)]}' { "log": [ { "commit": "d7ff48d92a0f28bc0612da47c054efbc28c19562", "tree": "ebfa3d97a43c26b7f0bf40e80a51ffcab1559d2c", "parents": [ "92ad9cc4e56583e9932e93ddc7f4c508751356ea", "1fdc4164e488916402badddbb1f51e9380dabb91" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:31 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:31 2026 -0400" }, "message": "Merge trace/for-next\n" }, { "commit": "92ad9cc4e56583e9932e93ddc7f4c508751356ea", "tree": "b589aff228f82cdb73014e27cb8b8e360fa8ecf8", "parents": [ "5a0bd05c7f55c7343949f78735dd8593e0fb2cfd", "5ddc4497508a628b6c18653a0d5208edc6228aaf" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:31 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:31 2026 -0400" }, "message": "Merge tools/for-next\n" }, { "commit": "5a0bd05c7f55c7343949f78735dd8593e0fb2cfd", "tree": "ab372ee0c7f1c9e50c5b4b32b350a5a855ff72d4", "parents": [ "8d7f90301113732336232a3800fb5d18f5f4e84c", "5e9bdf2924c9041ff1520b528db6104626e9ef41" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:29 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:29 2026 -0400" }, "message": "Merge rv/for-next\n" }, { "commit": "8d7f90301113732336232a3800fb5d18f5f4e84c", "tree": "b20ac1cc3a4d4ae5adf0857f9447be6b71994da5", "parents": [ "0ded98948cde8802ec8d5ccf0c4d511ceba9bdd3", "453d0f47b174cac387af48d303c503b84f82212e" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:27 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:27 2026 -0400" }, "message": "Merge ring-buffer/for-next\n" }, { "commit": "0ded98948cde8802ec8d5ccf0c4d511ceba9bdd3", "tree": "b9d38468d8da4b4a0eaf2922fd7b8c7cea5ad879", "parents": [ "13d8f2241106d232d8ebd8e34bdb93479dc30693", "677f83795fdfc25ddc51b665a9111f5ff199f7ca" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:25 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Oct 24 07:59:25 2026 -0400" }, "message": "Merge bootconfig/for-next\n" }, { "commit": "1fdc4164e488916402badddbb1f51e9380dabb91", "tree": "820b4c1d245c51f954bf4cd262e7cf37279fab2b", "parents": [ "c0c7c3f9d2e7d9ecc44e536d6f39f44b1faf6044" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Fri Oct 23 10:46:20 2026 -0700" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Oct 23 20:45:16 2026 -0400" }, "message": "tracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()\u0027s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary \u0027!\u0027 tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid \u003d\u003d 1 || common_pid \u003d\u003d 2 \u0026\u0026\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations.\n\nFixes: 80765597bc587 (\"tracing: Rewrite filter logic to be simpler and faster\")\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261023174620.91969-1-kylebot@openai.com\nAssisted-by: Codex:gpt-6-astra\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nTested-by: JongHyuk Kim(MalHyuk) \u003cmalhyuk97@gmail.com\u003e\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c0c7c3f9d2e7d9ecc44e536d6f39f44b1faf6044", "tree": "e275049bbc89ae8d17e869979ce243e351ad0335", "parents": [ "107b87efc8fcd6a597f1b534f116385620770e56" ], "author": { "name": "Haoran Wang", "email": "haoranwangsec@gmail.com", "time": "Fri Oct 16 16:30:00 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Oct 23 13:31:10 2026 -0400" }, "message": "tracing: Guard trace_event_get_offsets() against an empty fields list\n\ntrace_event_get_offsets() dereferences the first entry of the fields list\nreturned by trace_get_fields() via list_first_entry(). list_first_entry()\nthen returns the list head itself, and tail-\u003eoffset + tail-\u003esize reads past\nit. The corrupted result is used as the BPF context-size bound in\n__perf_event_set_bpf_prog():\n\n int off \u003d trace_event_get_offsets(event-\u003etp_event);\n if (prog-\u003eaux-\u003emax_ctx_offset \u003e off)\n return -EACCES;\n\nso a context-reading BPF program that ought to be rejected can instead be\nattached to a zero-field tracepoint (which still carries\nTRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the\ntracepoint fires, bypassing the verifier\u0027s context-size confinement.\n\nThis is reachable through user_events: a user can register an event with no\nfields (e.g. `echo u:my_event \u003e dynamic_events`), which leaves user-\u003efields\nempty while the event remains a BPF-attachable tracepoint,\ntrace_get_fields() then routes through user_event_get_fields() to that\nempty list. The corrupted\nresult after list_first_entry is then used as the BPF context-size bound in\n__perf_event_set_bpf_prog(), which lets context-reading BPF programs attach\nto a zero-field tracepoint when they should be rejected with -EACCES.\n\nAdd list empty check to fix this bug.\n\nLink: https://patch.msgid.link/6ad1f2ca.6048f038.32d739.a530@mx.google.com\nSigned-off-by: Haoran Wang \u003chaoranwangsec@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "107b87efc8fcd6a597f1b534f116385620770e56", "tree": "af6bce2a6482106a821d48eb5c845769c2ed2d66", "parents": [ "f86641ffea95ee6f62d829929a69be7ab1496ce5" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 22 15:33:59 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Oct 23 13:27:24 2026 -0400" }, "message": "cpuidle: haltpoll: Only define guest_halt_poll_ns tracepoint when used\n\nTracepoints that are defined take up around 5K each, even if they are not\nused. When a tracepoint is used only in code when a specific config is\nenabled, their definition must also be only defined when the same config\nis enabled otherwise it wastes memory.\n\nThe tracepoint guest_halt_poll_ns is only used when CONFIG_CPU_IDLE_GOV_HALTPOLL\nis enabled. Guard the definition of that tracepoint with the same config.\n\nLink: https://patch.msgid.link/20261022153359.2433474b@gandalf.local.home\nFixes: 0da11bf0cab90 (\"cpuidle: haltpoll: Add trace points for guest_halt_poll_ns grow/shrink\")\nAcked-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "13d8f2241106d232d8ebd8e34bdb93479dc30693", "tree": "dbec70bffb4340b09f49e399df7d2da96b0d7a00", "parents": [ "4c2e39a19a6eeb795b55cba3722e2b353c53cd2a", "e1f339ff3b83857b93baf8b88186275a413d445e" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Oct 20 08:44:34 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Oct 20 08:44:34 2026 -0400" }, "message": "Merge remote-tracking branch \u0027ftrace/ftrace/for-next\u0027 into trace/merge/for-next\n" }, { "commit": "4c2e39a19a6eeb795b55cba3722e2b353c53cd2a", "tree": "032c420acc2fa5f4e8ee605b14ba368a4a5e0902", "parents": [ "f86641ffea95ee6f62d829929a69be7ab1496ce5", "d4d028a7ae6401ce70825a3eb663f0a2dfc49db6" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Oct 20 08:41:42 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Oct 20 08:41:42 2026 -0400" }, "message": "Merge remote-tracking branch \u0027ftrace/probes/for-next\u0027 into trace/merge/for-next\n" }, { "commit": "f86641ffea95ee6f62d829929a69be7ab1496ce5", "tree": "b9199321db11a4066dcd03fc129bb6e1866a842c", "parents": [ "3403d9bb27ebc3572bd048620746b4414e073bf9" ], "author": { "name": "Adrián García Casado", "email": "adriangarciacasado42@gmail.com", "time": "Mon Oct 19 22:53:44 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Mon Oct 19 20:07:13 2026 -0400" }, "message": "tracing/osnoise: Add __printf attribute to osnoise_print()\n\nBuilding kernel/trace/trace_osnoise.o with W\u003d1 triggers the following\ncompiler warning:\n\n kernel/trace/trace_osnoise.c:96:17: warning: function \u0027osnoise_print\u0027\n might be a candidate for \u0027gnu_printf\u0027 format attribute\n [-Wsuggest-attribute\u003dformat]\n\nosnoise_print() forwards its format string and va_list arguments to\ntrace_array_vprintk(), which is annotated with __printf(3, 0).\n\nAdd the __printf(1, 2) attribute to osnoise_print() to silence the W\u003d1\nwarning and enable compile-time format string checking for its callers.\n\nLink: https://patch.msgid.link/20261019205344.190022-1-adriangarciacasado42@gmail.com\nSigned-off-by: Adrián García Casado \u003cadriangarciacasado42@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "3403d9bb27ebc3572bd048620746b4414e073bf9", "tree": "6e8c8eb02761547a921adaef85dc093a03a48b48", "parents": [ "d5c42664fc094899af9aae5300b27fe8fdb658ef" ], "author": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Mon Oct 19 12:07:29 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Mon Oct 19 10:47:46 2026 -0400" }, "message": "tracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file-\u003eevent_call) and adjust se-\u003eref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event\u0027s\nreference count. If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse-\u003eref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that \u0026se-\u003ecall matches\nfile-\u003eevent_call before adjusting se-\u003eref.\n\nFixes: 4b147936fa50 (\"tracing: Add support for \u0027synthetic\u0027 events\")\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261019120730.2342739-1-lee@kernel.org\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "e1f339ff3b83857b93baf8b88186275a413d445e", "tree": "71536e87f47e71605b3f7548e583628b8b516c86", "parents": [ "c738829502be3f71500b9e70e04f8eee49734d95" ], "author": { "name": "Aaron Ahmed", "email": "aarnahmd@amazon.com", "time": "Fri Oct 16 23:04:03 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Mon Oct 19 10:46:23 2026 -0400" }, "message": "ftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves \u0027modname\u0027 and \u0027offset\u0027 uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, \u0027modname\u0027 holds a garbage\nvalue, passes the \u0027if (modname)\u0027 check, and is dereferenced by\nseq_printf().\n\n Oops: general protection fault\n RIP: 0010:string+0x48/0xe0\n Call Trace:\n vsnprintf+0x1f5/0x650\n seq_printf+0x8e/0xb0\n print_rec+0x6c/0xc0\n t_show+0x4c/0x440\n seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name.\n\nCc: stable@vger.kernel.org\nFixes: b39181f7c690 (\"ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function\")\nLink: https://patch.msgid.link/20261016230403.4916-1-aarnahmd@amazon.com\nTested-by: Gavin Inglis \u003cgiinglis@amazon.com\u003e\nSigned-off-by: Aaron Ahmed \u003caarnahmd@amazon.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c738829502be3f71500b9e70e04f8eee49734d95", "tree": "f0f96070308a8128edba87c0932629bf92c39a37", "parents": [ "6703ab347f4b7c228bbe391dafbe57b1a62b2997" ], "author": { "name": "Jose Fernandez (Anthropic)", "email": "jose.fernandez@linux.dev", "time": "Thu Sep 24 22:35:46 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Mon Oct 19 10:28:11 2026 -0400" }, "message": "ftrace: Let ftrace_call_adjust() reject a patch site\n\nWhen ftrace_call_adjust() returns 0 for a patch site,\nftrace_process_locs() does not skip the site. The NULL test runs before\nthe adjustment since commit 6eeca746fa5f (\"ftrace: Test mcount_loc\naddr before calling ftrace_call_addr()\"), so the 0 is stored as the\nrecord\u0027s ip and ftrace_init_nop() later hits the BUG_ON() in arm64\u0027s\npatch_map(). Test the adjusted address too and count the site as\nskipped.\n\nLink: https://patch.msgid.link/20260924-b4-arm64-callops-kcfi-v2-2-587865b6d991@linux.dev\nReviewed-by: Ben Cressey \u003cben@cressey.dev\u003e\nReviewed-by: Florent Revest (Anthropic) \u003cflorent.revest@linux.dev\u003e\nAssisted-by: LLM\nSigned-off-by: Jose Fernandez (Anthropic) \u003cjose.fernandez@linux.dev\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "6703ab347f4b7c228bbe391dafbe57b1a62b2997", "tree": "be6e8ebed1b18dc27cc4fbe283de27c8226c9fa7", "parents": [ "1054e526ce4e428562b8084f6ee4ef1721a5675c" ], "author": { "name": "Jose Fernandez (Anthropic)", "email": "jose.fernandez@linux.dev", "time": "Thu Sep 24 22:35:45 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Mon Oct 19 10:27:53 2026 -0400" }, "message": "ftrace: Do not leak a module\u0027s empty page group\n\nWhen every mcount_loc entry of a module is skipped,\nftrace_process_locs() leaves the module\u0027s first page group linked\nwith no records. ftrace_release_mod() matches a module\u0027s groups by\nrecords[0].ip, which is 0 here, so the group is never freed. While\nit stays linked, ftrace_free_mem() reads pg-\u003erecords[pg-\u003eindex - 1]\nwith pg-\u003eindex \u003d\u003d 0 on every later module load, as lookup_rec() did\nbefore commit ee92fa443358f (\"ftrace: Fix invalid address access in\nlookup_rec() when index is 0\").\n\nUnlink and free the new page groups when none of them got a record.\n\nLink: https://patch.msgid.link/20260924-b4-arm64-callops-kcfi-v2-1-587865b6d991@linux.dev\nReported-by: sashiko-bot@kernel.org\nCloses: https://lore.kernel.org/all/20260904013350.5141B1F000E9@smtp.kernel.org/\nAssisted-by: LLM\nSigned-off-by: Jose Fernandez (Anthropic) \u003cjose.fernandez@linux.dev\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d5c42664fc094899af9aae5300b27fe8fdb658ef", "tree": "83fd1568449481462331c72ebe9baf78afa30475", "parents": [ "5a6bd62f09147b49b31fd19d4eba122cb5f941a1" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Tue Sep 15 08:47:54 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Oct 16 14:00:46 2026 -0400" }, "message": "tracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data \u003d find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist-\u003ehist_data \u003d hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile \u003d hist_data-\u003efield_var_hists[i]-\u003ehist_data-\u003eevent_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n kfree+0x154/0x420\n event_hist_trigger_free+0x1d5/0x320\n event_hist_trigger_parse+0x35f3/0x69e0\n trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger.\n\nCc: stable@vger.kernel.org\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nLink: https://lore.kernel.org/all/20260914110753.221E61F000FF@smtp.kernel.org/\nLink: https://patch.msgid.link/20260914234754.3676905-1-donggeunyoo.kernel@gmail.com\nFixes: 02205a6752f2 (\"tracing: Add support for \u0027field variables\u0027\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAssisted-by: Claude:claude-fable-5\nAcked-by: Tom Zanussi \u003czanussi@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "5a6bd62f09147b49b31fd19d4eba122cb5f941a1", "tree": "f992db559b382c85ea81f695f154023300255652", "parents": [ "66877a312ae3c2c3d849e82e882f642ffd4ec3e2" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Fri Oct 16 07:16:35 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Oct 16 11:40:17 2026 -0400" }, "message": "tracing: Hold trace_types_lock when resetting last boot data from readers\n\nupdate_last_data_if_empty() is called from tracing_open() with O_TRUNC,\ntracing_read_pipe() and tracing_buffers_read() without trace_types_lock.\nTwo readers can both pass the LAST_BOOT test and free module_delta\ntwice, and a module notifier can update module_delta while it is being\nfreed.\n\nTake trace_types_lock in those paths and keep the callers that already\nhold it on an unlocked variant.\n\nCc: stable@vger.kernel.org\nFixes: 32dc0042528d (\"tracing: Reset last-boot buffers when reading out all cpu buffers\")\nLink: https://patch.msgid.link/20261016061638.214847-2-devnexen@gmail.com\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "66877a312ae3c2c3d849e82e882f642ffd4ec3e2", "tree": "f70b4c731bcff13e48341855a42f78009fb02eef", "parents": [ "097fd0050089df17b032f2b852b9b65e548e342a" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Fri Oct 16 07:16:34 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Oct 16 11:40:05 2026 -0400" }, "message": "tracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array.\n\nCc: stable@vger.kernel.org\nFixes: 5f3719f697c3 (\"tracing: Update modules to persistent instances when loaded\")\nLink: https://patch.msgid.link/20261016061638.214847-1-devnexen@gmail.com\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "097fd0050089df17b032f2b852b9b65e548e342a", "tree": "5481ba957e905eceb0ef290d4f8e0017053e974f", "parents": [ "d3e0dfc1ba49a0ab6aeddbb4bcde4bfc0e171a02" ], "author": { "name": "Haoran Wang", "email": "haoranwangsec@gmail.com", "time": "Fri Oct 16 11:33:13 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Oct 16 11:36:30 2026 -0400" }, "message": "tracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch.\n\nCc: stable@vger.kernel.org\nFixes: baa031b7bd2ce (\"tracing: Allow syscall trace events to read more than one user parameter\")\nLink: https://patch.msgid.link/6ad19afd.a938ce27.16851e.3440@mx.google.com\nSigned-off-by: Haoran Wang \u003chaoranwangsec@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "1054e526ce4e428562b8084f6ee4ef1721a5675c", "tree": "d37c9aeacb666194d8b07c81ec183d2abec6a2e8", "parents": [ "188a5bfd876a46d4e465542683f83079edf537bf" ], "author": { "name": "Yun Zhou", "email": "yun.zhou@windriver.com", "time": "Thu Sep 24 11:01:08 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 20:12:49 2026 -0400" }, "message": "ftrace: Add max field to function profiler stats\n\nThe function profiler (trace_stat/function\u003ccpu\u003e) reports Hit, Time,\nAvg and s^2 per function. Add a \"max\" field recording the maximum\nsingle-call duration, which is valuable for real-time tuning and for\ninvestigating occasional latency spikes.\n\nLike Time/Avg, it honors the graph-time and sleep-time options, so it\nreflects entry-to-return wall-clock latency.\n\nLink: https://patch.msgid.link/20260924030108.2673654-1-yun.zhou@windriver.com\nSigned-off-by: Yun Zhou \u003cyun.zhou@windriver.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d3e0dfc1ba49a0ab6aeddbb4bcde4bfc0e171a02", "tree": "ef25c484bb9d20c232df74e8d742a6560d39b1fd", "parents": [ "443d23176812803d0fa182b8d05ef066a7b8271f" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 17 13:59:18 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 20:06:53 2026 -0400" }, "message": "tracing: Print a signed histogram key as signed\n\nA histogram sorts its rows by the key named in sort\u003d, and for a key over a\nsigned event field it sorts them signed: create_tracing_map_fields() picks\nthe comparison function with\n\n\telse\n\t\tcmp_fn \u003d tracing_map_cmp_num(field-\u003esize,\n\t\t\t\t\t field-\u003eis_signed);\n\nhist_trigger_print_key() does not look at is_signed at all. Every numeric\nkey is printed with %llu, so a sorted histogram over a signed field comes\nout looking unsorted. syscalls/sys_exit_lseek carries \"long ret\", which\nSYSCALL_FIELD() marks signed and which is negative on every error:\n\n # echo \u0027hist:keys\u003dret:sort\u003dret\u0027 \u003e events/syscalls/sys_exit_lseek/trigger\n # echo 1 \u003e events/syscalls/sys_exit_lseek/enable\n # (five lseek(2) calls returning -ESPIPE, -EINVAL, -EBADF, 0 and 100)\n # cat events/syscalls/sys_exit_lseek/hist\n\n { ret: 18446744073709551587 } hitcount: 1\n { ret: 18446744073709551594 } hitcount: 1\n { ret: 18446744073709551607 } hitcount: 1\n { ret: 0 } hitcount: 1\n { ret: 100 } hitcount: 1\n\nThe rows are in ascending order and the numbers are not, because the three\nleading ones are -29, -22 and -9 rendered as their two\u0027s complement.\n\nTake the rendering from the same place the sort order comes from: the event\nfield when the key has one, and the hist_field itself when it does not. The\nsame histogram then reads\n\n { ret: -29 } hitcount: 1\n { ret: -22 } hitcount: 1\n { ret: -9 } hitcount: 1\n { ret: 0 } hitcount: 1\n { ret: 100 } hitcount: 1\n\nA \".buckets\" key stays unsigned here, and not because it is right.\nhist_field_bucket() divides as unsigned, so the group holding S64_MAX also\nholds S64_MIN, reported at\n\n https://lore.kernel.org/all/20260914054614.82A9B1F000FF@smtp.kernel.org/\n\nPrinting that group signed would name a range that does not contain\nS64_MIN, so the grouping has to be fixed with it, in a patch of its own.\n\nLink: https://patch.msgid.link/20260917045918.370993-1-donggeunyoo.kernel@gmail.com\nFixes: 7ef224d1d0e3 (\"tracing: Add \u0027hist\u0027 event trigger command\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "443d23176812803d0fa182b8d05ef066a7b8271f", "tree": "ef52883a8b01a5605b88d5bea098cf9e00067433", "parents": [ "289e2a775de434ccab2d107076bc78362ce288bd" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 17 10:55:32 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 19:59:35 2026 -0400" }, "message": "tracing: Fix 64-bit and signed histogram fields on 32-bit kernels\n\nDEFINE_HIST_FIELD_FN() reads a trace event field and widens it to the u64\nthe histogram uses as a key or a value:\n\n\ttype *addr \u003d (type *)(event + hist_field-\u003efield-\u003eoffset);\n\n\treturn (u64)(unsigned long)*addr;\n\nunsigned long is 32 bits on a 32-bit kernel, so the intermediate cast\ndiscards the upper half of a 64-bit field, and widens a signed field by\nzero extension from 32 bits rather than sign extension from its own\nwidth. Five of the eight instantiations are wrong there: s64, u64, s32,\ns16 and s8.\n\nThe cast came in with commit 79e577cbce4c (\"tracing: Support string type\nkey properly\"), which also added hist_field_dynstring() and\nhist_field_pstring(). Those convert a char * to u64 and do warn without\nan unsigned long in between on 32-bit. DEFINE_HIST_FIELD_FN() converts an\ninteger and never a pointer, so it gains nothing from the cast and only\nloses information.\n\nDrop the intermediate cast and let the usual arithmetic conversions widen\n*addr according to its own type. unsigned long is 64 bits on LP64, so the\ntwo forms are identical there and 64-bit kernels are unaffected.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260917015532.103081-1-donggeunyoo.kernel@gmail.com\nFixes: 79e577cbce4c (\"tracing: Support string type key properly\")\nReported-by: sashiko-bot@kernel.org\nCloses: https://lore.kernel.org/all/20260914054614.82A9B1F000FF@smtp.kernel.org/\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "453d0f47b174cac387af48d303c503b84f82212e", "tree": "31f4dd9adc48ea47848cf7df874c321faf8f2813", "parents": [ "9dce3e2d1fca0298ce5ee3ec7f47d78e2e3f8b78" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Wed Sep 16 20:26:28 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 19:53:48 2026 -0400" }, "message": "ring-buffer: Take cpus_read_lock() when changing the subbuf order\n\nA CPU coming online for the first time gets its per CPU buffer allocated\nby trace_rb_cpu_prepare(), which then adds it to buffer-\u003ecpumask. If that\nhappens while ring_buffer_subbuf_order_set() is running, the CPU shows up\nafter the allocation loop and the install loop walks it with an empty\nnew_pages list, corrupting the buffer.\n\nTake cpus_read_lock() as ring_buffer_resize() does.\n\nCc: stable@vger.kernel.org\nFixes: f9b94daa542a (\"ring-buffer: Set new size of the ring buffer sub page\")\nLink: https://patch.msgid.link/20260916192628.274136-1-devnexen@gmail.com\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nReviewed-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "9dce3e2d1fca0298ce5ee3ec7f47d78e2e3f8b78", "tree": "6cffb523caeaf9fbae8f5d0f29c1f5e2077d2568", "parents": [ "9fd830120fd61ab934aff90361586e65b8dd020d" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Wed Sep 16 16:28:13 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 19:51:42 2026 -0400" }, "message": "ring-buffer: Remove unnecessary cpumask_test_cpu\n\nfor_each_buffer_cpu() already iterates over buffer-\u003ecpumask. Remove the\nunnecessary cpumask_test_cpu() found in ring_buffer_subbuf_order_set().\n\nLink: https://patch.msgid.link/20260916152813.105082-3-vdonnefort@google.com\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "9fd830120fd61ab934aff90361586e65b8dd020d", "tree": "5efaa1c27ddc9015e85d70d045f97f7a5af3e3c4", "parents": [ "20d432b4454b54f32afaaa1b0ac336078c3b6be7" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Wed Sep 16 16:28:12 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 19:51:42 2026 -0400" }, "message": "ring-buffer: Clean up resize_disabled checks\n\nring_buffer_subbuf_order_set() checks for resize_disabled twice under\nthe same buffer-\u003emutex hold. Moreover, this check duplicates the logic\nin ring_buffer_resize(). Create a common helper rb_resize_disabled() to\nfactor out this code.\n\nLink: https://patch.msgid.link/20260916152813.105082-2-vdonnefort@google.com\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "188a5bfd876a46d4e465542683f83079edf537bf", "tree": "80b60ed21ec33837538e870d128629e5aa339c73", "parents": [ "2557f93014d8d3dcab9dda20130412df591fd996" ], "author": { "name": "pengdonglin", "email": "pengdonglin@xiaomi.com", "time": "Wed Sep 16 21:32:18 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:54:49 2026 -0400" }, "message": "tracing: Update funcgraph-retval documentation\n\nThe existing documentation for funcgraph-retval is outdated and partially\nincorrect, as it describes limitations that have now been resolved.\n\nRecent changes (e.g., using BTF to obtain function return types) have\naddressed key issues:\n1. Return values are now printed only for non-void functions.\n2. Values are trimmed to the correct width of the return type, avoiding\n garbage data from high bits.\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Xiaoqin Zhang \u003czhangxiaoqin@xiaomi.com\u003e\nLink: https://patch.msgid.link/20260916133218.1282590-5-dolinux.peng@gmail.com\nSigned-off-by: pengdonglin \u003cpengdonglin@xiaomi.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "2557f93014d8d3dcab9dda20130412df591fd996", "tree": "4b1d6c9b50c53692e46d244bc004909f71cd4bdd", "parents": [ "ba0ec74274944254f266ab118fd4f454a002182f" ], "author": { "name": "pengdonglin", "email": "pengdonglin@xiaomi.com", "time": "Wed Sep 16 21:32:17 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:54:49 2026 -0400" }, "message": "fgraph: Enhance funcgraph-retval with BTF-based type-aware output\n\nThe current funcgraph-retval implementation suffers from two accuracy\nissues:\n\n1. Void-returning functions still print a return value, creating\n misleading noise in the trace output.\n\n2. For functions returning narrower types (e.g., char, short), the\n displayed value can be incorrect because high bits of the register\n may contain undefined data.\n\nThis patch addresses both problems by leveraging BTF to obtain the exact\nreturn type of each traced kernel function. The key changes are:\n\n1. Void function filtering: Functions with void return type no longer\n display any return value in the trace output, eliminating unnecessary\n clutter.\n\n2. Type-aware value formatting: The return value is now properly truncated\n to match the actual width of the return type before being displayed.\n Additionally, the value is formatted according to its type for better\n human readability.\n\nHere is an output comparison:\n\nBefore:\n # perf ftrace -G vfs_read --graph-opts retval\n ...\n 1) | touch_atime() {\n 1) | atime_needs_update() {\n 1) 0.069 us | make_vfsuid(); /* ret\u003d0x0 */\n 1) 0.067 us | make_vfsgid(); /* ret\u003d0x0 */\n 1) | current_time() {\n 1) 0.197 us | ktime_get_coarse_real_ts64_mg(); /* ret\u003d0x187f886aec3ed6f5 */\n 1) 0.352 us | } /* current_time ret\u003d0x69380753 */\n 1) 0.792 us | } /* atime_needs_update ret\u003d0x0 */\n 1) 0.937 us | } /* touch_atime ret\u003d0x0 */\n\nAfter:\n # perf ftrace -G vfs_read --graph-opts retval\n ...\n 2) | touch_atime() {\n 2) | atime_needs_update() {\n 2) 0.070 us | make_vfsuid(); /* ret\u003d0x0 */\n 2) 0.070 us | make_vfsgid(); /* ret\u003d0x0 */\n 2) | current_time() {\n 2) 0.162 us | ktime_get_coarse_real_ts64_mg();\n 2) 0.312 us | } /* current_time ret\u003d0x69380649(trunc) */\n 2) 0.753 us | } /* atime_needs_update ret\u003dfalse */\n 2) 0.899 us | } /* touch_atime */\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Xiaoqin Zhang \u003czhangxiaoqin@xiaomi.com\u003e\nLink: https://patch.msgid.link/20260916133218.1282590-4-dolinux.peng@gmail.com\nSigned-off-by: pengdonglin \u003cpengdonglin@xiaomi.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "ba0ec74274944254f266ab118fd4f454a002182f", "tree": "54dc60c5edfd37cebdb8fa8f054160e5682761a9", "parents": [ "42643ba35deb8ad1821acfc0577b445ee7ad7548" ], "author": { "name": "pengdonglin", "email": "pengdonglin@xiaomi.com", "time": "Wed Sep 16 21:32:16 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:52:53 2026 -0400" }, "message": "ftrace: Build trace_btf.c when CONFIG_DEBUG_INFO_BTF is enabled\n\nThe trace_btf.c file provides BTF helper functions used by the ftrace\nsubsystem. Make the compilation of trace_btf.c solely depend on\nCONFIG_DEBUG_INFO_BTF, allowing features like funcgraph-retval to also\nutilize these helpers.\n\nAdditionally, the redundant dependency on CONFIG_PROBE_EVENTS_BTF_ARGS\nis removed, as CONFIG_DEBUG_INFO_BTF already depends on\nCONFIG_BPF_SYSCALL.\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Xiaoqin Zhang \u003czhangxiaoqin@xiaomi.com\u003e\nLink: https://patch.msgid.link/20260916133218.1282590-3-dolinux.peng@gmail.com\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: pengdonglin \u003cpengdonglin@xiaomi.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "42643ba35deb8ad1821acfc0577b445ee7ad7548", "tree": "e5f0b309b36cb2ae3e7fd7589b44b185a25b01db", "parents": [ "5505be91c9413e52efcb37aea528d5699356e075" ], "author": { "name": "pengdonglin", "email": "pengdonglin@xiaomi.com", "time": "Wed Sep 16 21:32:15 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:52:53 2026 -0400" }, "message": "tracing: Avoid BTF lookup in atomic context\n\nThe function graph trace formatter can be called from ftrace_dump_one()\nwith interrupts disabled. When ftrace_dump_on_oops is enabled, the trace\npanic notifier can reach ftrace_dump() from the panic path, including the\nnmi_panic() path used by the hard lockup detector.\n\nbtf_find_func_proto() calls bpf_find_btf_id(), which may initialize vmlinux\nBTF under a mutex. Skip the BTF lookup when running in an atomic context\nor with interrupts disabled, and fall back to the existing return value\nformatting.\n\nLink: https://patch.msgid.link/20260916133218.1282590-2-dolinux.peng@gmail.com\nFixes: ebeed8d4a555 (\"tracing/probes: Move finding func-proto API and getting func-param API to trace_btf\")\nSigned-off-by: pengdonglin \u003cpengdonglin@xiaomi.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "289e2a775de434ccab2d107076bc78362ce288bd", "tree": "6ef9cd92678f695c18e7e5d426b1c887cedeffec", "parents": [ "91c14d6c13096091c56304120aaa26e479130b8b" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 14 22:23:46 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:44:16 2026 -0400" }, "message": "tracing: Clamp the printed end of a histogram bucket at U64_MAX\n\nA key with the \".buckets\u003dN\" modifier is stored as the start of its bucket,\nand hist_trigger_print_key() prints the range it covers as start to\nstart + N - 1. That addition overflows once the start is within N of\nU64_MAX:\n\n # echo \u0027hist:keys\u003doffset.buckets\u003d10\u0027 \u003e\u003e \\\n events/syscalls/sys_enter_lseek/trigger\n # ./seeker 5 -1 # lseek(0, 5) and lseek(0, -1)\n # cat events/syscalls/sys_enter_lseek/hist\n ...\n { offset: ~ 18446744073709551610-3 } hitcount: 1\n { offset: ~ 0-9 } hitcount: 1\n ...\n\n18446744073709551610 + 10 - 1 does not fit in 64 bits, so the range ends\nbelow where it starts.\n\nThe bucket does end at U64_MAX: it holds every value hist_field_bucket()\nmaps onto its start, and there is no value above U64_MAX. Clamp the printed\nend there. Printed honestly the group is shorter than the size asked for,\nwhich histogram.rst does not mention, so say it there.\n\nLink: https://patch.msgid.link/20260914132346.2234731-1-donggeunyoo.kernel@gmail.com\nFixes: de9a48a360b7 (\"tracing: Add linear buckets to histogram logic\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "91c14d6c13096091c56304120aaa26e479130b8b", "tree": "04c3c230baedf3e4f042502181163287f202167f", "parents": [ "18bb005845b78e0c0eb44b7f231c29d138552438" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 14 19:40:36 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:42:38 2026 -0400" }, "message": "tracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data-\u003efield_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n # echo \u0027hist:keys\u003dpid:ts0\u003dcommon_timestamp.usecs\u0027 \u003e\u003e \\\n events/sched/sched_waking/trigger\n # echo \u0027my_synth u64 lat; int a; int b\u0027 \u003e\u003e synthetic_events\n # echo \u0027hist:keys\u003dnext_pid:wakeup_lat\u003dcommon_timestamp.usecs-$ts0:\\\n onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)\u0027\\\n \u003e\u003e events/sched/sched_switch/trigger\n # cat events/sched/sched_waking/trigger\n hist:keys\u003dpid:vals\u003dhitcount:ts0\u003dcommon_timestamp.usecs:sort\u003dhitcount:size\u003d2048:clock\u003dglobal [active]\n hist:keys\u003dpid:vals\u003dhitcount:synthetic_prio\u003dprio:sort\u003dhitcount:size\u003d2048 [active]\n\nThe second histogram is the one created for \u0027prio\u0027. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260914104036.1768529-1-donggeunyoo.kernel@gmail.com\nFixes: 02205a6752f2 (\"tracing: Add support for \u0027field variables\u0027\")\nReported-by: sashiko-bot@kernel.org\nCloses: https://lore.kernel.org/all/20260913204302.DB2551F000FF@smtp.kernel.org/\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "18bb005845b78e0c0eb44b7f231c29d138552438", "tree": "2bb066b1d37df844308eb617e36d7ba4a7e34614", "parents": [ "c027ed03bc03a0e82fc368eaad657584a4480c7a" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 14 14:34:42 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:40:28 2026 -0400" }, "message": "tracing: Only report the stacktrace modifier on a real field\n\nget_hist_field_flags() returns \"stacktrace\" for any field carrying\nHIST_FIELD_FL_STACKTRACE, including the common_stacktrace pseudo-field,\nwhich has no ftrace_event_field behind it. parse_field() no longer takes\nthe modifier there:\n\n\tif (stack_modifier \u0026\u0026\n\t (!field || field-\u003efilter_type !\u003d FILTER_STACKTRACE)) {\n\t\thist_err(tr, HIST_ERR_BAD_FIELD_MODIFIER, errpos(field_str));\n\nso expr_field_str() renders \"common_stacktrace.stacktrace\", a spelling\nthat cannot be parsed back.\n\nReport the modifier only when there is a field to report it for.\n\nhist_field_print(), the other caller of get_hist_field_flags(), excludes\nHIST_FIELD_FL_STACKTRACE before it calls, so this is confined to\nexpr_field_str(), whose only key renderer arrives in the next patch.\n\nLink: https://patch.msgid.link/20260914053443.981201-4-donggeunyoo.kernel@gmail.com\nFixes: a5e70ba87ca8 (\"tracing: Fix memory corruption from the histogram stacktrace modifier\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c027ed03bc03a0e82fc368eaad657584a4480c7a", "tree": "614e43a9094fdedc9c1a19783717aa7b4dddbd15", "parents": [ "387945e8d2f29fa8a28d219af5416e6d3bedc314" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 14 14:34:41 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:40:28 2026 -0400" }, "message": "tracing: Add the bucket size to expr_field_str()\n\nexpr_field_str() renders a HIST_FIELD_FL_BUCKET field as \"pid.buckets\",\ndropping the count, and parse_field() rejects that spelling.\n\nget_hist_field_flags() returns the bare string \"buckets\" and keeps the\ncount in hist_field-\u003ebuckets. hist_field_print() appends it,\nexpr_field_str() never did. Nothing reaches it today, since .buckets is\nrefused on a value and no expression can carry one, but the next patch\nrenders histogram keys with expr_field_str(), where a .buckets key is\nlegal.\n\nAppend the count, as hist_field_print() does.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260914053443.981201-3-donggeunyoo.kernel@gmail.com\nFixes: de9a48a360b7 (\"tracing: Add linear buckets to histogram logic\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "387945e8d2f29fa8a28d219af5416e6d3bedc314", "tree": "d084f89b71a2cf679b06a2f1809c80c45872e152", "parents": [ "c28bf729dd9c73408fca2645b75c3fda187b11a3" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 14 14:34:40 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:40:28 2026 -0400" }, "message": "tracing: Print the bucket size as unsigned\n\nA key\u0027s bucket size reads back negative once it exceeds LONG_MAX:\n\n # echo \u0027hist:keys\u003dnext_pid.buckets\u003d18446744073709551615\u0027 \u003e trigger\n # cat trigger\n hist:keys\u003dnext_pid.buckets\u003d-1:vals\u003dhitcount:...\n\nparse_field() takes the size with kstrtoul() and rejects only zero, so the\nwhole unsigned long range is accepted and stored, but hist_field_print()\nrenders it with %ld.\n\nPrint it with %lu.\n\nLink: https://patch.msgid.link/20260914053443.981201-2-donggeunyoo.kernel@gmail.com\nFixes: de9a48a360b7 (\"tracing: Add linear buckets to histogram logic\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "20d432b4454b54f32afaaa1b0ac336078c3b6be7", "tree": "2db2badc2a3e96b849890254f5c76ecfa1e0add7", "parents": [ "8acb31975a55e5cf3efc36750dad5d0788ff8bb7" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri Sep 11 20:39:37 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:31:09 2026 -0400" }, "message": "ring-buffer: Unify ring buffer minimum page calculations\n\nThe codebase scatters hardcoded minimum page limits across multiple\nplaces. Introduce RING_BUFFER_MIN_NR_PAGES and rb_calculate_nr_pages()\nto formalize the requirement of two pages in a ring buffer.\n\nLink: https://patch.msgid.link/20260911193937.602202-4-vdonnefort@google.com\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "8acb31975a55e5cf3efc36750dad5d0788ff8bb7", "tree": "01f9c0c89f0a385b17ed34137fdd05c6a81f565a", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Sep 08 09:40:35 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:30:46 2026 -0400" }, "message": "ring-buffer: Add a MAINTAINERS category specific for the tracing ring-buffer\n\nThe ring buffer code in the tracing directory has always been decoupled\nfrom the tracing code. It had a clean abstracted API to allow it to be\nused by systems outside of tracing. The API even allowed the ring buffer\ncode to be drastically changed without affecting the tracing sub-system.\n\nRecently, Vincent Donnefort has been contributing a lot of work to enhance\nthe ring buffer. He implemented the user space mappings and recently\ncreated a version to allow pKVM hypervisors to use the code to trace\nthe hypervisor and expose the events to the user.\n\nCreate a separate category for maintaining the ring buffer code so that\nVincent can become an official maintainer of it. His work has little to do\nwith the tracing code itself. In the future, he may even be the main\nmaintainer of the ring buffer.\n\nLink: https://patch.msgid.link/20260908094035.0b180833@gandalf.local.home\nAcked-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c28bf729dd9c73408fca2645b75c3fda187b11a3", "tree": "6a7b5839a7d1b4578f99cfb132641e44a28d2771", "parents": [ "e41338909f32d48aceaa3058f6b56578e1d0ecf7" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Tue Sep 08 10:09:37 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:28:41 2026 -0400" }, "message": "tracing: Rename tracing_entries_fops to tracing_capacity_fops\n\nSince commit 8a5f63637890 (\"ring-buffer: Fix subbuf resize race with\nring buffer readers\"), \"capacity\" refers to the memory available for\nevents, while \"entries\" refers to the number of events in a ring buffer.\nAs a consequence, rename trace_array::entries to capacity to align with\nthis convention.\n\nWhile at it, rename also tracing_total_entries_fops. It is the aggragate\nof all ring buffer capacities.\n\nLink: https://patch.msgid.link/20260908090937.838544-4-vdonnefort@google.com\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "e41338909f32d48aceaa3058f6b56578e1d0ecf7", "tree": "1ebda0f4693c2ee1af59d4b2da2b40a5e0f2ab00", "parents": [ "4b0c4fb9bc51282e2cf895b838c533f364c2e7a1" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Tue Sep 08 10:09:36 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:28:41 2026 -0400" }, "message": "tracing: Rename trace_array::entries to capacity\n\nSince commit 8a5f63637890 (\"ring-buffer: Fix subbuf resize race with\nring buffer readers\"), \"capacity\" refers to the memory available for\nevents, while \"entries\" refers to the number of events in a ring buffer.\nAs a consequence, rename trace_array::entries to capacity to align with\nthis convention and avoid any confusion.\n\nRename also the helper functions trace_set_buffer_entries and\nupdate_buffer_entries.\n\nLink: https://patch.msgid.link/20260908090937.838544-3-vdonnefort@google.com\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "4b0c4fb9bc51282e2cf895b838c533f364c2e7a1", "tree": "5ff2b43ef78af3e927c1170adae0a9ff92de242b", "parents": [ "084100a1b579e6e08085dfc33caa4df31bb25696" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Tue Sep 08 10:09:35 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:28:41 2026 -0400" }, "message": "ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity()\n\nSince commit 8a5f63637890 (\"ring-buffer: Fix subbuf resize race with\nring buffer readers\"), \"capacity\" refers to the memory available for\nevents (excluding subbuffer headers) while \"size\" refers to the raw\nallocation. ring_buffer_size() actually calculates this event capacity.\nRename it to ring_buffer_capacity() to align with this convention.\n\nLink: https://patch.msgid.link/20260908090937.838544-2-vdonnefort@google.com\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "084100a1b579e6e08085dfc33caa4df31bb25696", "tree": "212d2235c6ea320666264a02f627625dcf1b195a", "parents": [ "d30778dee467f2a54759f90b29019f5aec69abd3" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Tue Sep 08 08:22:21 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:23:35 2026 -0400" }, "message": "tracing: Parse filter from boot event string\n\nMake it possible to specify a trace event filter from the\nkernel command line.\n\nExample:\n\n\ttrace_event\u003dsyscalls:sys_enter_clock_nanosleep:filter:which_clock\u003d\u003d0\n\nLink: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-7-05396a3fb663@linutronix.de\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d30778dee467f2a54759f90b29019f5aec69abd3", "tree": "621acad0c7301fce78f2140cf7ef049c046bbb3d", "parents": [ "cc879c2b6cd8a1114e7d9c2e3df0d4e4cd8bb998" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Tue Sep 08 08:22:20 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:23:35 2026 -0400" }, "message": "tracing: Add a filter argument to __ftrace_set_clr_event()\n\nMake it possible to directly enable a filter when enabling an event.\n\nFor now this is unused, an upcoming patch will wire it up.\n\nLink: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-6-05396a3fb663@linutronix.de\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "cc879c2b6cd8a1114e7d9c2e3df0d4e4cd8bb998", "tree": "8ad1011d9124a897a942276938cdd8a3d4820957", "parents": [ "f572b5d9142774891a98eae21b63b1286dc6e331" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Tue Sep 08 08:22:19 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:23:35 2026 -0400" }, "message": "tracing: Add a test for ftrace_parse_event_string()\n\nThe parsing logic is a bit complicated and about to become more so.\n\nAdd a unit test to avoid regressions.\n\nLink: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-5-05396a3fb663@linutronix.de\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "f572b5d9142774891a98eae21b63b1286dc6e331", "tree": "b4478ee03a906797a93b673c3e675f3e213456b9", "parents": [ "82c9b6a0581f6304fca15cad264a26196e1d40cb" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Tue Sep 08 08:22:18 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:23:35 2026 -0400" }, "message": "tracing: Split the event string parsing logic into a dedicated function\n\nThis new function can be tested with a KUnit test to prevent regressions\nwhen adding new fields to the format.\n\nLink: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-4-05396a3fb663@linutronix.de\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "82c9b6a0581f6304fca15cad264a26196e1d40cb", "tree": "7d861e2fbbdd554e653981d140d08c88473bc8ce", "parents": [ "37a39701f69341ec4b730325a17eddf310cd805d" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Tue Sep 08 08:22:17 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:23:35 2026 -0400" }, "message": "tracing: Stop modifying the input buffer in ftrace_set_clr_event()\n\nftrace_set_clr_event() modifies its input buffer during parsing.\nBefore returning to the caller these modifications are undone.\nThis is restoration is error prone and was forgotten before.\nUpcoming changes will also make it more complicated.\n\nCopy the input argument and modify that copy and drop the\nrestoration logic.\n\nAlso mark the input argument as const.\n\nLink: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-3-05396a3fb663@linutronix.de\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "37a39701f69341ec4b730325a17eddf310cd805d", "tree": "86977f5833e5c587481648bb73910382f860019a", "parents": [ "b16cb6d8040fca3ec38801f6867b830414d9cb68" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Tue Sep 08 08:22:16 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:23:35 2026 -0400" }, "message": "tracing: Remove duplicate declaration of ftrace_set_clr_event()\n\nThe function is also declared in include/linux/trace_events.h which is\neven included from kernel/trace/trace.h.\n\nHaving two declarations creates churn when changing the signature.\n\nRemove the unnecessary, duplicate declaration.\n\nLink: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-2-05396a3fb663@linutronix.de\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "5505be91c9413e52efcb37aea528d5699356e075", "tree": "0ada9871a44d19806a0b400f4301f4aa89d960f1", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Aug 25 19:10:36 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:21:40 2026 -0400" }, "message": "ftrace: Have stacktrace option work with func-args\n\nWhen both the func_stack_trace option is enabled first, the func-args\noption can not be enabled. Same if the func-args option is enabled first,\nthe func_stack_trace option can not be enabled.\n\nAllow the two to work together. The stack trace is already slow and\ntesting the current tracer flags should be in the noise of overhead.\n\nLink: https://patch.msgid.link/20260825191036.11b19036@gandalf.local.home\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b16cb6d8040fca3ec38801f6867b830414d9cb68", "tree": "f33ee210674d9cfa5d612ba11e105d6ae410a368", "parents": [ "7884b0bf098c5f3d23418e94751502f25ebae309" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Aug 21 19:28:22 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:20:30 2026 -0400" }, "message": "tracnig: Add proper error message for glob use with \"within\" filter\n\nIf a user were to use a glob expression with the \"within\" filter, it\ncurrently just fails with an errno return but does not update the\nerror_log to tell the user why it failed. Update it to use the parsing\nerror log to tell the user why it failed.\n\n # echo \u0027within ~ \"*_read\"\u0027 \u003e events/kmem/kmem_cache_alloc/filter\n -bash: echo: write error: Invalid argument\n\n # cat error_log\n [ 4676.606481] event filter parse error: error: \u0027within\u0027 filter cannot take glob expressions\n Command: within ~ \"*_read\"\n ^\n\nLink: https://patch.msgid.link/20260821233050.488131029@kernel.org\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "7884b0bf098c5f3d23418e94751502f25ebae309", "tree": "e8eac24114b9feb53df341c2bec6396a9df11890", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Chen Jun", "email": "chenjun102@huawei.com", "time": "Fri Aug 21 19:28:21 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Oct 15 18:20:30 2026 -0400" }, "message": "tracing: Add \"within\" filter for call-stack-based event filtering\n\nLow-level kernel functions are called from many different paths.\nWhen debugging, it is often useful to filter trace events to only\nthose occurring within a specific call chain.\n\nAdd a \"within\" filter predicate that tests whether a given function\nappears in the current call stack at event time. The function name\nis resolved to its address range via kallsyms during filter setup;\nat runtime, stack_trace_save() captures the call stack and compares\neach return address against the stored range.\n\nExample:\n echo \u0027within \u003d\u003d \"vfs_read\"\u0027 \u003e events/sched/sched_switch/filter\n\nOnly \"\u003d\u003d\" and \"!\u003d\" operators are supported. The filter depends on\nCONFIG_STACKTRACE.\n\nLink: https://patch.msgid.link/20260821233050.335986786@kernel.org\nLink: https://patch.msgid.link/20260608145556.94931-1-chenjun102@huawei.com\nSigned-off-by: Chen Jun \u003cchenjun102@huawei.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d4d028a7ae6401ce70825a3eb663f0a2dfc49db6", "tree": "58ba38047940e665718fcc55b576a2db50e8edc8", "parents": [ "3ccfe2a1a85f3639d770c9efe153ffdc58c60ac1" ], "author": { "name": "Alexander Gordeev", "email": "agordeev@linux.ibm.com", "time": "Tue Aug 25 18:58:40 2026 +0200" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Oct 13 22:37:11 2026 +0900" }, "message": "ftrace/selftests: Change non-unique test symbol to init_once\n\nThe name_show symbol is not the best choise, because it often\nappears only three times on s390 in kallsyms, with two of them\nhaving module annotations [mdev] and [i2c_core].\n\nSwitch to init_once which has many more duplicate instances\nall in vmlinux, making it a more reliable non-unique symbol\nfor testing kprobe registration failure.\n\nLink: https://lore.kernel.org/all/67ac21cd214ec9371276df9ba790e9832cf328d4.1787670777.git.agordeev@linux.ibm.com/\n\nSigned-off-by: Alexander Gordeev \u003cagordeev@linux.ibm.com\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "3ccfe2a1a85f3639d770c9efe153ffdc58c60ac1", "tree": "c8987de3e3d3343317ccf6b18f242cb90cf41aa9", "parents": [ "06e0d3b89da12f24ed5ed434acc8e2cb504f5e4f" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 25 13:12:23 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Mon Oct 12 19:01:56 2026 +0900" }, "message": "tracing/probes: Clarify btf_find_struct_member() container parameter and add kernel-doc\n\nbtf_find_struct_member() returns the containing structure or union type\n(which can be an inner anonymous struct/union rather than the outer\npassed type) via its last parameter. However, the parameter was named\n@member_type, which easily confuses readers and static analyzers into\nthinking it returns the member field\u0027s own datatype.\n\nRename @member_type to @container_type in the prototype, definition,\nand callers to make the relationship explicit. Also convert the comment\nabove btf_find_struct_member() to standard kernel-doc format, documenting\nall parameters and return values.\n\nLink: https://lore.kernel.org/all/179030954365.77418.17193777972248047975.stgit@devnote2/\n\nAssisted-by: LLM\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e" }, { "commit": "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907", "tree": "35e4248213006b8c37f54118790a99b673c84fd9", "parents": [ "d6d3455d8751854e0d1820f14184682e23ac4475" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 20:04:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 20:04:55 2026 -0700" }, "message": "Linux 7.3-rc7\n" }, { "commit": "d6d3455d8751854e0d1820f14184682e23ac4475", "tree": "3107f1b1b6e6a358126d76304bf914f234a0124c", "parents": [ "f47959816751f02a711aab27cf1c805bd4964819", "3d8cc52db2f86b624308321c58513019f6b21eec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:49:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:49:08 2026 -0700" }, "message": "Merge tag \u0027landlock-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock fix from Mickaël Salaün:\n \"This fixes a Clang bug by removing an annotation, which was introduced\n mostly for documentation\"\n\n* tag \u0027landlock-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Drop __counted_by from landlock_domain.handled_masks\n" }, { "commit": "f47959816751f02a711aab27cf1c805bd4964819", "tree": "83d3dedf60510bf1b1d1fa632d7f847b51ff715a", "parents": [ "5906f156e8818d29839d7d7280b691f627b59883", "00765a3467b992d0eb56704a28887256317eb4bd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:33:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:33:26 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A small collection of driver specific fixes, plus a new device ID in\n the DesignWare device tree binding.\n\n One of the sg2044 fixes which enforces clock limits properly is more\n critical than average since getting them wrong might lead to data\n corruption\"\n\n* tag \u0027spi-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi\n spi: sg2044-nor: Honor SPI clock limits\n spi: sg2044-nor: Return transfer errors\n spi: cadence-qspi: Fix status polling with octal DTR chips\n spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock\n" }, { "commit": "5906f156e8818d29839d7d7280b691f627b59883", "tree": "f53ccc2f9524159381015fe343e8768b2be80065", "parents": [ "d5b6dc381db93ff2d1888f7d99c06e0bd85f4083", "28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:28:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:28:36 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"There\u0027s a couple of core fixes here: there were a couple of issues\n with of_regulator_bulk_get_all() not behaving consistently with the\n other bulk regulator APIs which caused memory leaks and error handling\n issues in users.\n\n We also have a couple of fairly standard driver specific fixes\"\n\n* tag \u0027regulator-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: ltc3676: don\u0027t read the write-only HRST and CLIRQ registers\n regulator: of: state who owns the array from of_regulator_bulk_get_all()\n regulator: of: fill in supply names in of_regulator_bulk_get_all()\n regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4\n" }, { "commit": "d5b6dc381db93ff2d1888f7d99c06e0bd85f4083", "tree": "428c10f5bd4c1c345642d4b48943fb2318e83b95", "parents": [ "4375b45d7060a6a3f41e14a9181c5c913ea474a4", "469fa055664bfd8717b087a80d59c03055789c17" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:23:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:23:19 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Driver (and tape media changer) only fixes. Three of the fixes are\n about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO)\n but the unsafe MMIO is the least obvious logic change\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ\n scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()\n scsi: ch: Do not keep references to data transfer element devices\n scsi: ufs: mediatek: Handle mPHY power-on failures\n scsi: qedi: Initialize callback state before registration\n scsi: ufs: core: Hold a clock reference across the probe\n" }, { "commit": "4375b45d7060a6a3f41e14a9181c5c913ea474a4", "tree": "265c34a6704ac644eb104ea06490fd357f3f9937", "parents": [ "b7c0316c1a062dbadd0d62f1b796dd3264915242", "41cab3a71dc7be62114d91cc849424879062d324" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:00:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:00:33 2026 -0700" }, "message": "Merge tag \u0027block-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - Fix swapped ZRASF zone state values for full and read only\n - nvme-multipath revalidate head zones after unfreezing the head\n queue\n - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\",\n which broke things\n - nvmet fixes for invalid NSIDs on feature 82h and using the local\n P2P device on metadata allocation failure\n\n - zloop: zero out only the unread tail of a short read\n\n* tag \u0027block-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"\n zloop: zero out only the unread tail of short reads\n nvmet: use the local P2P device on metadata allocation failure\n nvme-multipath: revalidate head zones after unfreezing the head queue\n nvme: fix swapped ZRASF zone state values for full and read only\n nvmet: return Invalid Field for invalid NSIDs feature 82h\n" }, { "commit": "3d8cc52db2f86b624308321c58513019f6b21eec", "tree": "b45592a5161df6fc99a2beaa872744a9b2bcebc4", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Nguyen Ngoc Thang", "email": "ngocthang2710.1999@gmail.com", "time": "Sat Oct 10 23:44:49 2026 +0700" }, "committer": { "name": "Mickaël Salaün", "email": "mic@digikod.net", "time": "Sun Oct 11 17:54:21 2026 +0200" }, "message": "landlock: Drop __counted_by from landlock_domain.handled_masks\n\nWith clang 22 and CONFIG_FORTIFY_SOURCE, the second\nlandlock_restrict_self() call hits a bogus fortify report in\ninherit_ruleset():\n\n memcpy: detected buffer overflow: 4 byte write of buffer size 0\n Call Trace:\n __fortify_panic\n landlock_merge_ruleset\n __se_sys_landlock_restrict_self\n\nhandled_masks[] lives in an anonymous struct inside the anonymous union\nthat overlays work_free. For such a flexible array, clang computes the\naddress of the __counted_by counter as the start of the array instead of\n\u0026num_layers. The bound is then read from handled_masks[0], i.e. from\nthe first layer\u0027s access masks, which is not a count. The same layout\ncrashes clang itself in a standalone test.\n\nThe annotation was added as documentation, so drop it rather than\nrestructure the union. Keep the information in the member comment.\n\nReported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003da0eecb22de4d821a9e5d\nFixes: bd3a19800dd1 (\"landlock: Add counted_by in landlock_domain\")\nSigned-off-by: Nguyen Ngoc Thang \u003cngocthang2710.1999@gmail.com\u003e\nLink: https://lore.kernel.org/r/20261010164450.194439-1-ngocthang2710.1999@gmail.com\nReviewed-by: Günther Noack \u003cgnoack3000@gmail.com\u003e\nReported-by: Konrad Dybcio \u003ckonrad.dybcio@oss.qualcomm.com\u003e\nReported-by: Mike Bommarito \u003cmichael.bommarito@gmail.com\u003e\nCloses: https://lore.kernel.org/r/20261009115108.17819-1-michael.bommarito@gmail.com\n[mic: Rebased on master, where the array is handled_masks[], updated the\nfortify report, added the clang bug link and the other reports]\nSigned-off-by: Mickaël Salaün \u003cmic@digikod.net\u003e\n" }, { "commit": "b7c0316c1a062dbadd0d62f1b796dd3264915242", "tree": "4027fdac2db753c97e0778eccd854367b4322e50", "parents": [ "5f97a3ec36a1c2c9e4847eaf1b071707792b9035", "fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:53:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:53:11 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Don\u0027t spin on local work the exiting task can\u0027t run.\n\n For a ring still R_DISABLED when the task got its tctx node, the\n submitter is set later and may be another task, so DEFER_TASKRUN\n local work stays pending forever and the exiting task spins in\n do_exit().\n\n - Don\u0027t charge the SQ/CQ rings or provided buffer rings to\n RLIMIT_MEMLOCK. The region API conversion started charging them,\n which the rings had been exempt from.\n\n - Don\u0027t exempt disabled rings from task restrictions on register\n\n - Populate the CONNECT filter fields for a 24-byte sockaddr_in6\n\n* tag \u0027io_uring-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/cancel: don\u0027t spin on local work the task can\u0027t run\n io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n io_uring/register: don\u0027t exempt disabled rings from task restrictions\n io_uring/kbuf: don\u0027t charge provided buffer rings to RLIMIT_MEMLOCK\n io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK\n" }, { "commit": "5f97a3ec36a1c2c9e4847eaf1b071707792b9035", "tree": "0c617b328e3352aa83e0e7b0c2bbe1f9e713f509", "parents": [ "4d61397c866eb1ae656c39fa9f28766e4388776b", "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:34:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:34:34 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"This fixes a data corruption vector where a user could trick the\n exchange-range feature to add shared blocks beyond the file\u0027s EOF,\n which may then be used to modify data on another file\"\n\n* tag \u0027xfs-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: fix exchange-range-to-eof file size exchange\n xfs: stop exchanging reflink flags when exchanging mappings\n" }, { "commit": "4d61397c866eb1ae656c39fa9f28766e4388776b", "tree": "1a1aeecffd604e64e156b122da3b8776bdfac9b4", "parents": [ "b2d929a1c2a887dd046e0af2d4a06dbf4e7d87a6", "87db7795cbaaf636ae22ae031f4906db7bb77803" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:23:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:23:06 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-10-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Work around AMD TLBI Erratum #1718 (Borislav Petkov)\n\n* tag \u0027x86-urgent-2026-10-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/CPU/AMD: Fix AMD TLBI Erratum #1718\n" }, { "commit": "b2d929a1c2a887dd046e0af2d4a06dbf4e7d87a6", "tree": "14f01a6ab6f0cb190206c1f3936392ae775da7b0", "parents": [ "b88c841d11641923fa3a4da011d7202cd89df68a", "d4f25b097e46d82718bb737d4540c99b7ab0a408" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:13:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:13:52 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"Several security fixes, a significant strnlen() regression fix, and\n several other miscellaneous fixes:\n\n - Fix a regression in the Zbb-enabled strnlen() implementation when\n huge counts are specified\n\n - When userspace pointer masking is enabled, strip the tag from\n user-specified pointers in two spots in the RISC-V futex code where\n this was missing\n\n - When CONFIG_SHADOW_CALL_STACK\u003dy, use a supervisor mode-only CSR bit\n to determine whether the trap came from userspace or not, rather\n than a userspace-writable register\n\n - Reset the HSTATUS.HU bit during CPU initialization to avoid\n unexpected behavior, as the RISC-V specification does not require\n this bit to be hardware-reset\n\n - Fix the T-Head GhostWrite probing code when\n !CONFIG_ERRATA_THEAD_MAE\n\n - Fix RV32 boots using 32-bit.config by constraining NR_CPUS\n\n - Implement a workaround for SiFive MAL-9092, which requires fences\n around hypervisor load/store instructions\n\n - Fix the RISC-V patch_map() code to work properly for EXECMEM\n addresses when !CONFIG_STRICT_MODULE_RWX\n\n - Fix ptrace register set access reporting when CFI landing pad or\n shadow stack support is enabled\n\n - Avoid copying garbage into the target\u0027s vstate when\n PTRACE_SETREGSET is called with a short iov_len\n\n - Fix load_unaligned_zeropad() on RV32 kernels with\n CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS\u003dy\n\n - Fix build breakage for any userspace program that includes\n uapi/asm/vendor/mips.h\n\n - Fix a build warning for 32-bit allmodconfig builds related to\n SiFive errata\n\n - Fix misspecified inline assembly constraints in the vector context\n save/restore code\"\n\n* tag \u0027riscv-for-linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: fix load_unaligned_zeropad() fixup for RV32\n riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\n riscv: ptrace: Zero-initialize regset buffers before copyin\n riscv: ptrace: reject CFI regset access when extensions are absent\n riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds\n riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n riscv: futex: untag the user pointer before the atomic access\n riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts\n riscv: patch: fix handling of bpf-jit execmem addresses\n RISC-V: Clear HSTATUS.HU on CPU initialization\n RISC-V: errata: Add SiFive MAL-9092 workaround\n riscv: vector: Fix output operands in context save\n riscv: vector: Fix data pointer constraints in context save/restore\n riscv: limit sifive errata to CONFIG_64BIT\n riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header\n" }, { "commit": "b88c841d11641923fa3a4da011d7202cd89df68a", "tree": "5c9cec398cc29997a149322823efd5733187d8e8", "parents": [ "a5ebb76233b79db01e82e061173cb73c6d2b5c6b", "41363c27b8509bd4efcba244803edac9ba25d1b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:10:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:10:43 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - A fix for the ati_remote2 sysfs attributes handling, resolving type\n confusion after conversion to dev_groups\n\n - Updates to the xpad joystick driver adding support for the Corsair\n Novablade Pro controller (wired and 2.4 GHz wireless) and a newer\n hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox.\n\n* tag \u0027input-for-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox\n Input: xpad - add support for Corsair Novablade Pro\n Input: ati_remote2 - fix type confusion in device attribute handlers\n" }, { "commit": "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9", "tree": "8f7329cadc94d2d2e9a3e8d78ec27bd53fcf54cb", "parents": [ "d84d6c1a7f1e2de9e601703a326a4c1b7b421943" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Wed Oct 07 10:02:27 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sun Oct 11 08:23:43 2026 +0200" }, "message": "xfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE\u0027s TO_EOF flag. The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what\u0027s going wrong:\n\n\u003e Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n\u003e that gets rewritten and file1 is the one that ends up with the flag\n\u003e cleared.\n\u003e\n\u003e Start, nothing shared:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [201] [202]\n\u003e\tdonor1 size 4096 -\u003e [300]\n\u003e\tdonor2 size 4096 -\u003e [400]\n\u003e\n\u003e 1. FICLONERANGE peer\u0027s block into file1\u0027s middle slot:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [100] [202] reflink flag set\n\u003e ^^^^^ both files own block 100\n\u003e\n\u003e 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n\u003e file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n\u003e are exchanged with it:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [200] [100] [300] reflink flag set\n\u003e ^^^^^^^^^^^ still owned, now past the size\n\u003e\tdonor1 size 12288 -\u003e [202]\n\u003e\n\u003e file1 says it is one block long while it still owns three. Nothing was\n\u003e unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n\u003e\n\u003e 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n\u003e By i_disk_size this is two one-block files exchanging everything, so\n\u003e xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [400] [100] [300] reflink flag CLEARED\n\u003e\tdonor2 size 4096 -\u003e [200]\n\u003e\n\u003e Block 100 is still shared with peer.\n\u003e\n\u003e 4. pwrite(file1, 4096, 4096), which is file1\u0027s second slot, block 100.\n\u003e xfs_is_cow_inode(file1) is false, so no CoW:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100] same block, new contents\n\u003e\n\u003e Block 100 is the only one that matters here. PoC below, it reads a file\n\u003e called peer in the current directory. The filesystem needs reflink and\n\u003e exchange-range, which mkfs.xfs 7.x turns on by default.\n\nSo yes, TO_EOF is screwing up the file size even if it\u0027s actually\nexchanging the data block correctly. The following is the intended\nbehavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:\n\n\"Ignore the length parameter. All bytes in file1_fd from file1_offset\n to EOF are moved to file2_fd, and file2\u0027s size is set to\n (file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in\n file2 from file2_offset to EOF are moved to file1 and file1\u0027s size is\n set to (file1_offset+(file2_length-file2_offset)).\"\n\nIn other words, if we only exchange a portion of the file data, then we\nshould only exchange the portion of the file size that relates to the\nexchanged data. Unfortunately, the code swaps the ondisk file size and\nthe incore file sizes, which is incorrect if the caller passes in a\nnonzero offset.\n\nHaving confused the file sizes, the PoC uses a second exchange-range\ncall on what looks like a non-reflinked single-block file. Because the\nfile size is set incorrectly, exchange-range thinks it\u0027s exchanging the\nfull contents of two files and clears the reflink flag on the broken\nfile. That enables an extending write of the broken file to rewrite the\nshared block that\u0027s just past EOF. This has become known colloquially\nas refluxfs.\n\nOnce the file sizes are set correctly, the second exchange-range no\nlonger thinks that it\u0027s doing a full-contents swap, so it won\u0027t clear\nthe reflink flag on either of its file arguments.\n\nNorbert followed up to an earlier version of this patch with a second\ncomplaint about us not handling the i_disk_size state correctly:\n\n\u003e The offsets are bounded against the incore i_size but subtracted from\n\u003e the ondisk i_disk_size, so a file that has not been written back gives\n\u003e xmi_isize1 \u003d 0 + (0 - 12288).\n\u003e\n\u003e For instance, you can do:\n\u003e\n\u003e $ xfs_io -f -c \"pwrite -q 0 4096\" -c fsync file1\n\u003e $ xfs_io -f -c \"pwrite -q 0 12288\" \\\n\u003e -c \"exchangerange -s 0 -d 12288 file1\" dirty\n\u003e $ stat -c %s file1\n\u003e 0\n\u003e $ stat -c %i file1\n\u003e 131\n\u003e $ sudo xfs_io -r -c \"bulkstat_single 131\" . | grep bs_size\n\u003e bs_size \u003d 18446744073709539328\n\nThat\u0027s wrong, and the new file size update logic depends on the ondisk\ni_disk_size matching the incore i_size, so flush the pagecache as needed\nto push it upwards.\n\nLink: https://lore.kernel.org/linux-xfs/1E196589-DEBE-40AC-AFEA-D420DAAB067F@doyensec.com/\nReported-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nCc: stable@vger.kernel.org # v6.10\nFixes: 966ceafc7a4371 (\"xfs: create deferred log items for file mapping exchanges\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "d84d6c1a7f1e2de9e601703a326a4c1b7b421943", "tree": "12c73b8337b4b875fd3565ce858cbbc0cc217a55", "parents": [ "a5ebb76233b79db01e82e061173cb73c6d2b5c6b" ], "author": { "name": "Norbert Szetei", "email": "norbert@doyensec.com", "time": "Wed Oct 07 16:43:22 2026 +0200" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sun Oct 11 08:23:38 2026 +0200" }, "message": "xfs: stop exchanging reflink flags when exchanging mappings\n\nWhen an exchange covers both files from offset 0 to i_disk_size,\nxmi_can_exchange_reflink_flags() assumes every mapping moved and hands\nthe reflink flag over to the other file.\n\nThat assumption is wrong. A file can still own shared blocks past\ni_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size\nwithout unmapping anything. The flag is cleared anyway, and the next\nwrite to such a block happens in place instead of CoW, corrupting the\nother file that shares it.\n\nCommit a23eca88448e (\"xfs: fix exchange-range reflink flag clearing\nissue with INO1_WRITTEN\") fixed one instance of this. Rather than add\nanother special case, stop moving the flags.\nxfs_exchmaps_ensure_reflink() already sets the flag on both inodes\nbefore the exchange, so both just keep it.\n\nNothing sets CLEAR_INO{1,2}_REFLINK anymore. Intents logged by older\nkernels may still carry them; recovery already masks them off, so they\nstay in the log format mask and are ignored.\n\nXFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from\none inode to the other along with the extents. Just removing that is\nnot enough here: the exchange path flags both inodes up front in\nxfs_exchmaps_ensure_reflink(), but swapext has no such step, so the\ninode receiving the shared extents would be left without the flag.\nSet it on both inodes instead, and make sure both have a CoW fork,\nsince an inode with the reflink flag is expected to have one.\n\nThe flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a\ntruncate to zero removes it.\n\nFixes: 966ceafc7a43 (\"xfs: create deferred log items for file mapping exchanges\")\nFixes: f0bc4d134b46 (\"xfs: swap inode reflink flags when swapping inode extents\")\nCc: stable@vger.kernel.org # v6.10\nAssisted-by: LLM\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "677f83795fdfc25ddc51b665a9111f5ff199f7ca", "tree": "3b6ecb9e22570698fbf20adcf7543218d07e921a", "parents": [ "e84e60da22ea2fb48576d8d78def44fab677374e" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 23:13:33 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Sun Oct 11 10:33:40 2026 +0900" }, "message": "bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h\n\nBOOTCONFIG_FOOTER_SIZE was defined locally in tools/bootconfig/main.c.\nMove it to include/linux/bootconfig.h so that it can be shared with\nthe kernel and user-space tools. Also, use it in init/main.c instead\nof the hardcoded (BOOTCONFIG_MAGIC_LEN + 8) expression when checking\nthe initrd size.\n\nLink: https://lore.kernel.org/all/178913601321.248794.4786502771058559887.stgit@devnote2/\n\nSuggested-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\n\n" }, { "commit": "e84e60da22ea2fb48576d8d78def44fab677374e", "tree": "d407a5677a676697c61fd1c24de46c598d20f46c", "parents": [ "78715511921cc8f331a2de79655f9850a71ae48c" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 23:13:24 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Sun Oct 11 10:33:40 2026 +0900" }, "message": "bootconfig: Skip internal tree sanity checks in kernel\n\nIn xbc_verify_tree(), the loop iterating through all nodes to check that\nxbc_nodes[i].next \u003c xbc_node_num and xbc_nodes[i].child \u003c xbc_node_num\nis a defensive sanity check against implementation regressions (such\nan out-of-bounds index cannot be produced by malformed input).\n\nRunning this check in the kernel adds unnecessary boot-time overhead.\nSplit this check out into xbc_sanity_check_tree() for userspace, so\nthat it continues to run during userspace bootconfig validation (e.g.\nwhen applying or testing bootconfig with tools/bootconfig), but is\nomitted in the kernel to speed up initialization.\n\nLink: https://lore.kernel.org/all/178913600409.248794.12941798680046327623.stgit@devnote2/\n\nReported-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nCloses: https://lore.kernel.org/all/20260905141637.1547429-1-ekffu200098@gmail.com/\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e" }, { "commit": "78715511921cc8f331a2de79655f9850a71ae48c", "tree": "1a27bb4d3550715ef8cae1cc0d424377e31ad6bb", "parents": [ "fac634087ad85d2c6845cf3ead4fbf520274ca49" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 23:13:15 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Sun Oct 11 10:33:40 2026 +0900" }, "message": "tools/bootconfig: Consolidate xbc_init() to error message wrapper\n\nUse init_xbc_with_error() for all bootconfig initialization in the\nbootconfig tool instead of showing errors in different way.\n\nThis simplifies the code logic and make it easy to maintain.\n\nLink: https://lore.kernel.org/all/178913599508.248794.10388592925402087434.stgit@devnote2/\n\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e" }, { "commit": "fac634087ad85d2c6845cf3ead4fbf520274ca49", "tree": "5abc06fff475194496a11842638331b0d93e6612", "parents": [ "958c01049e0a81a02370c9fce50670cda8478b1b" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 23:13:06 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Sun Oct 11 10:29:43 2026 +0900" }, "message": "bootconfig: Reject unexpected data after null character\n\nIf a bootconfig buffer contains an intermediate null character in the\nmiddle of the configuration, xbc_parse_tree() stops at the null character\nbecause string delimiter searches (e.g. strpbrk()) stop at \u0027\\0\u0027, and\ncleanly breaks out of the loop without error. As a result, any\nconfiguration data following the intermediate null character is silently\nignored, allowing unparsed or potentially malicious data to be hidden\nafter an early termination.\n\nFix this in xbc_parse_tree() by checking that no non-null data remains\nbetween the parser termination point and the end of the input buffer.\nTrailing null characters (such as alignment padding in initrd) continue\nto be accepted as valid.\n\nAlso update apply_xbc() in tools/bootconfig/main.c to calculate the\nbuffer size based on the loaded file size rather than strlen(), so that\nfiles with intermediate null characters are not truncated before\nvalidation.\n\nLink: https://lore.kernel.org/all/178913598628.248794.1048773774471250986.stgit@devnote2/\n\nAssisted-by: LLM\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\n" }, { "commit": "958c01049e0a81a02370c9fce50670cda8478b1b", "tree": "2c3577ccfbd8d3a292df5deb958987c532e65d38", "parents": [ "6dc993d4520fdaa083c8871e5fee443117d87057" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 04 00:23:15 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Sun Oct 11 09:07:10 2026 +0900" }, "message": "bootconfig: Skip printing early params to cmdline from bootconfig\n\nIf user configures `kernel.key` in bootconfig, the \u0027key\u0027 is shown\nin kernel cmdline (/proc/cmdline) and kernel boot parameter\nhandler associated with \u0027key\u0027 is invoked. However, since the\nbootconfig does not support the parameter defined with early_param,\nthose keys are shown in \u0027/proc/cmdline\u0027 but not handled by kernel.\n\nThis could easily mislead users who expected to be able to specify\nearly parameters via the boot configuration, leading them to wonder\nwhy it doesn\u0027t work.\n\nLet\u0027s skip printing out early params to cmdline buffer, and warn\nif there is such parameters in bootconfig.\n\nLink: https://lore.kernel.org/all/178844899530.263905.7707547252181797215.stgit@devnote2/\n\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e" }, { "commit": "a5ebb76233b79db01e82e061173cb73c6d2b5c6b", "tree": "b493225b8e2a8f99a4a25b51c1879b0b544f4aea", "parents": [ "bb934c29fda8dcd409145a0deddc1a8095fec930", "7484bc43ba6b8e189b482db5b75e7842890a82b1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:57:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:57:30 2026 -0700" }, "message": "Merge tag \u0027edac_urgent_for_v7.3_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fix from Borislav Petkov:\n\n - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND\n MSR to only two bits. It is perfectly fine to do so because no system\n ever supported more than 2 bits of information (the Chip Selects used\n were only 4 maximum) and newer hardware will use only 2 bits anyway\n\n* tag \u0027edac_urgent_for_v7.3_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/amd64: Mask UMC chip select to the four implemented selects\n" }, { "commit": "bb934c29fda8dcd409145a0deddc1a8095fec930", "tree": "5832030025fae27d15bdf8999ea7fdb61f2a8725", "parents": [ "b62f58bd7187ddbefa66913ec742137680ca5b22", "c61e23ed14359e6289c08e55940dd3401fe27db0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:50:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:50:50 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-10-11\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Ailie:\n \"Live from Dublin Airport, it\u0027s Saturday Night drm fixes.\n\n This week has the missing misc fixes from last week which I tracked\n down and seemed to be a race/bug in my lei setup somehow, once I asked\n lei to ignore it\u0027s cache I got the missing email. But there are more\n misc fixes this week and amd and intel ones.\n\n The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and\n imagination in the middle, with a bunch of small single fixes.\n\n Bit busier than I\u0027d like, but the missing misc might explain it,\n anyways time for me to fly home.\n\n fb:\n - defer setup when fbdev_probe() fails, not just on -EAGAIN\n\n bridge:\n - Fix unlocked list_del in drm_bridge_add()\n - Fix unlocked list access in drm_bridge_attach()\n - th1520-dw-hdmi:\n - Fix error check on dw_hdmi_probe() return value\n - Fix remove() callback\n\n aspeed:\n - Balance the display clock enable on teardown\n\n i915:\n - Fix a GT park race that could trigger spurious RPM wakelock\n warnings\n - Fix execbuffer relocation cleanup to avoid out-of-bounds free\n\n xe:\n - i2c removal\n - system Controller Maibox header handling\n - two bo pin/unpin accounting bugs\n - not emitting a w/a twice\n - xe_mmio_wait32() to honor delay/sleep maximums\n\n amdgpu:\n - Fix direct scanout alpha on some DRM_FORMATs\n - UserQ fixes\n - Fix tearing flips with PSR\n - GPU reset vblank fix\n - Debugfs register interface fix\n - Fix display mode patching\n - Expand Mac reserved memory workaround\n\n amdkfd:\n - SDMA doorbell fix\n - Fix dma-buf reference leak in error path\n\n imagination:\n - fix reference and vm_bo handling in remap()\n - size page table preallocation by device address\n\n gud:\n - don\u0027t keep a connector without a CRTC as connector_state\n\n panthor:\n - validate userspace queue count against initialized firmware\n slot count\n\n nouveau:\n - fix null ptr regression\n - skip turing CE workaround for non-GR\n\n vmwgfx:\n - validate pitch value\n - add blend mode property\n\n vc4:\n - drain hangcheck timer on unbind\n - free BO cache on teardown\n - use kvmalloc_objs for bo cache size list\n - disable V3D interrupt across runtime suspend\n - fix binner slot allocation\n - fix fw refcount leak\"\n\n* tag \u0027drm-fixes-2026-10-11\u0027 of https://gitlab.freedesktop.org/drm/kernel: (39 commits)\n drm/nouveau: Skip the Turing CE workaround object for non-GR channels\n drm/vc4: Fix binner slot allocation failing on an idle GPU\n drm/vc4: Disable the V3D interrupt across runtime suspend\n drm/imagination: Size page table preallocation by device address\n drm/imagination: Fix reference and vm_bo handling in remap()\n drm/amdgpu: make Mac FB workaround generic\n drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info\n drm/amd/display: Don\u0027t replace a sink mode that shares the native totals\n drm/amdkfd: align SDMA doorbell base for shader doorbell writes\n drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks\n drm/amdgpu: serialize vblank counter reads against GPU reset\n drm/amd/display: disable self-refresh on tearing flips\n drm/amdgpu/userq: return the memdup_user() error for the user MQD\n drm/amdgpu/userq: only accept doorbell BOs as queue doorbell\n drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs\n drm/xe/i2c: cancel the client work on remove\n drm/xe/sysctrl: Fix mailbox header handling\n drm/i915/gt: Unmask interrupts only when ACTIVE is true\n drm/i915/gem: Prevent overstepping exec array boundary\n drm/gud: don\u0027t keep a connector without a CRTC as connector_state\n ...\n" }, { "commit": "b62f58bd7187ddbefa66913ec742137680ca5b22", "tree": "c50cd93252da977d70acd0d5aaec92ac4b52c558", "parents": [ "3857c2fe5449541e24afc5efdb0f81a8a8f9a3a0", "ae8364085574203e7f4ea961921a1c7493bcb6de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:41:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:41:28 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fix from Andi Shyti:\n \"Just one qcom-geni fix for a runtime PM reference leak\n during transfer setup\"\n\n* tag \u0027i2c-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: qcom-geni: release runtime PM reference when set_rate fails\n" }, { "commit": "c61e23ed14359e6289c08e55940dd3401fe27db0", "tree": "4daa2c2a5b8cedb6661b37d5caf224ca932e860a", "parents": [ "492c4ded0ff7c7f162f35eea37984db5b0f2b5ba", "6ccf996a0dec1852dab94ad865f27b4904750e12" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:57:56 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:58:03 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-10-09\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA pointer assignment fix for gud, a reference fix and a preallocation\nsize fix for imagination, a suspend fix and an allocation fix when idle\nfor vc4, and a hardware variant fix for nouveau.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cself@mripard.dev\u003e\nLink: https://patch.msgid.link/asjkbknTHg2t8JGy@houat\n" }, { "commit": "492c4ded0ff7c7f162f35eea37984db5b0f2b5ba", "tree": "c8223877f505461ca772e6d8071d0d58f7c66a2c", "parents": [ "a8013cbe8d403051aae151f9e35e5f3c8af89a02", "c7f44ec5c4ec760e74351f1843dcb8322f67cbf6" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:53:22 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:57:33 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-10-08\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-10-08:\n\namdgpu:\n- Fix direct scanout alpha on some DRM_FORMATs\n- UserQ fixes\n- Fix tearing flips with PSR\n- GPU reset vblank fix\n- Debugfs register interface fix\n- Fix display mode patching\n- Expand Mac reserved memory workaround\n\namdkfd:\n- SDMA doorbell fix\n- Fix dma-buf reference leak in error path\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com\n" }, { "commit": "a8013cbe8d403051aae151f9e35e5f3c8af89a02", "tree": "8f8fb8b8a41b99f6fba07efdcd146c3289f5dd9c", "parents": [ "5a768f5f76d8833b02b00f99d246cba6c463760b", "611857adc9e7b0ee1239a0baf38498922ca5a12e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:47:12 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:47:37 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-10-08\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nFixes on:\n - i2c removal (Fan)\n - system Controller Maibox header handling (Mallesh)\n - two bo pin/unpin accounting bugs (Thomas)\n - not emitting a w/a twice (Tvrtko)\n - xe_mmio_wait32() to honor delay/sleep maximums (Alan)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com\n" }, { "commit": "3857c2fe5449541e24afc5efdb0f81a8a8f9a3a0", "tree": "9274ea2a042a38c82b47be3b6db224da687aa17d", "parents": [ "b71ccf604fbdf78450d3b17b5d69365caba29061", "79c168e2aa957ed0054c93db17caba653b95e377" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:30:04 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:30:04 2026 +0200" }, "message": "Merge tag \u0027pci-v7.3-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fix from Bjorn Helgaas:\n \"This fixes some GPU initialization regressions caused by eddba19b8b5f\n (\"PCI/AER: Support Advisory Non-Fatal Errors\"), which appeared in\n v7.3-rc1.\n\n That commit also caused a MacBookPro16,1 spontaneous power-off\n regression; I expect a fix for that next week\"\n\n* tag \u0027pci-v7.3-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI/AER: Skip error recovery on false alarms\n" }, { "commit": "b71ccf604fbdf78450d3b17b5d69365caba29061", "tree": "b4920555f63456258e849269d5425044e5fd90fd", "parents": [ "f7bec60381da152e110bb71358c0903f9bc1826e", "c96ca94425b076dc398d929366e378d1e22ec794" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:26:56 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:26:56 2026 +0200" }, "message": "Merge tag \u0027mmc-v7.3-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC/MEMSTICK fixes from Ulf Hansson:\n \"MMC host:\n - cavium-octeon|thunderx: Destroy slot platform devices on remove\n - mtk-sd: Cancel request timeout work on remove\n - sdhci-sprd: Disable runtime PM on remove\n\n MEMSTICK:\n - Wait for request completion before freeing card\n - rtsx_usb_ms: Complete requests after eject instead of dropping\n them\"\n\n* tag \u0027mmc-v7.3-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n memstick: rtsx_usb_ms: complete requests after eject instead of dropping them\n memstick: core: wait for request completion before freeing card\n mmc: cavium-thunderx: destroy slot platform devices on remove\n mmc: cavium-octeon: destroy slot platform devices on remove\n mmc: sdhci-sprd: disable runtime PM on remove\n mmc: mtk-sd: Cancel request timeout work on remove\n" }, { "commit": "f7bec60381da152e110bb71358c0903f9bc1826e", "tree": "ab8d8ad8e7ea4ff8067e499e817ffc3cd13c6c7b", "parents": [ "5f6ee187fa3a7b3cee4b9dae6c3dda6d1d3237db", "2579cbe68005f46fc7f8f95364f6b101b07b9d1c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:22:38 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:22:38 2026 +0200" }, "message": "Merge tag \u0027media/v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fix from Mauro Carvalho Chehab:\n \"A fix for em28xx unregister code affecting devices with FM radio\n support\"\n\n* tag \u0027media/v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: em28xx: use video_unregister_device for radio_dev\n" }, { "commit": "5f6ee187fa3a7b3cee4b9dae6c3dda6d1d3237db", "tree": "e81727e07120fe8efa9a65952edf53ddfee75032", "parents": [ "9a06d4b7c5feedea819a00af0db1629e43f3def4", "07c75552f7fe636a0695baae506a7d72fabd3be4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:20:08 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:20:08 2026 +0200" }, "message": "Merge tag \u0027sound-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A dozen of small fixes. All device-specific quirks or fixes, and\n nothing exciting is expected.\n\n - USB-audio and HD-audio quirks\n\n - HD-audio TAS2781 codec fix\n\n - ctxfi driver memory leak fix\n\n - ASoC AMD quirks\n\n - ASoC cs35l56 and adau1372 codec fixes\"\n\n* tag \u0027sound-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts\n ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA\n ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI\n ASoC: cs35l56: Add DAI for SDCA OT25 stream\n ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM\n ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes\n ASoC: adau1372: allow sleepy powerdown GPIOs\n ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)\n ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)\n ALSA: hda/tas2781: Accept V1 calibration data without CRC\n ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H\n ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers\n" }, { "commit": "9a06d4b7c5feedea819a00af0db1629e43f3def4", "tree": "1a85684baabf1cc57052ba5c94a1fe0fcff002f3", "parents": [ "c8d4256f1081c191773de9f46e2ad8f5e8d05d30", "4c66c423593e26273ea0d644906ed007630c6f6d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:57:46 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:57:46 2026 +0200" }, "message": "Merge tag \u0027pmdomain-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain provider fixes from Ulf Hansson:\n\n - imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl\n\n - rockchip: Fix a couple of errors during probe\n\n* tag \u0027pmdomain-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: rockchip: don\u0027t ignore clock lookup errors on attach\n pmdomain: rockchip: fix clock leak on domain probe failure\n pmdomain: rockchip: propagate subdomain add errors\n pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains\n" }, { "commit": "c8d4256f1081c191773de9f46e2ad8f5e8d05d30", "tree": "a0a4249505eef08cf3f6680574c2bb3fd3564e29", "parents": [ "fc1c25014ff8e416d75e8a5ba3b9c0ba5eb8e877", "911655ab1dfb9d526978a75df3b210132620d30a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:49:55 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:49:55 2026 +0200" }, "message": "Merge tag \u0027dma-mapping-7.3-2026-10-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two more fixes for the corner cases in the DMA-mapping SWIOTLB code\n (Peng Fan and Marek Szyprowski)\"\n\n* tag \u0027dma-mapping-7.3-2026-10-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n swiotlb: fix default_swiotlb_limit() for non-growable default pool\n iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys\n" }, { "commit": "fc1c25014ff8e416d75e8a5ba3b9c0ba5eb8e877", "tree": "310c6faafceb48f403d54f97831dcb1ac0796c06", "parents": [ "f99005fbed4e8071110faa350cc5fa453afa1455", "e58c3805ed325fe2d4ae2dd467c0486cc860b733" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:01:12 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:01:12 2026 +0200" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity fix from Eric Biggers:\n \"Fix a regression from commit f77f281b6118 (\"fsverity: use a hashtable\n to find the fsverity_info\")\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n fsverity: RCU-delay the freeing of struct fsverity_info\n" }, { "commit": "f99005fbed4e8071110faa350cc5fa453afa1455", "tree": "2e5e41e0cadba5b7c961a82a7c17d00439bf0751", "parents": [ "9515f634dbed2bb8928fbb3b01102dd4e64f4aeb", "3d399224425573875b6f6f1181bd8cf9a28cc7d1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:37:44 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:37:44 2026 +0200" }, "message": "Merge tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n \"This contains fixes for the current development cycle.\n\n All of them came out of a review of the mount code that started with a\n bug report. The review modeled the corner cases of mount propagation,\n unmounting and mount reference counting and turned up a lot of bugs.\n Most of them years old. Most fixes come with a selftest.\n\n - Rework connected mounts.\n\n A mount that is unmounted together with its parent can stay\n attached to the parent to keep its mountpoint covered. That happens\n when the mountpoint is removed with rmdir(), unlink() or rename(),\n when a detached tree is dissolved, and for locked mounts in any\n umount that isn\u0027t synchronous, including the teardown of their\n mount namespace. The parent then owns the child and drops it on its\n own final mntput(). So any reference from the child\u0027s superblock\n back to one of its ancestors becomes a cycle that is never freed.\n\n A loop device backed by an image on a tmpfs and mounted on that\n same tmpfs is enough. Remove the directory the tmpfs is mounted on\n from the host, let the container\u0027s mount namespace exit, and the\n loop device, the tmpfs and the filesystem on the loop device are\n leaked for good. The same works with autofs, zram, ecryptfs,\n binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md,\n and the selftests have reproducers for them. This has been possible\n since v4.1. It is also why \"put_mnt_ns(): leave mounts connected\"\n was reverted in -rc5. Keeping every mount of a dying mount\n namespace connected made these cycles trivial to create.\n\n Every unmounted mount is now detached from its parent. Where the\n mountpoint has to stay covered the mount leaves a cover on the\n parent instead, allocated together with the mount. A lookup on the\n unmounted parent that hits a cover finds an empty immutable\n directory or file on the private nullfs instance. Nothing leads\n from a cover to another mount, so no unmounted mount owns another\n one and no cycle can form.\n\n This is visible to userspace. A formerly connected mount can no\n longer be reached through its unmounted parent and \"..\" inside it\n leads nowhere, as for every other lazily unmounted mount.\n\n With that the private nullfs instance becomes reachable from\n userspace, so it now refuses mounts on top, is mounted read-only,\n and refuses fsnotify marks and file locks. Its inodes are shared by\n every holder and a watch or a lock would otherwise reach across\n users. may_decode_fh() now also decides its subtree check under a\n single mount_lock hold, as a racing umount could otherwise let it\n decode into what a locked child covered.\n\n - umount:\n\n * Don\u0027t silently unmount busy mounts.\n\n Since v4.13 propagate_umount() takes down propagated copies of\n the victim with children as long as each child is an overmount or\n another copy of the victim, but propagate_mount_busy() only ever\n checked copies without children or with just an overmount. A\n container that moved a tree beneath its copy of a host mount lost\n that tree from under its open file descriptor to a plain umount()\n on the host. propagate_mount_busy() now applies the same rules,\n walking each chain of copies once.\n\n * Don\u0027t let a migrating task hide its reference from umount().\n\n mnt_get_count() sums the per-cpu counters under mount_lock but\n the mntget() and mntput() fast paths don\u0027t take it. A task that\n takes a reference on a cpu the sum has already passed and drops\n it after migrating to one the sum hasn\u0027t reached yet hides the\n reference it held to begin with, and umount() succeeds with the\n file still open. Gets and puts now live in separate per-cpu\n counters and all puts are summed before all gets with a full\n barrier in between, the way srcu_readers_active_idx_check() does\n it. mntget() is unchanged and mntput() gains an smp_wmb().\n\n * Check each submount for references right before unmounting it.\n\n shrink_submounts() and mark_mounts_for_expiry() checked all their\n victims up front. Unmounting the first could move a busy\n overmount to where the next victim\u0027s propagated copy is looked up\n and it was then unmounted without a check.\n\n * Never expire a locked mount.\n\n A shrinkable mount moved beneath a locked mount with\n MOVE_MOUNT_BENEATH takes over the lock, and umount() of an\n unlocked ancestor expired it and revealed what it covered. That\n umount() now fails with EBUSY as it does for any other locked\n child. A lazy umount still takes the whole tree.\n\n - Overmounts and locked mounts:\n\n * Unhash a dentry before detaching the mounts on it.\n\n unlink(), rmdir() and rename() detach the mounts on the victim\n but only d_delete() it once its inode is unlocked, a window that\n includes an expedited RCU grace period. In between, a lookup from\n a mount namespace in which the dentry is a mountpoint found it\n hashed, positive and uncovered. Drop the dentry first, as\n d_invalidate() already does.\n\n * Don\u0027t reveal overmounted entries in refwalk.\n\n A refwalk that had grabbed the dentry before the unlink never\n rechecked it the way rcuwalk does with d_seq and mount_lock.\n Without any artificial widening three walkers read the covered\n file 27 times in a minute. step_into() now fails an unhashed\n dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is\n retried.\n\n * Keep covered mounts covered in OPEN_TREE_NAMESPACE.\n\n Creating such a mount namespace only takes a user namespace and\n the copy followed bind mount rules: no children without\n AT_RECURSIVE and no unbindable mounts with it. An unprivileged\n user could see what mounts covered in the source, such as the\n parts of /proc and /sys that container runtimes mask. If the\n caller doesn\u0027t own the source mount namespace a non-recursive\n copy of a mount with something mounted below the requested\n directory is now refused and a recursive copy includes unbindable\n mounts, the way unshare() copies.\n\n * Keep the lock on a mount that a propagated copy is moved beneath.\n\n MNT_LOCKED moved to any mount that ended up beneath a locked\n mount, propagated copies included. A host mount and umount on a\n directory covered by a locked mount in a less privileged mount\n namespace left that cover unlocked for the namespace\u0027s owner to\n remove. Only mounts the caller places beneath take over the lock\n now.\n\n * Handle mount locking for automounts correctly. Which copies to\n lock was decided by the mount namespace of the task that\n triggered the automount. A task in a user namespace that\n triggered one on a host mount through a file descriptor got the\n host\u0027s own automount locked while its own copy stayed unlocked\n and could have nosuid, nodev and noexec cleared. Use the owner of\n the mount namespace the mount lands in.\n\n - Use-after-free and crashes:\n\n * Refuse an automount below a mount that is in no namespace.\n\n The private clones overlayfs uses for its layers have the\n MNT_NS_INTERNAL error pointer as their namespace, which\n finish_automount() let through and count_mounts() dereferenced. A\n fanotify filesystem mark on an overlayfs lower layer hands out\n file descriptors on such a clone. With debugfs as the lower layer\n opening \"tracing\" oopses with namespace_sem held for writing and\n every mount operation on the system blocks from then on.\n\n * Reset the old parent\u0027s -\u003eovermount in mnt_change_mountpoint().\n When propagate_umount() moved an overmount off a mount that a\n file descriptor kept alive, MOVE_MOUNT_BENEATH through that\n descriptor later followed the stale pointer into the freed\n overmount.\n\n * statmount() with STATMOUNT_BY_FD and pivot_root() read the parent\n of a mount that may be unmounted and only held by a file\n descriptor, while the parent\u0027s final mntput() can free it.\n statmount() now reads it under mount_lock and pivot_root() first\n checks that both mounts are in the caller\u0027s mount namespace.\n\n * Queue a mount only once for mount notifications. A mount\n reparented by one umount_tree() and taken down by the next under\n the same namespace_sem hold, as in shrink_submounts(), was queued\n twice. That cut the mounts queued in between out of notify_list\n while it still pointed at them, and once they were freed every\n later mount operation walked freed memory.\n\n * Don\u0027t let a pseudo dentry become the root of a mount. A bind\n mount of a bpf token file did that with a DCACHE_NORCU dentry,\n which is freed without an RCU grace period while lockless path\n walks may still look at it. Refuse to clone such a mount.\n\n * Don\u0027t inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily\n unmounted nsfs or pidfs mount through its file descriptor started\n out flagged as unmounted. Among other things __detach_mounts()\n then dropped the namespace\u0027s reference on it, the mount outlived\n its namespace and mount_setattr() through the descriptor read the\n freed namespace. A recursive bind mount of such a mount also\n copied the unmounted stack still attached to it. That now fails\n with EINVAL, copying the mount itself still works.\n\n * Remove the fsnotify marks of a mount namespace in free_mnt_ns()\n instead of the RCU callback that frees the namespace, where\n taking the group mutexes meant sleeping in softirq context.\n\n - Propagation and copies:\n\n * Keep a copied mount unbindable. Since v6.17 clone_mnt() didn\u0027t\n copy the unbindable flag, so every mount namespace created with\n CLONE_NEWNS had bindable copies of all unbindable mounts. This\n had been fixed once before.\n\n * Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the\n mount an unbindable slave, a state nothing else can produce, or\n silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE\n after restoring sharing and isn\u0027t affected.\n\n * Check a recursive bind mount for mount namespace loops.\n\n Recursively bind mounting a tree from another mount namespace\n could put a mount of a namespace\u0027s file inside that same\n namespace, which then pins itself and all its mounts. Repeating\n it leaks without limit, the reproducer took Shmem from 380 kB to\n 65916 kB. The copy is now checked with check_for_nsfs_mounts()\n before it is grafted, as move_mount() does.\n\n * Look at the topmost mount for a mount namespace file.\n\n attach_recursive_mnt() never looked at the topmost mount of the\n source\u0027s chain of overmounts. If that was the chain\u0027s only mount\n namespace file an existing mount at a propagated destination got\n buried below the root of the nsfs file where no path walk reaches\n it.\n\n * Don\u0027t put a mountpoint on a dentry that\u0027s being removed.\n\n attach_recursive_mnt() makes a mountpoint of the source\u0027s root\n without its inode lock, so a racing rmdir() of that directory\n could leave a mount on it that nothing ever detaches.\n d_set_mounted() now checks cant_mount() as well.\n\n - nullfs:\n\n * Take no inode lock for readdir of an immutable directory.\n\n The root of every empty mount namespace is the same nullfs\n directory and iterate_dir() held its i_rwsem across\n -\u003eiterate_shared(). A reader whose buffer faults on a FUSE mount\n of its own holds it for as long as its server wants, and with an\n exclusive locker queued behind it every lookup that misses the\n dcache, every create and every mount in that directory waits. One\n user of an empty mount namespace stalls all others. Directories\n with the new FOP_IMMUTABLE flag skip the lock.\n\n * Refuse to reconfigure internal superblocks through fspick(),\n MS_REMOUNT or the read-only remount that a synchronous umount()\n of the root does. For nullfs only root in the initial user\n namespace could do it, but the superblock is shared by every\n mount namespace and the flags showed up in statfs() for all of\n them.\n\n * Don\u0027t update the access time on nullfs and refuse F_SET_RW_HINT\n on an immutable inode.\n\n - unshare: Free an nsproxy that was never installed with\n nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped\n active references that were never taken, which triggered a warning\n and hid the caller\u0027s own namespaces from listns().\n\n - Smaller changes: mount_setattr() checks the target before it walks\n the tree to allocate peer group ids, unshare() puts the old\n fs_struct before the old namespaces, dissolve_on_fput() drops the\n file\u0027s reference to the tree itself, disconnect_mount() is\n simplified and the documentation of the propagated unmount rule is\n brought up to date\"\n\n* tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits)\n namespace: simplify disconnect_mount()\n selftests/filesystems: test covered mounts\n namespace: rework connected mounts\n nullfs: add an empty immutable regular file\n selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody\n selftests/filesystems: add a helper that holds a readdir in a page fault\n readdir: take no inode lock on an immutable directory\n nullfs: refuse file locks\n fsnotify: let a filesystem refuse marks on its objects\n namespace: nothing is mounted on or written through knullfs\n namespace: keep the private nullfs instance in knullfs\n fhandle: decide the subtree check under mount_lock\n selftests/filesystems: check that an automount below an overlay layer is refused\n selftests/filesystems: check the atime of the empty mount namespace root\n selftests/filesystems: check that a lock lands on the right mount and stays\n namespace: keep the lock on a mount that a propagated copy is moved beneath\n namespace: never expire a locked mount\n nullfs: don\u0027t update the access time\n namespace: handle mount locking for automounts correctly\n namespace: refuse an automount below a mount that is in no namespace\n ...\n" }, { "commit": "9515f634dbed2bb8928fbb3b01102dd4e64f4aeb", "tree": "0d1f379dc24d0d6a54716680535b3f62006f6fab", "parents": [ "af32da41b0327b9c6a37856ba82b6760d6c8d10e", "a9cd14bfb0c113f1cd77be4349784663bec71bb4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:32:55 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:32:55 2026 +0200" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"It finally seems to have calmed down on the arm64 fixes front, so\n please pull these two straightforward fixes for -rc7. One fixes the\n EL2 trap configuration for implementation-defined CPU PMU hardware\n during boot and the other fixes a kcov selftest failure by excluding\n our softirq early entry code:\n\n - Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU\n\n - Fix kcov boot selftest failure by excluding our early IRQ entry\n code\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: irq: exclude the softirq stack switch from KCOV\n arm64/boot: Don\u0027t set PMUv3p9 FGT2 bits without PMUv3\n" }, { "commit": "41363c27b8509bd4efcba244803edac9ba25d1b5", "tree": "b0369d2b5d7f86d94d8994b118ca0af194668798", "parents": [ "f9282b8aa85a8c97c50d656db75feb6d76fc7cbe" ], "author": { "name": "Bihaan Sen", "email": "stevewholikesthings@gmail.com", "time": "Fri Sep 25 17:14:38 2026 +0530" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:19:05 2026 -0700" }, "message": "Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox\n\nThe 8BitDo Pro 2 Wired Controller for Xbox is already matched by the\nvendor-wide XPAD_XBOXONE_VENDOR(0x2dc8) entry, but a later hardware\nrevision reports product ID 0x201e, which has no entry in the\nxpad_device table. The device therefore binds and functions but is\nexposed to userspace as \"Generic X-Box pad\".\n\nAdd the VID/PID pair so the controller is named correctly, and set\nMAP_SHARE_BUTTON to expose the share button as KEY_RECORD.\n\nSigned-off-by: Bihaan Sen \u003cstevewholikesthings@gmail.com\u003e\nLink: https://patch.msgid.link/20260925114459.110253-1-stevewholikesthings@gmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f9282b8aa85a8c97c50d656db75feb6d76fc7cbe", "tree": "7a5e79c3ff12c16f15021e19a187459d54dcc1b8", "parents": [ "f321cc430c49b6c1be0d53f2ef19d8342d8029cc" ], "author": { "name": "Krzysztof Furman", "email": "krisfur@proton.me", "time": "Fri Oct 09 15:47:10 2026 +0100" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:15:35 2026 -0700" }, "message": "Input: xpad - add support for Corsair Novablade Pro\n\nAdd device IDs for the Corsair Novablade Pro leverless fight controller\nin both wired (0x2b1f) and 2.4 GHz receiver (0x2b2b) modes, and add\nCorsair\u0027s vendor ID to the Xbox 360 vendor match list.\n\nOutside of its PS4/PS5 modes the controller uses the Xbox 360 protocol\n(vendor-specific class, subclass 93, protocol 1) on interface 0, which\nxpad does not currently bind, so no gamepad device is created. The\nPS4/PS5 modes present a standard HID gamepad and already work with\nhid-generic.\n\nTested on 7.2.5 with the 2.4 GHz receiver and wired.\n\nAssisted-by: Claude Opus 5.5\nSigned-off-by: Krzysztof Furman \u003ckrisfur@proton.me\u003e\nLink: https://patch.msgid.link/20261009-xpad-corsair-novablade-v1-1-e58746bef99f@proton.me\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f321cc430c49b6c1be0d53f2ef19d8342d8029cc", "tree": "eb5dd4fd022b53887e9eabed4d1cb7c91b568d23", "parents": [ "3bf8d603fd45649c106cae6290a10f20b1bbb569" ], "author": { "name": "Haotian Zhang", "email": "vulab@iscas.ac.cn", "time": "Fri Oct 09 10:48:25 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 10:58:35 2026 -0700" }, "message": "Input: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data.\n\nFixes: b20d6bf8014b (\"Input: ati-remote2 - use driver core to instantiate device attributes\")\nAssisted-by: DeepSeek-V4.1-Flash\nSigned-off-by: Haotian Zhang \u003cvulab@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20261009040302.3087205-1-vulab@iscas.ac.cn\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7", "tree": "b1379df89b350034d5593dc13d2355dd7675a684", "parents": [ "aa5d5f8e502318e783545ba5d04bb40130b83e20" ], "author": { "name": "Cen Zhang (Microsoft Security FORGE Labs)", "email": "cenzhang@linux.microsoft.com", "time": "Thu Oct 08 15:16:02 2026 -0400" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:33:09 2026 -0600" }, "message": "io_uring/cancel: don\u0027t spin on local work the task can\u0027t run\n\nio_uring_cancel_generic() refuses to sleep while any ring on the exiting\ntask\u0027s tctx has local work pending. It assumes the task is that ring\u0027s\nsubmitter and that the next io_uring_try_cancel_requests() pass will run\nthe work. This does not hold for a ring that was still\nIORING_SETUP_R_DISABLED when the task got its tctx node from\nio_uring_create() or io_ringfd_register(). The submitter is set later by\nIORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the\nsubmitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To\nthe exiting task the work stays pending forever, the loop never reaches\nschedule(), and the task trips the WARN_ON_ONCE() once and then spins in\ndo_exit().\n\nAn unprivileged user can set this up at will by creating a disabled\nring, having a child enable it and stop, posting to the ring with\nIORING_OP_MSG_RING and exiting with a request in flight that only the\nchild can complete. The exiting thread burns a CPU until the child runs\nor dies, and with panic_on_warn set the WARN panics the kernel.\n\nFix by skipping the sleep only when io_allowed_defer_tw_run() allows the\ntask to run the work. This is reasonable since work it cannot run cannot\ncomplete any of its requests either, so nothing is lost by sleeping.\nDrop the WARN_ON_ONCE() since handing a disabled ring to another thread\nis a supported scenario, not a bug state.\n\nFixes: 360cd42c4e95 (\"io_uring: optimise io_req_local_work_add\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nSigned-off-by: Cen Zhang (Microsoft Security FORGE Labs) \u003ccenzhang@linux.microsoft.com\u003e\nLink: https://patch.msgid.link/20261008191602.45101-1-cenzhang@linux.microsoft.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "aa5d5f8e502318e783545ba5d04bb40130b83e20", "tree": "67c6256f0e53e7a056e8240e01f87bf773f5d16c", "parents": [ "6da8f402e362b2f546e2efb7167fc9597aef6faf" ], "author": { "name": "Natasha Klaus", "email": "natalie.klaus@runtimeverification.com", "time": "Fri Oct 09 16:38:07 2026 +0300" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:33:09 2026 -0600" }, "message": "io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len \u003e\u003d sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port \u003d\u003d P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode.\n\nFixes: 899bea8248ce (\"io_uring/net: allow filtering on IORING_OP_CONNECT\")\nCc: stable@vger.kernel.org # 7.2\nSigned-off-by: Natasha Klaus \u003cnatalie.klaus@runtimeverification.com\u003e\nLink: https://patch.msgid.link/20261009133807.730724-1-natalie.klaus@runtimeverification.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "6da8f402e362b2f546e2efb7167fc9597aef6faf", "tree": "549fbcfcac9ac4135e5ce4878f2fd125954aed5b", "parents": [ "cde56daf4b93f474dc256dbcc5205035223ae6f5" ], "author": { "name": "Eugene Gvozdetsky", "email": "gvozdet@gmail.com", "time": "Fri Oct 09 01:08:49 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:32:55 2026 -0600" }, "message": "io_uring/register: don\u0027t exempt disabled rings from task restrictions\n\nA ring created with IORING_SETUP_R_DISABLED is exempt from its register\nrestrictions until it is enabled. This lets the creator register the\nrestrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,\nwhether or not that opcode is in the allowed set.\n\nSince commit ed82f35b926b (\"io_uring: allow registration of per-task\nrestrictions\"), a ring also inherits restrictions from the task that\ncreates it, and the same exemption applies to those. A task whose\nregister opcodes are restricted can therefore create a disabled ring,\nissue any register opcode on it, and then enable it.\n\nMark rings whose restrictions were inherited from the task, and keep\nchecking register opcodes for them while the ring is disabled. Enabling\nsuch a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the\ntask\u0027s allowed set. Per-ring restrictions registered on a disabled ring\nwork as before.\n\nFixes: ed82f35b926b (\"io_uring: allow registration of per-task restrictions\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5-5\nSigned-off-by: Eugene Gvozdetsky \u003cgvozdet@gmail.com\u003e\nLink: https://patch.msgid.link/20261009-iouring-task-restrict-fix-v1-1-a49daf55a12c@gmail.com\n[axboe: amend with inheritance flag fixup]\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "cde56daf4b93f474dc256dbcc5205035223ae6f5", "tree": "26080bca928a985c1fa634edff765e481ea3e40e", "parents": [ "b59cabf9b4acb65f3f9968087ca0e18010d85076" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Oct 08 13:07:38 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:20:41 2026 -0600" }, "message": "io_uring/kbuf: don\u0027t charge provided buffer rings to RLIMIT_MEMLOCK\n\nJust like with the SQ and CQ rings, the provided buffer rings were also\nnot charged against the memlock limit prior to the below mentioned\ncommit. Restore that behavior.\n\nFixes: ef62de3c4ad5 (\"io_uring/kbuf: use region api for pbuf rings\")\nReported-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nCc: stable@vger.kernel.org\nTested-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "af32da41b0327b9c6a37856ba82b6760d6c8d10e", "tree": "1908c1d636394d7ab56ed3e469eb41e9cd357fd6", "parents": [ "6c377d19d4a5116d9bec5203aa3c6c11523e7898", "37f12441f557468a56c1e27790413aa78c82afa2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "message": "Merge tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from wireless, wireguard, CAN and Bluetooth.\n We have one known regression to wrap up in VLAN handling.\n\n Current release - regressions:\n\n - Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex\n\n Previous releases - regressions:\n\n - can: fix regression in handling RPS after migrating metadata to skb_ext\n\n - eth:\n - iavf: fix regressions in reconfig impacting bonding\n - mana: fix packet forwarding performance regression\n - stmmac: remove buggy VLAN acceleration support\n\n Previous releases - always broken:\n\n - a few high prio fixes for tun, and af_packet\n\n - amt: fix a UaF on tunnel teardown\n\n - eth:\n - bnxt: fix PCIe AER recovery and FLR handling issues\n - macb: don\u0027t modify Tx skbs before taking ownership\n - axienet: don\u0027t leak Tx skbs on interface stop\n\n - wifi:\n - nxpwifi: number of LLM-ish fixes\n - assorted mt76 fixes\"\n\n* tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)\n net: macb: copy shared skbs before appending the FCS\n net: macb: check TX ring before modifying skb\n vsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n wireguard: noise: reject response consumption after intermediate initiation\n wireguard: queueing: preserve tstamp_type when encapsulating packet\n net: openvswitch: validate transport header presence in set_ipv6_addr\n net/smc: protect clcsock lifetime in smc_getname\n ipv6: do not warn on route notification size race\n ipv4: do not warn on route notification size race\n ipv4: validate checksum_start before completing checksum\n ptp: ocp: fix PCIe delay estimation calculation\n xen/netfront: don\u0027t leak the skb when xennet_fill_frags() fails\n net/packet: call packet_parse_headers after virtio_net_hdr_to_skb\n xen/netfront: drop RX packets with a short Ethernet header\n net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n net: sparx5: free the matchall entry on destroy\n selftests: mlxsw: Test port range occupancy on template create\n mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n net: dsa: microchip: fix KSZ8765 fiber detection\n net/mlx5e: Order ICOSQ cc update after CQ doorbell\n ...\n" }, { "commit": "6ccf996a0dec1852dab94ad865f27b4904750e12", "tree": "99390fd342d15271103c45caad0cde813093052a", "parents": [ "cca01232d94adcb10f7c8c5bb8ce072b045fcb58" ], "author": { "name": "Mary Guillemard", "email": "mary@mary.zone", "time": "Wed Oct 07 16:30:15 2026 +0200" }, "committer": { "name": "Lyude Paul", "email": "lyude@redhat.com", "time": "Thu Oct 08 18:14:46 2026 -0400" }, "message": "drm/nouveau: Skip the Turing CE workaround object for non-GR channels\n\nThis workaround is here for the old Gallium driver and predate async CE\nand NVDEC. Instead of only skipping it for NVDEC, let\u0027s only apply it\nin case of GR channels.\n\nThis should make async CE work properly on Turing by stopping the assign\nof a GRCE. (here CE0)\n\nSigned-off-by: Mary Guillemard \u003cmary@mary.zone\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nReviewed-by: Daniel Almeida \u003cdaniel.almeida@collabora.com\u003e\nSigned-off-by: Lyude Paul \u003clyude@redhat.com\u003e\nLink: https://patch.msgid.link/20261007-turing-async-ce-fix-v1-1-12ee6ccd1a3c@mary.zone\n" }, { "commit": "79c168e2aa957ed0054c93db17caba653b95e377", "tree": "254c799e92bc304ba52721cf1d85d90d2020626e", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Lukas Wunner", "email": "lukas@wunner.de", "time": "Thu Oct 08 14:26:00 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Thu Oct 08 14:33:04 2026 -0500" }, "message": "PCI/AER: Skip error recovery on false alarms\n\nAlex is seeing a probe failure of the amdgpu driver after the Root Port\nabove an AMD Navi10 GPU has been reset. The reset was performed to recover\nfrom a Firmware First reported Fatal Error.\n\nHowever all status registers in the Root Port\u0027s AER Extended Capability are\nblank, so apparently the platform firmware raised a false alarm.\n\nThe issue is only occurring since commit eddba19b8b5f (\"PCI/AER: Support\nAdvisory Non-Fatal Errors\"). It looks like enabling Advisory Non-Fatal\nErrors causes code paths to be exercised in platform firmware which were\nnever validated before.\n\nSkip error recovery on false alarms, i.e. if no unmasked errors were\nactually signaled.\n\nNote that this will also skip recovery if both the Status and Mask\nregisters are \"all ones\", as would be the case for inaccessible devices.\nHowever that seems justified because it would imply either a hot-unplug\nevent or a Surprise Down Error further up in the hierarchy. Interfering\nwith recovery from that seems uncalled for.\n\nFixes: eddba19b8b5f (\"PCI/AER: Support Advisory Non-Fatal Errors\")\nReported-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d222095\nSigned-off-by: Lukas Wunner \u003clukas@wunner.de\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/0552ed277e40a288e0157af799257ee6ec722534.1791460615.git.lukas@wunner.de\n" }, { "commit": "cca01232d94adcb10f7c8c5bb8ce072b045fcb58", "tree": "08a173557f1c3eb715599ffa6e160bb0407dacba", "parents": [ "6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Wed Sep 30 15:20:44 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Oct 08 16:21:07 2026 -0300" }, "message": "drm/vc4: Fix binner slot allocation failing on an idle GPU\n\nA job\u0027s binner slots are returned to bin_alloc_used by vc4_complete_exec(),\nwhich runs from the job_done workqueue, but the seqno\nvc4_v3d_get_bin_slot() waits on is incremented earlier, in the function\nvc4_irq_finish_render_job(). Therefore, a waiter can wake, retry, and still\nfind the pool full because the worker has not run. By then, the job might\nhave left the render_job_list, so no seqno remains to wait on and the\nallocation fails returning -ENOMEM.\n\nThis scenario can be reproduced on a Raspberry Pi 3 by using a burst of\nsmall jobs (e.g. Piglit\u0027s `quick_gl` suite), with userspace seeing a\nrejected submit for a pool about to become free.\n\nNote that the slots are held from validation until the render completes,\nso the pool can also be exhausted by jobs still queued on bin_job_list,\nleaving render_job_list empty and nothing to wait on.\n\nRelease the slots from the FRDONE handler and wait on the pool instead of\non one job\u0027s seqno. This bounds the wait to the actual resource. Also, by\nclaiming the slot inside the wait condition, another submit is unable to\ntake the slot between the wakeup and the retry. vc4_complete_exec() keeps\nclearing the slots for jobs that never completed, and now wakes the\nwaiters too.\n\nNote that the wait takes a deadline, since the two callers need different\nones. The submit path is a user task and can be interrupted, so it waits\nwithout one. On the other hand, vc4_overflow_mem_work() runs on a worker\nand never sees a signal, so it needs a deadline. During a reset,\nvc4_irq_disable() masks V3D_DRIVER_IRQS before draining the worker, and\nwith those masked nothing can release a slot. This deadlocks: the worker\nwould wait for slots that only the reset can free, while the reset waits\nin cancel_work_sync() for the worker.\n\nFixes: 553c942f8b2c (\"drm/vc4: Allow using more than 256MB of CMA memory.\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nLink: https://patch.msgid.link/20260930182204.1877361-1-mcanal@igalia.com\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f", "tree": "b721b4c7c31f55d2a856c401909df001ae0b0d67", "parents": [ "789f290b2e81d42820bddcb4010ffbc2ae2ded54" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Fri Sep 25 16:10:19 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Oct 08 16:20:06 2026 -0300" }, "message": "drm/vc4: Disable the V3D interrupt across runtime suspend\n\nvc4_irq_disable() masks the V3D interrupt sources and then calls\nsynchronize_irq() before the V3D is powered down. However, by itself,\nthis is not enough to quiesce the interrupt handler.\n\nsynchronize_irq() waits for handlers that have already set\nIRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.\nA GIC interrupt chip is able to mark an interrupt active as soon as a\nCPU acknowledges it, so there these checks cover the whole dispatch path.\nOn RPi 0-3, however, the interrupt controller is ARMCTRL, which has no\nactive state. A CPU that has read the hwirq out of the pending register\nbut has not yet reached handle_level_irq() stays invisible to\nsynchronize_irq().\n\nDuring a power transition, vc4_irq() may therefore run after the power\ndomain is off, where every V3D register read will return 0xdeadbeef.\n0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn\u0027t\ntrigger NULL pointer dereference issues only because the functions\nvc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early\nwhen there is no job pointer, but OUTOMEM is still able to schedule\nvc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.\n\nTherefore, fix the spurious interrupts by disabling the interrupt line\nacross the PM transition. To preserve the enable/disable balance, move\nvc4_irq_install() and request the IRQ line disabled before the first\nruntime resume.\n\nFixes: 9b6f461582e6 (\"drm/vc4: v3d: Stop disabling interrupts\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nLink: https://patch.msgid.link/20260925191318.541938-1-mcanal@igalia.com\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "b59cabf9b4acb65f3f9968087ca0e18010d85076", "tree": "b96b8138447ea250ae4932cf6298671d4375861d", "parents": [ "a92193c91e8839fe5fc209616ea95465ae4b919d" ], "author": { "name": "Hengyu Liang", "email": "hengyul@cs.unc.edu", "time": "Tue Oct 06 08:57:32 2026 -0400" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Oct 08 13:07:38 2026 -0600" }, "message": "io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK\n\nCommit 8078486e1d53 (\"io_uring: use region api for SQ\") and commit\n81a4058e0cd0 (\"io_uring: use region api for CQ\") made io_uring_setup()\nallocate the rings with io_create_region().\n\nHowever, io_create_region() charges the memory to RLIMIT_MEMLOCK, and\nthe rings had been exempt from that limit since commit 26bfa89e25f4\n(\"io_uring: place ring SQ/CQ arrays under memcg memory limits\"). As of\nnow, a user without CAP_IPC_LOCK gets ENOMEM from io_uring_setup() when\ntheir rings exceed the limit, which is 8 MiB by default. PostgreSQL\ndevelopers have already hit this in their io_uring tests [1].\n\nThe issue can be reproduced with a simple liburing program, run as an\nunprivileged user:\n\n #include \u003cliburing.h\u003e\n #include \u003cstdio.h\u003e\n\n int main(void)\n {\n static struct io_uring ring[64];\n int i;\n\n for (i \u003d 0; i \u003c 64; i++)\n if (io_uring_queue_init(4096, \u0026ring[i], 0) \u003c 0)\n break;\n printf(\"%d rings\\n\", i);\n return 0;\n }\n\nBefore those commits (v6.13), it prints \"64 rings\". After those commits\n(v6.14), it prints \"21 rings\".\n\nThis patch makes io_create_region() take the user to charge, and passes\nno user for the SQ/CQ rings.\n\nLink: https://www.postgresql.org/message-id/flat/667f7dcf-404b-4898-a426-57ca6e0617f6@gmail.com [1]\nFixes: 8078486e1d53 (\"io_uring: use region api for SQ\")\nFixes: 81a4058e0cd0 (\"io_uring: use region api for CQ\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nLink: https://lore.kernel.org/io-uring/20261006125732.3425762-1-hengyul@cs.unc.edu/\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "37f12441f557468a56c1e27790413aa78c82afa2", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3", "9151d6c42799105e109c8b54dbaad91ce0e17c47" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:54 2026 -0700" }, "message": "Merge branch \u0027net-macb-fix-software-fcs-handling-of-shared-and-requeued-skbs\u0027\n\nNicolai Buchwitz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: macb: fix software FCS handling of shared and requeued skbs\n\nWhile testing the genet MTU series I used a Raspberry Pi CM5 (RP1 GEM)\nas pktgen source for the CM4. With clone_skb the CM5 rebooted after a\nfew seconds. Further investigation showed that macb_pad_and_fcs()\nappends the FCS in place, so the shared skb grows with every transmit\nuntil BQL completes more than was queued and dql_completed() hits its\nBUG_ON.\n\nThe same code also modifies the skb before the TX ring check, so a\nNETDEV_TX_BUSY retry gets an skb that was already replaced or grown.\n\nPatch 1 checks the ring first, patch 2 copies shared skbs.\n\nTested on Raspberry CM5 with pktgen at 60/20000 bytes, clone_skb 0/\n1000, burst 1/32.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-0-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9151d6c42799105e109c8b54dbaad91ce0e17c47", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "6b48ed85ae0ca37c7403ef5d512be75975844f2f" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: copy shared skbs before appending the FCS\n\nmacb_pad_and_fcs() appends the FCS in place when the skb has tailroom.\nA shared skb, as pktgen sends in clone_skb mode, grows by one FCS per\ntransmit. BQL then completes more bytes than were queued and\ndql_completed() hits its BUG_ON.\n\nOn a Raspberry Pi CM5 (RP1 GEM) pktgen with clone_skb 1000 burst 32 at\n60 bytes kills the box within seconds.\n\nCopy shared skbs before appending the FCS. Clearing IFF_TX_SKB_SHARING\nwould also fix it but makes pktgen refuse clone_skb on macb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-2-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6b48ed85ae0ca37c7403ef5d512be75975844f2f", "tree": "009f5227692a79a54dc6d9f5da534e11059f1f99", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: check TX ring before modifying skb\n\nmacb_pad_and_fcs() replaces or extends the skb before the ring space\ncheck. On NETDEV_TX_BUSY the stack requeues an skb that is already freed\nor grown.\n\nCheck the ring first, using the padded length for the descriptor count.\nNonlinear skbs always take the copy path so the count can assume a\nlinear skb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-1-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "7c24a4e87e219072e5e106f6791146cbf3b056b3" }