its scheduler has no caps on\n sched_ext: Fix the running task keeping its protection into bypass\n sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu\n sched_ext: Keep proxy donors with slice left on the local DSQ\n selftests/sched_ext: Report reload_loop attach failures\n selftests/sched_ext: Bound exit waits\n selftests/sched_ext: Add SCX_ASSERT_ALIVE and adopt it\n selftests/sched_ext: Fail loudly when EXIT_KIND is missing from BTF\n sched_ext: Add SCX_ECODE_RSN_CGROUP_OFFLINE to user_exit_info.h\n selftests/sched_ext: Fix reload_loop error-path use-after-free\n selftests/sched_ext: Fix build error in dequeue_remote selftest\n sched_ext: scx_qmap: Reset a child\u0027s cpuperf targets once its PERF revoke takes effect\n sched_ext: Add ops.sub_child_ecaps_updated() to report a child\u0027s effective cap changes\n sched_ext: scx_qmap: Show actual cid use per participant\n ...\n" }, { "commit": "77f77fb7923feab3edd0accf793235623ef4b342", "tree": "b29b6def51ee7717014c6e1d7a757622eddd26f0", "parents": [ "031cb4ccf803f15b73e153d71024d75031bef5f3", "1850c669516cb8568150937497a9a16a7bfa1582" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:28:11 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:28:11 2026 -1000" }, "message": "Merge tag \u0027cgroup-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup updates from Tejun Heo:\n\n - A write to cgroup.subtree_control or cgroup.type could hang in D\n state for as long as a task pinning a dying controller took to exit,\n as syzbot reported. The wait is now interruptible.\n\n - cpuset: the deadline bandwidth check ran on cpusets that weren\u0027t\n valid partition roots, failing cpuset writes with -EBUSY while\n deadline tasks existed. The CPU count the fair class takes from\n cpuset assumed a shared hierarchy that cgroup1 may not have.\n\n - Finding a cgroup\u0027s effective controller state no longer walks up the\n hierarchy, for per-I/O users such as nvmet. io.stat reads of cgroups\n without block devices skip the stat flush.\n\n - cpuset v1-only code moved to the v1 file and the exclusive flag\n dropped from v2, with documentation corrections for partition roots\n and boot-isolated CPUs.\n\n - Dead cgroups fail writes with -ENODEV consistently, plus small\n cleanups.\n\n - Selftest fixes, most visibly for tests that skipped on machines with\n many mounts, and a new pids.events notification test.\n\n* tag \u0027cgroup-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)\n selftests/cgroup: test pids.events notification\n selftests: cgroup: make test_memcg_sock check flushed sock stats\n selftests: cgroup: skip test_memcg_sock under cgroup.memory\u003dnosocket\n selftests/cgroup: Free the paths returned by cg_control()\n selftests: memcg: Don\u0027t close an uninitialized fd\n cgroup: Track the effective css in each cgroup\n cgroup/cpuset: Move cpuset_update_flag() to cpuset-v1.c\n selftests: cgroup: Preserve command arguments in with_stress.sh\n selftests: cgroup: Enable the cpu controller in test_cpu\n cgroup/cpuset: Use cpuset_v2() in cpuset_num_cpus()\n selftests/cgroup: add settings file with a longer timeout\n cgroup/cpuset: Remove CS_CPU_EXCLUSIVE handling code from v2\n cgroup/cpuset: Run SCHED_DEADLINE shrink test on valid partition root only\n docs: cgroup-v2: Describe effective CPUs of partition roots\n docs: cgroup-v2: Describe boot-isolated CPUs in cpuset.cpus.isolated\n cgroup/cpuset: Remove redundant sched domain rebuild from update_prstate()\n selftests/cgroup: don\u0027t crash on a truncated mount entry in cg_find_root()\n selftests/cgroup: read the entire file in read_text()\n blk-cgroup: skip rstat flush for cgroups without blkgs\n cgroup: use assign_bit() where applicable\n ...\n" }, { "commit": "031cb4ccf803f15b73e153d71024d75031bef5f3", "tree": "3c72a2a510e46d594870fb3bb22c52f7e8d416c3", "parents": [ "14785eff402944f56466ef0058408334cfc2f91d", "bda345b3fc59f2899c50379c64a0734a3e720683" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:25:52 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:25:52 2026 -1000" }, "message": "Merge tag \u0027wq-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue updates from Tejun Heo:\n\n - Flushing a workqueue now visits only the queues used since the last\n flush instead of one per possible CPU. Idle flushes get 10 to 100\n times faster on large machines, which XFS hits on every log force.\n\n - Per-cpu workqueues are built through the same attribute path as\n unbound ones and get a max_active of their own, continuing the work\n to turn them into an affinity scope of unbound workqueues.\n\n - New tracepoints for work items turning CPU-intensive, rescuer mayday\n and rescue events, and BH workers yielding with work pending.\n\n - A KCSAN annotation and small cleanups\n\n* tag \u0027wq-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n workqueue: mark pool-\u003enr_running as __data_racy\n workqueue: BUG_ON() a pwq release before workqueue_init()\n workqueue: Derive the standard attrs from the workqueue flags\n workqueue: Give percpu workqueues their own max_active\n workqueue: Make flush_workqueue() visit only pwqs active since the last flush\n workqueue: Maintain pwq-\u003etotal_in_flight\n workqueue: Add for_each_node_with_fallback()\n workqueue: Fix typo \"upto\" in comment\n workqueue: Add workqueue_bh_budget_yield tracepoint\n workqueue: Add workqueue_mayday and workqueue_rescued tracepoints\n workqueue: Add workqueue_cpu_intensive tracepoint\n workqueue: rename the pwq slot helpers shared with percpu\n workqueue: build percpu pwqs through the attrs path\n workqueue: make the default pwq optional\n workqueue: resolve the backing pool in alloc_pwq()\n workqueue: move the unbound-only attrs check to apply_workqueue_attrs()\n" }, { "commit": "14785eff402944f56466ef0058408334cfc2f91d", "tree": "b61a8af6aa38f266bb7ee6a34de837a295a1853a", "parents": [ "3815f7d55ae18564f4eac57557479f8b3548af95", "722658cac48a6ba49f5506fd74d010ad9dbb2f05" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:02:37 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:02:37 2026 -1000" }, "message": "Merge tag \u0027keys-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull keys updates from Jarkko Sakkinen:\n \"Highlight:\n\n - Don\u0027t leak local kernel addresses (and complement the ongoing\n rhashtable migration) (Kyle Zeng)\n\n The index value for the associative array has been calculated with\n the following formula:\n\n\tmult_64x32_and_fold(description + type address + domain address)\n\n By creating a sequence of dummy keys (e.g., \"A\", \"B\", \"C\", ...), it\n is trivial to form a group of equations with a predictable hash\n function, and ultimately break KASLR.\n\n Kyle\u0027s solution is based on an ephemeral SipHash key and an atomic\n 64-bit counter, which is encapsulated to a key_index_id(). This\n function is then used to assign identifiers for types and domains,\n and since the IDs are unique for each power on, they are as unique\n as memory addresses are.\n\n With these ingredients the index value calculation can be changed\n into form, which is not leaking any kernel addresses:\n\n\tSipHash(description + type id + domain id)\n\n Features and improvements:\n\n - TPM fields were moved from trusted_key_options to the TPM backend.\n They cost memory for non-TPM backends.\n\n - A TPM trusted key now caches tpm_is_tpm2() at the root of each call\n chain, and passes the result as a parameter. This decreases the\n amount of I/O traffic given that tpm_is_tpm2() starts and stops the\n chip via tpm_try_get_ops() and tpm_put_ops().\n\n Bugfixes:\n\n - A TPM trusted key corrupted the return value of a failed key\n unsealing operation if the pcrlock feature was used.\n\n - A TPM 2 trusted key allocated an off-by-four too large buffer for\n the decoded ASN.1 blob coming from keyctl add trusted.\n\n - Sometimes a TPM 2 trusted key rejected created keys based on the\n TPM2_Create response size, treating them as too large. Now it\n correctly checks the extracted TPM2 key blob size.\n\n - The keyctl reject operation raced with keyctl restrict_keyring\n because keyring-\u003esem was not held in key_reject_and_link() before\n accessing keyring-\u003erestrict_link.\n\n - keyctl_describe_key() was not holding key-\u003esem while accessing its\n fields, which can lead to use-after-free of a retired key type.\n\n - find_keyring_by_name() and procfs code were reading the UID from\n key-\u003euser-\u003euid instead of key-\u003euid. The latter is the cached value\n and is meant to protect against a use-after-free caused by keyctl\n chown.\n\n - search_process_keyrings_rcu() did not properly RCU-dereference the\n authorization key payload, which could cause a null dereference if\n the payload was revoked.\n\n - keyctl_read_key() checked key-\u003etype-\u003eread without holding key-\u003esem,\n which can lead to use-after-free if the type is retired. Based on\n my suggestion, this was addressed in __keyctl_read_key(), which\n already did take key-\u003esem\"\n\n* tag \u0027keys-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n keys/trusted_keys: reuse TPM version in option handling\n security: keys: Fix comment of search_process_keyrings_rcu()\n keys/trusted/tpm2: Validate TPM2_Create object sizes separately\n keys/trusted_keys: move TPM-specific fields into struct trusted_key_tpm\n keys: Protect the read method check against type removal\n keys: Avoid owner account dereferences in /proc/keys\n keys: make keyring indexes independent of kernel addresses\n keys: Check the authorization payload in process keyring searches\n keys: Avoid the owner account dereference in named keyring lookup\n keys: Protect the type name while describing a key\n KEYS: Fix key_reject_and_link() race with keyring restriction\n KEYS: trusted: Fix blob allocation size in tpm2_key_decode()\n keys/trusted_keys: return immediately after TPM unseal failure\n" }, { "commit": "3815f7d55ae18564f4eac57557479f8b3548af95", "tree": "e8ec39efb4107e35910700c2ea8bc91c9a0bf77e", "parents": [ "bbc48daecac6c69ccbce4005aa2a681298e2fc7d", "3e271a27c46fd591d1011c7de5a644a41e2010f1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:58:44 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:58:44 2026 -1000" }, "message": "Merge tag \u0027landlock-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock update from Mickaël Salaün:\n \"The main change adds composable Landlock controls for namespace types\n and Linux capabilities, thanks to new LSM hooks (merged via the LSM\n tree). A umount race condition is also fixed\"\n\n* tag \u0027landlock-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Fix superblock use-after-free in release_inode()\n selftests/landlock: Fix snprintf truncation checks in test files\n landlock: Add documentation for capability and namespace restrictions\n samples/landlock: Add capability and namespace restriction support\n selftests/landlock: Add capability restriction tests\n selftests/landlock: Add namespace restriction tests\n landlock: Enforce capability restrictions\n landlock: Enforce namespace use restrictions\n landlock: Wrap per-layer access masks in struct layer_config\n landlock: Rename quiet_masks to quiet_access\n" }, { "commit": "bbc48daecac6c69ccbce4005aa2a681298e2fc7d", "tree": "b5c0b56132d8479e376f3491ed30b8af38e4465b", "parents": [ "31aa19260278943f8539da6837f03fdeadf4aa7e", "e2f08fadb48509c239e47cdaf81438c162395932" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:55:12 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:55:12 2026 -1000" }, "message": "Merge tag \u0027ipe-pr-20261019\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe\n\nPull IPE updates from Fan Wu:\n\n - Fix an extra empty audit record on enforcement changes\n\n ipe_audit_enforce() started an audit buffer but logged the state\n change with audit_log(), which emits its own record. Ending the\n unused buffer produced an additional empty AUDIT_MAC_STATUS record\n every time the enforcement state was changed.\n\n - Keep the name and token tables in sync with their enums\n\n The audit name tables now use designated initializers, so each name\n stays bound to its enum value, and static assertions on the policy\n parser token tables break the build if an enum value is added without\n a matching token.\n\n - Constify token_default() and correct a comment about policy text\n ownership, with no functional changes\n\n - Fix an invalid sgid value in an audit event example in the docs\n\n - Point the docs to the new IPE website and test suite repository\n\n* tag \u0027ipe-pr-20261019\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:\n ipe: update the project and test suite links\n ipe: fix enforcement audit\n ipe: correct policy text ownership comment\n ipe: check parser token table sizes\n ipe: use designated initializers for audit name tables\n ipe: constify token_default()\n ipe: fix invalid sgid value in audit event documentation\n" }, { "commit": "31aa19260278943f8539da6837f03fdeadf4aa7e", "tree": "d89756dea1d72b52387189e2fd15258de0021f49", "parents": [ "bf2325084583daaea91084b25069f121d5d8832b", "ceb24c7052cc4649e3b52a51a7cca7dfe4896cec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:53:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:53:20 2026 -1000" }, "message": "Merge tag \u0027integrity-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity\n\nPull IMA updates from Mimi Zohar:\n \"Cleanup:\n\n - Update ima_audit_msg() to report errno directly, revert making it a\n wrapper for ima_audit_message(), and remove ima_audit_message()\n\n Two bug fixes when carrying the IMA measurement list across kexec:\n\n - Restore the number of violations in the IMA measurement list\n\n - Reject restoring IMA measurement list record(s) beyond the expected\n buffer size (out-of-bounds)\"\n\n* tag \u0027integrity-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:\n ima: reject a kexec buffer whose declared size exceeds the buffer\n ima: recover number of violations after kexec\n integrity: Replace integrity_audit_message() with integrity_audit_msg()\n integrity: Report error code in integrity_audit_msg() call sites\n" }, { "commit": "bf2325084583daaea91084b25069f121d5d8832b", "tree": "92934f2b651890d36f1a2177c31a246b25b412c0", "parents": [ "2a08195e4db5aba84600db6518089a1dbe2d04c7", "178aff4cf425b3fc51ff09c571fa1bfbc1eb8ea4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:36:46 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:36:46 2026 -1000" }, "message": "Merge tag \u0027v7.4-p1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto updates from Herbert Xu:\n \"API:\n - Fix algif_skcipher source SG overrun\n - Allow hmac(sha512) for non-root users\n\n Algorithms:\n - Add wrapper for zeroing AES key context\n - Avoid redundant stream initialisations in zstd\n\n Drivers:\n - Remove hisilicon/sec.\n - Handle digest-only authenc requests in atmel\n - Handle zero-length skcipher requests in mxs-dcp\n - Lower the default priority of caam/qi2\n\n Others:\n - Optimise key comparison in rhashtable lookup that uses constant\n parameters\"\n\n* tag \u0027v7.4-p1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (146 commits)\n crypto: atmel-tdes - consolidate error paths in atmel_tdes_dma_init()\n crypto: atmel-tdes - reuse fast in atmel_tdes_crypt_start()\n crypto: atmel-tdes - use separate DMA scatterlists\n MAINTAINERS: delete entry for John Allen\n hwrng: amd - use PMBASE_OFFSET consistently\n hwrng: cctrng - simplify cctrng_probe()\n hwrng: intel - simplify intel_rng_mod_init()\n crypto: qat - fix use of destroyed vf2pf_lock on VF restart\n crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()\n hwrng: imx-rngc - Use optional clock\n crypto: talitos - init tasklets before requesting IRQs\n crypto: algif_skcipher - rewind rounded output bytes\n crypto: algif_hash - Allow hmac(sha512) for unpriviledged users\n crypto: sa2ul - Remove unused fields\n hwrng: stm32 - use devm_platform_ioremap_resource() in stm32_rng_probe()\n hwrng: stm32 - drop redundant initializations\n hwrng: amd - simplify control flow in amd_rng_mod_init()\n hwrng: stm32 - reuse clock rate in stm32_rng_clock_freq_restrain()\n hwrng: stm32 - use swap() in stm32_rng_probe()\n hwrng: cctrng - drop redundant initializations\n ...\n" }, { "commit": "2a08195e4db5aba84600db6518089a1dbe2d04c7", "tree": "5053309d3c336648459a7673be388b3d5fd23355", "parents": [ "968de9d17980a0e538fc4e4394af49465294386d", "e38f53f0482468efd04397f66bda4648b70ac9fa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:23:28 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:23:28 2026 -1000" }, "message": "Merge tag \u0027linux_kselftest-kunit-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kunit update from Shuah Khan:\n \"A single fix to kunit_run_all_tests() to return void since callers\n don\u0027t check the return value and the integer return type is a remnant\n from when the function was executed as initcall which is no longer the\n case\"\n\n* tag \u0027linux_kselftest-kunit-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n kunit: Return void from kunit_run_all_tests()\n" }, { "commit": "968de9d17980a0e538fc4e4394af49465294386d", "tree": "9e091112c98c09b034805c67637b118148c1d67f", "parents": [ "7cd80b8168c9269e4b11788ce815c0f446ab5b34", "368e5d4d12a802ee3708800319cd13904721286f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:20:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:20:22 2026 -1000" }, "message": "Merge tag \u0027linux_kselftest-next-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kselftest updates from Shuah Khan:\n\n - Improve selftest build, run-time, and install framework\n\n Install even when some modules fail to build, print summary of test\n results at the end of the default test run, keep the build status\n from wrapping to success so build errors are reported, and optionally\n record per-suite build and install results.\n\n - Add LLVM support to kselftest_deps.sh\n\n - Fix resctrl, breakpoints suspend, ftrace, and tracing tests\n\n - Fix and enhance resctrl test\n\n* tag \u0027linux_kselftest-next-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n selftests: breakpoints: Skip step_after_suspend_test on systems without a wakeup capable RTC\n selftests: optionally record per-suite build and install results\n selftests: keep the build status from wrapping to success\n selftests/ftrace: Add nice dependency\n selftests: kselftest_deps.sh: Support LLVM\n selftests: lib.mk: Don\u0027t fail install if no modules were built\n selftests/ftrace: Avoid unlink error on first run\n tracing/selftests: Fix incorrect invocation of exit_fail\n selftests/lib.mk: run_tests: print summary at the end\n selftests/ftrace: skip gcov symbols when picking a function to probe\n selftests/resctrl: Enable dynamic management of IMC counters via linked list\n selftests/resctrl: Replace counter index references with pointers\n selftests/resctrl: Introduce linked list management for IMC counters\n selftests/resctrl: Skip L3_CAT when no exclusive cache portion exists\n" }, { "commit": "7cd80b8168c9269e4b11788ce815c0f446ab5b34", "tree": "070863419ab62749f44af44a1ba3174c315fff29", "parents": [ "bb2235894a8a604c08b3f93f4e1082b9df03265a", "4ad423aa2108485f8bc5dde51fdf9c1ed979ee4b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:12:31 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:12:31 2026 -1000" }, "message": "Merge tag \u0027uml-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux\n\nPull UML updates from Johannes Berg:\n\n - NOMMU support, mostly for mm/ testing\n\n The only bigger change, we added support for building with\n !CONFIG_MMU, mostly for testing, e.g. via kunit. Some new\n selftests targetted to NOMMU are moving elsewhere, but are\n runnable on ARCH\u003dum without MMU.\n\n - Tighter page permissions\n\n Tighten page permissions to catch more bugs (ARCH\u003dum is,\n after all, often used for testing), and also mark __init\n memory inaccessible for the same reason.\n\n - Various maintenance/cleanups\n\n Fix build on really old hosts, fix leaks, make the code a\n bit more robust, header cleanups, typo fixes, the usual.\n\n* tag \u0027uml-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits)\n um: place large BSS inputs in an output section\n um: fix shutdown __inittext access\n um: time-travel: fix sched_yield() behaviour\n um: require MMU for UML PCI support\n um: vector: avoid NULL queue dereference in legacy RX mode\n um: use %pB to print functions in stack traces\n um: mprotect() __init memory\n um: move init text between __init_begin/end\n um: improve checking for --no-warn-rwx-segments\n um: make stub compilation more robust\n um: link .lbss/.ldata/.lrodata correctly\n um: add perf-event support\n x86/um: remove unused \u003casm/required-features.h\u003e header\n um: fix typo \"hander\" in comment\n um: Add definition of __NR_close_range for older host OSs\n um: virtio_uml: switch to dynamic root device\n um: Tighten exec permissions on page mappings\n Documentation: um: document nommu UML\n um: allow deselecting CONFIG_MMU\n um: nommu: add userspace runner processes\n ...\n" }, { "commit": "bb2235894a8a604c08b3f93f4e1082b9df03265a", "tree": "c6e58a900d8e77472ecd8d5c7837985f2023055b", "parents": [ "979fac3eaaa02fa887c7dfe6509248b21dca3872", "129f5d395fd66b6587a5ac156b232cca060d6512" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:05:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:05:19 2026 -1000" }, "message": "Merge tag \u0027powerpc-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc updates from Madhavan Srinivasan:\n\n - powerpc/numa: Support coregroup on PowerNV\n\n - powerpc/irq: Move __softirq_pending out of irq_stat\n\n - powerpc/512x: Remove pdm360ng platform setup in favor of mpc512x_generic\n\n - powerpc/ps3: Simplify control flow in ps3_{virq,irq_plug}_setup()\n\n - KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users\n\n - powerpc/syscall: Avoid atomic test_and_clear_thread_flag on fast path\n\n - pseries/plpks cleanup and fixes\n\n - Misc fixes and cleanup\n\nThanks to Abhishek Dubey, Amit Machhiwal, Anushree Mathur, Bui Nguyen\nNhu Quynh, Christophe Leroy (CS GROUP), Dmitry Torokhov, Gaurav Batra,\nGautam Menghani, Geert Uytterhoeven, Greg Joyce, Hari Bathini, Harsh\nPrateek Bora, Karl Mehltretter, Link Mauve, Michal Suchánek, Mukesh\nKumar Chaurasiya (IBM), Nayna Jain, Ritesh Harjani (IBM), R Nageswara\nSastry, Saket Kumar Bhaskar, Samir Mulani, Shivang Upadhyay, Shrikanth\nHegde, Sourabh Jain, Srikar Dronamraju, Srish Srinivasan, Thorsten Blum,\nVaibhav Jain (IBM), Venkat Rao Bagalkote, and Yeswanth Krishna Tellakula\n\n* tag \u0027powerpc-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (44 commits)\n powerpc/numa: Support coregroup on PowerNV\n powerpc/numa: Allow cpu_to_coregroup_id without PPC_SPLPAR\n powerpc/numa: Simplify find_primary_domain_index\n powerpc/fadump: collect dump when CPU_STATE_DATA is less than reserved\n powerpc/syscall: Avoid atomic test_and_clear_thread_flag on fast path\n powerpc/kasan: fix r2 corruption in mem*() on GENERIC_ENTRY with old compilers\n powerpc: fix NMI exit ordering: restore soft masks after irqentry_nmi_exit()\n powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped\n KVM: PPC: Book3S HV: Free the queue pages in error path\n KVM: PPC: Book3S HV: Add missing mappings for tracing exits\n powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard\n KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form\n KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users\n KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls\n pseries/plpks: update PKS documentation and MAINTAINERS entry\n pseries/plpks: rename the default wrapping key macro\n pseries/plpks: make narrowing conversions explicit\n pseries/plpks: hide wrapping_features when unsupported\n pseries/plpks: fix self-reference in plpks_var initializer\n pseries/plpks: clear SED key data after use\n ...\n" }, { "commit": "979fac3eaaa02fa887c7dfe6509248b21dca3872", "tree": "feba5ab6a2305c92162cd09549fd7832b8aaa22a", "parents": [ "5b6eaf4aeba0aab8cc757d79102aa9662d148f97", "b74843b38da8f1186fd7d447646c835b47096a15" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:02:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:02:35 2026 -1000" }, "message": "Merge tag \u0027alpha-fixes-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha\n\nPull alpha floating point emulation fix from Matt Turner:\n \"Make the FP emulation determine tininess after rounding, as the\n hardware does.\n\n soft-fp always determined it before rounding, so an operation that\n trapped for software completion could report an underflow the same\n operation would not report when it did not trap. glibc\u0027s math\n testsuite catches the disagreement.\n\n This adds _FP_TININESS_AFTER_ROUNDING to the shared soft-fp code in\n include/math-emu/, as glibc\u0027s copy already has, and sets it only for\n alpha. It defaults to zero, so powerpc, sh and sparc are unchanged.\n\n This is the last patch of a three-patch series; the first two were\n merged for v7.3\"\n\n* tag \u0027alpha-fixes-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha:\n alpha: determine tininess after rounding in the FP emulation\n" }, { "commit": "5b6eaf4aeba0aab8cc757d79102aa9662d148f97", "tree": "b6ad7d0f455a40d0297b01357fc2f44680240bc3", "parents": [ "aad73b807cd1a5bff9c5277e8a42e75bbdc8adab", "01330dac0fa7c16ef0f3da39757e9509653a2e3f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:58:09 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:58:09 2026 -1000" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull ARM updates from Russell King:\n\n - remove supersection support\n\n - set \"current\" earlier to avoid KASAN issues\n\n - fix a couple of corner cases in the alignment handler\n\n - fix wrong free function in iommu allocation path\n\n - cacheinfo updates\n\n - properly align hugetlb mappings\n\n - always set endianness on xscale\n\n - fix clang backtracer\n\n - avoid replacing active_asids if already 0\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9493/1: asid: Do not replace active_asids if already 0\n ARM: 9490/1: backtrace-clang: fix wrong sp usage for unwinding\n ARM: 9482/5: decompressor: always set endianess on xscale\n ARM: 9524/1: mm: align hugetlb mappings to the huge page size\n ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU\n ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves()\n ARM: 9521/1: cacheinfo: count external caches in early_cache_level()\n ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves()\n ARM: 9519/1: dma-mapping: Fix wrong free function in __iommu_alloc_simple() error path\n ARM: 9492/1: alignment: fix LSR #32 and ASR #32 offset decoding\n ARM: 9491/1: alignment: restore uaccess state on emulation fault\n ARM: 9488/1: smp: set current pointer in assembly before jumping into C\n ARM: 9486/1: set !LPAE MAX_PHYSMEM_BITS to 32 and remove supersection mappings\n" }, { "commit": "aad73b807cd1a5bff9c5277e8a42e75bbdc8adab", "tree": "8c1f0864efd1be92f97e2d804a7bf619173922db", "parents": [ "4e092c2be4320f06dde1206652746ce0d83540b7", "cfe69169c03e71e2a22870317ef4cffb51f6f06d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:56:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:56:27 2026 -1000" }, "message": "Merge tag \u0027soc-arm-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull ARM SoC board file updates from Arnd Bergmann:\n \"These are mostly smaller cleanups for the remaining platform code in\n arch/arm/, the most notable one being the conversion of the\n s3c/crag6410 board to use software nodes for GPIO references in place\n of plain GPIO numbers.\n\n The earlier plan was to drop the deprecated (since 7.3) board files\n here, which would have been a much larger set of changes, but that is\n now deferred to 7.5\"\n\n* tag \u0027soc-arm-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n MAINTAINERS: Drop arm64 dts/intel path from ARM/SOCFPGA ARCHITECTURE\n ARM: tegra: Fix Trun -\u003e Turn typo\n ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus()\n ARM: vexpress: fix device_node refcount leak in vexpress_flags_set()\n MAINTAINERS: Change ARM Visconti5 architecture maintenance status to Odd Fixes\n ARM: mvebu: fix Cortex-A9 errata selection for Armada 38x\n ARM: OMAP2+: remove unused ctrl_module_wkup_44xx.h header\n ARM: EXYNOS: Replace __ASSEMBLY__ with __ASSEMBLER__\n ARM: s3c: crag6410: use software nodes/properties to set up GPIO keys\n Input: samsung-keypad - remove support for platform data\n ARM: s3c: crag6410: switch keypad device to software properties\n ARM: s3c: register and attach software nodes for Samsung gpio_chips\n Input: samsung-keypad - handle compact binding\n dt-bindings: input: samsung,s3c6410-keypad: introduce compact binding\n ARM: imx6q: remove KSZ9021 PHY fixup\n ARM: imx: Fix suspend/resume crash with Clang CFI\n ARM: OMAP2+: Replace __ASSEMBLY__ with __ASSEMBLER__\n soc: imx: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file\n ARM: imx: Replace __ASSEMBLY__ with __ASSEMBLER__\n MAINTAINERS: Add git tree for TI K3 ARCHITECTURE\n" }, { "commit": "4e092c2be4320f06dde1206652746ce0d83540b7", "tree": "306a7c29df7e142235a7ffde7eab3582a0ce28e3", "parents": [ "2e51c645fee243dbcb5cee3eb063b5713317444c", "6db3ea21a541d34e45f3727b71575424495df44c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:55:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:55:27 2026 -1000" }, "message": "Merge tag \u0027soc-defconfig-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC defconfig updates from Arnd Bergmann:\n \"Only a few new drivers get enabled this time.\n\n The size of the defconfigs actually shrinks here, though that is only\n the result of all the Qualcomm clock drivers now being configured as\n modules by default when the corresponding platforms are enabled\"\n\n* tag \u0027soc-defconfig-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n arm64: defconfig: Update coreboot firmware symbols\n arm64: defconfig: Enable I3C and SPD5118 hwmon\n arm64: defconfig: Enable EMC2305 and PCA963x drivers\n arm64: defconfig: Switch Qualcomm SDM845, SM8150 and SM8250 drivers to modules\n ARM/arm64: defconfig: Drop redundant Qualcomm clock entries\n arm64: configs: defconfig: Convert TISCI to modules\n arm64: defconfig: Enable PMIC5 Gen3 ADC thermal monitor\n arm64: defconfig: Enable QMP PCIe Multi-PHY driver\n ARM: shmobile: defconfig: Refresh for v7.3-rc1\n arm: multi_v7_defconfig: Enable SND_ALOOP\n arm64: defconfig: enable the necessary drivers for the Ayaneo Pocket S2\n ARM: omap2plus_defconfig: Support for compressed firmware\n ARM: omap2plus_defconfig: Enable SND_ALOOP\n" }, { "commit": "2e51c645fee243dbcb5cee3eb063b5713317444c", "tree": "ee6bfb3eabdc46763c050c98a7549e504313a286", "parents": [ "7b9a0e857b427cdda5a08b662dbea7321e6bb470", "0045cd6b8ab2319e9d8de46e5e329cdc35ce6d05" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:52:50 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:52:50 2026 -1000" }, "message": "Merge tag \u0027soc-drivers-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC driver updates from Arnd Bergmann:\n \"There are lots of minor updates for driver subsystems managed through\n the soc tree (turris-omnia platform, cache driver, tee drivers,\n arm-cci, bus, memory) as well as soc vendor specific drivers\n (starfive, xilinx, microchip, nxp, amlogic, imx, renesas, samsung, ti,\n nvidia).\n\n The more notable changes are:\n\n - Larger updates for Qualcomm SoCs including support for SM8950\n (Maili) SM8975 (Hawi), Glymur, Shikra, and IPQ5424\n\n - Added SoC support for Exynos5515, Tegra264, Tegra410, R8A774A3, and\n MT8167 in existing drivers\n\n - Arm SCMI firmware driver support for ACPI PCC transport and module\n autoloading of protocol specific drivers\n\n - Apple crash log support for CrgA embedded controller\"\n\n* tag \u0027soc-drivers-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (176 commits)\n platform: cznic: turris-omnia-mcu: stop button emulation producers\n cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers\n soc: mpfs: use kref cleanup on probe failure\n arm64: enable HAVE_SHARED_GPIOS for all ARM64 platforms\n bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port()\n bus: arm-cci: Drop CPU node reference in cci_ace_init_ports()\n soc: fsl: dpio: Free the IRQ before releasing the I/O object\n soc: fsl: dpio: Fix cleanup on IRQ registration failure\n bus: fsl-mc: Annotate fsl_mc_io.portal_virt_addr with __counted_by_ptr\n bus: fsl-mc: drop the fwnode links of the dpmacs nodes\n soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()\n soc: qcom: geni-se: Drop unused icc_ddr parameter from geni_icc_get()\n firmware: qcom: scm: Allow QSEECOM on ThinkPad T14s Gen 7\n dt-bindings: mailbox: qcom: Document Maili CPUCP mailbox controller\n dt-bindings: spmi: glymur-spmi-pmic-arb: Add compatible for Qualcomm Maili SoC\n soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove\n ASoC: dt-bindings: qcom,apr: Add modem_apps GLINK channel for shikra\n firmware: qcom: tzmem: disable SHM bridge for SM7125 platform\n soc: qcom: ubwc: Add Kalambo UBWC config\n firmware: qcom: scm: Allow QSEECOM on Kalambo CRD\n ...\n" }, { "commit": "7b9a0e857b427cdda5a08b662dbea7321e6bb470", "tree": "f54d9637f27a40a848ed29eba6eff73a1afb880d", "parents": [ "6876634d0fc254362ed6cc4f475c16ddd5e2c0eb", "15644868ad522eac914d368fd08c340051f1076c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:48:17 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:48:17 2026 -1000" }, "message": "Merge tag \u0027soc-dt-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC devicetree updates from Arnd Bergmann:\n \"This is a rather large update of over 1000 non-merge commits touching\n devicetree files and bindings.\n\n A few notable SoC were added this time:\n\n - Apple M4 and A18 Pro are used in laptops, these follow the M3 model\n added in 7.2.\n\n - Google Laguna (aka Tensor G5) is used last year\u0027s Pixel phone\n generation. Unlike the earlier Tensor chips, this is not based on\n Samsung\u0027s Exynos family design but starts a new chip family.\n\n - Qualcomm\u0027s Hawi and Nord SoCs are two powerful chips using the\n custom Oryon cores. Product names and applications are so far not\n known, which means that Qualcomm is doing something right by\n upstreaming kernel support early.\n\n The ST stm32mp23xc/stm32mp25xc SoC support was previously removed\n because there were no users upstream, but they are back now that\n boards have shown up. Renesas RZ/G2M v3.0 (R8A774A3) is just a minor\n variation of the already supported SoC.\n\n In total, there are 81 new dts files for individual boards, and they\n are all over the place. Only one riscv based machine is added, the\n Milk-V Meles SBC using the T-Head th1520 chip. For 32-bit Arm, we have\n 13 new boards. About half are industrial embedded boards using NXP\n i.MX6/7 chips, the rest are older products: two Amazon tablets, two\n Motorola phones and two SoM boards.\n\n Everything else is 64-bit Arm:\n\n - many industrial embedded boards using NXP layerscape, NXP i.MX8/9,\n Qualcomm Hamoa, ST stm32mp2, Rockchip rk35xx, and Renesas RZ/G2\n SoCs\n\n - Laptops and tablets using Apple M4, Qualcomm Snapdragon X2,\n Snapdragon X1 Elite and Allwinner A133 chips\n\n - Valve Steam Frame VR headset using Snapdragon 8 Gen 3\n\n - Seven handheld game consoles using Qualcomm Dragonwing qcs8550\n\n - Mobile phones using Google Tensor G5, Samsung Exynos 850, and\n various Qualcomm Snapdragon chips\n\n Aside from the new stuff, there is still a lot going on for existing\n socs and boards, including GPU hardware support on MediaTek MT8173\n based laptops. Most patches actually add features this time, as the\n compile-time diagnostic changes are slowing down\"\n\n* tag \u0027soc-dt-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (1022 commits)\n arm64: dts: rockchip: Add Radxa E54C\n dt-bindings: arm: rockchip: Add Radxa E54C\n arm64: dts: rockchip: remove FRL GPIO for 100ASK DshanPi A1\n arm64: dts: rockchip: fix M.2 E-key reset pinctrl on rk3588 rock-5-itx\n arm64: dts: rockchip: add pcie30phy data-lanes on rk3588 coolpi-cm5-evb\n arm64: dts: rockchip: Add the fan tachometers to Kobol Helios64\n arm64: dts: rockchip: enable NPU on Radxa E52C\n arm64: dts: rockchip: fix adc button voltage on Radxa E52C\n riscv: dts: sophgo: sg2002-milkv-duo256m: drop reserved memory node\n riscv: dts: sophgo: cv1800b-milkv-duo: drop reserved memory node\n arm64: dts: nuvoton: npcm845-evb: Add peripheral nodes\n arm64: dts: nuvoton: npcm845-evb: Fix DTS coding style\n arm64: dts: nuvoton: npcm845: Add peripheral nodes\n arm64: dts: nuvoton: npcm845: Split APB address ranges\n riscv: dts: sophgo: cv180x: Fix internal ephy node name\n riscv: dts: sophgo: add Milk-V Duo 256M ethernet support overlay\n riscv: dts: sophgo: Limit SG2042 SPI NOR to 12.5 MHz\n riscv: dts: sophgo: Enable SPI NOR on SRD3-10\n riscv: dts: spacemit: set ETH MAC from eeprom for OrangePi\n arm64: dts: allwinner: sun50i-h616: Add video engine\n ...\n" }, { "commit": "6876634d0fc254362ed6cc4f475c16ddd5e2c0eb", "tree": "c81988632f72bd9ccea6dbb4d1a80d3103c0dab2", "parents": [ "2c2fe95ab19b09bef7391e3e5cdf8146d09792b6", "01a40ad5a9687ea5a837857d4b21ddd764be7aa3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:44:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:44:26 2026 -1000" }, "message": "Merge tag \u0027mailbox-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox\n\nPull mailbox updates from Jassi Brar:\n\n - altera: shut down RX polling timer on channel teardown\n\n - arm-mhu: timeout if receiver never comes up in mhuv2, keep combined\n IRQ enabled during suspend in mhuv3, and drop redundant unregister on\n probe failure in doorbell\n\n - axiado: fix RX frame draining and error handling, and fix debugfs\n name truncation warning\n\n - bcm74110: cap rx_svc_init_list growth to prevent PMC-induced OOM\n\n - hisilicon: convert Hi3660 and Hi6220 bindings to DT schema\n\n - mtk-cmdq: fix runtime PM leak in cmdq_mbox_flush()\n\n - pcc: free channel before unmapping shared memory and serialize\n channel updates with teardown\n\n - qcom: guard against NULL con_priv race in IPCC send_data, use\n dev_name() for IRQ names, drop stray disable_irq_wake(), read 64-bit\n register with readq() in CPUCP, drop redundant unregister on probe\n failure, and add SDM670 and IPQ9650 APCS bindings\n\n - rockchip: prefix register defines, simplify device variant handling,\n and convert to use dev_err_probe()\n\n - ti-msgmgr: add TDA54 main secure-proxy support and DT bindings, read\n exact trailing bytes for non-word-aligned messages, and do not report\n RX poll timeout as a send failure\n\n - misc: use designated initializers for acpi_device_id across drivers\n\n* tag \u0027mailbox-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: (27 commits)\n mailbox: Use named initializers for acpi_device_id\n mailbox: qcom-cpucp: read mbox hardware register using readq()\n mailbox: qcom-ipcc: remove stray disable_irq_wake() call\n mailbox: qcom-ipcc: Use dev_name() as IRQ name instead of a static counter\n mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()\n mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()\n mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM\n mailbox: arm_mhuv2: time out if the receiver never comes up\n mailbox: altera: shut down RX polling timer on channel teardown\n dt-bindings: mailbox: qcom: Add IPQ9650 APCS compatible\n dt-bindings: mailbox: Convert hisilicon,hi6220-mbox to DT schema\n dt-bindings: mailbox: Convert hisilicon,hi3660-mbox to DT schema\n mailbox: ti-msgmgr: Read exact number of trailing message bytes\n mailbox: ti-msgmgr: Do not report rx poll timeout as a send failure\n mailbox: arm_mhuv3: Keep the combined IRQ enabled during system suspend\n mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure\n mailbox: qcom-ipcc: Remove redundant mbox_controller_unregister() on probe failure\n dt-bindings: mailbox: qcom: Add SDM670 APCS compatible\n mailbox: rockchip: Convert to use dev_err_probe()\n mailbox: rockchip: Simplify device variant handling\n ...\n" }, { "commit": "2c2fe95ab19b09bef7391e3e5cdf8146d09792b6", "tree": "6c7c7a675bf70ad1ad3ffc37d8620a58f0303d00", "parents": [ "7e3f52ef2fe67ae9689496760ab6bd3d5d68ea6f", "60ccbc2343d37c65a76b736eb7cf41ce0ec343b8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:40:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:40:27 2026 -1000" }, "message": "Merge tag \u0027hid-for-linus-2026102101\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID updates from Jiri Kosina:\n \"Core:\n - OOB fix in s32ton() (Alan Stern)\n - switch to named initializers for acpi_device_id (Pawel Zalewski)\n - UAF fix in hiddev (Yousef Alhouseen)\n\n AMD SFH:\n - support for newer AMD SoCs (Basavaraj Natikar)\n - sysfs attributes of operating-mode telemetry (Basavaraj Natikar)\n\n Apple:\n - power management fix for Apple Touch Bar (Andre Eikmeyer)\n - fix for trackpad hanling on T2 Macs (Aditya Garg)\n\n ASUS:\n - power management fix for ROG Ally (Deni Benato)\n - asus_work() hardening (Denis Benato)\n\n Intel-THC:\n - conversion of intel-thc-hid to hid_safe_input_report() (Even Xu)\n\n Nintendo:\n - support for Switch 2 controller (Vicki Pfau)\n - support for PDP Afterglow controller (Aiman Najjar)\n\n Roccat:\n - fixes for proper handling of short reports (Jiale Yao)\n\n Wacom:\n - UAF fixes (Lee Jones)\n\n .. other assorted fixes, device ID additions and code cleanups\"\n\n* tag \u0027hid-for-linus-2026102101\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (80 commits)\n HID: nintendo: introduce dependency in USB_HID\n HID: asus: add keyboard dock of the ASUS Transformer Book T302CHI device ID\n HID: wacom: fix wacom_intuos_irq NULL pen_input deref\n HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata\n HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct\n HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg\n HID: hid-lenovo-go-s: Move attribute init to after device query\n HID: hid-lenovo-go-s: Add suspend function and gate access under bool.\n HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume\n HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback\n HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup\n HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete\n HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()\n HID: logitech-hidpp: cancel reset_hi_res_work on probe failure\n HID: apple: ignore the trackpad on T2 Macs\n HID: usbhid: skip interrupt IN polling for devices with no input reports\n HID: mcp2221: always initialize and cancel init_work\n HID: magicmouse: fix null pointer dereference in magicmouse_event()\n HID: core: Fix out-of-bounds left shift by 32 in s32ton()\n HID: asus: add support for xgm led\n ...\n" }, { "commit": "7e3f52ef2fe67ae9689496760ab6bd3d5d68ea6f", "tree": "ace6e4a6949fe4fd73c13e2b7bc799f106837df4", "parents": [ "bb436f2a8568d14f176475c79b0d5069f0a6f9e3", "f63dc0eea92d07c5bb799a406571b555cd2bbd97" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:38:51 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:38:51 2026 -1000" }, "message": "Merge tag \u0027auxdisplay-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay\n\nPull auxdisplay updates from Andy Shevchenko:\n \"A tiny batch of auxdisplay changes, which resided in Linux next for\n more than enough without any regression reports:\n\n - Fix ABI documentation formatting\n\n - Miscellaneous cleanups\"\n\n* tag \u0027auxdisplay-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay:\n docs: ABI: auxdisplay: use literal blocks for commands\n auxdisplay: panel: use assign_bit() where applicable\n auxdisplay: arm-charlcd: Use DEFINE_SIMPLE_DEV_PM_OPS for power management\n" }, { "commit": "bb436f2a8568d14f176475c79b0d5069f0a6f9e3", "tree": "3dac357c4e7176ec0e1b3e42bdc9c14d4201659d", "parents": [ "8279fb300585e0a8ee69bd0a12d343e59b6fe7be", "0f6be986ad0eb6fe7338d963a14eaf0dee87677d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:36:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:36:22 2026 -1000" }, "message": "Merge tag \u0027i2c-7.4-part1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c updates from Andi Shyti:\n \"The main changes are the new Novatek NT72676 driver, the qcom-cci\n clock and timing updates and a collection of smaller driver, core and\n DT binding improvements.\n\n Core and helpers:\n - acpi: run ASUS and Dell touchpads at 100 kHz to avoid lag\n - core: return bool from check_functionality() and update users\n - smbus: limit block reads to the caller\u0027s buffer size\n - acpi: mark I2C transfer buffers as DMA-safe\n\n Drivers:\n - qcom-geni: several firmware node and runtime PM improvements\n - qcom-cci: several patches rework clock selection and timings\n - qcom-cci: enable SCL clock stretching\n - imx-lpi2c: fix DMA mapping device selection and cleanup\n - designware: tune RX FIFO thresholds to reduce interrupts\n - i801: respect SPD write protection when probing DDR5 modules\n - bcm2835: fully initialize clock configuration data\n\n Generic cleanups:\n - mux: simplify channel lookup and firmware node handling\n - core, busses: tidy up ACPI device ID tables\n - docs: clarify adapter lookup and fix a client driver example\n - xlnx: update maintainer for Xilinx IIC bindings\n - ljca: remove redundant adapter deletion\n\n New support and DT bindings:\n - add DW compatibles for Synaptics SL2610 and UltraRISC DP1000\n - allow six DMA channels for R-Car Gen5\n - add Allwinner A733 compatible to mv64xxx bindings\n - add support for Novatek NT72676 (new driver)\"\n\n* tag \u0027i2c-7.4-part1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (37 commits)\n i2c: imx-lpi2c: remove dmaengine_desc_free()\n i2c: busses: use named initializers for acpi_device_id\n i2c: i2c-core-acpi: use named initializers for acpi_device_id\n i2c: i801: Gate SPD instantiation on SPD Write Disable bit\n i2c: acpi: Use I2C_M_DMA_SAFE in acpi_gsb_i2c_[read|write]_bytes()\n dt-bindings: i2c: dw: Add Synaptics sl2610 i2c\n i2c: designware: size the RX FIFO threshold to the queued transfer\n i2c: imx-lpi2c: use dmaengine_get_dma_device() for DMA mapping\n docs: i2c: writing-clients: Add missing end of command\n i2c: qcom-cci: skip core clock rates the clock cannot provide\n i2c: core: document preference for i2c_get_adapter_by_fwnode()\n i2c: qcom-cci: always enable SCL clock stretching\n MAINTAINERS: Add entry for Novatek NT72676 I2C controller driver\n i2c: nt72676: Add Novatek NT72676 I2C controller driver\n dt-bindings: i2c: Add Novatek NT72676 I2C controller\n i2c: acpi: Force ASUE140D touchpads to 100 kHz\n i2c: qcom-cci: Enforce the required CCI clock rate\n i2c: qcom-cci: Share the timing table across CCI revisions\n i2c: qcom-cci: Add 19.2 MHz timings for the v2 CCI\n i2c: qcom-cci: Support per-mode CCI clock rates\n ...\n" }, { "commit": "8279fb300585e0a8ee69bd0a12d343e59b6fe7be", "tree": "92d16536982b12ab0d7110a7b176c458104d5d4a", "parents": [ "22cbcdafe135752082853355168460c730d1c4aa", "30167fadbf87fa901a2fee49c30a5c5a506a43e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:34:52 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:34:52 2026 -1000" }, "message": "Merge tag \u0027for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux\n\nPull hte updates from Dipen Patel:\n\n - prevent releasing GPIO before time expires in the test code\n\n - initialize spin lock before registering the chip in the provider\n driver\n\n* tag \u0027for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux:\n hte: tegra194-test: shut down timer before GPIO release\n hte: tegra194: Initialize slice locks before registering chip\n hte: tegra194: Remove redundant dev_err()\n" }, { "commit": "22cbcdafe135752082853355168460c730d1c4aa", "tree": "db72161f4ac6693ead6ee146a366512e1c7abec0", "parents": [ "0e557fc68a1667183b5f4649ee76e833160c6714", "6276c8195e598361942082423114877265c17692" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:32:49 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:32:49 2026 -1000" }, "message": "Merge tag \u0027watchdog-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull watchdog updates from Guenter Roeck:\n \"Core/generic:\n - Replace __MODULE_STRING() with __stringify()\n - Use assign_bit() where applicable\n - Use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr for dev_pm_ops\n - Fix repeated words and typos in comments\n - Differentiate scenarios when watchdog is closed\n\n Added device support in existing drivers:\n - mtk_wdt: Support for MediaTek MT8167 and MT8127\n - apple_wdt: Support for T8140\n - s3c2410_wdt: Support for Exynos 5515\n\n Various other minor bug fixes and improvements\"\n\n* tag \u0027watchdog-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (22 commits)\n watchdog: mediatek: Apply the driver\u0027s mode to a watchdog left running\n dt-bindings: watchdog: apple,wdt: Add t8140 compatible\n watchdog: Replace __MODULE_STRING() with __stringify()\n watchdog: use assign_bit() where applicable\n watchdog: mediatek: Add support for mt8167 toprgu/watchdog\n dt-bindings: watchdog: Add compatible for MediaTek mt8167\n watchdog: sp805_wdt: fix suspend/resume handling of HW_RUNNING watchdog\n watchdog: PM: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr for dev_pm_ops\n watchdog: mediatek: Add wdt/toprgu resets for mt6589\n watchdog: msc313e: Replace commas with semicolons in probe()\n watchdog: sp805: Replace SIMPLE_DEV_PM_OPS with DEFINE_SIMPLE_DEV_PM_OPS\n watchdog: fix repeated words in comments\n watchdog: fix typos in comments\n watchdog: i6300esb: do not stop an already running watchdog\n dt-bindings: watchdog: mediatek: Add MT8127\n watchdog: Differentiate scenarios when watchdog is closed\n dt-bindings: watchdog: renesas,r9a09g057-wdt: Add CPG/MSSR syscon support\n watchdog: mediatek: acknowledge pretimeout interrupt\n watchdog: s3c2410_wdt: Add exynos5515-wdt compatible data\n dt-bindings: watchdog: samsung-wdt: Add exynos5515-wdt compatible\n ...\n" }, { "commit": "0e557fc68a1667183b5f4649ee76e833160c6714", "tree": "9ba10d6cbfc66303c188bc8abf7c2563d9279969", "parents": [ "03480653ddfd1b004dc622acb4fa913b05c3edaa", "6d318db9ffcb611f9b3b6b3201c963690541a943" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:31:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:31:02 2026 -1000" }, "message": "Merge tag \u0027pmdomain-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain updates from Ulf Hansson:\n \"pmdomain core:\n - Add a genpd config to support unknown initial status\n - Add support system wide resume latency constraints\n - Enable a non-CPU device in a CPU PM domain to do power on\n - Fall back to use device node name for domain idle states\n\n pmdomain providers:\n - cpuidle-psci: Initialize the PM domains in powered off state for OSI\n - cpuidle-psci: Move initialization a bit earlier in the boot sequence\n - qcom: Add NMXC power domain for Nord\n - qcom: Add support for SM7250, Kuno and MSM8952 power domains\n - renesas: Add support for r8a774a3 SYSC power domains\n - renesas: Fix lockdep false positive for r8a78000\n - riscv: Add RPMI device power service\n - st: Add the actual power domains on U8500\n - st: Convert Ux500 PM domains to schema\n\n pm qos:\n - Add a flag for system wide latency constraints\n - Add lockless read for flags\"\n\n* tag \u0027pmdomain-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (36 commits)\n dt-bindings: arm: Add the actual power domains on U8500\n dt-bindings: arm: ux500: Drop NR_DOMAINS\n dt-bindings: power: Convert Ux500 PM domains to schema\n dt-bindings: power: rpmpd: Add MSM8952 power domains\n pmdomain: rockchip: drop duplicated errno from supply failure message\n pmdomain: core: add support system-wide resume latency constraints\n pmdomain: core: add genpd_for_each_child() helper\n PM / QoS: add lockless read for flags\n PM / QoS: add flag to indicate latency applies system-wide\n pmdomain: renesas: rcar-sys: Add r8a774a3 support\n dt-bindings: power: Add r8a774a3 SYSC power domain definitions\n dt-bindings: power: renesas,rcar-sysc: Document vendor-prefixed header paths\n pmdomain: imx93-blk-ctrl: Use pm_runtime_resume_and_get()\n pmdomain: imx8m-blk-ctrl: Use pm_runtime_resume_and_get()\n pmdomain: imx: gpcv2: Use pm_runtime_resume_and_get()\n pmdomain: rockchip: Fix domain check in rockchip_pm_add_one_domain()\n pmdomain: core: Fall back to node name for idle states\n pmdomain: renesas: r8a78000: Fix lockdep false positive\n pmdomain: fix typo \"releated\" in comment\n pmdomain: imx: Propagate SCU provider registration failures\n ...\n" }, { "commit": "03480653ddfd1b004dc622acb4fa913b05c3edaa", "tree": "5523a2d035f09a3dfbb57c09f359b13c0ddf026f", "parents": [ "9aa54fb74ead1737b92a9dc2f7a5d9d5e48dc7b5", "fd9af27f6c2319713bb23832066585f8a59a1771" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:29:07 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:29:07 2026 -1000" }, "message": "Merge tag \u0027mmc-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC updates from Ulf Hansson:\n \"MMC core:\n - Add a power-off-delay-us DT property to support HW specific delays\n - Add mmc_send_tuning_timeout() to allow hosts to specify a timeout\n - Enable hosts to control the re-programming of the crypto keys\n\n MMC host:\n - dw_mmc: Add a common watchdog and convert the various timeouts to use it\n - dw_mmc: Expose the watchdog state in debugfs\n - dw_mmc-rockchip: Use a tighter per command tuning timeout\n - greybus-sdio: Convert to devm_mmc_alloc_host()\n - meson-gx: Enable the bus pipeline clock on T7\n - rtsx_usb_sdmmc: Start card power-up at 3.3V\n - sdhci-cadence: Add Altera Agilex5 SD6HC support\n - sdhci-cadence: Add Cadence SD6HC support\n - sdhci-msm: Add support for the MSM8952 and Maili variants\n - sdhci-msm: Use pm ops to better manage restoring of crypto keys\n - sdhci-of-dwcmshc: Disable CQE error halt request for Rockchip\n - sdhci-pxav3: Disable clock inversion for SD HS cards\n - sunplus: Fixup initialization for DDR modes\n - sunxi: Add support for Allwinner B288\n - vub300: Remove the driver for the obsolete HW\"\n\n* tag \u0027mmc-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (43 commits)\n dt-bindings: mmc: sun4i-a10-mmc: add Allwinner B288\n mmc: dw_mmc-rockchip: use a tighter per-command tuning timeout\n mmc: core: add mmc_send_tuning_timeout()\n mmc: sdhci-of-dwcmshc: Disable CQE error halt request for Rockchip\n dt-bindings: mmc: sdhci-msm: Add MSM8952 compatible\n mmc: use assign_bit() where applicable\n mmc: sdhci-pci: Replace deprecated PCI functions\n mmc: sunplus: initialise rd_crc_dly\u003d1 for DDR modes\n mmc: core: fix stale mmc_start_req() references in comments\n docs: mmc: fix stale async request documentation\n docs: mmc: document eMMC health status support in mmc-tools\n mmc: cavium-thunderx: Drop redundant calls to get|put_device()\n mmc: core: Turn mmc_alloc|free_host() into static functions\n staging: greybus: sdio: Convert to devm_mmc_alloc_host()\n mmc: vub300: Remove the driver for the obsolete HW\n mmc: dw_mmc: remove unused slot member\n mmc: sdhci-pxav3: avoid of_node\n CREDITS: Add Pierre Ossman\n mmc: fix typos in comments\n mmc: meson-gx: enable the bus pipeline clock on T7\n ...\n" }, { "commit": "9aa54fb74ead1737b92a9dc2f7a5d9d5e48dc7b5", "tree": "c6c88491978082614d156ae91e58aa9e2169a2a0", "parents": [ "6ef8f742f9008132db003313bf7a6ca2edb8bbae", "2dee91ee94eec85d09c13c7ca83e3005906d3732" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:23:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:23:27 2026 -1000" }, "message": "Merge tag \u0027regmap-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap updates from Mark Brown:\n \"This is a relatively busy release, mostly due to the general cleanup\n work which people have been doing throughout the kernel - for regmap\n that\u0027s mostly been some work from Peng Fan.\n\n I also added some more tests for the sparse caches to catch some\n gotchas people might run into trying to improve the maple cache.\n\n - Test very high register numbers to help people avoid a nasty gotcha\n trying to optimise the maple cache\n\n - Make more use of scoped lock and allocation guards\n\n - A couple of other smaller improvements and fixes\"\n\n* tag \u0027regmap-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: debugfs: Use __free(kfree) for regmap_reg_ranges_read_file\n regmap: debugfs: Use guard to simplify code\n regmap: debugfs: Use __free(kfree) in regmap_name_read_file()\n regmap: fix potential double-free of map-\u003ereg_defaults on cache reinit\n regmap: use krealloc_array() in regmap_register_patch()\n regcache: simplify control flow and reduce nesting\n regcache: extract __regcache_sync() to deduplicate sync dispatch\n regcache: extract locked helpers to replace open-coded lock/unlock pairs\n regmap: debugfs: use the regmap scoped lock guard\n regcache: rbtree: use the regmap scoped lock guard\n regcache: use the regmap scoped lock guard\n regmap: convert lock/unlock to a scoped guard\n regmap: fix typo \"asynchrnous\" in comment\n regmap: Test rbtree and maple caches for very high register numbers\n regmap: Allow a base register to be specified for the RAM regmap\n" }, { "commit": "6ef8f742f9008132db003313bf7a6ca2edb8bbae", "tree": "a0320a0403df3621a688d2e9424c676aa81ae850", "parents": [ "003e5a0c479e16f06b7684a1b82543aa941a5043", "d5acef12e819c1627c8bf6a0325845ab39d8c99d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:16:16 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:16:16 2026 -1000" }, "message": "Merge tag \u0027spi-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi updates from Mark Brown:\n \"Quite a lot of work in the SPI subsystem this time around, almost all\n in drivers rather than the core.\n\n As well as the general cleanup/fix work we\u0027re seeing over most of the\n kernel there\u0027s been some substantial performance work to two existing\n drivers and support for a number of new devices including a couple of\n new drivers. There was also a big overhaul of the spidev_test utility\n from the Pengutronix people.\n\n - Improvements for spidev_test to cover additional use cases, plus be\n a bit easier to use.\n\n - Substantial performance work in both DesignWare and Tegra210 QSPI\n drivers, making their interrupt handling more efficient to drive up\n hardware utilisation.\n\n - Documentation clarifications.\n\n - Fixes for some runtime PM and error handling issues.\n\n - Support for Nuvoton MA35D1, Qualcomm QPIC SNAND v2, Renesas R-Car\n Gen5 and X5H and Realtek RTD1625\"\n\n* tag \u0027spi-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (136 commits)\n spi: ch341: handle transfers without a TX or RX buffer\n spi: dt-bindings: spi-qpic-snand: Add IPQ9650 compatible\n spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout\n spi: amd: fix len\u003d\u003d0 underflow and FIFO overflow\n spi: tegra114: initialize native chip selects inactive\n spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op\n spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer\n spi: omap2-mcspi: handle DMA setup failures\n spi: jcore: fix divide-by-zero when speed_hz is zero\n spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path\n spi: cadence-xspi: reject SDMA transfers larger than the requested length\n spi: meson-spicc: fix invalid DMA unmap on mapping failure\n spi: s3c64xx: Use snprintf() instead of sprintf()\n spi: omap2-mcspi: Use snprintf() instead of sprintf()\n spi: tle62x0: Use kstrtoul() instead of simple_strtoul()\n spi: lm70llp: Use strscpy() instead of strcpy()\n spi: butterfly: Use strscpy() instead of strcpy()\n spi: jcore: Use devm_platform_ioremap_resource()\n spi: sh-hspi: Use devm_platform_ioremap_resource()\n spi: ljca: validate the response length before copying the data\n ...\n" }, { "commit": "003e5a0c479e16f06b7684a1b82543aa941a5043", "tree": "1e03fe19b81e1d03b99de0cca5830cb2dbf7b588", "parents": [ "5a12cbf26134d417531289e89375bbe580803dec", "ba83dd4a47bb47da3d2791b2ad6cd816a851b5d0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:08:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:08:48 2026 -1000" }, "message": "Merge tag \u0027regulator-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator updates from Mark Brown:\n \"This is quite a quiet release, especially given the general onslaught\n of cleanup patches seen elsewhere. There is some of that, but not as\n much as I\u0027m seeing elsewhere relatively to the size of the subsystem.\n We do have some new drivers as well, plus Linus Walleij has done a big\n overhaul of the AB8500 driver including feature buildout.\n\n - Substantial cleanups and feature additions for the ST Ericsson AB8500\n\n - Overhaul of the configuration for the LP872x.\n\n - A bunch of DT binding conversions\n\n - Support for Maxim MAX20024, MPS MPQ4210, Nexperia NEX10000UB\"\n\n* tag \u0027regulator-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (60 commits)\n regulator: rpi-panel-attiny: Fix probe failure after a host cold boot\n regulator: lp872x: Use macro to fill regulator descriptor\n regulator: lp872x: Add support for input and regulator power supplies\n regulator: lp872x: Remove platform_data based probing\n regulator: lp872x: Remove redundant regmap wrappers\n regulator: lp872x: Fold driver header into driver file\n regulator: dt-bindings: ti,lp872x: Document input supplies\n regulator: dt-bindings: ti,lp872x: Deprecate ti,dvs-gpio and ti,update-config\n regulator: dt-bindings: sy8827n: support standard properties\n regulator: dt-bindings: Reference Tegra regulator coupling schema\n regulator: dt-bindings: nvidia,tegra-regulators-coupling: Convert to DT schema\n regulator: dt-bindings: ti,lp872x: Convert to DT schema\n regulator: dt-bindings: Drop obsolete MAX8925 .txt binding\n regulator: 88pm886: Add Vbus regulator\n regulator: core: Export helpers used by regulator couplers\n regulator: core: Fix coupled regulators reference leak on removal\n regulator: dt-bindings: ti,tps6586x: Convert to DT schema\n regulator: dt-bindings: Add MAX20024 sd4\n regulator: dt-bindings: Convert mediatek,mt6380-regulator to DT schema\n regulator: mp886x: fix pontential division by zero\n ...\n" }, { "commit": "5a12cbf26134d417531289e89375bbe580803dec", "tree": "c694976186da755776bcae583317495ec608e851", "parents": [ "bfa231bb4c7eae56b9967da19d1678bf0847259d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:03:40 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:03:40 2026 -1000" }, "message": "rust: missed rustfmt fix up in rust/kernel/mem.rs\n\nMiguel had mentioned this rustfmt issue, but I overlooked this one when\ndoing the driver core merge.\n\nMake rustfmt happy again.\n\nReminded-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "bfa231bb4c7eae56b9967da19d1678bf0847259d", "tree": "857a1be5784d9e9600ea1dac5fcd6e4bd67a7eec", "parents": [ "74b1dbf6f236f4fe88bd1077ae4657ca4b2c339e", "47f16cf7a6017212230985f6bc7f1b55b6d234d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:59:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:59:20 2026 -1000" }, "message": "Merge tag \u0027gpio-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio updates from Bartosz Golaszewski:\n \"Nothing stands out as particularly interesting, it\u0027s been a calm\n cycle. We have three new drivers, support for more models and lots of\n updates across many modules (details are in the signed tag as usual).\n There are also some minor changes and additions to the in-kernel GPIO\n API.\n\n GPIO core:\n - provide a new controller API: gpiochip_generic_get_config()\n - return -EOPNOTSUPP instead of -ENODEV to user-space if it requests\n hardware timestamping on systems where it\u0027s unavailable (no\n user-space regressions reported)\n\n New drivers:\n - add a driver for ROHM BD73800 PMIC GPIO controller\n - add a driver for Axiado AX3005 SGPIO controller\n - add a driver for Analog Devices AD7768 GPIO controller\n\n New hardware support:\n - extend gpio-rcar with support for R-Car X5H (R8A78000)\n - extend gpio-tegra186 with support for Tegra 268\n\n Driver changes:\n - refactor and improve gpio-rtd1625: switch to modern or better\n fitting interfaces and improve coding style\n - improve error handling of return values of\n platform_get_irq_optional() in several drivers\n - normalize the return value of the gpio_chip::get() callback in\n gpio-siox in order to not propagate invalid values up to the GPIO\n core\n - implement gpio_chip::get_direction() for gpio-pcf857x\n - use managed variants of notifier registration functions in several\n drivers\n - remove legacy gpio_set_value_cansleep() as it has no more users\n - add pinctrl support to gpio-realtek-otto\n - add runtime PM support to the gpio-regmap helper module\n - add more ACPI GPIO quirks for various hardware\n - stop needlessly reading gpio_chip::base in gpio-pxa\n - add support for tracking of direction of generic GPIO chips with no\n direction registers via pinctrl backend to gpio-mmio (use the new\n core API: gpiochip_generic_get_config())\n - use the \"safe\" variants of debugfs_create_file() in\n gpio-sloppy-analyzer\n - use device name as GPIO chip label in gpio-omap\n - refactor bit ops in gpio-dln2\n - prepare gpio-it87 for upcoming kmalloc_obj() conversion\n\n Devicetree bindings:\n - document new model in gpio-pca95xx\n - allow the gpio-hogs property in gpio-zynq and fsl,qoriq-gpio\n - allow the gpio-ranges property in gpio-realtek-otto\n\n Misc fixes:\n - add missing MODULE_ALIAS() to gpio-crystalcove\n - fix a comment typo in example GPIO tools\n - fix unbalanced brackets in documentation\n - add names to regmaps in gpio-mvebu to avoid collisions in debugfs\n output\n - fix GPIO lookup using relative paths in GPIO ACPI\"\n\n* tag \u0027gpio-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (63 commits)\n gpiolib: acpi: Fix GPIO lookup using relative path\n gpio: legacy: Kill gpio_set_value_cansleep()\n dt-bindings: gpio: pca95xx: add onnn,pca9655 with nxp,pca9555 fallback\n gpiolib: acpi: Ignore GPIO 11 interrupt on Acer Nitro V 16S AI\n gpio: pxa: stop reading gpio_chip::base in direction callbacks\n gpio: axiado: add AX3005 SGPIO controller support\n dt-bindings: gpio: add Axiado AX3005 SGPIO controller\n gpiolib: acpi: Add quirk for Lenovo IdeaPad Slim 3 15ABR8\n MAINTAINERS: Add ROHM BD73800 PMIC files\n gpio: bd73800: Support ROHM BD73800 PMIC GPIOs\n clk: bd718x7: Support ROHM BD73800\n regulator: bd71828: Support ROHM BD73800\n rtc: bd70528: Support RTC on ROHM BD73800\n mfd: Support for ROHM BD73800 PMIC core\n dt-bindings: mfd: ROHM BD73800 PMIC\n dt-bindings: regulator: ROHM BD73800 regulators\n dt-bindings: rohm,bd*: Ref common ROHM bindings\n dt-bindings: mfd: Common ROHM PMIC properties\n gpio: siox: normalize return value of gpio_get()\n gpio: dln2: use assign_bit() where applicable\n ...\n" }, { "commit": "74b1dbf6f236f4fe88bd1077ae4657ca4b2c339e", "tree": "8ac15152cc01c612f89c25232b7e2738ae902b48", "parents": [ "b0e1eda687a2f19a8fa3958303fbb45d493ea46b", "eadea156f11b2c9a780b60c1699c2da145c9d1f2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:56:33 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:56:33 2026 -1000" }, "message": "Merge tag \u0027pwrseq-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull power sequencing updates from Bartosz Golaszewski:\n \"The bulk of added lines are kunit tests that comprehensively verify\n the core functionality of the power sequencing framework.\n\n Other than that, we have another pwrseq driver: Renesas RZ/G3L Power\n Ready and support for more models in pwrseq-pcie-m2. We also added a\n new consumer-facing API in the form of pwrseq_is_controllable()\n function which allows consumers to check if a given target resource is\n actually host-controllable.\n\n Summary:\n\n Power sequencing core:\n - add a suite of kunit test cases for the power sequencing core\n functionalities\n - provide a new consumer API: pwrseq_is_controllable()\n\n New Drivers:\n - add the Renesas RZ/G3L Power Ready driver which provides\n information on power readiness for various IPs on RZ/G3L\n\n Driver changes:\n - use pwrseq_is_controllable() to report controllability to consumers\n in pwrseq-qcom-wcn and pwrseq-pcie-m2\n - add support for PCIe switch topologies to pwrseq-pcie-m2\n - add the PCI ID for Foxconn WCN7850 to pwrseq-pcie-m2\"\n\n* tag \u0027pwrseq-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n power: sequencing: pcie-m2: Add Foxconn WCN7850 subsystem PCI ID\n power: sequencing: qcom-wcn: Report power controllability\n power: sequencing: pcie-m2: Report power controllability\n power: sequencing: Add pwrseq_is_controllable() API\n power: sequencing: add kunit test cases\n power: sequencing: pwrseq-pcie-m2: Support PCIe switch topologies\n power: sequencing: Add Renesas RZ/G3L Power Ready driver\n" }, { "commit": "b0e1eda687a2f19a8fa3958303fbb45d493ea46b", "tree": "5b93d55489e7299b5649c5afbd66e24c55cacbe7", "parents": [ "7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614", "00e917df050d79ac26ec700717680ad6421d2808" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:44:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:44:27 2026 -1000" }, "message": "Merge tag \u0027pwm/for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux\n\nPull pwm updates from Uwe Kleine-König:\n \"The usual mix of fixes for older issues, devicetree changes and\n cleanups.\n\n Part of this is a shared branch that introduces device-managed\n variants of atomic_notifier_chain_register() and\n blocking_notifier_chain_register()\"\n\n* tag \u0027pwm/for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:\n dt-bindings: pwm: Add IPQ5210 binding\n pwm: tiehrpwm: Clear period on disable to allow reconfiguration\n pwm: Allow 32-bit tasks to use the character device\n pwm: lp3943: fix NULL pointer dereference for an unconfigured channel\n pwm: mtk-disp: Fix period readback\n pwm: ipq: Prevent potential 32-bit integer overflow in hi_div calculation\n pwm: loongson: Reload PWM configuration through counter reset\n pwm: Fix typos in comments\n dt-bindings: pwm: Convert TI PWM Subsystem to DT schema\n docs: pwm: Fix bracket and punctuation\n pwm: iqs620a: Use devm_blocking_notifier_chain_register()\n pwm: renesas-tpu: Fix runtime PM reference leak\n notifier: add device-managed registration APIs\n" }, { "commit": "1a2c35c49cc7c6be860038b8442b52424a8f123c", "tree": "74a0a06d9a09392c4f117115593686889c689cc6", "parents": [ "207dd12bc195153fe6ca614d8add9ecb0b636270" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 17:21:01 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 17:45:45 2026 +0200" }, "message": "Bluetooth: btusb: disable by default Qualcomm multi-subsystem\n\nNew knobs should default to \u0027n\u0027. The mentioned one depends on\nBT_HCIBTUSB, but the latter is enabled on most systems.\n\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47193113641e5e1f9b5758b73d7b7a0273acb836", "tree": "6eeec07677ff10922fe134ffb3bbb140b27f7380", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Mon Sep 28 20:17:32 2026 -0300" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Thu Oct 22 10:31:23 2026 -0300" }, "message": "coco/tsm: Update maintainership\n\nWith Dan\u0027s passing Alexey, Aneesh and Jason have volunteered to take this\non, with the support of their employers.\n\nReviewed-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nReviewed-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nReviewed-by: Lukas Wunner \u003clukas@wunner.de\u003e\nAcked-by: Aneesh Kumar K.V (Arm) \u003caneesh.kumar@kernel.org\u003e\nAcked-by: Suzuki K Poulose \u003csuzuki.poulose@arm.com\u003e\nAcked-by: Mathieu Poirier \u003cmathieu.poirier@linaro.org\u003e\nAcked-by: Jonathan Cameron \u003cjonathan.cameron@oss.qualcomm.com\u003e\nAcked-by: Dave Jiang \u003cdave.jiang@intel.com\u003e\nAcked-by: Ankit Agrawal \u003cankita@nvidia.com\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "207dd12bc195153fe6ca614d8add9ecb0b636270", "tree": "dbaa855c271985e94a813cea919eb9396c99da84", "parents": [ "f71ff7d406523748bfb8236830c7eaa6a308aaa1", "f4377bf85887f57b59abb5479f7660a81ffe4449" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 11:41:47 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 11:45:58 2026 +0200" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nMerge in late fixes in preparation for the net-next PR.\n\nConflicts:\n\nnet/netfilter/nf_conntrack_netlink.c\n cd37ab22a74e0 (\"netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter\")\n 1ae2d094b0200 (\"netfilter: ctnetlink: fix inverted IPv6 address match in dump filter\")\n\nAdjacent changes:\n\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c\n 8830e65ed46de (\"net: use assign_bit() where applicable\")\n 07bd391eb957 (\"octeontx2-af: Fix CQ enable state tracking after AQ writes\")\n\nnet/core/sock.c\n 31c5ea8a3296 (\"ipv6: Remove IPV6_ADDRFORM.\")\n 31b564f70d88 (\"net: use the full socket in sk_mc_loop()\")\n\nnet/mptcp/protocol.h\n 0cb6910130a3 (\"mptcp: remove thmac from subflow ctx\")\n 7538fa33bb2f (\"mptcp: fix subflow bitfield misuse\")\n\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f4377bf85887f57b59abb5479f7660a81ffe4449", "tree": "28bf081d9b549d234587a2de4621971a294b19a6", "parents": [ "473167593f42551ce6b00c05cee8cd20309d45ac" ], "author": { "name": "Henry Martin", "email": "bsdhenrymartin@gmail.com", "time": "Mon Oct 19 19:58:59 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 11:05:31 2026 +0200" }, "message": "tipc: fix broadcast sender hang on last acker departure\n\nTIPC group broadcast senders are blocked while a replicast still has\noutstanding member acks: tipc_group_bc_cong() returns true as long as\ngrp-\u003ebc_ackers is non-zero, and clears *grp-\u003eopen, which is what\ntipc_poll() uses to report EPOLLOUT (via tsk-\u003egroup_is_open).\n\nWhen the last outstanding acker departs before acking,\ntipc_group_delete_member() decrements grp-\u003ebc_ackers to zero but\nnever restores *grp-\u003eopen. As a result poll(EPOLLOUT) never fires\nagain. A writer blocked in sendmsg() is only released if some other\nwakeup happens after the deletion: with TIPC_GROUP_MEMBER_EVTS the\nleave event delivery calls sk_data_ready() and wakes it, but without\nmember events nothing does and it sleeps indefinitely, since the\ndefault send timeout is MAX_SCHEDULE_TIMEOUT.\n\nCommit 99cc2a62e07a (\"tipc: reject invalid and unexpected\nGRP_ACK_MSG to prevent bc_ackers underflow\") already calls this out\nin its changelog as a pre-existing issue.\n\nRestore the open state exactly on the 1-\u003e0 transition in the delete\npath, mirroring the GRP_ACK_MSG completion path, and invoke\nsk-\u003esk_write_space() from tipc_sk_filter_rcv() when the group just\nbecame writable again.\n\nAlso make the ack accounting precise. The delete path used to test\nless(m-\u003ebc_acked, grp-\u003ebc_snd_nxt - 1), which also matches members\nthat were never counted for the current replicast (JOINING/LEAVING\nmembers keep a stale bc_acked), and the GRP_ACK_MSG handler accepted\nan ack from any member whose bc_acked differed from the expected\nvalue. Either could zero bc_ackers on behalf of a member that owes\nnothing and silently void an ack still owed by a real acker. Track\nwhether a member owes an ack for the current replicast in a new\nper-member bc_pending flag, set when the member is counted and\ncleared when its ack arrives, and use it both to accept an ack and\nto decide on deletion. bc_acked has no remaining user and is\nremoved. Suggested by Tung Quang Nguyen.\n\nThis issue was discovered by Tencent CodeBuddy Security.\n\nCc: stable@vger.kernel.org\nFixes: 2f487712b893 (\"tipc: guarantee that group broadcast doesn\u0027t bypass group unicast\")\nSigned-off-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20261019115859.3471295-1-bsdhenrymartin@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "473167593f42551ce6b00c05cee8cd20309d45ac", "tree": "b6a8ce95b6694066b02969f999ab8b6a73ea492a", "parents": [ "ffdf678dd16610e3f006dac904bd37c09684673c" ], "author": { "name": "Binbin Deng", "email": "18983559317@163.com", "time": "Mon Oct 19 18:43:52 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 10:42:23 2026 +0200" }, "message": "tipc: fix use-after-free of broadcast reception link at node release\n\nWhen the last reference to a tipc_node is dropped, the node itself is\ndeferred to the RCU callback tipc_node_free(), but the nested broadcast\nreception link, n-\u003ebc_entry.link, is kfree()d synchronously in\ntipc_node_kref_release(), before call_rcu(), and the pointer is never\ncleared. Readers that obtained the node from node_list and then\ndereference bc_entry.link deep into the link (tipc_link_name() in\ntipc_nl_node_reset_link_stats(), bcl-\u003ename/stats in\ntipc_nl_add_bc_link() on the link dump path) therefore touch freed\nmemory although the enclosing node stays alive for a full grace period.\nThe sibling per-bearer links get \"kfree + NULL\" under the node write\nlock in tipc_node_clear_links(); the broadcast entry was missed.\n\nThe race is reachable through the node cleanup timer: once a peer has\nbeen unreachable for NODE_CLEANUP_AFTER (300 s), tipc_node_timeout() -\u003e\ntipc_node_cleanup() unlinks the node under the write lock, and the\nfinal tipc_node_put() at the caller runs outside node_list_lock, so the\nkfree executes in timer softirq context, concurrently with genl dump/\nreset walkers that hold only rcu_read_lock(). (A netlink \"peer remove\"\ncannot race those walkers itself: tipc_genl_family has no parallel_ops,\nso all doit/dumpit calls serialize on the global genl lock.)\n\nReproduced in a QEMU/KVM guest running v7.3.0 with KASAN and\nPREEMPT(full): 10 TIPC peer namespaces on veth bearers, bearer removal\nstaggered so the 300 s node cleanup timers expire while other tasks\nloop link dumps with the broadcast filter and reset-link-stats lookups.\nKASAN hit within two cleanup cycles:\n\n BUG: KASAN: slab-use-after-free in strlen+0x85/0xa0\n Read of size 1 at addr ffff88800b54a004 by task poc_eth/371\n strlen+0x85/0xa0\n tipc_nl_add_bc_link+0x2f9/0xd40\n __tipc_nl_add_node_links+0x10c/0x140\n tipc_nl_node_dump_link+0x8d5/0xd50\n Freed by task 0:\n kfree+0x121/0x380\n tipc_node_timeout+0xa33/0xcf0\n run_timer_softirq+0x144/0x250\n sysvec_apic_timer_interrupt\n\nwith the freed object being the kmalloc-1k tipc_link allocated by\ntipc_link_bc_create() during peer discovery. The same defect fires in\nstrcmp() called from tipc_nl_node_reset_link_stats().\n\nMove the kfree of n-\u003ebc_entry.link into the tipc_node_free() RCU\ncallback so the broadcast link lives exactly as long as the enclosing\nnode. All readers are covered: the netlink walkers are inside\nrcu_read_lock(), and the packet reception path reaches the node via\ntipc_node_find(), whose kref defers kref_release itself.\n\nFound during a static-analysis-assisted audit: candidate sites were\nsurfaced by a Coccinelle rule, and the reader/writer paths were\nconfirmed by LLM-assisted (GLM-5.3) code inspection.\n\nFixes: d25a01257e42 (\"tipc: fix crash during node removal\")\nAssisted-by: GLM-5.3 coccinelle\nSigned-off-by: Binbin Deng \u003c18983559317@163.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20261019104352.488347-1-18983559317@163.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614", "tree": "c5705f05f97dd869c257a1c35db062eba3fbd5c6", "parents": [ "4403278e4ea2f654f8130a5c03eb8b4516a0f201", "d4ffc4896b3e709c6a5d7e5a78a1fddfc774fa25" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 18:53:14 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 18:53:14 2026 -1000" }, "message": "Merge tag \u0027driver-core-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core updates from Danilo Krummrich:\n \"Core:\n\n - Add TAINT_FORCED_BIND to taint the kernel and driver module before\n manual sysfs bind/unbind operations; make add_taint_module()\n available to driver core and update taint decoding tools and\n documentation\n\n - Constify device_show/store_*() attribute parameters and adapt x86\n MCE and perf users to prepare for const dev_ext_attribute instances\n\n - Fix UAF in NUMA access node registration failure handling by\n dropping the device reference with put_device() instead of directly\n freeing the node\n\n debugfs:\n\n - Make debugfs_create_str() read-only to eliminate double-free races\n between concurrent writers; reject writable modes; convert\n interconnect and SoundWire users to local file operations with\n mutex-protected strings\n\n kobject:\n\n - Fix out-of-bounds access in kobject_action_type() when parsing\n action strings containing embedded NUL bytes\n\n - Fix the kobject_set_name() reference in kset_register() kernel-doc\n\n Rust:\n\n - DMA:\n\n - Tie Coherent, CoherentBox and CoherentHandle to the device\u0027s\n bound lifetime to prevent retaining DMA allocations beyond\n driver unbind; propagate the lifetime through nova-core and the\n DMA sample driver\n\n - I/O:\n\n - Require explicit base types for registers and replace relative\n registers with typed subregion projections; reimplement\n register!() as a proc macro, support registers using existing\n types without inline bitfields, and convert nova-core, Tyr and\n the PCI sample; add AsRepr/AsReprMut and transmute helpers with\n deferred size checks for representation conversions\n\n - Wrap ResourceSize in a transparent newtype with explicit\n conversions, including checked conversion to usize\n\n - PCI:\n\n - Add typed PCIe extended capability lookup and SR-IOV accessors\n for the First VF Offset and decoded VF BAR addresses and widths,\n keeping raw SR-IOV registers private to preserve PCI core\n ownership of their state\n\n - scatterlist:\n\n - Honor the device\u0027s maximum segment size as well as the DMA\n mapping limit when constructing SG tables\n\n - Return u32 from SGEntry::dma_len() to match the C segment length\n type\n\n - misc:\n\n - Validate auxiliary DeviceId name length explicitly to improve\n compile-time diagnostics for oversized device ID table entries\n\n - Drop unnecessary \u0027static bounds from debugfs ScopedDir file\n creation methods to support data containing non-\u0027static\n references, including DMA buffers\n\n Misc:\n\n - Add Johan Hovold as driver core maintainer\n\n - Simplify platform_device_alloc() by returning early on allocation\n failure\n\n - Fix typos in driver core and kernfs comments\"\n\n* tag \u0027driver-core-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)\n rust: pci: add extended capability and SR-IOV support\n kobject: Fix the kobj_set_name reference in kset_register() kernel-doc\n rust: io: convert ResourceSize into a transparent newtype\n rust: scatterlist: return u32 from SGEntry::dma_len()\n MAINTAINERS: add myself as driver core maintainer\n debugfs: make debugfs_create_str() read-only\n soundwire: debugfs: replace writable string helper\n interconnect: debugfs: replace writable string helper\n docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted\n driver core: platform: Simplify platform_device_alloc()\n kobject: fix out-of-bounds access in kobject_action_type()\n rust: scatterlist: honor the device\u0027s maximum segment size\n driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers\n module: fix up documentation for add_taint() and add_taint_module()\n module: pull out add_taint_module() to be public\n driver core: Constify the signature of device_show/store_*()\n drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute\n x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute\n rust: auxiliary: validate DeviceId name length\n driver core: fix typos in comments\n ...\n" }, { "commit": "f71ff7d406523748bfb8236830c7eaa6a308aaa1", "tree": "b44ca64862c2b2dea4e9fe2c572bbc40f3d046c4", "parents": [ "82858f249d65126539aa4297677b468fd6619041" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Tue Oct 20 12:15:42 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 18:07:08 2026 -0700" }, "message": "r8169: clear TX LPI on RTL8168h at link up after phylink conversion\n\nCommit 3cdeaef1754a (\"r8169: disable EEE on RTL8168h/8111h\") disables\nEEE on RTL_GIGA_MAC_VER_46 with phy_disable_eee() but keeps the version\nEEE-capable, so that link up still calls rtl_enable_tx_lpi(tp, false)\nand clears the MAC TX-LPI bits (ERI 0x1b0[1:0]). rtl_hw_start_8168h_1()\ndoes not clear them, so a warm reboot from an EEE-active state could\notherwise leave TX-LPI asserted while the PHY no longer negotiates EEE.\n\nIn net-next, commit 8a3c76523e44 (\"r8169: add support for phylink\")\nmoved link handling to phylink, and rtl_mac_link_up() does not touch\nthe TX-LPI bits. The merge of net into net-next kept the\nphy_disable_eee() quirk and its comment, but not the link-up clear it\ndepends on. The only remaining clear is rtl_mac_disable_tx_lpi(), which\nphylink calls from phylink_deactivate_lpi() only after\nphylink_activate_lpi() has enabled LPI. With EEE disabled on this chip\nthat never happens, so the bits are never cleared and the comment in\nr8169_mdio_register() no longer holds.\n\nClear TX-LPI explicitly in rtl_mac_link_up() for RTL_GIGA_MAC_VER_46.\n\nFixes: f49defea7668 (\"Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\")\nLink: https://lore.kernel.org/all/0e0b727e94d046b19ad463e7a1a9fe68@realsil.com.cn/\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nLink: https://patch.msgid.link/20261020161543.3712208-1-sashal@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ffdf678dd16610e3f006dac904bd37c09684673c", "tree": "5573d6630e8790e7a8bcfd10ca2752d3fa7c813a", "parents": [ "a55eb6a622141352131aa6156bbd6ce5da79d9b5" ], "author": { "name": "David Woodhouse", "email": "dwmw@amazon.co.uk", "time": "Tue Oct 20 10:48:10 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 18:05:49 2026 -0700" }, "message": "tun: Require CAP_NET_ADMIN to attach to an ownerless device\n\nTwenty years ago I made creating a tuntap device require CAP_NET_ADMIN\nin commit ca6bb5d7ab22 (\"[NET]: Require CAP_NET_ADMIN to create tuntap\ndevices.\")\n\nThe idea was to allow the permissions on /dev/net/tun to be relaxed to\n0666 and thus allow owners of tun devices assigned with TUNSETOWNER to\nactually open it and get at their devices.\n\nWhat we missed at the time was that persistent devices with *no* owner\nwere already essentially world-consumable, and anyone who could open\nthe device node could also attach to those.\n\nEven then, using persistent devices with no explicitly set owner — on\nthe (false) presumption that CAP_NET_ADMIN would be required to open\nthem — wasn\u0027t an egregious userspace bug. There are cases where it does\nmake sense to separate the creation/configuration of the netdevice, from\nthe process which shovels packets into it.\n\nSince then, TUNSETGROUP was added a year later in commit 8c644623fe7e\n(\"[NET]: Allow group ownership of TUN/TAP devices.\"). Its commit message\nnoted that if both uid and gid are set, both have to match (in itself a\nbizarre choice) — but still not that with *neither* set, no permission\nat all was required.\n\nThen in 2012 commit c8d68e6be1c3 (\"tuntap: multiqueue support\") allowed\nnew queues to be attached to a device from the moment of its creation,\nwith no way for userspace to close the race between creation and a\nsubsequent TUNSET{OWNER,GROUP}.\n\nIn 2024, commit 3ca459eaba1bf (\"tun: fix group permission check\") tried\nto fix things to be saner: only require the user *or* the group to\nmatch, in line with standard POSIX permissions, and require\nCAP_NET_ADMIN if neither the user nor group authorised the access\n(although it put the CAP_NET_ADMIN check first, and would wrongly have\nreported the capability as having been used even when it was not).\n\nThat fix was reverted in commit a70c7b3cbc06 (\"tun: revert fix group\npermission check\") due to allegedly causing a regression in an selinux\ntest suite which *expected* the attachment to succeed when authorised\nby none of user, group, nor CAP_NET_ADMIN:\nhttps://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/\n\nWe should not break UAPI. But we don\u0027t have to consider an selinux test\ncase which deliberately exercises a security flaw to be UAPI worth\npreserving either. To which end, I have fixed it in selinux-testsuite\ncommit b2f894f0016b (\"tests/tun_tap: set an owner on the device for the\nrelabel tests\").\n\nSo: fix the lack of CAP_NET_ADMIN check on devices which *haven\u0027t* been\nassigned an owner or group, while leaving the weird tun ownership model\nas it was (user *and* group have to match, if both are set). If someone\nstill wants to fix the latter (which wasn\u0027t actually the reason the\nprevious attempt was reverted), they can do it under separate cover.\n\nPermit attaching to an existing device only if an owner and/or group was\nset and the caller matches all that were set, or if the caller has\nCAP_NET_ADMIN. The only behavioural change is that a device with no\nowner or group now requires CAP_NET_ADMIN to attach — precisely the\nloophole we want to close.\n\nAnd put the CAP_NET_ADMIN check in the right place this time.\n\nFixes: ca6bb5d7ab22 (\"[NET]: Require CAP_NET_ADMIN to create tuntap devices.\")\nReported-by: Andrew Lutomirski \u003cluto@kernel.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw@amazon.co.uk\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/3c77f88acff5b3c2617b22d64faad15f6212619c.camel@infradead.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "82858f249d65126539aa4297677b468fd6619041", "tree": "a018db54f936f95c4f746f9d30fda25d6c3cf09f", "parents": [ "46cbf85155e5451b6682ea0c17bc62ec564aec36", "700b4c6c70d6a36e6878c5ea092c4877da3f10d8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:25 2026 -0700" }, "message": "Merge branch \u0027net-sched-sch_cake-fixes-for-accounting-and-reconfiguration\u0027\n\nJamal Hadi Salim says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: sch_cake: fixes for accounting and reconfiguration\n\nFour independent fixes in the CAKE qdisc. Three are follow-ups to the\nautorate reconfiguration work around commit 7cbfb180945c (\"net/sched:\nsch_cake: fix autorate reconfiguration throttling\") and the 32-bit\nadmission-counter wraps fixed in gred/bfifo/plug by commit 4c660ee8c809\n(\"net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue\");\nthe fourth is a dead-code cleanup found while auditing the dump path.\n\nPatch 1 serializes a \u0027tc qdisc change\u0027 with the datapath\u0027s autorate\nupdate under the qdisc lock, so the netlink writer and the autorate\nwriter can no longer lose the configured rate. rate_bps needs no atomic\n(it is only loaded and stored), so it stays a plain u64 with\nREAD_ONCE()/WRITE_ONCE() annotations.\n\nPatch 2 propagates the backlog reduction of the reconfigure-time tin\npurge to classful parents, so a CAKE leaf under HTB no longer leaves the\npurged packets in the parent\u0027s qlen/backlog forever.\n\nPatch 3 widens buffer_used and buffer_max_used to u64. The u32\naccumulator wraps once the resident truesize passes 2^32, bypassing the\nover-limit drop loop while the configured limit is a u32 attribute; the\nu32 MEMORY_USED export is clamped so widening the counter does not\ntruncate the reported value.\n\nPatch 4 drops an unreachable \u0027nla_nest_end() \u003c 0\u0027 error check: the\nhelper never returns a negative value.\n\nAll four are hardening for net-next (no Fixes:, no Cc: stable): the\ncounter wrap, the missing parent-backlog propagation and the\nreconfiguration race all predate any contract we could anchor a\nregression on. Patches 1-2 were reported by Sashiko (gemini) and patch\n3 comes from the gred 32-bit-wrap family; patch 4 is a static cleanup.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "700b4c6c70d6a36e6878c5ea092c4877da3f10d8", "tree": "a018db54f936f95c4f746f9d30fda25d6c3cf09f", "parents": [ "dc48c97e7c69215483beeb7d1d80e8e3adbd92c9" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:08 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:20 2026 -0700" }, "message": "net/sched/sch_cake: drop dead nla_nest_end() error check\n\ncake_dump_class_stats() closes the TCA_STATS_APP nest with\n\n\tif (nla_nest_end(d-\u003eskb, stats) \u003c 0)\n\t\treturn -1;\n\nnla_nest_end() never returns a negative value: it has a single\n`return skb-\u003elen;` and no error path (that is why the overflow-aware\nnla_nest_end_safe() helper was later added). The \u0027\u003c 0\u0027 test can never\nbe true, so the \u0027return -1\u0027 is unreachable dead code.\n\nDrop the check and close the nest with the bare statement, matching the\nsibling cake nests in the same file.\n\nThis issue was discovered while fixing a bug on the gate action, see:\nhttps://lore.kernel.org/netdev/QDISC-H19Z.v1.20261001053234@mojatatu.com/\n\nConditions to recreate the bug:\n- not runtime observable: the issue is found by inspection.\n\nLink: https://lore.kernel.org/netdev/87v77csd5q.fsf@toke.dk/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-4@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dc48c97e7c69215483beeb7d1d80e8e3adbd92c9", "tree": "177e4cc02968b0bfb60f1f590ff7ef4cb8030004", "parents": [ "d7010be1ba2337372ea32142951858f936c26e0d" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:07 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:19 2026 -0700" }, "message": "net/sched/sch_cake: widen buffer_used to u64\n\nThis is a follow-up to commit 4c660ee8c809 (\"net: sched: fix 32-bit\nbacklog wrap in gred, bfifo and plug enqueue\"), which promoted the\nbacklog + length admission sums in gred, bfifo and plug to u64. CAKE\u0027s\nown memory accounting has the same 32-bit wrap.\n\nThe issue:\ncake_sched_data.buffer_used accumulates skb-\u003etruesize and is compared\nagainst memory_limit:\n\n\tq-\u003ebuffer_used +\u003d skb-\u003etruesize;\n\tif (q-\u003ebuffer_used \u003c\u003d q-\u003ebuffer_limit)\n\t\treturn NET_XMIT_SUCCESS;\n\twhile (q-\u003ebuffer_used \u003e q-\u003ebuffer_limit)\n\t\tdrop...\n\nbuffer_used is u32, so once the resident truesize passes 2^32 it wraps to\na small value, the \u003c\u003d test passes and the drop loop is skipped even\nthough far more than the configured limit is queued. memory_limit is a\nu32 attribute (TCA_CAKE_MEMORY), so buffer_limit can be as large as\nU32_MAX and never caps buffer_used below the wrap point; with a large\nmemory_limit the queue then grows until the machine is out of memory.\n\nThe fix:\nWiden buffer_used and buffer_max_used to u64, the same shape as the\ngred/bfifo/plug fix. buffer_limit stays u32; the comparison promotes it\nto u64, so the bounded queue stops at the configured limit below 2^32 and\nthe counter can no longer wrap. buffer_used is subtracted on dequeue and\ndrop, so the widened type flows through unchanged. The ACK-filter\nreplacement applied the net delta as one expression,\nq-\u003ebuffer_used +\u003d skb-\u003etruesize - ack-\u003etruesize. Both operands are\nunsigned int, so the subtraction is evaluated at u32 and a larger removed\nACK wraps the delta; the old u32 accumulator folded that back to the\ncorrect net value, but the widened u64 accumulator would persist it as a\nroughly 4 GiB over-count. Apply the replacement as two exact operations\non the widened counter instead; the queue already accounts ack-\u003etruesize,\nso the subtraction cannot underflow.\n\nWidening the counters alone is incomplete because cake_dump_stats() still\nexports buffer_max_used through PUT_STAT_U32(MEMORY_USED, ...), and\ntc.yaml declares memory-used as u32. buffer_max_used only ever rises, so\nonce the widened counter passes 2^32 the export reports peak - 2^32 for\nthe rest of the qdisc\u0027s life. Clamp the exported value to U32_MAX; the\ncounter itself is unaffected.\n\nThe dump path runs without the qdisc lock: tc_fill_qdisc() passes NULL to\ngnet_stats_start_copy_compat(), so the reader races with the enqueue-side\nupdate. READ_ONCE() is not an atomic 64-bit load on 32-bit CPUs, so a\nreader can observe a torn high-water mark and report a bogus MEMORY_USED.\nPublish the counter as u64_stats_t under the qdisc lock, which the enqueue\npath already holds, and take a seqcount-protected snapshot in the dump.\nThe counter stays u64; only the exported value is bounded.\n\nConditions to recreate the bug:\nCAP_NET_ADMIN (root or a user namespace, the qdisc attach is gated by\nnetlink_net_capable(CAP_NET_ADMIN)).\n\nA TUN device is needed so the root qdisc can park packets instead of\ndropping them. Open /dev/net/tun, request TUNSETIFF with\nIFF_TUN | IFF_NO_PI | IFF_BACKPRESSURE and keep the fd open without\nreading it (run it in the background and stop it at teardown): with\nIFF_BACKPRESSURE the full tx ring calls netif_tx_stop_queue() rather than\ndropping, so the queue behind the qdisc can grow past 4 GiB of resident\ntruesize. A plain \u0027ip tuntap add\u0027 attaches no fd and does not request\nIFF_BACKPRESSURE, so it cannot park the queue this way.\n\n ip link set tun0 txqueuelen 32 up\n ip addr add 10.99.0.1/24 dev tun0\n tc qdisc add dev tun0 root handle 1: cake memlimit 4294967295\n\n # Then push more than 4 GiB of resident truesize through the qdisc: six\n # UDP senders using large SO_SNDBUFFORCE buffers send 1400-byte\n # datagrams (the reported OOM witness used 6 workers for 100 s on a\n # 12 GiB guest). On the unfixed kernel buffer_used wraps, the admission\n # test passes, the drop loop is bypassed and the guest runs out of\n # memory; with the fix the counter passes the limit without wrapping and\n # the excess is dropped.\n\n # The ACK-filter over-count is a separate corner: it needs ack-filter\n # enabled and a queued pure ACK whose truesize is larger than the\n # replacement ACK. Use a fresh interface (or \u0027tc qdisc change\u0027) rather\n # than a second root \u0027tc qdisc add\u0027 on an interface that already has a\n # qdisc:\n tc qdisc change dev tun0 root cake ack-filter\n\nCONFIG_NET_SCH_CAKE\u003dy and CONFIG_TUN\u003dy are required, and the\nmemory-residency recipe needs a root-run sender envelope with enough\nguest RAM to hold the queued data.\n\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260818095927.15901-1-jhs@mojatatu.com\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260818095927.15901-1-jhs@mojatatu.com\nLink: https://lore.kernel.org/netdev/20260818095927.15901-1-jhs@mojatatu.com/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-3@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d7010be1ba2337372ea32142951858f936c26e0d", "tree": "7f6037e124746b37de198c2a623d9438983a7e6e", "parents": [ "d23a16d907dc991614eb301830bff8e5b713fb56" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:06 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:19 2026 -0700" }, "message": "net/sched/sch_cake: reduce parent backlog when clearing a tin\n\nThe issue:\nCAKE has purged unused tins on DiffServ reconfiguration since commit\n83f8fd69af4f (\"sch_cake: Add DiffServ handling\") without propagating the\nresulting backlog reduction to classful parents. The issue was noticed\nwhile reviewing 7cbfb180945c, but predates that change.\n\ncake_clear_tin() drops every packet from a tin with\nkfree_skb_reason() but never calls qdisc_tree_reduce_backlog(), so a\nCAKE qdisc under a classful parent (e.g. HTB) leaves the dropped packets\nin the parent qdisc\u0027s and class\u0027s qlen/backlog accounting forever. The\nnormal dequeue path does reduce the parent; only the live reconfigure\npurge misses it.\n\nThe fix:\nTins are cleared from cake_reset() and, on reconfigure, from\ncake_configure_rates(). The qdisc core already owns the parent delta for\nthe reset path: qdisc_purge_queue() snapshots qlen/backlog, runs\nqdisc_reset(), then reduces the tree, so propagating the reduction from\ncake_clear_tin() itself would subtract the same backlog twice. Snapshot\nCAKE\u0027s qlen/backlog around only the reconfiguration purge in\ncake_configure_rates() and reduce the parent once afterwards, matching\nthe delta pattern already used by cake_enqueue().\n\nConditions to recreate the bug:\nput CAKE (diffserv8) under an HTB class, flood DSCP-classified traffic\ninto a high tin so it backlogs, then change CAKE to diffserv3. The HTB\nparent keeps the purged packets in its qlen and backlog; a kernel with\nthe fix shows the parent at the leaf\u0027s backlog (426b/5p) instead of\nretaining the purged packets.\n\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nLink: https://sashiko.dev/#/patchset/20260816012109.2865223-1-ooonea@gmail.com\nLink: https://lore.kernel.org/netdev/20260816012109.2865223-1-ooonea@gmail.com/\nLink: https://lore.kernel.org/netdev/8733ugtry8.fsf@toke.dk/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-2@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d23a16d907dc991614eb301830bff8e5b713fb56", "tree": "738394be55a8cfa8eb43d20c8b7215fa9d9ad031", "parents": [ "46cbf85155e5451b6682ea0c17bc62ec564aec36" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:05 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:19 2026 -0700" }, "message": "net/sched/sch_cake: serialize reconfiguration with the datapath\n\nThis is a follow-up to commit 7cbfb180945c (\"net/sched: sch_cake: fix\nautorate reconfiguration throttling\"). That change only stored\nlast_reconfig_time; it did not address the concurrency between the\nautorate rate update in cake_enqueue() and the netlink reconfiguration\npath, which the original review flagged.\n\nThe issue:\ncake_change() -\u003e cake_config_change() updates the fields of the shared\nstruct cake_sched_config under RTNL but not under the qdisc lock: it only\ntook sch_tree_lock() later, around cake_reconfigure(). The datapath in\nturn serializes cake_enqueue() with itself under the qdisc lock, and its\nautorate-ingress path stores the estimated rate into\nq-\u003econfig-\u003erate_bps. Two writers therefore update the same rate with no\ncommon lock:\n\n CPU0: cake_enqueue() sees CAKE_FLAG_AUTORATE_INGRESS, computes an\n estimate, and is about to store it.\n CPU1: \u0027tc qdisc change ... bandwidth X\u0027 clears autorate in its local\n rate_flags, writes rate_bps \u003d X, publishes the cleared flag, and\n waits in sch_tree_lock().\n CPU0: stores the estimate, calls cake_reconfigure(), and unlocks.\n CPU1: reconfigures from the estimate and returns.\n\nThe qdisc is left with autorate disabled but with the estimate installed\ninstead of X.\n\nThe fix:\nCommit the parsed configuration and reconfigure while holding the same\nqdisc lock that serializes the datapath, so the netlink writer and the\nautorate writer can no longer interleave. rate_bps needs no atomic: it is\nonly ever loaded and stored, so plain READ_ONCE()/WRITE_ONCE() annotations\nare enough for the accesses that run outside the lock. The lockless\npaths read the rate once into a local and reuse that value, so a single\ncoherent snapshot is used per operation.\n\nThe annotations do not make a 64-bit access single-copy atomic on 32-bit:\nREAD_ONCE()/WRITE_ONCE() are still two 32-bit accesses there. The lockless\nreaders -- cake_config_dump() and the cake_mq children, which observe the\nshared config under a different child\u0027s lock -- can therefore still see a\ntorn rate on 32-bit. That rate is an advisory shaper value and is accepted\nas best-effort; the state that must be consistent (the configured rate and\nthe autorate flag) is written under the qdisc lock.\n\nConditions to recreate the bug:\nThe lost update (a) needs no sanitizer. Put cake in autorate-ingress on a\ndevice, drive bursty traffic with gaps so the 250 ms autorate reconfiguration\nfires, and concurrently loop \u0027tc qdisc change ... cake bandwidth \u003cN\u003ekbit\u0027\nwithout autorate-ingress (specifying a bandwidth clears the flag).\nIf the autorate store lands after the change wrote its rate but before the\nchange reconfigures, the qdisc ends up with autorate disabled and the estimate\ninstalled instead of \u003cN\u003e; reading the rate back then shows the estimate, which\nan unfixed kernel can do and a fixed one cannot.\n(b) The unsynchronized access is reported by KCSAN: build with CONFIG_KCSAN\u003dy\nand run the same trigger with the change loop keeping autorate-ingress set;\nKCSAN reports a data race in cake_config_change / cake_enqueue.\nThe non-atomic 64-bit store only shows up as tearing on a 32-bit machine;\non 64-bit the store is atomic and KCSAN flags the access discipline instead.\n\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nLink: https://sashiko.dev/#/patchset/20260816012109.2865223-1-ooonea@gmail.com\nLink: https://lore.kernel.org/netdev/20260816012109.2865223-1-ooonea@gmail.com/\nLink: https://lore.kernel.org/netdev/875wzctsky.fsf@toke.dk/\nLink: https://lore.kernel.org/netdev/87ld7t3kl3.fsf@all.your.base.are.belong.to.us/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-1@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a55eb6a622141352131aa6156bbd6ce5da79d9b5", "tree": "d8033ec76ff1ca1420659e2d86b5ec7d166f68f6", "parents": [ "e0a958ddfc89f2e1c43448cdaeb5b30e54e19448" ], "author": { "name": "Travis Howard", "email": "thoward@lafayetteinstrument.com", "time": "Mon Oct 19 20:03:10 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:49:48 2026 -0700" }, "message": "tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table\n\nThe Datto SIRIS 5 1U Server is a Dell OEMR XL R640 (Dell\u0027s OEM-ready\nvariant of the PowerEdge R640) sold under Datto\u0027s identity. Its DMI\nstrings report sys_vendor \"datto\" and product_name \"SIRIS 5 1U Server\",\nso it does not match the existing \"PowerEdge R640\" entry in\ntg3_restart_aer_quirk_table.\n\nAs on the PowerEdge R640, a system restart triggers a fatal PCIe AER\non the BCM5720 during ACPI _PTS for S5, which the iDRAC logs as\nPCI1318 and which hangs the reboot. Power off is unaffected.\n\nClearing the same PCI_EXP_DEVCTL error-reporting bits on both BCM5720\nfunctions from userspace immediately before restart allows the system\nto reboot normally, confirming the quirk applies to this platform.\n\nFixes: e0efe83ed325 (\"tg3: Disable tg3 PCIe AER on system reboot\")\nSigned-off-by: Travis Howard \u003cthoward@lafayetteinstrument.com\u003e\nLink: https://patch.msgid.link/20261019-tg3-datto-aer-quirk-v1-1-f0eccfb2ab5d@lafayetteinstrument.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e0a958ddfc89f2e1c43448cdaeb5b30e54e19448", "tree": "e56e211e9c23b3fad7e6630a1bfcd5a30a6c3112", "parents": [ "4957ea03bf2696f5da12c09144f48d040696ecc2" ], "author": { "name": "Cosmin Ratiu", "email": "cratiu@nvidia.com", "time": "Tue Oct 20 18:36:59 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:48:38 2026 -0700" }, "message": "net/mlx5e: Stop asserting for RTNL when closing channels\n\nmlx5e_close_channels() has an ASSERT_RTNL() from the time when RTNL was\nrequired for closing channels.\nBut the driver has been switched to using the netdev lock a while back,\nand this fired from a flow which was forgotten during the conversion:\n\nmlx5e_tx_timeout_work()\n -\u003e mlx5e_reporter_tx_timeout()\n -\u003e mlx5e_health_report()\n -\u003e mlx5e_tx_reporter_timeout_recover()\n -\u003e mlx5e_safe_reopen_channels()\n -\u003e mlx5e_safe_switch_params()\n -\u003e mlx5e_close_channels()\n\nThe RTNL is not acquired here, but the netdev lock is, and it is enough.\n\nRather than switching to netdev_assert_locked(), simply drop the assert.\nUpper layers (networking core, ethtool core) provide locking and lower\nlayers (NAPI helpers) assert that the netdev lock is held.\n\nFixes: 8f7b00307bf1 (\"net/mlx5e: Convert mlx5 netdevs to instance locking\")\nSigned-off-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nReviewed-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261020153659.3440902-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4403278e4ea2f654f8130a5c03eb8b4516a0f201", "tree": "921a7aaf5b1143c9cb2f9b9a4828280208c03616", "parents": [ "df37e3924292fb41d325721008520ba93deced42", "503bb6e70bbf6304b8113373d09dfffcc4aa9183" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:38:01 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:38:01 2026 -1000" }, "message": "Merge tag \u0027thermal-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control updates from Rafael Wysocki:\n \"These are mostly updates of thermal drivers including a new Exynos\n ACPM thermal driver for Google GS101, new Renesas RZ/G3L thermal\n sensor support, new Qualcomm MSM8952 TSENS support, new Qualcomm\n PMAU0102 Master BandGap temperature monitor support in DT bindings,\n and new rugged Panther Lake support in intel_tcc_cooling. Moreover,\n the AN7583 driver is extended to register separate thermal zones for\n bandgap, GbE and CPU (its DT bindings are updated accordingly).\n\n There are also multiple fixes and assorted cleanups, as usual.\n\n Specifics:\n\n - Make the Intel powerclamp thermal driver reject invalid window_size\n values, drop redundant clamp() from duration_set() in it, and\n simplify 4 functions in it (Thorsten Blum)\n\n - Add rugged Panther Lake support to the intel_tcc_cooling thermal\n driver (Srinivas Pandruvada)\n\n - Fix temperature selection around 0 C in the int340x thermal driver,\n drop redundant else from proc_thermal_add() in it, and simplify\n slider_def_*_set() in it (Thorsten Blum)\n\n - Drop unbalanced paren from cpu-idle-cooling.rst (Manuel Ebner)\n\n - Use %pe to print error pointers symbolically in the thermal control\n code and fix assorted typos in comments in it (Sumeet Pawnikar and\n Hemanth Selam)\n\n - Add the Exynos ACPM thermal driver for Google GS101, along with DT\n bindings and a MAINTAINERS entry (Tudor Ambarus)\n\n - Add Renesas RZ/G3L thermal sensor support and DT bindings, and move\n default calibration values to per-SoC match data (Biju Das)\n\n - Add Qualcomm MSM8952 TSENS support and the corresponding DT binding\n compatible (Muzaffer Kadir)\n\n - Document the Qualcomm PMAU0102 Master BandGap temperature monitor\n compatible in the DT bindings (Dhruvin Rajpura)\n\n - Extend the QCom TSENS v2 trip temperature limits to the hardware\n range of -204°C to +204°C to prevent interrupt storms when\n operating beyond the previous software limits (Priyansh Jain)\n\n - Fix temperature threshold map indexing in the QCom SPMI temperature\n alarm driver to prevent out-of-bounds reads (Georgi Djakov)\n\n - Describe the additional bus clock required by the Amlogic T7\n thermal sensor and switch the driver to the clk_bulk API to manage\n multiple clocks (Ronald Claveau)\n\n - Request the Airoha EN7581 IRQ after thermal zone registration to\n prevent the interrupt handler from accessing an unregistered or\n already freed thermal zone (Vitaliy Sochnev)\n\n - Fix the Airoha AN7583 ADC mux field mapping, serialize access to\n the shared ADC, and verify mux selection to avoid invalid\n temperature readings and spurious critical shutdowns (Vitaliy\n Sochnev)\n\n - Register separate thermal zones for the AN7583 bandgap, GbE and CPU\n sensors, and update the DT bindings to use one thermal sensor cell\n to select the sensor (Vitaliy Sochnev)\n\n - Fix signed integer overflow in the Renesas RZ/G3E\n temperature-to-code conversion, preserve compare interrupt state\n across runtime PM, and prevent overlapping temperature conversions\n (Ovidiu Panait)\n\n - Remove redundant trip window validation and runtime PM\n pm_runtime_mark_last_busy() calls from the Renesas RZ/G3E driver\n (Ovidiu Panait)\n\n - Propagate reset assertion failures from Renesas RZ/G3E suspend and\n attempt to restore power if the sensor was active (Pengpeng Hou)\n\n - Stop the TI bandgap alert IRQ before removing sensor interfaces and\n cancel pending alert work to prevent use-after-free on driver\n removal (Weigang He)\n\n - Validate Spreadtrum sensor IDs read from the device tree before\n using them for register offsets and array indexing (Weigang He)\n\n - Convert the TI OMAP bandgap DT bindings to schema and document the\n DRA752 compatible and thermal sensor cells (Bhargav Joshi)\n\n - Use DT property helpers matching the signed temperature and\n unsigned hysteresis types defined by the thermal zone bindings (Rob\n Herring)\n\n - Reuse common error handling code in the power allocator governor\n bind callback (Markus Elfring)\n\n - Constify the thermal zone device operations in the i.MX9 driver\n (Christophe JAILLET)\n\n - Fix kernel-doc parameter names and firmware node references in the\n cooling device registration helpers (Aryan Sinha)\n\n - Correct the documented return value of ti_bandgap_get_sensor_data()\n to describe validation errors and potentially NULL stored data\n (Karl Mehltretter)\n\n - Ensure NUL-termination when copying the cooling device command-line\n argument in tmon and fix the associated string truncation warning\n (Florian Fainelli)\n\n - Fix undefined behavior caused by a signed shift in the tmon thermal\n zone binding display (Liu Jing)\n\n - Fix wording in tmon comments (Hemanth Selam)\n\n - Simplify cpufreq_set_cur_state() in the cpufreq_cooling thermal\n control driver (Thorsten Blum)\"\n\n* tag \u0027thermal-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (51 commits)\n thermal/drivers/rzg3e: Propagate reset assertion failure from suspend\n thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc\n thermal/fw: Fix kernel-doc parameter names\n thermal/qcom/tsens: Add support for MSM8952 tsens\n dt-bindings: thermal: tsens: Add MSM8952\n thermal/drivers/amlogic: Switch to clk_bulk API to support multiple clocks\n dt-bindings: thermal: amlogic: describe bus clock for t7-thermal\n tools/thermal/tmon: Fix string truncation warning in optarg copy\n thermal/drivers/airoha: Register a thermal zone per AN7583 sensor\n dt-bindings: arm: airoha: Use one thermal sensor cell for AN7583\n thermal/drivers/airoha: Serialise access to the shared ADC\n thermal/drivers/airoha: Fix AN7583 ADC mux field mapping\n thermal/drivers/sprd: validate the sensor id from the device tree\n thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove\n thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing\n thermal: gov_power_allocator: Use common error handling code in power_allocator_bind()\n tools/thermal/tmon: Fix signed shift UB in binding display\n MAINTAINERS: Add entry for Samsung Exynos ACPM thermal driver\n thermal/drivers/samsung: Add Exynos ACPM TMU driver GS101\n dt-bindings: thermal: Add Google GS101 TMU\n ...\n" }, { "commit": "4957ea03bf2696f5da12c09144f48d040696ecc2", "tree": "70be0e5a3d45a3015e517b15c3d014b32cc806c2", "parents": [ "d06e106229d6c5af67aed5146c22bdebf6eff0a0" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Tue Oct 20 17:19:54 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:32:26 2026 -0700" }, "message": "net: shrink the payload-only part of skb dataref to one bit\n\nskb_shinfo(skb)-\u003edataref is split in two 16-bit halves: the lower\none counts all references, the upper one the payload-only (nohdr)\nreferences.\n\n__skb_clone() increments dataref without bound, and skb_cloned()\nonly checks the low 16 bits. With 65,537 references the low half\nreads 1, the head looks private, and pskb_expand_head() (or\nskb_unclone(), skb_cow(), ...) frees it while clones still point\nto it.\n\nAn unprivileged user can reach this from a user and network namespace:\nabout 32,770 AF_PACKET sockets on lo bring dataref to 0x10001, then\nany pskb_expand_head() on the receive path (here a pull of a large\nIPv6 Hop-by-Hop header) frees the shared head:\n\nBUG: KASAN: slab-use-after-free in _copy_to_iter+0x187/0x1330\nRead of size 1590 at addr ff110001104a9002 by task dataref_wrap/87\n skb_copy_datagram_iter+0x60/0x190\n packet_recvmsg+0x1f5/0x12b0\n __sys_recvfrom+0x18d/0x290\nFreed by task 87:\n kfree+0xf3/0x3b0\n pskb_expand_head+0x344/0xeb0\n __pskb_pull_tail+0xf9/0x1bf0\n ipv6_parse_hopopts+0x377/0x4f0\n ip6_rcv_core+0xc67/0x1620\n\nThe upper half never holds more than 1. It is only set by\n__skb_header_release(), with atomic_set() on an skb owning its head\n(TCP/SCTP output, and GRO which never sees cloned skbs).\n__skb_clone() clears nohdr, and __copy_skb_header() does not copy it.\n\nMove SKB_DATAREF_SHIFT to 30, so that the reference count gets 30 bits,\nand dataref stays positive. Wrapping it would need 2^30 live clones of\na single skb, which socket buffer limits and memory make unreachable.\n\nThis issue was found by Anthropic using Claude, and validated by\nAda Logics.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Stephan Lipp \u003cStephan@adalogics.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261020151954.22953-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "46cbf85155e5451b6682ea0c17bc62ec564aec36", "tree": "4d239f99e6e4408806a1fdc3f3433208c66ea91e", "parents": [ "77dac783f113dcc4576efca6f4391d7324c0b1fc" ], "author": { "name": "Liu Chao", "email": "liuc63@xiaopeng.com", "time": "Tue Oct 20 17:42:49 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:31:01 2026 -0700" }, "message": "net: wwan: iosm: validate msg_head before indexing msg_ring\n\nipc_protocol_free_msg_get() reads msg_head from shared memory and\nuses it directly as an index into msg_ring[]. If the head is out\nof range, the subsequent memset() writes beyond the message ring.\n\nValidate head against IPC_MEM_MSG_ENTRIES before using it as an\nindex. The ring is a circular buffer, so a value outside the valid\nrange indicates a corrupted head pointer; report the error and fail\nthe allocation instead of writing out of bounds.\n\nFixes: 64516f633bfd (\"net: iosm: protocol operations\")\nCc: stable@vger.kernel.org\nReviewed-by: Fang Xieyan \u003cfangxy@xiaopeng.com\u003e\nSigned-off-by: Liu Chao \u003cliuc63@xiaopeng.com\u003e\nReviewed-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261020094254.4017726-1-liuc63@xiaopeng.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "77dac783f113dcc4576efca6f4391d7324c0b1fc", "tree": "d85af4e410a4824b16dcad80619b17a1f4a4f23a", "parents": [ "5a3dcad8e101ddcd3a886907c8992df54472f749" ], "author": { "name": "Rosen Penev", "email": "rosenp@gmail.com", "time": "Sun Oct 18 16:16:29 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:29:58 2026 -0700" }, "message": "net: bgmac: rate limit RX error messages\n\nWhen the RX ring is full the RX FIFO overflows. With RX overflow\ncontinue enabled, the DMA engine then writes one frame with a bogus\nlength (always 0x45c2 on a BCM4716), which the driver drops with\n\"Found oversized packet at slot %d, DMA issue!\".\n\nUnder sustained overload this happens on every NAPI poll. On an Asus\nRT-N16 a 950 Mbit/s UDP stream to the router printed about 1450 such\nlines in 20 seconds. The messages are printed from NAPI context, so\nwith a serial console the router spends most of its time printing.\n\nThe frames are already accounted in rx_length_errors and rx_errors.\nRate limit both RX error messages. With this change the same flood\nprinted 60 lines while rx_length_errors counted 14297 dropped frames.\n\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261018231629.39734-1-rosenp@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d06e106229d6c5af67aed5146c22bdebf6eff0a0", "tree": "12f8e171b26d3a0b84a86225afbcec622bc19840", "parents": [ "b5b8c81836e2bec7b444dfa2b14fd14e912e9d63", "a70575ae9e812908acf658ec785f81daeba1a23b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:41 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:41 2026 -0700" }, "message": "Merge branch \u0027veth-schedule-the-peer-s-napi-after-xdp_tx-when-only-gro-is-enabled\u0027\n\nTianyi Gao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nveth: schedule the peer\u0027s NAPI after XDP_TX when only GRO is enabled\n\nWhen an XDP program on a veth device returns XDP_TX and the peer has\nGRO enabled but no XDP program, the frames are queued on the peer\u0027s\nring, but the peer\u0027s NAPI is never scheduled to process them. Once the\nring is full, every XDP_TX frame is dropped.\n\nCommit 0e672f306a28 (\"veth: check for NAPI instead of xdp_prog before\nxmit of XDP frame\") made such a peer work as an XDP_REDIRECT target,\nwhere veth_xdp_xmit() both queues the frames and schedules the peer\u0027s\nNAPI. XDP_TX queues its frames through the same function but schedules\nthe NAPI in veth_xdp_flush(), which still checks xdp_prog.\n\nThe usual workaround is to load a dummy XDP program on the peer [1].\nThat turns off TSO on the device, and every skb it sends then goes\nthrough the peer\u0027s XDP path, where most of them are copied. In our\ntests, TCP sent from a namespace dropped from 22.1 to 14.8 Gbit/s with\nthe dummy program. With this fix the program is no longer needed.\n\nPatch 1 makes veth_xdp_flush() check the peer\u0027s napi pointer, as\nveth_xdp_xmit() does. Patch 2 adds a test for this case to veth.sh.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261016214217.16942-1-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a70575ae9e812908acf658ec785f81daeba1a23b", "tree": "12f8e171b26d3a0b84a86225afbcec622bc19840", "parents": [ "f16b8c6a656e62bfa7bb6a3b876f9ccdaf53bd43" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Fri Oct 16 22:42:17 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:36 2026 -0700" }, "message": "selftests: net: veth: test XDP_TX to a peer with GRO enabled\n\nTest that XDP_TX frames reach a peer that has GRO enabled and no XDP\nprogram. GRO enables NAPI on the peer, so the frames are queued on the\npeer\u0027s ring, and the peer\u0027s NAPI must be scheduled to process them.\n\nAttach a program that returns XDP_TX for every frame, send 5 echo\nrequests and check that all of them were sent back and that the peer\u0027s\nNAPI received them, as counted in its xdp_packets statistic. IPv6 is\ndisabled on both devices, so that only the echo requests are counted.\n\nAdd the program to xdp_dummy.bpf.c in a section of its own, so that the\ntests that load \"section xdp\" still get XDP_PASS.\n\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nLink: https://patch.msgid.link/20261016214217.16942-3-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f16b8c6a656e62bfa7bb6a3b876f9ccdaf53bd43", "tree": "56d30ca27a732aa0e7035f4dde937abe702bba0b", "parents": [ "b5b8c81836e2bec7b444dfa2b14fd14e912e9d63" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Fri Oct 16 22:42:16 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:36 2026 -0700" }, "message": "veth: schedule the peer\u0027s NAPI after XDP_TX when only GRO is enabled\n\nveth_xdp_xmit() queues XDP_TX frames on the peer\u0027s ring if the peer has\nNAPI. A peer with GRO enabled and no XDP program also has NAPI.\n\nveth_xdp_flush() then schedules the peer\u0027s NAPI, but only if the peer\u0027s\nxdp_prog is set, so for such a peer the frames are never processed.\nNothing else schedules that NAPI by default.\n\nOnce the ring is full, every XDP_TX frame is dropped, and so are the\nskbs that veth_xmit() queues on the same ring.\n\nCommit 0e672f306a28 (\"veth: check for NAPI instead of xdp_prog before\nxmit of XDP frame\") changed the check in veth_xdp_xmit() but not the one\nin veth_xdp_flush(). Make veth_xdp_flush() check the napi pointer\ninstead of xdp_prog, as veth_xdp_xmit() does.\n\nFixes: 0e672f306a28 (\"veth: check for NAPI instead of xdp_prog before xmit of XDP frame\")\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nReviewed-by: Mohsin Bashir \u003chmohsin@meta.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nLink: https://patch.msgid.link/20261016214217.16942-2-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "df37e3924292fb41d325721008520ba93deced42", "tree": "27ff6b17f0f540c5ecb76be9f18c21be313550bd", "parents": [ "4df4d2a577db2d3d57b888bcfb1206fc74661d16", "6c326a54b0738ec3b2cc89e1da953a3586c6a8c4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:24:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:24:26 2026 -1000" }, "message": "Merge tag \u0027pm-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management updates from Rafael Wysocki:\n \"This time, the most visible part are the ACPI CPPC updates from\n Christian Loehle, including CPPC cpufreq driver changes, even though\n updates of cpufreq drivers proper are still the largest topic group.\n However, the updates of cpufreq drivers depend on the ACPI CPPC\n updates, so they should really be counted together and that is well\n over 1/2 of the total commit count.\n\n Interestingly enough, almost all of the updates included here are\n fixes or cleanups, with some new feature support in the amd-pstate\n cpufreq driver and IPQ9650 support in the qcom-nvmem cpufreq driver.\n The runtime PM documentation improvements from Brian Norris can also\n be mostly regarded as fixes, but a new kunit test goes along with\n them.\n\n Specifics:\n\n - Fix multiple issues related to input validation, synchronization,\n access safety, memory layout and register field validation, and\n error handling in the ACPI CPPC library (Christian Loehle and Sumit\n Gupta)\n\n - Select the frequency-invariance callback per CPU in the CPPC\n cpufreq driver and create the FIE worker before enabling PCC\n callbacks in it to avoid queueing work through a missing worker and\n dereferencing a NULL pointer (Christian Loehle)\n\n - Update the CPPC cpufreq driver entry in MAINTAINERS and add a new\n entry for the ACPI CPPC library (Christian Loehle)\n\n - Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel\n Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,\n Sumeet Pawnikar, and Xueqin Luo)\n\n - Fix wrong behaviors on multi-node servers in the Loongson cpufreq\n driver (Huacai Chen)\n\n - Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet\n Koseoglu)\n\n - Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)\n\n - Fixups for a few bugs identified by Sashiko in the amd-pstate\n cpufreq driver (Mario Limoncielloi, Wentao Guan)\n\n - Initial support for maximum frequency capacity handling on Zen6\n client in amd-pstate (Mario Limonciello)\n\n - Fix for amd-pstate-ut with \u0027Requested CPU Min frequency\u0027 BIOS\n option (K Prateek Nayak)\n\n - New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,\n Vishal Badole)\n\n - amd-pstate documentation fix (Karl Mehltretter)\n\n - Restrict deferred downscaling to low load for shared policies in\n the conservative cpufreq governor to avoid undesirable CPU\n frequency reduction in some cases (Shengming Hu)\n\n - Serialize sugov_start() against rate limit updates in the schedutil\n cpufreq governor to avoid using a stale rate limit value (Hui Su)\n\n - Prevent cpuidle governors menu and teo from returning idle state 0\n after it has been disabled (Xueqin Luo)\n\n - Replace min_t() with the better alternatives in the intel_idle\n driver and make it use 2-argument strscpy() (Andy Shevchenko)\n\n - Fix two repeated phrase instances in cpuidle (Hemanth Selam,\n Syazwina Fazrul)\n\n - Add rugged Panther Lake support to the intel_rapl power capping\n driver and make it use %pe for printing error pointers (Srinivas\n Pandruvada and Sumeet Pawnikar)\n\n - Update and improve runtime PM documentation and add a kunit test\n for supplier idle/suspend (Brian Norris)\n\n - Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()\n to ensure autosuspend disabling on driver teardown (Joshua Crofts)\n\n - Ignore page-zero RAM in E820 checksum during hibernation on x86 to\n avoid rejecting images created after kexec() (Matthias Goergens)\n\n - Add resume event mapping for PMSG_POWEROFF to the PM core to allow\n it to carry out device shutdown in the future (Mario Limonciello)\n\n - Add DPM watchdog to prepare/late/early/noirq/complete phases of\n device suspend and resume (Mayank Rungta)\n\n - Update swsusp.txt references to swsusp.rst in hibernation\n documentation (Li Jun)\n\n - Fix use-after-free of perf domain in netlink doit handlers for\n energy models (Fan Wu)\n\n - Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it\n was removed inadvertently in previous development cycles to avoid\n use-after-free (Bradley Morgan)\n\n - Unregister CPU PM notifier outside the timer lock in the\n timer-ti-dm clocksource driver (Bradley Morgan)\n\n - Fix typo \"sucessfully\" in a comment in pm_clk_add_clk() kerneldoc\n comment and typo \"hierachy\" in a comment in pm-graph (Hemanth\n Selam)\n\n - Fix the return value in dev_pm_opp_get_of_node() kernel-doc (Karl\n Mehltretter)\"\n\n* tag \u0027pm-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (89 commits)\n cpufreq: loongson3: Replace IOCSR read/write with MMIO ones\n cpufreq: loongson3: Use global physical CPU ID in get/target callbacks\n cpufreq: loongson3: Replace per-package mutex with per-node\n cpufreq: loongson3: Adjust the width of id and val in smc_message\n cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64\n PM: runtime: Expand introduction with core concepts and structure\n cpufreq: schedutil: Serialize sugov_start() against rate limit updates\n MAINTAINERS: ACPI: Add a separate CPPC entry\n MAINTAINERS: cpufreq: Replace CPPC reviewer\n arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend\n cpufreq: mediatek: Enter system sleep at the suspend OPP\n cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing\n cpufreq: qcom-nvmem: Add IPQ9650 support\n cpufreq: Add Milos to cpufreq-dt-platdev blocklist\n cpufreq: Use %pe to print error pointers symbolically\n rust: rcpufreq_dt: add module alias\n cpufreq: sti: avoid NULL dereference in dev_err()\n cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv\n cpufreq: sparc-us2e: fix frequency table index copy-paste error\n rust: cpufreq: reject NULL from cpufreq_cpu_get()\n ...\n" }, { "commit": "b5b8c81836e2bec7b444dfa2b14fd14e912e9d63", "tree": "5c64d53c865248cbfe2787ce2380802b520f383c", "parents": [ "9770818b8a92fb5fb77725bd5055f165eee3f52e" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Tue Oct 20 17:21:11 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:24:20 2026 -0700" }, "message": "pppoe: delete session hash entries by pointer match\n\npppoe_connect() copies the requested PPPoE address to a socket before\nattempting to insert the socket into the session hash table. If the\ntuple already exists, __set_item() returns -EALREADY, but the copied\naddress and ifindex remain set on the failed socket.\n\nClosing that socket then deletes the existing socket\u0027s hash entry\nthrough pppoe_release(), preventing it from receiving further session\ntraffic. An unprivileged process in the same network namespace can\ntrigger this through a duplicate connection attempt.\n\nTo avoid the accidental delete, pass the pppox_sock to __delete_item(),\nand unlink only an entry whose pointer matches the requested socket.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nLink: https://patch.msgid.link/20261020092118.47416-1-qingfang.deng@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9770818b8a92fb5fb77725bd5055f165eee3f52e", "tree": "f5ce07edd92a9285e9de9fd61cf2afacd6e56384", "parents": [ "a031ec9ff5a2e55867430e74e9b497fe844116ba" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Tue Oct 20 10:57:27 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:22:07 2026 -0700" }, "message": "net: lan969x: don\u0027t disable hardirqs in fdma tx clear\n\nlan969x_fdma_tx_clear_buf() runs from the NAPI poll and frees the skbs\nof completed tx DCBs with napi_consume_skb(), under sparx5-\u003etx_lock.\n\nBefore this patch, the lock is taken with spin_lock_irqsave(), so the\nskbs are freed with hardirqs disabled. RX skbs are marked for page_pool\nrecycling, so when such an skb is forwarded back out and its tx\ncompletion frees it here, the free path reaches __page_pool_put_page(),\nwhich warns via lockdep_assert_no_hardirq().\n\nTake tx_lock with a plain spin_lock(), as the only other tx_lock user,\nsparx5_port_xmit_impl(), already does. tx_clear_buf() is only called\nfrom softirq context, so disabling hardirqs is not needed.\n\nFound with lockdep enabled (CONFIG_PROVE_LOCKING), which the assert\ndepends on. Reproduced on lan969x by redirecting received frames out of\nanother port with tc mirred.\n\nFixes: d84ad2c0d80c (\"net: lan969x: add FDMA implementation\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261020-lan969x-fdma-tx-clear-irq-v1-1-b9f9d1eda317@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5a3dcad8e101ddcd3a886907c8992df54472f749", "tree": "798f168beec2020cf86dfefe5b145a4b5472b7fc", "parents": [ "13c9735380f1bc0f62c2e41a57d1e651df10ff85" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Tue Oct 20 10:58:58 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:20:58 2026 -0700" }, "message": "net: sparx5/lan969x: do not clobber the PSFP cycle timer update period\n\nsparx5_psfp_init() enables the periodic stream gate cycle timer update,\nwhich keeps the cycle start time of each stream gate within one cycle\ntime of the current time. SG_CT_CLKS sets the update period, in system\nclock cycles.\n\nBefore this patch, the update is enabled with a full register write of\nSG_CT_UPDATE_ENA only, which also sets SG_CT_CLKS to zero. That is below\nthe documented minimum, the number of stream gates (1024 on sparx5 and\n256 on lan969x).\n\nWrite both fields, and set the period to the recommended 10 us,\ncomputed from the core clock since it differs per target (6250 cycles\nat 625 MHz, 3280 at 328 MHz).\n\nFound by an AI code review agent, and confirmed on lan969x and sparx5\nby reading the register back as 0x80000000.\n\nFixes: e116b19db202 (\"net: microchip: sparx5: initialize PSFP\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261020-sparx5-psfp-cycle-timer-v1-1-00f2908f096a@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a031ec9ff5a2e55867430e74e9b497fe844116ba", "tree": "fe5aaa91449314822a52550a3e415a5082f5f233", "parents": [ "b0e4ea3a0cd42eccad9cc4153afcad555480b9e6" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Tue Oct 20 10:58:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:20:28 2026 -0700" }, "message": "net: lan969x: fix DSM calendar for empty taxis\n\nlan969x_dsm_calendar_calc() computes the DSM calendar schedule of one\ntaxi. sparx5_config_dsm_calendar() calls it for each taxi, reusing the\nsame sparx5_calendar_data.\n\nBefore this patch, the schedule is only cleared after the n_devs \u003d\u003d 0\nearly return. For a taxi with no active ports, the function writes\nSPX5_DSM_CAL_EMPTY only to schedule[0] and leaves the remaining slots\nat whatever they held before. For the first taxi that is zero from\nkzalloc(), so sparx5_dsm_cal_len() returns a bogus length and\nsparx5_dsm_calendar_check() fails, which fails the probe:\n\n Port 0: distance 20 above limit 0\n\nA later empty taxi inherits the previous taxi\u0027s schedule instead, which\npasses the check, so only an empty taxi 0 triggers the failure.\n\nClear the full schedule up front on every path, and on the empty path\nplace a single idle marker (SPX5_DSM_CAL_MAX_DEVS_PER_TAXI) in slot 0,\nso the update step sees a calendar length of one and programs one idle\nslot into the hardware, matching what sparx5_dsm_calendar_calc() does.\n\nReported by a customer whose DT enables none of the ports in a taxi.\nReproduced on lan969x by disabling all taxi 0 ports in the DT.\n\nFixes: 5d2ba3941016 (\"net: lan969x: add function for calculating the DSM calendar\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261020-lan969x-dsm-empty-taxi-v1-1-14790f1e7430@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b0e4ea3a0cd42eccad9cc4153afcad555480b9e6", "tree": "c7b58dbc401b8bba41ae83926564382bbcecf53f", "parents": [ "9b8ae9aaa1b8e2b6c1cbf5613d3a37923cf53bc5" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Mon Oct 19 23:15:50 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:14:48 2026 -0700" }, "message": "virtio-net: fix frag overflow in big packets receive\n\nIn big packets mode with guest GSO, add_recvbuf_big() posts a chain of\nMAX_SKB_FRAGS + 1 pages. page_to_skb() copies only ETH_HLEN of the\nfirst page into the linear area and adds the rest of that page as a\nfrag, then one frag per remaining page. A device that fills the entire\nbuffer therefore causes MAX_SKB_FRAGS + 1 frags, writing one\nskb_frag_t past the end of skb_shinfo(skb)-\u003efrags[].\n\nPost one page less. The buffer still fits a maximal GSO packet. A well\nbehaved device does not trigger this, as GSO packets are at most 64KB.\n\nAlso check the frag count in page_to_skb() before adding any frag as\ndefense in depth.\n\nFixes: 9ab86bbcf8be (\"virtio_net: Defer skb allocation in receive path Date: Wed, 13 Jan 2010 12:53:38 -0800\")\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20261020032108.81879-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9b8ae9aaa1b8e2b6c1cbf5613d3a37923cf53bc5", "tree": "4e5e9afd8197ea9aa90638c6b39afd2f210c86d5", "parents": [ "abeacca61eea4f6803df4a595b656ea45c2d3249" ], "author": { "name": "Jijie Shao", "email": "shaojijie@huawei.com", "time": "Fri Oct 16 19:04:21 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:13:07 2026 -0700" }, "message": "net: hibmcge: set netdev_ops before hbg_init() to fix NULL pointer dereference\n\nThe driver assigns netdev_ops after hbg_init(), but hbg_init() calls\nhbg_mdio_init() -\u003e hbg_phy_connect() -\u003e phy_connect_direct() -\u003e\nphy_attach_direct() -\u003e phy_link_topo_add_phy(), which invokes\nnetdev_need_ops_lock(). With CONFIG_NET_SHAPER enabled, this function\ndereferences dev-\u003enetdev_ops-\u003enet_shaper_ops. Since netdev_ops is still\nNULL at this point, a NULL pointer dereference occurs.\n\nMove the netdev_ops assignment before hbg_init() so that\nnetdev_need_ops_lock() can safely access netdev_ops during PHY\nattachment.\n\nThe issue was hit and verified on an evaluation board.\n\nFixes: ff4edac6e9bd (\"net: hibmcge: Implement some .ndo functions\")\nSigned-off-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261016110421.2288670-1-shaojijie@huawei.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "13c9735380f1bc0f62c2e41a57d1e651df10ff85", "tree": "6d62faa56e06002c52799b89ba532643128e10fe", "parents": [ "6acb220312d58cffe6591c6adc90dbfd042cc1af", "4e15e0a941ce901d51b5f203713fa90feee9c4d3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:10:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:11:34 2026 -0700" }, "message": "Merge branch \u0027ionic-fix-port_info-lifetime-bugs\u0027\n\nEric Joyner says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nionic: fix port_info lifetime bugs\n\nTwo fixes for the lifetime of the ionic port_info DMA buffer.\n\nPatch 1 fixes a use-after-free. ionic_port_init() allocates port_info\nonly when the pointer is NULL, but its error path frees the buffer\nunconditionally. On the firmware recovery paths,\nionic_lif_handle_fw_up() and ionic_reset_done(), the buffer belongs to\nan earlier successful init, so a failed PORT_INIT frees it under any\nethtool op that is already reading it. The error path now frees only\nwhat the same call allocated.\n\nPatch 2 (v1 patch 3) fixes a leak of the same buffer when probe fails\nafter the port has been set up.\n\nIssues were discovered by a Sashiko. I tested it on an actual DSC3\n\"Pollara\" with a hacked driver and test kernel to cause both issues.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261015-ionic-port-info-lifetime-v2-0-57232013fd79@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4e15e0a941ce901d51b5f203713fa90feee9c4d3", "tree": "6d62faa56e06002c52799b89ba532643128e10fe", "parents": [ "d90d1a768b3b022c52beafb3a4701ee2ee3d2b5e" ], "author": { "name": "Eric Joyner", "email": "eric.joyner@amd.com", "time": "Thu Oct 15 16:03:31 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:10:54 2026 -0700" }, "message": "ionic: free port_info when probe fails after the port is set up\n\nionic_probe() allocates the port_info DMA buffer via ionic_setup_one()\n-\u003e ionic_port_init(). If probe then fails anywhere after that, it\nunwinds through err_out_pci, which never calls ionic_port_reset();\nionic_dev_teardown() and ionic_clear_pci() do not touch port_info, and\nso the buffer is leaked. The call was lost when the setup code was\nmoved into ionic_setup_one().\n\nSince ionic_remove() already frees the port_info DMA buffer with\nionic_port_reset(), call that on the probe error path too. Every path\nto err_out_pci runs after ionic_setup_one() succeeded, so the BARs are\nstill mapped and the firmware gets a PORT_RESET before the buffer is\nfreed, the same order as in ionic_remove().\n\nFixes: 0de38d9f1dba (\"ionic: extract common bits from ionic_probe\")\nSigned-off-by: Eric Joyner \u003ceric.joyner@amd.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20261015-ionic-port-info-lifetime-v2-2-57232013fd79@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d90d1a768b3b022c52beafb3a4701ee2ee3d2b5e", "tree": "af8d20ae6cb8ede7e063bf8ba1c4d7753fc8c3e6", "parents": [ "6acb220312d58cffe6591c6adc90dbfd042cc1af" ], "author": { "name": "Nikhil P. Rao", "email": "nikhil.rao@amd.com", "time": "Thu Oct 15 16:03:30 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:10:54 2026 -0700" }, "message": "ionic: fix port_info use-after-free on firmware recovery\n\nionic_port_init() allocates port_info when the pointer is NULL, but its\nerror path frees it without checking whether this call allocated it.\nBefore commit ddc5911b9bd2 (\"ionic: call ionic_port_init after\nfw-upgrade\") the function returned early when the buffer already\nexisted, so the two were symmetric.\n\nSince then a failed PORT_INIT on either recovery path - fw_up or\nreset_done - frees a buffer an earlier init owns, while the netdev is\nregistered and the ethtool ops are reading it.\n\nFree only what this call allocated.\n\nFixes: ddc5911b9bd2 (\"ionic: call ionic_port_init after fw-upgrade\")\nSigned-off-by: Nikhil P. Rao \u003cnikhil.rao@amd.com\u003e\nSigned-off-by: Eric Joyner \u003ceric.joyner@amd.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20261015-ionic-port-info-lifetime-v2-1-57232013fd79@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6acb220312d58cffe6591c6adc90dbfd042cc1af", "tree": "5038e885ae9d13f7f070c8bbe60bb33c80e65f3e", "parents": [ "ceb0527b1cda30364473698e5c8ec36371dfdba0" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Mon Oct 19 08:04:30 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:04:16 2026 -0700" }, "message": "net: cpsw: fix netdev cleanup on probe failure\n\nThe legacy CPSW driver registers its netdevs before requesting IRQs. If\na later IRQ request fails in dual-EMAC mode, the probe error path\nunregisters only the primary netdev. Devres then calls free_netdev() on\nthe still-registered secondary netdev, triggering the reg_state BUG_ON.\n\nOnce registered, either interface can queue rx_mode_work through\ndev_set_rx_mode(). The error path does not drain the work before devres\nreleases the netdev and its private data, allowing the worker to access\nfreed memory.\n\nUse the same per-port cleanup for probe failure and remove. Unregister\neach netdev whose reg_state is NETREG_REGISTERED, then drain its\nrx_mode_work. The state check is needed because cpsw_probe_dual_emac()\nstores the secondary pointer before register_netdev() succeeds.\n\nThe workqueue lifetime issue was found during an LLM-assisted review of\nthe 6.12.112-rc1 stable series. Inspecting the same path then exposed\nthe dual-EMAC cleanup bug.\n\nAn instrumented KASAN ARM kernel and a QEMU CPSW probe stub reproduced\nboth failures by forcing the TX IRQ request to return -EBUSY. Not tested\non real hardware.\n\nCc: stable+noautosel@kernel.org # LLM report + LLM fix, untested\nFixes: 070f9c658a59 (\"net: ethernet: ti: cpsw: Push the request_irq function to the end of probe\")\nFixes: 0b8c878d1173 (\"net: cpsw: Execute ndo_set_rx_mode callback in a work queue\")\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Alexander Sverdlin \u003calexander.sverdlin@siemens.com\u003e\nReviewed-by: Siddharth Vadapalli \u003cs-vadapalli@ti.com\u003e\nLink: https://patch.msgid.link/20261019060430.33254-1-kmehltretter@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "ceb0527b1cda30364473698e5c8ec36371dfdba0" }