)]}' { "log": [ { "commit": "2c50cd5d10e8723797f28c7978f1f61688e0c0d2", "tree": "429afd94518e88aff357a4659d835f15e34ab203", "parents": [ "1459b99bdaf9f524c124be93dcb47cc1927808f9" ], "author": { "name": "John Macias", "email": "dencity7@gmail.com", "time": "Sun Oct 25 20:58:03 2026 -0700" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:38:14 2026 +0100" }, "message": "wifi: cfg80211/mac80211: apply HE OBSS PD settings on beacon update\n\nhostapd puts NL80211_ATTR_HE_OBSS_PD into NL80211_CMD_SET_BEACON as well\nas NL80211_CMD_START_AP, but cfg80211 parses it only when the AP starts.\nA change of the spatial reuse parameters therefore reaches the beacon\nbut not the driver, and the only way to apply it is to restart the AP,\nwhich disconnects all stations.\n\nParse the attribute in the AP update path and apply it in\nieee80211_change_beacon() when it differs from the current settings.\n\nAssisted-by: LLM\nSigned-off-by: John Macias \u003cdencity7@gmail.com\u003e\nLink: https://patch.msgid.link/20261026035803.2630025-1-dencity7@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "1459b99bdaf9f524c124be93dcb47cc1927808f9", "tree": "8b6e17765bde9cb1be8da13cfdcd00842cd301c4", "parents": [ "e31a0e5347e34108d1afbc5290c6d28de620277e" ], "author": { "name": "Lewis O\u0027Flynn", "email": "lewis.oflynn@morsemicro.com", "time": "Tue Oct 20 18:27:08 2026 +1100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:38:14 2026 +0100" }, "message": "wifi: cfg80211: use self-managed regd after user hint\n\ncfg80211 does not apply user or country element hints to self-managed\nwiphys. However, once such a hint has been made, reg_get_regdomain()\nreturns the global regd instead of the self-managed wiphy\u0027s regd.\nCallers of freq_reg_info(), such as mac80211\u0027s\nieee80211_regulatory_limit_wmm_params(), will therefore use the wrong\nrule and may apply incorrect restrictions.\n\nAlways have reg_get_regdomain() return the wiphy\u0027s regd when it is\nself-managed. This makes the behaviour after a hint consistent with the\nbehaviour before one, where reg_get_regdomain() returns the wiphy\u0027s own\nregd.\n\nSigned-off-by: Lewis O\u0027Flynn \u003clewis.oflynn@morsemicro.com\u003e\nLink: https://patch.msgid.link/20261020072708.429946-1-lewis.oflynn@morsemicro.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "e31a0e5347e34108d1afbc5290c6d28de620277e", "tree": "2c7a521b3145cfc176f2bc80df5f7b7af16bdf8d", "parents": [ "757f5214abe5a31e831acce561ea3d4d32641832" ], "author": { "name": "Heyang Tan", "email": "thy15333007817@163.com", "time": "Mon Oct 19 15:33:40 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:38:14 2026 +0100" }, "message": "wifi: rt2x00: rt61pci: trim RX skb to reported frame length\n\nrt61pci_fill_rxdone() reports rxdesc.size from the 12-bit\nDATABYTE_COUNT field but, unlike the USB drivers, does not trim the skb\nto that length. rt2x00lib_rxdone() then computes the 802.11 header\nlength from the untrimmed skb and can call rt2x00crypto_rx_insert_iv()\nwhile skb-\u003elen does not match rxdesc.size.\n\nTrim the skb at the end of rt61pci_fill_rxdone(), matching rt2500usb and\nrt73usb, so the skb length is correct before the header length is\ncomputed and before any IV/ICV data is reinserted.\n\nSigned-off-by: Heyang Tan \u003cthy15333007817@163.com\u003e\nAcked-by: Stanislaw Gruszka \u003cstf_xl@wp.pl\u003e\nLink: https://patch.msgid.link/20261019073340.1063-1-thy15333007817@163.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "757f5214abe5a31e831acce561ea3d4d32641832", "tree": "9223e5af49e22e756ea7f2f4dc809e4f1c7ca4e8", "parents": [ "f5deac46fe4706c25ef3d59ec6ea4003a7e4c4af" ], "author": { "name": "YuanZhe Liu", "email": "25031212351@stu.xidian.edu.cn", "time": "Sat Oct 17 15:45:49 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:38:14 2026 +0100" }, "message": "wifi: libertas: cancel fw_timeout on disconnect\n\nif_usb_disconnect() frees the if_usb_card structure without ever cancelling\nits fw_timeout timer, which can still be pending in the timer wheel at that\npoint.\n\nThat timer is armed by the RX completion handler if_usb_receive_fwload()\nwith a five second deadline while a firmware download is in progress. The\nonly place that cancels it is the asynchronous firmware download callback\nif_usb_prog_firmware(), and it does so before killing the RX URBs:\n\n\twait_event_interruptible(cardp-\u003efw_wq,\n\t\t\t\t cardp-\u003esurprise_removed ||\n\t\t\t\t cardp-\u003efwdnldover);\n\ttimer_delete_sync(\u0026cardp-\u003efw_timeout);\n\tusb_kill_anchored_urbs(\u0026cardp-\u003erx_submitted);\n\nKilling the URBs does not undo a timer that a completion handler which was\nalready running re-armed in between, so fw_timeout can still be pending\nwhen the callback returns.\n\nIf the device is disconnected at that point, for example after a\nUSBDEVFS_RESET forced unbind or a physical unplug during firmware download,\nthe card structure is freed with its timer still queued in a timer wheel\nbucket:\n\n\tBUG: KASAN: slab-use-after-free in enqueue_timer+0x236/0x250\n\tWrite of size 8 at addr ffff88800ed324c8\n\n\tAllocated by task 1623:\n\t if_usb_probe+0xc8/0xc60\n\t drivers/net/wireless/marvell/libertas/if_usb.c:205\n\tFreed by task 1686:\n\t if_usb_disconnect+0x1c6/0x270\n\t drivers/net/wireless/marvell/libertas/if_usb.c:322\n\n\tThe buggy address is located 200 bytes inside of\n\t freed 512-byte region [ffff88800ed32400, ffff88800ed32600)\n\nThe offset corresponds to fw_timeout.entry.pprev, so the timer core later\nrewrites the list node of a timer living in freed memory, both when\nenqueuing another timer into the same bucket and when moving the bucket to\nthe expired list in run_timer_softirq().\n\nCancel the timer in if_usb_disconnect(), after if_usb_free() has killed the\nRX URBs, which stops the completion path from arming it again, and before\nthe card is freed.\n\nFixes: 4f82f5c853e3 (\"libertas: switch to a waitqueue and timer for handling USB firmware load\")\nCo-developed-by: Bin Yu \u003cbyu@xidian.edu.cn\u003e\nSigned-off-by: Bin Yu \u003cbyu@xidian.edu.cn\u003e\nCo-developed-by: Cheng Wen \u003cwencheng@xidian.edu.cn\u003e\nSigned-off-by: Cheng Wen \u003cwencheng@xidian.edu.cn\u003e\nSigned-off-by: YuanZhe Liu \u003c25031212351@stu.xidian.edu.cn\u003e\nLink: https://patch.msgid.link/20261017074549.57694-1-25031212351@stu.xidian.edu.cn\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "f5deac46fe4706c25ef3d59ec6ea4003a7e4c4af", "tree": "e308d02ac6feb4e00f83dd782d6b2748b67d2b15", "parents": [ "cbef3d2a7717225d63517bd5a3082a187c1e6dac" ], "author": { "name": "YuanZhe Liu", "email": "25031212351@stu.xidian.edu.cn", "time": "Sat Oct 17 15:03:35 2026 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:38:14 2026 +0100" }, "message": "wifi: libertas: check workqueue creation in lbs_add_card()\n\nlbs_add_card() does not check whether create_singlethread_workqueue()\nreturned a valid workqueue. That helper always creates the workqueue\nwith WQ_MEM_RECLAIM, so alloc_workqueue() also creates a rescuer kthread\nand returns NULL if that kthread cannot be created, for example when the\ntask which starts the driver is killed while kthread_create() waits for\nthe new thread:\n\n workqueue: Failed to create a rescuer kthread for wq \"lbs_worker\": -4\n\n-4 is -EINTR, which is exactly what the killable wait in\nkthread_create_on_node() returns when it is interrupted.\n\nThe card is published anyway, with priv-\u003ework_thread left NULL, and the\nremoval path destroys the workqueue unconditionally. destroy_workqueue()\ndereferences the NULL pointer while unregistering the workqueue from\nsysfs, which faults at offset 0xb0, the -\u003ewq_dev member of struct\nworkqueue_struct:\n\n KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7]\n RIP: 0010:destroy_workqueue+0x2e/0xc00 kernel/workqueue.c:6147\n Call Trace:\n lbs_remove_card+0xc9/0x3a0 main.c:919\n if_usb_disconnect+0xc1/0x270 if_usb.c:317\n\nFail the probe instead of publishing a card whose workqueue could not be\ncreated. The other two libertas bus backends already check the result\nof their alloc_workqueue() call, and all three callers of lbs_add_card()\nalready handle an ERR_PTR() return, so no caller needs to change.\n\nCo-developed-by: Bin Yu \u003cbyu@xidian.edu.cn\u003e\nSigned-off-by: Bin Yu \u003cbyu@xidian.edu.cn\u003e\nCo-developed-by: Cheng Wen \u003cwencheng@xidian.edu.cn\u003e\nSigned-off-by: Cheng Wen \u003cwencheng@xidian.edu.cn\u003e\nSigned-off-by: YuanZhe Liu \u003c25031212351@stu.xidian.edu.cn\u003e\nLink: https://patch.msgid.link/20261017070335.19330-1-25031212351@stu.xidian.edu.cn\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "cbef3d2a7717225d63517bd5a3082a187c1e6dac", "tree": "5943cc30d9a682adb6248e01a447ab65b0e6fb2b", "parents": [ "36350a9545833d15f8acc3d0f9c0cecb3c334427" ], "author": { "name": "Thomas Fourier", "email": "fourier.thomas@gmail.com", "time": "Fri Oct 16 15:45:32 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:38:14 2026 +0100" }, "message": "wifi: qtnfmac: topaz: Fix dma_unmap_single() size\n\nIn qtnf_pcie_data_tx(), the SKB is mapped with size skb-\u003elen, but it is\nunmapped in qtnf_topaz_free_xfer_buffers() with size SKB_BUF_SIZE. This\ncould leave parts of the buffer mapped, and thus leave memory exposed\nto the device.\n\nChange the size of the unmap to skb-\u003elen.\n\nThis bug was statically found and compile-tested only.\n\nFixes: e401fa25cfa2 (\"qtnfmac: add support for Topaz chipsets\")\nSigned-off-by: Thomas Fourier \u003cfourier.thomas@gmail.com\u003e\nLink: https://patch.msgid.link/20261016134538.42940-2-fourier.thomas@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "36350a9545833d15f8acc3d0f9c0cecb3c334427", "tree": "e76d80eb39b8333e91b760bda05d812e3f3b93f8", "parents": [ "0cf2eb997295589c5a9566a540ff89ebbbe3e8ea" ], "author": { "name": "Christoph Rudorff", "email": "chris@rudorff.com", "time": "Fri Oct 16 14:20:20 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:38:05 2026 +0100" }, "message": "wifi: mac80211: clarify ieee80211_set_antenna() return value\n\nTo set up antenna the device must be disabled, \"not started\".\nSo return -EBUSY instead of -EOPNOTSUPP\n\n$ iw phy0 set antenna 0x3\ncommand failed: Operation not supported (-95)\n\nexpected output:\ncommand failed: Device or resource busy (-16)\n\nSigned-off-by: Christoph Rudorff \u003cchris@rudorff.com\u003e\nLink: https://patch.msgid.link/20261016-fix-set-antenna-v1-1-e071d66f7f89@rudorff.com\n[fix commit message]\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "0cf2eb997295589c5a9566a540ff89ebbbe3e8ea", "tree": "7f8c54f489f59254f36c7a70882eb8d799342684", "parents": [ "9b3ebaef69366cdd55a0e8b848973b3718d0e3bf" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 14 16:07:51 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:34 2026 +0100" }, "message": "wifi: mac80211: remove .config method requirement\n\nGiven chanctx support, driver don\u0027t really need to\nhave a .config, so quite a few drivers now have an\nempty one. Allow it to be not set and remove those\nthat are no longer needed.\n\nLink: https://patch.msgid.link/20261014140752.754329-2-johannes@sipsolutions.net\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "9b3ebaef69366cdd55a0e8b848973b3718d0e3bf", "tree": "3ce6e50c9ca9fb150e74618764c620f43094effe", "parents": [ "6400fb3f6b8cbaac14b8a0647c372a8a3e47f4e8" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:38:52 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:16 2026 +0100" }, "message": "wifi: mac80211: avoid using dialog token 0\n\nThis dialog token will be special at least in UHR,\nand since there\u0027s no need to have zero just avoid\nusing zero in general.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153853.ee78f49efc86.I1c422b7dfc068b9c1a000a4213fcd9f7afc5d71d@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "6400fb3f6b8cbaac14b8a0647c372a8a3e47f4e8", "tree": "67d43b0f15ed0e022d888207d9001b306535f81a", "parents": [ "b7a615770a42b067c92f7cebd5e179cb0de47855" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:22 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:05 2026 +0100" }, "message": "wifi: mac80211: fix UHR Mode Change Tuples\n\nAt least since D2.0 the mode change tuples are just a\nsingle fixed octet, followed by an optional second one\nand mode specific parameters when enabled. Fix parsing\nand creation accordingly.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.52edf72dbc6c.I0a68bcc8690cf94b4243b3e89455b1fd2cc5be20@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "b7a615770a42b067c92f7cebd5e179cb0de47855", "tree": "12a29b4d50cd7ccc6896994e902920e8f0b27b07", "parents": [ "86ea4876e93da3ea11b54544409ae53adabca581" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:21 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:05 2026 +0100" }, "message": "wifi: ieee80211: fix MAPC element name\n\nIt\u0027s MAPC, not MACP, fix the typo.\n\nLink: https://patch.msgid.link/20261013153640.6761a1472057.I1c40fb9f59325b9ad6f8b2b97de740497036b576@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "86ea4876e93da3ea11b54544409ae53adabca581", "tree": "660c32b0007a31a0e4ff66920935f2b68ea9a778", "parents": [ "efa079dc01489ce2977faa2d5bfaab537f6deadd" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:20 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:05 2026 +0100" }, "message": "wifi: ieee80211: fix reconfiguration MLE size check\n\nThe operation parameters are three octets, and NSTR indication\nas well as DSO information was missing. Fix/add this.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.46883b68e1c0.I48ef9b2695252b412c724c45a35ab4e2ef498ccc@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "efa079dc01489ce2977faa2d5bfaab537f6deadd", "tree": "0928a83897241981227ae3afb3652d1806164815", "parents": [ "4a516bfadb482aa640d7425a99a186ef2cf54f0e" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:19 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:04 2026 +0100" }, "message": "wifi: ieee80211: check DUO in UHR operation size\n\nIf DUO is indicated present account for its size for the\nlength check to avoid later over-read.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.7170e4ee362d.I65287c8da8c22a1753cd734488f77d2705f370ac@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "4a516bfadb482aa640d7425a99a186ef2cf54f0e", "tree": "de7c921b03ebb0cea4162e6a8d8f3666ca77c0ea", "parents": [ "aa1957462ed3f46a9be11c6f6d49c926550297bf" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:18 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:04 2026 +0100" }, "message": "wifi: mac80211: track APs UHR DBE capabilities\n\nThe spec now decided that DBE capabilities are there,\nvs. just having EHT capabilities, overriding the EHT\nones for bandwidths that aren\u0027t advertised for EHT.\n\nParse those from the DBE capabilities and store them\nin EHT so they\u0027re treated the same, regardless of EHT\nhaving advertised them before or not.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.79eba411bb74.I2900ed0854bb2cfe3a4eafc19f88a30d044b83f6@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "aa1957462ed3f46a9be11c6f6d49c926550297bf", "tree": "b51ace9306ac50b37ab342546afc71e7f2f52b87", "parents": [ "a050770f182d225c298f1eef94b15924ccdc3b1d" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:17 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:04 2026 +0100" }, "message": "wifi: mac80211: mlme: refactor ieee80211_config_bw() output\n\nMove the extra output data (currently only \u0027changed\u0027) to a\nnew struct so we can add more data in the future for UHR.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.ac8685b8a102.I3861b5884c0fbf4f81f4abff796c817fde19f5d7@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "a050770f182d225c298f1eef94b15924ccdc3b1d", "tree": "8d2bb297127c4231e904034a6bf964064b3d72f1", "parents": [ "d2d1a0c22761958afbc4d5be6e1f12f1eba418f0" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:16 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:04 2026 +0100" }, "message": "wifi: mac80211: don\u0027t apply NPCA/DBE while being disabled\n\nIf during association NPCA or DBE are currently enabled\nbut in the process of being disabled via UHR Parameters\nUpdate, don\u0027t enable them in the first place.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.44d0b018547d.I688322203e8516243ab484cb9fd9aebcf50dbe8c@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "d2d1a0c22761958afbc4d5be6e1f12f1eba418f0", "tree": "192bf7ce8a9ab56968ec07998e5c8b7e4abe9dba", "parents": [ "e037cad3c75ee9d9d74c0a3fa729f2374cb29401" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:15 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:04 2026 +0100" }, "message": "wifi: mac80211: refuse bad UHR parameter update element\n\nIf a UHR parameter update element is present but invalid,\nrefuse using UHR.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.62286e7b16ae.I8398d927082b25e32c210b39919ed35c1e240e94@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "e037cad3c75ee9d9d74c0a3fa729f2374cb29401", "tree": "40e7a31c3987cc31dbf9a557faca12df1827ddda", "parents": [ "b0cdfeaa603a3ed1ba0e8092d45dc14d51ca5074" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:14 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:04 2026 +0100" }, "message": "wifi: mac80211: refactor UHR code from AP channel determination\n\nThis code is only going to grow with more UHR complexity\n(e.g. I\u0027m going to add checks for UHR parameter updates)\nand it\u0027s already long, move it to a separate function.\n\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20261013153640.2c019565b808.Ia668cdf25c3bce621fd178e47790b3285393c647@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "b0cdfeaa603a3ed1ba0e8092d45dc14d51ca5074", "tree": "3722e027d87ff062afde4ac85e9984c8cc2db06f", "parents": [ "37cbe582c55439f1ecb0e4a6832aae27d8d961a3" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:25:13 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:17:03 2026 +0100" }, "message": "wifi: mac80211: parse and validate UHR parameters update\n\nFind the UHR parameters update element, defragment it and\nvalidate that all the tuples are valid. This implements\nthe parsing per D2.0.\n\nLink: https://patch.msgid.link/20261013153640.7216b9c6edd1.Ied9308726862ef36c71473d8871345f9adc6204d@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "37cbe582c55439f1ecb0e4a6832aae27d8d961a3", "tree": "aa47a14a4911e3fdcf46a90a0089fec18262bbfd", "parents": [ "6604f4a45d8fd8eb910620f33b1726a80199b0ab" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:11:54 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:45 2026 +0100" }, "message": "wifi: mac80211: expose link STA TX bandwidth in debugfs\n\nThis will be useful to test the correct sequencing of\nRX (channel context) vs. TX (STA bandwidth) changes,\ne.g. during DBE enable/disable.\n\nLink: https://patch.msgid.link/20261013151154.62793c5224e5.I3b999eb6282d036bf2797fe1ef5898ee3a8f1241@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "6604f4a45d8fd8eb910620f33b1726a80199b0ab", "tree": "ca8e69801cb7c51eb365bec558edbb87a429113b", "parents": [ "9378d66bd138ac6ce47c60816fe23fabc3763104" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:10:14 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:37 2026 +0100" }, "message": "wifi: mac80211: add and use ieee80211_tu_to_ktime()\n\nDoing us_to_ktime(ieee80211_tu_to_usec(...)) gets pretty\nlong. Now that we use hrtimers more we have more uses of\nktime_t. Add a helper function for conversions to it.\n\nLink: https://patch.msgid.link/20261013151014.663e3b267a90.I84c31881c92065edc0716db81a5d7c416af9f32d@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "9378d66bd138ac6ce47c60816fe23fabc3763104", "tree": "099947fefb67a3355e617f866b09227279cb738c", "parents": [ "be9cb13747302c104df6b956d3d34eae704fda68" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 15:08:59 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:30 2026 +0100" }, "message": "wifi: mac80211: remove wrong unit from TTLM buffer define\n\nHaving this called IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS when it\u0027s\nactually in microseconds is wrong and confusing. Just remove the\nunit since it\u0027s only used in nearby code.\n\nLink: https://patch.msgid.link/20261013150858.1120d070af16.I6a6ea0b8d8f3eddfdec5c9aeb75e597745a49ae3@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "be9cb13747302c104df6b956d3d34eae704fda68", "tree": "81934bd347da8c7162201e00da92ca468b8a60c3", "parents": [ "1504c7ba396f9f0b2f99e5ef76264d4b6346257d" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:11 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:01 2026 +0100" }, "message": "wifi: mac80211: refactor tailroom needed checks\n\nWhether a key needs TX tailroom reserved for it is open-coded in\nseveral places as a test of the relevant flags. Create a small\nhelper function and use it instead.\n\nThe check for KEY_FLAG_UPLOADED_TO_HARDWARE is new in a few of\nthe places, but it\u0027s set appropriately there.\n\nLink: https://patch.msgid.link/20261013150605.c018564739a2.Ibe47133b0d3e04546b9a8346ad13f7f8bee32a25@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "1504c7ba396f9f0b2f99e5ef76264d4b6346257d", "tree": "9235eaeaae05ed4ffd8542da8865425a79206edf", "parents": [ "e824c7e74ef64d580eda1aeb5b90de51ab6eda8b" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:10 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:01 2026 +0100" }, "message": "wifi: mac80211: unify key finding/installation\n\nThere are multiple key lookups in the code now:\n - ieee80211_lookup_key() for get/del,\n - the old key in ieee80211_key_replace(), and\n - the new key place in ieee80211_key_link().\n\nIntroduce a new ieee80211_key_slot_lookup() function that\nlooks up the right place to install the key at (and get\nthe old key or information if needed), so that we can then\npass around that information to the functions needing it,\ninstead of doing the same kind of logic again and again.\n\nThere\u0027s one special case in it: if the cipher suite isn\u0027t\nknown (given as zero) then this is a case of looking up an\nexisting key for get/del, in which case it considers both\nthe TX GTKs and WEP keys.\n\nAdjust all the code to use the new function throughout,\nwhich in particular requires updates to deleting keys on\ninterface deletion, but at that point all keys except for\nkeys specific to the interface (or deflink) should already\nbe deleted.\n\nLink: https://patch.msgid.link/20261013150605.5c4af7e9e784.Ic6343d1f8b0a7b11bb9723c7b1b17caa8bfdc395@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "e824c7e74ef64d580eda1aeb5b90de51ab6eda8b", "tree": "3c6100b53d1f9cdbb0ca29eb9a82e1401b0cd20b", "parents": [ "9f280b400441bed463d98df1f9215779b3093840" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:09 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:00 2026 +0100" }, "message": "wifi: mac80211: remove lookup_key() dead code\n\nThis code path can never be exercised because pairwise\nrequires mac_addr set, so the code exited prior to it\nbeing reached here.\n\nLink: https://patch.msgid.link/20261013150604.98ab96f2a15c.I32022329526347cbf8a13b69a2ece1c2ee1b0261@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "9f280b400441bed463d98df1f9215779b3093840", "tree": "3410de96cd7d546c123dd5069a6fdf79ce43d458", "parents": [ "c4365d637235e5ae32d3a84d2c30a7f5ae8567ba" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:08 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:00 2026 +0100" }, "message": "wifi: mac80211: allow drivers to install AP GTK on STA\n\nSome drivers (e.g. iwlwifi) may want to install the GTK\non the AP station and not on the interface, so need the\nstation pointer. Allow them to set a flag to request it\nto be passed.\n\nLink: https://patch.msgid.link/20261013150604.e74f14ade79a.I21a55235891576ac6a4fc303a61455e840f3f53f@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "c4365d637235e5ae32d3a84d2c30a7f5ae8567ba", "tree": "523ede0391ea69991e3706ca825fe6e7b441f71d", "parents": [ "fc5c24654ee907d6aec8c8ff79644aeffda8d5e4" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:07 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:00 2026 +0100" }, "message": "wifi: mac80211: use per-STA GTK in client mode\n\nHistorically, client mode installed GTKs per interface,\nconflating them with AP mode where this is done, but in\nthat case they\u0027re for TX, while in client they\u0027re only\nfor RX.\n\nUse the new WIPHY_FLAG_CLIENT_AP_STA_GTK cfg80211 flag\nto indicate that we want/support per-AP-STA GTKs, and\nthen rename the gtk[]/cigtk[] arrays to tx_*[] (link)\nand to rx_*[] (link station) accordingly, finally\nclearing this up.\n\nFor now, don\u0027t tell the driver about this, though it\nwould simplify at least iwlwifi.\n\nNote that I\u0027ve also fixed an RCU issue here: removing\na link station previously didn\u0027t remove keys for it,\nso they\u0027d be reachable pointing to a freed link STA.\n\nLink: https://patch.msgid.link/20261013150604.fa618ff4fd1b.I848e5735dccc334d72ab917b7eb74e41db45b291@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "fc5c24654ee907d6aec8c8ff79644aeffda8d5e4", "tree": "e567e210b4ddc44e123923a1c8f0bc4eef8bd7d0", "parents": [ "9498e5b7f0774f1f370ced72aef42837c5be5cb6" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:06 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:00 2026 +0100" }, "message": "wifi: mac80211: clarify per-STA GTK handling code/docs\n\nThe FT case in the documentation cannot happen, because\nthe way mac80211 handles FT (now) doesn\u0027t add a station\nentry before the actual BSS transition. In addition, the\ndocumentation doesn\u0027t mention mesh, which also uses this\nflag. NAN was always allowing it, out of necessity.\n\nAlso clarify that other interface types aren\u0027t supported\n(for now) at all, which is already rejected by cfg80211\nbut checking here is easy and makes the code clearer.\n\nLink: https://patch.msgid.link/20261013150604.1c281934305e.Ib3a58f33a932b57be8a3e01b913b06f137f5c793@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "9498e5b7f0774f1f370ced72aef42837c5be5cb6", "tree": "5dd9abd2946fe26e4fbc7a8267c077f56b75d54a", "parents": [ "49a8e00e0db8ed1030188dbaf8a6a387c0c8b427" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:05 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:00 2026 +0100" }, "message": "wifi: cfg80211: support C/B/I/GTK per AP in client modes\n\nAdd WIPHY_FLAG_CLIENT_AP_STA_GTK indicating that the driver\ndoes per-AP C/B/I/GTK in client/P2P-client modes. If this is\nset, then cfg80211 will allow userspace to pass the AP\u0027s\n(or AP MLD\u0027s) MAC address with key commands, and will also\npass the current AP\u0027s MAC address if not given by userspace\nfor drivers requiring it, for backward compatibility.\n\nPer-AP C/B/I/GTK for RX will be required by mac80211 to clean\nup the code as well as for SMD Transition, where group keys\nfor the target AP may be installed while the switch isn\u0027t\ncomplete yet.\n\nLink: https://patch.msgid.link/20261013150604.a5da07b416e7.I344497e57aa89d9430ccdd9d386466d17064d018@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "49a8e00e0db8ed1030188dbaf8a6a387c0c8b427", "tree": "b7566d3d9650dc634ab3b37dc155f1ab30e87e17", "parents": [ "734bef548a96e8774d6eef5dfa2026c6edc4e80b" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 13 14:59:04 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Mon Oct 26 12:16:00 2026 +0100" }, "message": "wifi: mac80211: replace ieee80211_iter_keys_rcu()\n\nThis function is unsafe since we reuse the key-\u003elist for\ndeletions after RCU removal. Use a spinlock instead to\nprotect that, since otherwise we\u0027d have to add a new list\nhead for a very uncommon case.\n\nFixes: ef044763a3ca (\"mac80211: add atomic uploaded keys iterator\")\nLink: https://patch.msgid.link/20261013150604.e2fda97f779c.Ic15199f800d8a2bbcf4164ccc0e6f4d5aa0eac06@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "734bef548a96e8774d6eef5dfa2026c6edc4e80b", "tree": "ce2520b2602ce3b82f9842490d21836f9838d441", "parents": [ "864c07de0c7dcbca58b61625dfa2e461ae63b242", "1a2c35c49cc7c6be860038b8442b52424a8f123c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:58:00 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:58:00 2026 -1000" }, "message": "Merge tag \u0027net-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next\n\nPull networking updates from Paolo Abeni:\n \"This includes a significant number of low-priority fixes - especially\n in the NIC drivers area - that we deferred from the last few RCs in\n the previous cycle, which can\u0027t be easily outlined in the synopsis\n below.\n\n Core \u0026 protocols:\n\n - Continue the work on removing rtnl_lock dependencies:\n - per-netns ARP and ND neighbour tables, with the default settings\n now configurable per netns (inheritance from init_net is\n controlled by the new net.core.neigh_inherit_init_net sysctl)\n - RCU-protected configuration and rtnl_lock-less fill_info() for\n hsr, netkit, sit, vlan and vxlan devices\n - per-netns device unregistration for ip tunnel and gre devices\n - use the netdev instance lock instead of rtnl_lock when reading\n speed and duplex via sysfs\n - batch the flushing of uncached routes at device unregistration\n time, relieving rtnl_lock contention on netns dismantle.\n\n - Add hardware pacing offload support, admin-controlled via a new\n rtnetlink attribute, with sch_fq integration (implemented in idpf).\n\n - Re-segment BIG TCP GSO packets into GSO packets fitting the egress\n device limits instead of plain MSS-sized segments, improving\n throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.\n\n - Generate RSS keys that spread flows over all the RX queues; the\n previous random keys could leave some queues unused.\n\n - Optimize the bridge VLAN forwarding paths: cache the port-VLAN in\n fdb entries and consider only VLAN members when flooding, for ~10%\n more Mpps in the fdb forwarding path.\n\n - A few TCP/IP performance improvements aimed at efficient cache\n usage and reducing contention.\n\n - Add the TCP ROCCET congestion control, a CUBIC variant aimed at\n avoiding bufferbloat in cellular networks.\n\n - Continue the conversion of getsockopt callbacks to sockopt_t.\n\n - Add an ethtool command to list the front-facing ports of an\n interface, including SFP cages and modules, using the phy_port\n representation.\n\n - Enable BIG TCP support for bareudp tunnels.\n\n - Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state\n transitions (listen() + shutdown() + connect() and connect() +\n connect(AF_UNSPEC) + listen()).\n\n - Remove most BUG_ON()s from core packet processing, replacing them\n with error paths.\n\n Wireless:\n\n - Latency improvements, including lockless station get/dump and\n beacon updates, plus RTNL reduction and locking cleanups.\n\n - Infrastructure for non-station TX/RX with MLO.\n\n - NAN (Wi-Fi Aware) Instant Communication support and other NAN\n improvements.\n\n - Control frame Integrity Protocol (CIP) and protected TWT support.\n\n - Improvements for AP regulatory checks.\n\n Netfilter:\n\n - Disable br_netfilter in user namespaces and schedule it for removal\n in 2027.\n\n - Restrict the raw table in nft_compat to the specific family, hook\n and priority.\n\n - Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice\n versa).\n\n - Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better\n integration with memcg.\n\n - Allow discovering conntrack zone filtering support in ctnetlink\n dumps, and fix nfnetlink_hook handling of large dumps.\n\n Deletions:\n\n - Move the LLC type 2 sockets out of tree. There are no known users\n and the code attracts a never-ending stream of LLM-driven fixes.\n\n Device drivers:\n\n - New drivers:\n - Meta Platforms NIC (mpnic), the second-generation NIC from Meta\n - initial skeleton of the Nebula-matrix NICs driver (nbl)\n - X-Powers AC200/AC300 Fast Ethernet PHYs\n\n - Ethernet high-speed NICs:\n - Intel:\n - i40e: XDP metadata support for RX hash and VLAN tag\n - ice: expose the E825 TSPLL state via the DPLL subsystem\n - nVidia/Mellanox:\n - move the data direct infrastructure from IB to core, in\n preparation for netdev support.\n - reduce the memory used per offloaded TC rule\n - Meta (fbnic):\n - support large io_uring zero-copy RX buffers\n - Microsoft vNIC (mana):\n - add BQL support\n\n - Ethernet NICs consumer, and embedded:\n - Airoha:\n - LRO offload support\n - Cadence (macb):\n - context swapping for ringparam and MTU changes, avoiding\n buffer loss under memory pressure\n - Mucse (rnpgbe):\n - TX/RX and link status support\n - NXP (enetc):\n - SR-IOV improvements and VF support for ENETC v4\n - Qualcomm (ppe):\n - IPQ5424 support\n - Realtek PCI (r8169):\n - phylink support\n - RSS support for RTL8127\n - Renesas (ravb):\n - gPTP support for R-Car Gen4\n - Synopsys (stmmac):\n - XDP multi-buffer support on the TX side\n - tc mqprio hw queue priority offload\n - support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC\n DP1000 and Qualcomm sa8255p\n\n - Ethernet switches:\n - Mediatek (mt7530):\n - fast age and change conduit support\n - Microchip (ksz):\n - support for KSZ8995XA/KS8995XA\n - Microchip (lan966x):\n - PCIe FDMA support, ~20x throughput increase in PCIe endpoint\n - Microchip (sparx5):\n - Time Aware Shaper (taprio) offload\n - Motorcomm (yt921x):\n - LED and SerDes PCS support\n - Realtek (rtl8365mb):\n - EEE support\n\n - Ethernet PHYs:\n - Broadcom:\n - enable jumbo frames on BCM54xx\n - Realtek:\n - support for RTL8261CE_CG and RTL8261D_VM\n - MDIO support for RTL838x and RTL839x\n\n - WiFi drivers:\n - Broadcom (brcmfmac):\n - FT/OKC roaming offload\n - Intel (iwlwifi):\n - UHR sniffer support\n - support for newer UEFI/BIOS tables\n - MediaTek (mt76):\n - mt7925 NAN improvements\n - offchannel/scan improvements and MLO fixes\n - Morse Micro (mm81x):\n - monitor mode support\n - Qualcomm (ath12k):\n - IPQ5332 platform infrastructure\n - Realtek (rtw88):\n - RTL8723BS support\n - SDIO TX performance improvements\n - Realtek (rtw89):\n - P2P_DEVICE support\n - BT-coex updates for RTL8922D\n\n - Bluetooth:\n - move H:4 reassembly into the Bluetooth core\n - add generic support for vendor packets\n - MGMT: add security level changed event\n\n - Bluetooth drivers:\n - btusb: support Bulk Serialization Mode\n - Intel: support Draco and Titan Lake, allow unsigned firmware\n - Mediatek: MT7928 support\n - Qualcomm: QCC2072 support\n - Broadcom: Synaptics 4384 support\"\n\n* tag \u0027net-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)\n Bluetooth: btusb: disable by default Qualcomm multi-subsystem\n tipc: fix broadcast sender hang on last acker departure\n tipc: fix use-after-free of broadcast reception link at node release\n r8169: clear TX LPI on RTL8168h at link up after phylink conversion\n tun: Require CAP_NET_ADMIN to attach to an ownerless device\n net/sched/sch_cake: drop dead nla_nest_end() error check\n net/sched/sch_cake: widen buffer_used to u64\n net/sched/sch_cake: reduce parent backlog when clearing a tin\n net/sched/sch_cake: serialize reconfiguration with the datapath\n tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table\n net/mlx5e: Stop asserting for RTNL when closing channels\n net: shrink the payload-only part of skb dataref to one bit\n net: wwan: iosm: validate msg_head before indexing msg_ring\n net: bgmac: rate limit RX error messages\n selftests: net: veth: test XDP_TX to a peer with GRO enabled\n veth: schedule the peer\u0027s NAPI after XDP_TX when only GRO is enabled\n pppoe: delete session hash entries by pointer match\n net: lan969x: don\u0027t disable hardirqs in fdma tx clear\n net: sparx5/lan969x: do not clobber the PSFP cycle timer update period\n net: lan969x: fix DSM calendar for empty taxis\n ...\n" }, { "commit": "864c07de0c7dcbca58b61625dfa2e461ae63b242", "tree": "4d2c5f0962b95b99c8f5b04f62ff729086ac5f34", "parents": [ "5b193d6a8973655f19de87a7873ce31dee2d5fe6", "2f70a9b7e9c74b92a85a2584090f0f5c4cbaa4be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:01:57 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 15:01:57 2026 -1000" }, "message": "Merge tag \u0027hardening-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull hardening updates from Kees Cook:\n\n - Provide kmalloc_obj*-style API for devm_kmalloc()\n\n - Improve seq_buf API for saner C String handling with several bug\n fixes along the way (Kees Cook, Bill Wendling)\n\n - Overflow helper readability improvements (Bill Wendling)\n\n - Unexport native_write_cr4() (Dennis Chen)\n\n - um: fix CONFIG_GCOV for built-in code (Johannes Berg)\n\n - Improve stackinit test coverage (Justin Stitt)\n\n - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)\n\n - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)\n\n - signalfd: don\u0027t dequeue the forced fatal signals (Oleg Nesterov)\n\n - Fix randstruct to recognize new container_of() behavior\n\n - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too\n\n - Fix a couple remaining allocation return type mismatches\n\n* tag \u0027hardening-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)\n overflow: Match arithmetic in both parts of __builtin_choose_expr\n lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()\n extcon: realtek: Remove const from type_c_cfg allocation type\n coresight: cti: Add const to con_groups allocation type\n docs: core-api: Document the seq_buf API\n nvdimm: ndtest: Return the string length from flags_show()\n powerpc/papr_scm: Return the string length from the sysfs show functions\n seq_buf: Add seq_buf_init_append()\n bpf: Remove dead newline stripping from format_disasm_line()\n seq_buf: Add seq_buf_terminate()\n seq_buf: Add seq_buf_strlen()\n seq_buf: Clear what a writer did not claim when a seq_buf overflows\n seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow\n scsi: lpfc: Print rx monitor records straight into the seq_buf\n seq_buf: Do not pop from an overflowed seq_buf\n seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()\n .get_maintainer.ignore: Add Kees Cook\n devres: Provide kmalloc_obj*-style API for devm_kmalloc\n mm: Move default_gfp() into gfp_types.h\n kunit/stackinit: Clean up XFAIL under instrumentation\n ...\n" }, { "commit": "5b193d6a8973655f19de87a7873ce31dee2d5fe6", "tree": "e4028271892aa34ad12ffae196b884401412646b", "parents": [ "79132ddf81d78d9b84d9b8f05c7c5c3a3e912537", "b36b990c50b1f581b9a7f35ae256f5542415fa69" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:57:31 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:57:31 2026 -1000" }, "message": "Merge tag \u0027execve-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull execve update Kees Cook:\n \"Make CIs happier about the execve tests: report the skipped\n binfmt_misc_bpf test on stderr (Sasha Levin)\"\n\n* tag \u0027execve-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n selftests/exec: report the skipped binfmt_misc_bpf test on stderr\n" }, { "commit": "79132ddf81d78d9b84d9b8f05c7c5c3a3e912537", "tree": "024dee3cf10e3d1f2da0f95c83884f5ba7dd0c3b", "parents": [ "075e3396ebf5dfd0030bfe12642fa82cecd0c6ee", "e32008340585a12783045c4426fbb963cfa11b7e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:49:03 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:49:03 2026 -1000" }, "message": "Merge tag \u0027seccomp-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull seccomp updates from Kees Cook:\n\n - allow addfd to transfer O_PATH descriptors (Cong Wang)\n\n - allow restarting interrupted unreceived notifications (Cong Wang)\n\n - fix SECCOMP_ADDFD_FLAG_SEND when interrupted (Hui Peng)\n\n - Various docs and test clean-ups\n\n* tag \u0027seccomp-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n selftests/seccomp: Split fork_and_close into clone and close tests\n seccomp: Document RESTART_BEFORE_RECV and O_PATH addfd\n selftests/seccomp: test addfd with an O_PATH descriptor\n seccomp: allow addfd to transfer O_PATH descriptors\n docs/seccomp: describe the SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV flag\n selftests/seccomp: cover restart of unreceived notifications\n seccomp: allow restarting interrupted unreceived notifications\n seccomp: restore knotif-\u003estate when SECCOMP_ADDFD_FLAG_SEND is interrupted\n" }, { "commit": "075e3396ebf5dfd0030bfe12642fa82cecd0c6ee", "tree": "24b207306f24350761a0bfec7cb5914c6e875917", "parents": [ "3ac032ef6ca8e47bb06d1e189dfcf88fa0a09c75", "7c756181175d50200be487affa905e973f6cbaf5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:45:56 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 14:45:56 2026 -1000" }, "message": "Merge tag \u0027pstore-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull pstore updates from Kees Cook:\n\n - don\u0027t leave an ERR_PTR in the ramoops zone pointer (Andrea Parri)\n\n - reject persistent RAM zones too small for the buffer header (Andrea Parri)\n\n - publish big_oops_buf after max_compressed_size (Jaidev Shastri)\n\n* tag \u0027pstore-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n pstore: publish big_oops_buf after max_compressed_size\n pstore: reject persistent RAM zones too small for the buffer header\n pstore: don\u0027t leave an ERR_PTR in the ramoops zone pointer\n" }, { "commit": "3ac032ef6ca8e47bb06d1e189dfcf88fa0a09c75", "tree": "7dd7d10849e50e38721db3bce4285e585e0e77c7", "parents": [ "fcb92ecd733e11f37c32e7485da976a40d878e72", "bc6f2a284c63313e789d8cd294531e1cc2dc8c99" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:56:36 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:56:36 2026 -1000" }, "message": "Merge tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl\n\nPull fwctl update from Jason Gunthorpe:\n\n - One bug fix for a CFI issue in the Rust bindings\n\n* tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:\n rust: fwctl: declare cfi_encoding for fwctl_rpc_scope\n" }, { "commit": "fcb92ecd733e11f37c32e7485da976a40d878e72", "tree": "a890fddbbb6804eb812cc3b7c7e605fc8ddbe12f", "parents": [ "1021679bed5acc46e1b2dac78bdd006bd50970f4", "c3e8e9451e6f1b69f685b75e0fbf14f3d0fb2539" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:51:18 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:51:18 2026 -1000" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma updates from Jason Gunthorpe:\n \"A smaller cycle for features, still mostly AI and tool found bug fixes\n for long standing issues:\n\n - Bug fixes and minor cleanups across bnxt_re, cxgb4, EFA, ERDMA,\n HFI1, HNS, ionic, iRDMA, mlx4/mlx5, rdmavt, rtrs, RXE, SIW, SRP,\n isert and IPoIB. Lots of error unwind leaks, integer overflows, and\n use after free during teardown from timers/work that was not\n cancelled\n\n - Core fixes for uverbs DMABUF lifetime, RMPP reassembly use after\n free, multicast rb-tree corruption, restrack, and a user\n triggerable NULL deref when creating a WQ without a CQ\n\n - Prevent userspace from getting a writable mmap of the cxgb4 status\n page and the mlx4 clock page\n\n - Many rxe hardening fixes for bad user and network input, plus\n netdev and tunnel socket lifetime fixes\n\n - Peer supplied values are now validated in rtrs-clt, which is remote\n triggerable\n\n - umem now picks the DMA direction from the access flags instead of\n always using DMA_BIDIRECTIONAL, so an IOMMU can stop the device\n from writing to read-only memory. Several drivers were fixed to pin\n CQ and queue memory as writable to go along with this\n\n - SRQ support, firmware assigned CQ IDs and RCQ userspace support for\n ionic\n\n - RC QP improvements in MANA: MMQ creation, fixed size send WQEs and\n power of two send queues. Also multi-port GSI QPs and a rework of\n the UD send/receive and CQ polling paths\n\n - Relaxed ordering MRs for EFA\n\n - Non-contiguous kernel QP and CQ buffers for ERDMA\n\n - Move the mlx5 data direct infrastructure from mlx5_ib to mlx5_core\n so netdev can use it too. The data direct PCI driver is now named\n \"mlx5_dd\"\n\n - debugfs knob in hns to fix the SL used by the GSI QP, working\n around a HW problem with dropped CQEs\n\n - Selftest fixes, removal of the qib sysfs ABI docs, DT schema\n conversion for hns, and MANA maintainer handover\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (153 commits)\n RDMA/irdma: Bound in-flight CQP ops across deferred completions\n RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler\n RDMA/mlx5: Fix CQ resize destination index mask\n RDMA/usnic: Bound buffer size to sizeof(buf) in flowinfo_read()\n RDMA/rxe: Clear pkt-\u003eqp before the early drop exits in rxe_rcv()\n dt-bindings: infiniband: Convert hisilicon,hns-roce-v1 to DT schema\n RDMA/srp: Avoid reading uninitialized has_port on srp_parse_in() failure\n RDMA/irdma: Fix PBLE_LEVEL_2 FRWR generation\n RDMA/core: Reject LAG selection when source MAC lookup fails\n RDMA/core: Free unpublished port statistics after initial-read failure\n RDMA/core: Preserve the selected source GID on failed AH modification\n RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup\n RDMA/uverbs: Fix uobject leak in DMABUF release\n RDMA/irdma: Fix FRWR IRDMAQPSQ_PBLADDR field population\n IB/rdmavt: Fix error unwind path for qp_priv_init() in rvt_create_qp()\n RDMA/irdma: Check MR contiguity before PBLE alloc\n IB/mlx4: Avoid requeueing executing CM timeout work\n RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]\n RDMA/rxe: Fix out-of-range unsigned-to-signed conversion for RDMA message in 2GiB size\n RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]\n ...\n" }, { "commit": "1021679bed5acc46e1b2dac78bdd006bd50970f4", "tree": "d5fecc3721d2041d1798a6ff003dac481e54f634", "parents": [ "a1c2b1da93f5f612aa7a33190c4900c98e51f6da", "04bcf84613346b973a8cc0c59238b6b5bc902688" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:48:30 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 13:48:30 2026 -1000" }, "message": "Merge tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd\n\nPull iommufd updates from Jason Gunthorpe:\n \"Several bug fixes, probably found by AI based on the emails:\n\n - Several edge cases in the self test\n\n - Reject malformed invalidation commands in case the VMM let them\n through\n\n - Rework how the invalidation interface works to the drivers to be\n more robust and fix several Sashiko issues\n\n - Correct several error unwind paths\n\n - UAF during eventq file release\n\n - Reject more malformed usage of the dirty tracking by the VMM\"\n\n* tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:\n iommupt: Do not allow PTEs to be split when dirty logging\n iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA\n iommufd: Reject a zero-length dirty bitmap request\n iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned\n iommufd: Fix event queue release use-after-free\n iommufd: Keep dmabuf PFNs MMIO when filling another domain\n iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails\n iommufd: Fix iommufd_hw_capabilities reference in kernel-doc\n iommu/vt-d: Convert nested cache invalidation to the core array loop\n iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop\n iommufd/selftest: Convert cache invalidation mocks to the core array loop\n iommufd: Iterate the cache invalidation array in the core\n iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands\n iommufd/selftest: Skip when the mock device is not there\n iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again\n" }, { "commit": "a1c2b1da93f5f612aa7a33190c4900c98e51f6da", "tree": "d321c6eb9b42aa7a9b7f9a14056760b9530400cc", "parents": [ "98aec86f8c6bf2e1091fefb99eaba8b910e8eef1", "47193113641e5e1f9b5758b73d7b7a0273acb836" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:41:18 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:41:18 2026 -1000" }, "message": "Merge tag \u0027for-linus-tsm\u0027 of https://github.com/jgunthorpe/linux\n\nPull TSM update from Jason Gunthorpe:\n \"One patch to update the maintainers file following Dan\u0027s passing for\n TSM subsystem. Three people have volunteered to help complete this\n work\"\n\n* tag \u0027for-linus-tsm\u0027 of https://github.com/jgunthorpe/linux:\n coco/tsm: Update maintainership\n" }, { "commit": "98aec86f8c6bf2e1091fefb99eaba8b910e8eef1", "tree": "262edefdccfcca1df2cd15ffef6bfc7563ad48ef", "parents": [ "77f77fb7923feab3edd0accf793235623ef4b342", "1f5dde349ac2fca1f119ae8de3f0d2f1c2a8d338" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:37:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:37:35 2026 -1000" }, "message": "Merge tag \u0027sched_ext-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext updates from Tejun Heo:\n\n - Proxy execution can now be enabled together with sched_ext. A BPF\n scheduler can opt in to receive mutex-blocked tasks that donate their\n scheduling context to the lock owner and place them itself.\n\n - Lazy preemption: a BPF scheduler can preempt or kick a CPU lazily,\n deferring the switch to the next return to user space or tick, as the\n fair class can.\n\n - Sub-schedulers: a parent now learns which child runs on each CPU it\n delegated and when a cap change takes effect. A detaching child loses\n its caps before the parent restores the CPUs.\n\n - New kfuncs re-enqueue single tasks from a dispatch queue iteration\n and report a cgroup\u0027s CPU count and a CID\u0027s NUMA node. The CID\n topology now includes clusters.\n\n - Hot path optimizations: dispatch queue and task lookups compare keys\n inline, remote task moves no longer take a dispatch queue lock twice,\n and sub-scheduler hooks cost nothing without sub-schedulers.\n\n - Kfuncs callable from tracing programs are hardened against NMI and\n IRQ nesting, which could hard-lock the CPU or pick a wrong idle CPU.\n\n - Built-in dispatch queues no longer allocate per-CPU state that grew\n with the square of the CPU count.\n\n - Header syncs with the scx repo, a BTF workaround for pahole 1.32, and\n selftest fixes and coverage.\n\n* tag \u0027sched_ext-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (69 commits)\n sched_ext: Drop the locks periodically while walking a user DSQ for re-enqueue\n sched_ext: scx_qmap: Also re-enqueue stranded tasks with scx_bpf_dsq_reenq_task()\n sched_ext: Add scx_bpf_dsq_reenq_task() to re-enqueue single tasks from a DSQ iteration\n sched_ext: Factor out the rq lock switch of scx_dsq_move()\n sched_ext: Don\u0027t queue balance callbacks from a core-sched pick\n sched_ext: Don\u0027t leave balance callbacks queued across a pick retry\n sched_ext: Fix a bypassed task stalling on a cpu its scheduler has no caps on\n sched_ext: Fix the running task keeping its protection into bypass\n sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu\n sched_ext: Keep proxy donors with slice left on the local DSQ\n selftests/sched_ext: Report reload_loop attach failures\n selftests/sched_ext: Bound exit waits\n selftests/sched_ext: Add SCX_ASSERT_ALIVE and adopt it\n selftests/sched_ext: Fail loudly when EXIT_KIND is missing from BTF\n sched_ext: Add SCX_ECODE_RSN_CGROUP_OFFLINE to user_exit_info.h\n selftests/sched_ext: Fix reload_loop error-path use-after-free\n selftests/sched_ext: Fix build error in dequeue_remote selftest\n sched_ext: scx_qmap: Reset a child\u0027s cpuperf targets once its PERF revoke takes effect\n sched_ext: Add ops.sub_child_ecaps_updated() to report a child\u0027s effective cap changes\n sched_ext: scx_qmap: Show actual cid use per participant\n ...\n" }, { "commit": "77f77fb7923feab3edd0accf793235623ef4b342", "tree": "b29b6def51ee7717014c6e1d7a757622eddd26f0", "parents": [ "031cb4ccf803f15b73e153d71024d75031bef5f3", "1850c669516cb8568150937497a9a16a7bfa1582" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:28:11 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:28:11 2026 -1000" }, "message": "Merge tag \u0027cgroup-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup updates from Tejun Heo:\n\n - A write to cgroup.subtree_control or cgroup.type could hang in D\n state for as long as a task pinning a dying controller took to exit,\n as syzbot reported. The wait is now interruptible.\n\n - cpuset: the deadline bandwidth check ran on cpusets that weren\u0027t\n valid partition roots, failing cpuset writes with -EBUSY while\n deadline tasks existed. The CPU count the fair class takes from\n cpuset assumed a shared hierarchy that cgroup1 may not have.\n\n - Finding a cgroup\u0027s effective controller state no longer walks up the\n hierarchy, for per-I/O users such as nvmet. io.stat reads of cgroups\n without block devices skip the stat flush.\n\n - cpuset v1-only code moved to the v1 file and the exclusive flag\n dropped from v2, with documentation corrections for partition roots\n and boot-isolated CPUs.\n\n - Dead cgroups fail writes with -ENODEV consistently, plus small\n cleanups.\n\n - Selftest fixes, most visibly for tests that skipped on machines with\n many mounts, and a new pids.events notification test.\n\n* tag \u0027cgroup-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)\n selftests/cgroup: test pids.events notification\n selftests: cgroup: make test_memcg_sock check flushed sock stats\n selftests: cgroup: skip test_memcg_sock under cgroup.memory\u003dnosocket\n selftests/cgroup: Free the paths returned by cg_control()\n selftests: memcg: Don\u0027t close an uninitialized fd\n cgroup: Track the effective css in each cgroup\n cgroup/cpuset: Move cpuset_update_flag() to cpuset-v1.c\n selftests: cgroup: Preserve command arguments in with_stress.sh\n selftests: cgroup: Enable the cpu controller in test_cpu\n cgroup/cpuset: Use cpuset_v2() in cpuset_num_cpus()\n selftests/cgroup: add settings file with a longer timeout\n cgroup/cpuset: Remove CS_CPU_EXCLUSIVE handling code from v2\n cgroup/cpuset: Run SCHED_DEADLINE shrink test on valid partition root only\n docs: cgroup-v2: Describe effective CPUs of partition roots\n docs: cgroup-v2: Describe boot-isolated CPUs in cpuset.cpus.isolated\n cgroup/cpuset: Remove redundant sched domain rebuild from update_prstate()\n selftests/cgroup: don\u0027t crash on a truncated mount entry in cg_find_root()\n selftests/cgroup: read the entire file in read_text()\n blk-cgroup: skip rstat flush for cgroups without blkgs\n cgroup: use assign_bit() where applicable\n ...\n" }, { "commit": "031cb4ccf803f15b73e153d71024d75031bef5f3", "tree": "3c72a2a510e46d594870fb3bb22c52f7e8d416c3", "parents": [ "14785eff402944f56466ef0058408334cfc2f91d", "bda345b3fc59f2899c50379c64a0734a3e720683" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:25:52 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:25:52 2026 -1000" }, "message": "Merge tag \u0027wq-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue updates from Tejun Heo:\n\n - Flushing a workqueue now visits only the queues used since the last\n flush instead of one per possible CPU. Idle flushes get 10 to 100\n times faster on large machines, which XFS hits on every log force.\n\n - Per-cpu workqueues are built through the same attribute path as\n unbound ones and get a max_active of their own, continuing the work\n to turn them into an affinity scope of unbound workqueues.\n\n - New tracepoints for work items turning CPU-intensive, rescuer mayday\n and rescue events, and BH workers yielding with work pending.\n\n - A KCSAN annotation and small cleanups\n\n* tag \u0027wq-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n workqueue: mark pool-\u003enr_running as __data_racy\n workqueue: BUG_ON() a pwq release before workqueue_init()\n workqueue: Derive the standard attrs from the workqueue flags\n workqueue: Give percpu workqueues their own max_active\n workqueue: Make flush_workqueue() visit only pwqs active since the last flush\n workqueue: Maintain pwq-\u003etotal_in_flight\n workqueue: Add for_each_node_with_fallback()\n workqueue: Fix typo \"upto\" in comment\n workqueue: Add workqueue_bh_budget_yield tracepoint\n workqueue: Add workqueue_mayday and workqueue_rescued tracepoints\n workqueue: Add workqueue_cpu_intensive tracepoint\n workqueue: rename the pwq slot helpers shared with percpu\n workqueue: build percpu pwqs through the attrs path\n workqueue: make the default pwq optional\n workqueue: resolve the backing pool in alloc_pwq()\n workqueue: move the unbound-only attrs check to apply_workqueue_attrs()\n" }, { "commit": "14785eff402944f56466ef0058408334cfc2f91d", "tree": "b61a8af6aa38f266bb7ee6a34de837a295a1853a", "parents": [ "3815f7d55ae18564f4eac57557479f8b3548af95", "722658cac48a6ba49f5506fd74d010ad9dbb2f05" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:02:37 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 10:02:37 2026 -1000" }, "message": "Merge tag \u0027keys-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull keys updates from Jarkko Sakkinen:\n \"Highlight:\n\n - Don\u0027t leak local kernel addresses (and complement the ongoing\n rhashtable migration) (Kyle Zeng)\n\n The index value for the associative array has been calculated with\n the following formula:\n\n\tmult_64x32_and_fold(description + type address + domain address)\n\n By creating a sequence of dummy keys (e.g., \"A\", \"B\", \"C\", ...), it\n is trivial to form a group of equations with a predictable hash\n function, and ultimately break KASLR.\n\n Kyle\u0027s solution is based on an ephemeral SipHash key and an atomic\n 64-bit counter, which is encapsulated to a key_index_id(). This\n function is then used to assign identifiers for types and domains,\n and since the IDs are unique for each power on, they are as unique\n as memory addresses are.\n\n With these ingredients the index value calculation can be changed\n into form, which is not leaking any kernel addresses:\n\n\tSipHash(description + type id + domain id)\n\n Features and improvements:\n\n - TPM fields were moved from trusted_key_options to the TPM backend.\n They cost memory for non-TPM backends.\n\n - A TPM trusted key now caches tpm_is_tpm2() at the root of each call\n chain, and passes the result as a parameter. This decreases the\n amount of I/O traffic given that tpm_is_tpm2() starts and stops the\n chip via tpm_try_get_ops() and tpm_put_ops().\n\n Bugfixes:\n\n - A TPM trusted key corrupted the return value of a failed key\n unsealing operation if the pcrlock feature was used.\n\n - A TPM 2 trusted key allocated an off-by-four too large buffer for\n the decoded ASN.1 blob coming from keyctl add trusted.\n\n - Sometimes a TPM 2 trusted key rejected created keys based on the\n TPM2_Create response size, treating them as too large. Now it\n correctly checks the extracted TPM2 key blob size.\n\n - The keyctl reject operation raced with keyctl restrict_keyring\n because keyring-\u003esem was not held in key_reject_and_link() before\n accessing keyring-\u003erestrict_link.\n\n - keyctl_describe_key() was not holding key-\u003esem while accessing its\n fields, which can lead to use-after-free of a retired key type.\n\n - find_keyring_by_name() and procfs code were reading the UID from\n key-\u003euser-\u003euid instead of key-\u003euid. The latter is the cached value\n and is meant to protect against a use-after-free caused by keyctl\n chown.\n\n - search_process_keyrings_rcu() did not properly RCU-dereference the\n authorization key payload, which could cause a null dereference if\n the payload was revoked.\n\n - keyctl_read_key() checked key-\u003etype-\u003eread without holding key-\u003esem,\n which can lead to use-after-free if the type is retired. Based on\n my suggestion, this was addressed in __keyctl_read_key(), which\n already did take key-\u003esem\"\n\n* tag \u0027keys-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n keys/trusted_keys: reuse TPM version in option handling\n security: keys: Fix comment of search_process_keyrings_rcu()\n keys/trusted/tpm2: Validate TPM2_Create object sizes separately\n keys/trusted_keys: move TPM-specific fields into struct trusted_key_tpm\n keys: Protect the read method check against type removal\n keys: Avoid owner account dereferences in /proc/keys\n keys: make keyring indexes independent of kernel addresses\n keys: Check the authorization payload in process keyring searches\n keys: Avoid the owner account dereference in named keyring lookup\n keys: Protect the type name while describing a key\n KEYS: Fix key_reject_and_link() race with keyring restriction\n KEYS: trusted: Fix blob allocation size in tpm2_key_decode()\n keys/trusted_keys: return immediately after TPM unseal failure\n" }, { "commit": "3815f7d55ae18564f4eac57557479f8b3548af95", "tree": "e8ec39efb4107e35910700c2ea8bc91c9a0bf77e", "parents": [ "bbc48daecac6c69ccbce4005aa2a681298e2fc7d", "3e271a27c46fd591d1011c7de5a644a41e2010f1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:58:44 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:58:44 2026 -1000" }, "message": "Merge tag \u0027landlock-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock update from Mickaël Salaün:\n \"The main change adds composable Landlock controls for namespace types\n and Linux capabilities, thanks to new LSM hooks (merged via the LSM\n tree). A umount race condition is also fixed\"\n\n* tag \u0027landlock-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Fix superblock use-after-free in release_inode()\n selftests/landlock: Fix snprintf truncation checks in test files\n landlock: Add documentation for capability and namespace restrictions\n samples/landlock: Add capability and namespace restriction support\n selftests/landlock: Add capability restriction tests\n selftests/landlock: Add namespace restriction tests\n landlock: Enforce capability restrictions\n landlock: Enforce namespace use restrictions\n landlock: Wrap per-layer access masks in struct layer_config\n landlock: Rename quiet_masks to quiet_access\n" }, { "commit": "bbc48daecac6c69ccbce4005aa2a681298e2fc7d", "tree": "b5c0b56132d8479e376f3491ed30b8af38e4465b", "parents": [ "31aa19260278943f8539da6837f03fdeadf4aa7e", "e2f08fadb48509c239e47cdaf81438c162395932" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:55:12 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:55:12 2026 -1000" }, "message": "Merge tag \u0027ipe-pr-20261019\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe\n\nPull IPE updates from Fan Wu:\n\n - Fix an extra empty audit record on enforcement changes\n\n ipe_audit_enforce() started an audit buffer but logged the state\n change with audit_log(), which emits its own record. Ending the\n unused buffer produced an additional empty AUDIT_MAC_STATUS record\n every time the enforcement state was changed.\n\n - Keep the name and token tables in sync with their enums\n\n The audit name tables now use designated initializers, so each name\n stays bound to its enum value, and static assertions on the policy\n parser token tables break the build if an enum value is added without\n a matching token.\n\n - Constify token_default() and correct a comment about policy text\n ownership, with no functional changes\n\n - Fix an invalid sgid value in an audit event example in the docs\n\n - Point the docs to the new IPE website and test suite repository\n\n* tag \u0027ipe-pr-20261019\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:\n ipe: update the project and test suite links\n ipe: fix enforcement audit\n ipe: correct policy text ownership comment\n ipe: check parser token table sizes\n ipe: use designated initializers for audit name tables\n ipe: constify token_default()\n ipe: fix invalid sgid value in audit event documentation\n" }, { "commit": "31aa19260278943f8539da6837f03fdeadf4aa7e", "tree": "d89756dea1d72b52387189e2fd15258de0021f49", "parents": [ "bf2325084583daaea91084b25069f121d5d8832b", "ceb24c7052cc4649e3b52a51a7cca7dfe4896cec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:53:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:53:20 2026 -1000" }, "message": "Merge tag \u0027integrity-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity\n\nPull IMA updates from Mimi Zohar:\n \"Cleanup:\n\n - Update ima_audit_msg() to report errno directly, revert making it a\n wrapper for ima_audit_message(), and remove ima_audit_message()\n\n Two bug fixes when carrying the IMA measurement list across kexec:\n\n - Restore the number of violations in the IMA measurement list\n\n - Reject restoring IMA measurement list record(s) beyond the expected\n buffer size (out-of-bounds)\"\n\n* tag \u0027integrity-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:\n ima: reject a kexec buffer whose declared size exceeds the buffer\n ima: recover number of violations after kexec\n integrity: Replace integrity_audit_message() with integrity_audit_msg()\n integrity: Report error code in integrity_audit_msg() call sites\n" }, { "commit": "bf2325084583daaea91084b25069f121d5d8832b", "tree": "92934f2b651890d36f1a2177c31a246b25b412c0", "parents": [ "2a08195e4db5aba84600db6518089a1dbe2d04c7", "178aff4cf425b3fc51ff09c571fa1bfbc1eb8ea4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:36:46 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 09:36:46 2026 -1000" }, "message": "Merge tag \u0027v7.4-p1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto updates from Herbert Xu:\n \"API:\n - Fix algif_skcipher source SG overrun\n - Allow hmac(sha512) for non-root users\n\n Algorithms:\n - Add wrapper for zeroing AES key context\n - Avoid redundant stream initialisations in zstd\n\n Drivers:\n - Remove hisilicon/sec.\n - Handle digest-only authenc requests in atmel\n - Handle zero-length skcipher requests in mxs-dcp\n - Lower the default priority of caam/qi2\n\n Others:\n - Optimise key comparison in rhashtable lookup that uses constant\n parameters\"\n\n* tag \u0027v7.4-p1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (146 commits)\n crypto: atmel-tdes - consolidate error paths in atmel_tdes_dma_init()\n crypto: atmel-tdes - reuse fast in atmel_tdes_crypt_start()\n crypto: atmel-tdes - use separate DMA scatterlists\n MAINTAINERS: delete entry for John Allen\n hwrng: amd - use PMBASE_OFFSET consistently\n hwrng: cctrng - simplify cctrng_probe()\n hwrng: intel - simplify intel_rng_mod_init()\n crypto: qat - fix use of destroyed vf2pf_lock on VF restart\n crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()\n hwrng: imx-rngc - Use optional clock\n crypto: talitos - init tasklets before requesting IRQs\n crypto: algif_skcipher - rewind rounded output bytes\n crypto: algif_hash - Allow hmac(sha512) for unpriviledged users\n crypto: sa2ul - Remove unused fields\n hwrng: stm32 - use devm_platform_ioremap_resource() in stm32_rng_probe()\n hwrng: stm32 - drop redundant initializations\n hwrng: amd - simplify control flow in amd_rng_mod_init()\n hwrng: stm32 - reuse clock rate in stm32_rng_clock_freq_restrain()\n hwrng: stm32 - use swap() in stm32_rng_probe()\n hwrng: cctrng - drop redundant initializations\n ...\n" }, { "commit": "2a08195e4db5aba84600db6518089a1dbe2d04c7", "tree": "5053309d3c336648459a7673be388b3d5fd23355", "parents": [ "968de9d17980a0e538fc4e4394af49465294386d", "e38f53f0482468efd04397f66bda4648b70ac9fa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:23:28 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:23:28 2026 -1000" }, "message": "Merge tag \u0027linux_kselftest-kunit-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kunit update from Shuah Khan:\n \"A single fix to kunit_run_all_tests() to return void since callers\n don\u0027t check the return value and the integer return type is a remnant\n from when the function was executed as initcall which is no longer the\n case\"\n\n* tag \u0027linux_kselftest-kunit-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n kunit: Return void from kunit_run_all_tests()\n" }, { "commit": "968de9d17980a0e538fc4e4394af49465294386d", "tree": "9e091112c98c09b034805c67637b118148c1d67f", "parents": [ "7cd80b8168c9269e4b11788ce815c0f446ab5b34", "368e5d4d12a802ee3708800319cd13904721286f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:20:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:20:22 2026 -1000" }, "message": "Merge tag \u0027linux_kselftest-next-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kselftest updates from Shuah Khan:\n\n - Improve selftest build, run-time, and install framework\n\n Install even when some modules fail to build, print summary of test\n results at the end of the default test run, keep the build status\n from wrapping to success so build errors are reported, and optionally\n record per-suite build and install results.\n\n - Add LLVM support to kselftest_deps.sh\n\n - Fix resctrl, breakpoints suspend, ftrace, and tracing tests\n\n - Fix and enhance resctrl test\n\n* tag \u0027linux_kselftest-next-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n selftests: breakpoints: Skip step_after_suspend_test on systems without a wakeup capable RTC\n selftests: optionally record per-suite build and install results\n selftests: keep the build status from wrapping to success\n selftests/ftrace: Add nice dependency\n selftests: kselftest_deps.sh: Support LLVM\n selftests: lib.mk: Don\u0027t fail install if no modules were built\n selftests/ftrace: Avoid unlink error on first run\n tracing/selftests: Fix incorrect invocation of exit_fail\n selftests/lib.mk: run_tests: print summary at the end\n selftests/ftrace: skip gcov symbols when picking a function to probe\n selftests/resctrl: Enable dynamic management of IMC counters via linked list\n selftests/resctrl: Replace counter index references with pointers\n selftests/resctrl: Introduce linked list management for IMC counters\n selftests/resctrl: Skip L3_CAT when no exclusive cache portion exists\n" }, { "commit": "7cd80b8168c9269e4b11788ce815c0f446ab5b34", "tree": "070863419ab62749f44af44a1ba3174c315fff29", "parents": [ "bb2235894a8a604c08b3f93f4e1082b9df03265a", "4ad423aa2108485f8bc5dde51fdf9c1ed979ee4b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:12:31 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:12:31 2026 -1000" }, "message": "Merge tag \u0027uml-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux\n\nPull UML updates from Johannes Berg:\n\n - NOMMU support, mostly for mm/ testing\n\n The only bigger change, we added support for building with\n !CONFIG_MMU, mostly for testing, e.g. via kunit. Some new\n selftests targetted to NOMMU are moving elsewhere, but are\n runnable on ARCH\u003dum without MMU.\n\n - Tighter page permissions\n\n Tighten page permissions to catch more bugs (ARCH\u003dum is,\n after all, often used for testing), and also mark __init\n memory inaccessible for the same reason.\n\n - Various maintenance/cleanups\n\n Fix build on really old hosts, fix leaks, make the code a\n bit more robust, header cleanups, typo fixes, the usual.\n\n* tag \u0027uml-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits)\n um: place large BSS inputs in an output section\n um: fix shutdown __inittext access\n um: time-travel: fix sched_yield() behaviour\n um: require MMU for UML PCI support\n um: vector: avoid NULL queue dereference in legacy RX mode\n um: use %pB to print functions in stack traces\n um: mprotect() __init memory\n um: move init text between __init_begin/end\n um: improve checking for --no-warn-rwx-segments\n um: make stub compilation more robust\n um: link .lbss/.ldata/.lrodata correctly\n um: add perf-event support\n x86/um: remove unused \u003casm/required-features.h\u003e header\n um: fix typo \"hander\" in comment\n um: Add definition of __NR_close_range for older host OSs\n um: virtio_uml: switch to dynamic root device\n um: Tighten exec permissions on page mappings\n Documentation: um: document nommu UML\n um: allow deselecting CONFIG_MMU\n um: nommu: add userspace runner processes\n ...\n" }, { "commit": "bb2235894a8a604c08b3f93f4e1082b9df03265a", "tree": "c6e58a900d8e77472ecd8d5c7837985f2023055b", "parents": [ "979fac3eaaa02fa887c7dfe6509248b21dca3872", "129f5d395fd66b6587a5ac156b232cca060d6512" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:05:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:05:19 2026 -1000" }, "message": "Merge tag \u0027powerpc-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc updates from Madhavan Srinivasan:\n\n - powerpc/numa: Support coregroup on PowerNV\n\n - powerpc/irq: Move __softirq_pending out of irq_stat\n\n - powerpc/512x: Remove pdm360ng platform setup in favor of mpc512x_generic\n\n - powerpc/ps3: Simplify control flow in ps3_{virq,irq_plug}_setup()\n\n - KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users\n\n - powerpc/syscall: Avoid atomic test_and_clear_thread_flag on fast path\n\n - pseries/plpks cleanup and fixes\n\n - Misc fixes and cleanup\n\nThanks to Abhishek Dubey, Amit Machhiwal, Anushree Mathur, Bui Nguyen\nNhu Quynh, Christophe Leroy (CS GROUP), Dmitry Torokhov, Gaurav Batra,\nGautam Menghani, Geert Uytterhoeven, Greg Joyce, Hari Bathini, Harsh\nPrateek Bora, Karl Mehltretter, Link Mauve, Michal Suchánek, Mukesh\nKumar Chaurasiya (IBM), Nayna Jain, Ritesh Harjani (IBM), R Nageswara\nSastry, Saket Kumar Bhaskar, Samir Mulani, Shivang Upadhyay, Shrikanth\nHegde, Sourabh Jain, Srikar Dronamraju, Srish Srinivasan, Thorsten Blum,\nVaibhav Jain (IBM), Venkat Rao Bagalkote, and Yeswanth Krishna Tellakula\n\n* tag \u0027powerpc-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (44 commits)\n powerpc/numa: Support coregroup on PowerNV\n powerpc/numa: Allow cpu_to_coregroup_id without PPC_SPLPAR\n powerpc/numa: Simplify find_primary_domain_index\n powerpc/fadump: collect dump when CPU_STATE_DATA is less than reserved\n powerpc/syscall: Avoid atomic test_and_clear_thread_flag on fast path\n powerpc/kasan: fix r2 corruption in mem*() on GENERIC_ENTRY with old compilers\n powerpc: fix NMI exit ordering: restore soft masks after irqentry_nmi_exit()\n powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped\n KVM: PPC: Book3S HV: Free the queue pages in error path\n KVM: PPC: Book3S HV: Add missing mappings for tracing exits\n powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard\n KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form\n KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users\n KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls\n pseries/plpks: update PKS documentation and MAINTAINERS entry\n pseries/plpks: rename the default wrapping key macro\n pseries/plpks: make narrowing conversions explicit\n pseries/plpks: hide wrapping_features when unsupported\n pseries/plpks: fix self-reference in plpks_var initializer\n pseries/plpks: clear SED key data after use\n ...\n" }, { "commit": "979fac3eaaa02fa887c7dfe6509248b21dca3872", "tree": "feba5ab6a2305c92162cd09549fd7832b8aaa22a", "parents": [ "5b6eaf4aeba0aab8cc757d79102aa9662d148f97", "b74843b38da8f1186fd7d447646c835b47096a15" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:02:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 08:02:35 2026 -1000" }, "message": "Merge tag \u0027alpha-fixes-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha\n\nPull alpha floating point emulation fix from Matt Turner:\n \"Make the FP emulation determine tininess after rounding, as the\n hardware does.\n\n soft-fp always determined it before rounding, so an operation that\n trapped for software completion could report an underflow the same\n operation would not report when it did not trap. glibc\u0027s math\n testsuite catches the disagreement.\n\n This adds _FP_TININESS_AFTER_ROUNDING to the shared soft-fp code in\n include/math-emu/, as glibc\u0027s copy already has, and sets it only for\n alpha. It defaults to zero, so powerpc, sh and sparc are unchanged.\n\n This is the last patch of a three-patch series; the first two were\n merged for v7.3\"\n\n* tag \u0027alpha-fixes-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha:\n alpha: determine tininess after rounding in the FP emulation\n" }, { "commit": "5b6eaf4aeba0aab8cc757d79102aa9662d148f97", "tree": "b6ad7d0f455a40d0297b01357fc2f44680240bc3", "parents": [ "aad73b807cd1a5bff9c5277e8a42e75bbdc8adab", "01330dac0fa7c16ef0f3da39757e9509653a2e3f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:58:09 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:58:09 2026 -1000" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull ARM updates from Russell King:\n\n - remove supersection support\n\n - set \"current\" earlier to avoid KASAN issues\n\n - fix a couple of corner cases in the alignment handler\n\n - fix wrong free function in iommu allocation path\n\n - cacheinfo updates\n\n - properly align hugetlb mappings\n\n - always set endianness on xscale\n\n - fix clang backtracer\n\n - avoid replacing active_asids if already 0\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9493/1: asid: Do not replace active_asids if already 0\n ARM: 9490/1: backtrace-clang: fix wrong sp usage for unwinding\n ARM: 9482/5: decompressor: always set endianess on xscale\n ARM: 9524/1: mm: align hugetlb mappings to the huge page size\n ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU\n ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves()\n ARM: 9521/1: cacheinfo: count external caches in early_cache_level()\n ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves()\n ARM: 9519/1: dma-mapping: Fix wrong free function in __iommu_alloc_simple() error path\n ARM: 9492/1: alignment: fix LSR #32 and ASR #32 offset decoding\n ARM: 9491/1: alignment: restore uaccess state on emulation fault\n ARM: 9488/1: smp: set current pointer in assembly before jumping into C\n ARM: 9486/1: set !LPAE MAX_PHYSMEM_BITS to 32 and remove supersection mappings\n" }, { "commit": "aad73b807cd1a5bff9c5277e8a42e75bbdc8adab", "tree": "8c1f0864efd1be92f97e2d804a7bf619173922db", "parents": [ "4e092c2be4320f06dde1206652746ce0d83540b7", "cfe69169c03e71e2a22870317ef4cffb51f6f06d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:56:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:56:27 2026 -1000" }, "message": "Merge tag \u0027soc-arm-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull ARM SoC board file updates from Arnd Bergmann:\n \"These are mostly smaller cleanups for the remaining platform code in\n arch/arm/, the most notable one being the conversion of the\n s3c/crag6410 board to use software nodes for GPIO references in place\n of plain GPIO numbers.\n\n The earlier plan was to drop the deprecated (since 7.3) board files\n here, which would have been a much larger set of changes, but that is\n now deferred to 7.5\"\n\n* tag \u0027soc-arm-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n MAINTAINERS: Drop arm64 dts/intel path from ARM/SOCFPGA ARCHITECTURE\n ARM: tegra: Fix Trun -\u003e Turn typo\n ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus()\n ARM: vexpress: fix device_node refcount leak in vexpress_flags_set()\n MAINTAINERS: Change ARM Visconti5 architecture maintenance status to Odd Fixes\n ARM: mvebu: fix Cortex-A9 errata selection for Armada 38x\n ARM: OMAP2+: remove unused ctrl_module_wkup_44xx.h header\n ARM: EXYNOS: Replace __ASSEMBLY__ with __ASSEMBLER__\n ARM: s3c: crag6410: use software nodes/properties to set up GPIO keys\n Input: samsung-keypad - remove support for platform data\n ARM: s3c: crag6410: switch keypad device to software properties\n ARM: s3c: register and attach software nodes for Samsung gpio_chips\n Input: samsung-keypad - handle compact binding\n dt-bindings: input: samsung,s3c6410-keypad: introduce compact binding\n ARM: imx6q: remove KSZ9021 PHY fixup\n ARM: imx: Fix suspend/resume crash with Clang CFI\n ARM: OMAP2+: Replace __ASSEMBLY__ with __ASSEMBLER__\n soc: imx: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file\n ARM: imx: Replace __ASSEMBLY__ with __ASSEMBLER__\n MAINTAINERS: Add git tree for TI K3 ARCHITECTURE\n" }, { "commit": "4e092c2be4320f06dde1206652746ce0d83540b7", "tree": "306a7c29df7e142235a7ffde7eab3582a0ce28e3", "parents": [ "2e51c645fee243dbcb5cee3eb063b5713317444c", "6db3ea21a541d34e45f3727b71575424495df44c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:55:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:55:27 2026 -1000" }, "message": "Merge tag \u0027soc-defconfig-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC defconfig updates from Arnd Bergmann:\n \"Only a few new drivers get enabled this time.\n\n The size of the defconfigs actually shrinks here, though that is only\n the result of all the Qualcomm clock drivers now being configured as\n modules by default when the corresponding platforms are enabled\"\n\n* tag \u0027soc-defconfig-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n arm64: defconfig: Update coreboot firmware symbols\n arm64: defconfig: Enable I3C and SPD5118 hwmon\n arm64: defconfig: Enable EMC2305 and PCA963x drivers\n arm64: defconfig: Switch Qualcomm SDM845, SM8150 and SM8250 drivers to modules\n ARM/arm64: defconfig: Drop redundant Qualcomm clock entries\n arm64: configs: defconfig: Convert TISCI to modules\n arm64: defconfig: Enable PMIC5 Gen3 ADC thermal monitor\n arm64: defconfig: Enable QMP PCIe Multi-PHY driver\n ARM: shmobile: defconfig: Refresh for v7.3-rc1\n arm: multi_v7_defconfig: Enable SND_ALOOP\n arm64: defconfig: enable the necessary drivers for the Ayaneo Pocket S2\n ARM: omap2plus_defconfig: Support for compressed firmware\n ARM: omap2plus_defconfig: Enable SND_ALOOP\n" }, { "commit": "2e51c645fee243dbcb5cee3eb063b5713317444c", "tree": "ee6bfb3eabdc46763c050c98a7549e504313a286", "parents": [ "7b9a0e857b427cdda5a08b662dbea7321e6bb470", "0045cd6b8ab2319e9d8de46e5e329cdc35ce6d05" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:52:50 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:52:50 2026 -1000" }, "message": "Merge tag \u0027soc-drivers-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC driver updates from Arnd Bergmann:\n \"There are lots of minor updates for driver subsystems managed through\n the soc tree (turris-omnia platform, cache driver, tee drivers,\n arm-cci, bus, memory) as well as soc vendor specific drivers\n (starfive, xilinx, microchip, nxp, amlogic, imx, renesas, samsung, ti,\n nvidia).\n\n The more notable changes are:\n\n - Larger updates for Qualcomm SoCs including support for SM8950\n (Maili) SM8975 (Hawi), Glymur, Shikra, and IPQ5424\n\n - Added SoC support for Exynos5515, Tegra264, Tegra410, R8A774A3, and\n MT8167 in existing drivers\n\n - Arm SCMI firmware driver support for ACPI PCC transport and module\n autoloading of protocol specific drivers\n\n - Apple crash log support for CrgA embedded controller\"\n\n* tag \u0027soc-drivers-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (176 commits)\n platform: cznic: turris-omnia-mcu: stop button emulation producers\n cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers\n soc: mpfs: use kref cleanup on probe failure\n arm64: enable HAVE_SHARED_GPIOS for all ARM64 platforms\n bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port()\n bus: arm-cci: Drop CPU node reference in cci_ace_init_ports()\n soc: fsl: dpio: Free the IRQ before releasing the I/O object\n soc: fsl: dpio: Fix cleanup on IRQ registration failure\n bus: fsl-mc: Annotate fsl_mc_io.portal_virt_addr with __counted_by_ptr\n bus: fsl-mc: drop the fwnode links of the dpmacs nodes\n soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()\n soc: qcom: geni-se: Drop unused icc_ddr parameter from geni_icc_get()\n firmware: qcom: scm: Allow QSEECOM on ThinkPad T14s Gen 7\n dt-bindings: mailbox: qcom: Document Maili CPUCP mailbox controller\n dt-bindings: spmi: glymur-spmi-pmic-arb: Add compatible for Qualcomm Maili SoC\n soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove\n ASoC: dt-bindings: qcom,apr: Add modem_apps GLINK channel for shikra\n firmware: qcom: tzmem: disable SHM bridge for SM7125 platform\n soc: qcom: ubwc: Add Kalambo UBWC config\n firmware: qcom: scm: Allow QSEECOM on Kalambo CRD\n ...\n" }, { "commit": "7b9a0e857b427cdda5a08b662dbea7321e6bb470", "tree": "f54d9637f27a40a848ed29eba6eff73a1afb880d", "parents": [ "6876634d0fc254362ed6cc4f475c16ddd5e2c0eb", "15644868ad522eac914d368fd08c340051f1076c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:48:17 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:48:17 2026 -1000" }, "message": "Merge tag \u0027soc-dt-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC devicetree updates from Arnd Bergmann:\n \"This is a rather large update of over 1000 non-merge commits touching\n devicetree files and bindings.\n\n A few notable SoC were added this time:\n\n - Apple M4 and A18 Pro are used in laptops, these follow the M3 model\n added in 7.2.\n\n - Google Laguna (aka Tensor G5) is used last year\u0027s Pixel phone\n generation. Unlike the earlier Tensor chips, this is not based on\n Samsung\u0027s Exynos family design but starts a new chip family.\n\n - Qualcomm\u0027s Hawi and Nord SoCs are two powerful chips using the\n custom Oryon cores. Product names and applications are so far not\n known, which means that Qualcomm is doing something right by\n upstreaming kernel support early.\n\n The ST stm32mp23xc/stm32mp25xc SoC support was previously removed\n because there were no users upstream, but they are back now that\n boards have shown up. Renesas RZ/G2M v3.0 (R8A774A3) is just a minor\n variation of the already supported SoC.\n\n In total, there are 81 new dts files for individual boards, and they\n are all over the place. Only one riscv based machine is added, the\n Milk-V Meles SBC using the T-Head th1520 chip. For 32-bit Arm, we have\n 13 new boards. About half are industrial embedded boards using NXP\n i.MX6/7 chips, the rest are older products: two Amazon tablets, two\n Motorola phones and two SoM boards.\n\n Everything else is 64-bit Arm:\n\n - many industrial embedded boards using NXP layerscape, NXP i.MX8/9,\n Qualcomm Hamoa, ST stm32mp2, Rockchip rk35xx, and Renesas RZ/G2\n SoCs\n\n - Laptops and tablets using Apple M4, Qualcomm Snapdragon X2,\n Snapdragon X1 Elite and Allwinner A133 chips\n\n - Valve Steam Frame VR headset using Snapdragon 8 Gen 3\n\n - Seven handheld game consoles using Qualcomm Dragonwing qcs8550\n\n - Mobile phones using Google Tensor G5, Samsung Exynos 850, and\n various Qualcomm Snapdragon chips\n\n Aside from the new stuff, there is still a lot going on for existing\n socs and boards, including GPU hardware support on MediaTek MT8173\n based laptops. Most patches actually add features this time, as the\n compile-time diagnostic changes are slowing down\"\n\n* tag \u0027soc-dt-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (1022 commits)\n arm64: dts: rockchip: Add Radxa E54C\n dt-bindings: arm: rockchip: Add Radxa E54C\n arm64: dts: rockchip: remove FRL GPIO for 100ASK DshanPi A1\n arm64: dts: rockchip: fix M.2 E-key reset pinctrl on rk3588 rock-5-itx\n arm64: dts: rockchip: add pcie30phy data-lanes on rk3588 coolpi-cm5-evb\n arm64: dts: rockchip: Add the fan tachometers to Kobol Helios64\n arm64: dts: rockchip: enable NPU on Radxa E52C\n arm64: dts: rockchip: fix adc button voltage on Radxa E52C\n riscv: dts: sophgo: sg2002-milkv-duo256m: drop reserved memory node\n riscv: dts: sophgo: cv1800b-milkv-duo: drop reserved memory node\n arm64: dts: nuvoton: npcm845-evb: Add peripheral nodes\n arm64: dts: nuvoton: npcm845-evb: Fix DTS coding style\n arm64: dts: nuvoton: npcm845: Add peripheral nodes\n arm64: dts: nuvoton: npcm845: Split APB address ranges\n riscv: dts: sophgo: cv180x: Fix internal ephy node name\n riscv: dts: sophgo: add Milk-V Duo 256M ethernet support overlay\n riscv: dts: sophgo: Limit SG2042 SPI NOR to 12.5 MHz\n riscv: dts: sophgo: Enable SPI NOR on SRD3-10\n riscv: dts: spacemit: set ETH MAC from eeprom for OrangePi\n arm64: dts: allwinner: sun50i-h616: Add video engine\n ...\n" }, { "commit": "6876634d0fc254362ed6cc4f475c16ddd5e2c0eb", "tree": "c81988632f72bd9ccea6dbb4d1a80d3103c0dab2", "parents": [ "2c2fe95ab19b09bef7391e3e5cdf8146d09792b6", "01a40ad5a9687ea5a837857d4b21ddd764be7aa3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:44:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:44:26 2026 -1000" }, "message": "Merge tag \u0027mailbox-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox\n\nPull mailbox updates from Jassi Brar:\n\n - altera: shut down RX polling timer on channel teardown\n\n - arm-mhu: timeout if receiver never comes up in mhuv2, keep combined\n IRQ enabled during suspend in mhuv3, and drop redundant unregister on\n probe failure in doorbell\n\n - axiado: fix RX frame draining and error handling, and fix debugfs\n name truncation warning\n\n - bcm74110: cap rx_svc_init_list growth to prevent PMC-induced OOM\n\n - hisilicon: convert Hi3660 and Hi6220 bindings to DT schema\n\n - mtk-cmdq: fix runtime PM leak in cmdq_mbox_flush()\n\n - pcc: free channel before unmapping shared memory and serialize\n channel updates with teardown\n\n - qcom: guard against NULL con_priv race in IPCC send_data, use\n dev_name() for IRQ names, drop stray disable_irq_wake(), read 64-bit\n register with readq() in CPUCP, drop redundant unregister on probe\n failure, and add SDM670 and IPQ9650 APCS bindings\n\n - rockchip: prefix register defines, simplify device variant handling,\n and convert to use dev_err_probe()\n\n - ti-msgmgr: add TDA54 main secure-proxy support and DT bindings, read\n exact trailing bytes for non-word-aligned messages, and do not report\n RX poll timeout as a send failure\n\n - misc: use designated initializers for acpi_device_id across drivers\n\n* tag \u0027mailbox-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: (27 commits)\n mailbox: Use named initializers for acpi_device_id\n mailbox: qcom-cpucp: read mbox hardware register using readq()\n mailbox: qcom-ipcc: remove stray disable_irq_wake() call\n mailbox: qcom-ipcc: Use dev_name() as IRQ name instead of a static counter\n mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()\n mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()\n mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM\n mailbox: arm_mhuv2: time out if the receiver never comes up\n mailbox: altera: shut down RX polling timer on channel teardown\n dt-bindings: mailbox: qcom: Add IPQ9650 APCS compatible\n dt-bindings: mailbox: Convert hisilicon,hi6220-mbox to DT schema\n dt-bindings: mailbox: Convert hisilicon,hi3660-mbox to DT schema\n mailbox: ti-msgmgr: Read exact number of trailing message bytes\n mailbox: ti-msgmgr: Do not report rx poll timeout as a send failure\n mailbox: arm_mhuv3: Keep the combined IRQ enabled during system suspend\n mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure\n mailbox: qcom-ipcc: Remove redundant mbox_controller_unregister() on probe failure\n dt-bindings: mailbox: qcom: Add SDM670 APCS compatible\n mailbox: rockchip: Convert to use dev_err_probe()\n mailbox: rockchip: Simplify device variant handling\n ...\n" }, { "commit": "2c2fe95ab19b09bef7391e3e5cdf8146d09792b6", "tree": "6c7c7a675bf70ad1ad3ffc37d8620a58f0303d00", "parents": [ "7e3f52ef2fe67ae9689496760ab6bd3d5d68ea6f", "60ccbc2343d37c65a76b736eb7cf41ce0ec343b8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:40:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:40:27 2026 -1000" }, "message": "Merge tag \u0027hid-for-linus-2026102101\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID updates from Jiri Kosina:\n \"Core:\n - OOB fix in s32ton() (Alan Stern)\n - switch to named initializers for acpi_device_id (Pawel Zalewski)\n - UAF fix in hiddev (Yousef Alhouseen)\n\n AMD SFH:\n - support for newer AMD SoCs (Basavaraj Natikar)\n - sysfs attributes of operating-mode telemetry (Basavaraj Natikar)\n\n Apple:\n - power management fix for Apple Touch Bar (Andre Eikmeyer)\n - fix for trackpad hanling on T2 Macs (Aditya Garg)\n\n ASUS:\n - power management fix for ROG Ally (Deni Benato)\n - asus_work() hardening (Denis Benato)\n\n Intel-THC:\n - conversion of intel-thc-hid to hid_safe_input_report() (Even Xu)\n\n Nintendo:\n - support for Switch 2 controller (Vicki Pfau)\n - support for PDP Afterglow controller (Aiman Najjar)\n\n Roccat:\n - fixes for proper handling of short reports (Jiale Yao)\n\n Wacom:\n - UAF fixes (Lee Jones)\n\n .. other assorted fixes, device ID additions and code cleanups\"\n\n* tag \u0027hid-for-linus-2026102101\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (80 commits)\n HID: nintendo: introduce dependency in USB_HID\n HID: asus: add keyboard dock of the ASUS Transformer Book T302CHI device ID\n HID: wacom: fix wacom_intuos_irq NULL pen_input deref\n HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata\n HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct\n HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg\n HID: hid-lenovo-go-s: Move attribute init to after device query\n HID: hid-lenovo-go-s: Add suspend function and gate access under bool.\n HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume\n HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback\n HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup\n HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete\n HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()\n HID: logitech-hidpp: cancel reset_hi_res_work on probe failure\n HID: apple: ignore the trackpad on T2 Macs\n HID: usbhid: skip interrupt IN polling for devices with no input reports\n HID: mcp2221: always initialize and cancel init_work\n HID: magicmouse: fix null pointer dereference in magicmouse_event()\n HID: core: Fix out-of-bounds left shift by 32 in s32ton()\n HID: asus: add support for xgm led\n ...\n" }, { "commit": "7e3f52ef2fe67ae9689496760ab6bd3d5d68ea6f", "tree": "ace6e4a6949fe4fd73c13e2b7bc799f106837df4", "parents": [ "bb436f2a8568d14f176475c79b0d5069f0a6f9e3", "f63dc0eea92d07c5bb799a406571b555cd2bbd97" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:38:51 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:38:51 2026 -1000" }, "message": "Merge tag \u0027auxdisplay-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay\n\nPull auxdisplay updates from Andy Shevchenko:\n \"A tiny batch of auxdisplay changes, which resided in Linux next for\n more than enough without any regression reports:\n\n - Fix ABI documentation formatting\n\n - Miscellaneous cleanups\"\n\n* tag \u0027auxdisplay-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay:\n docs: ABI: auxdisplay: use literal blocks for commands\n auxdisplay: panel: use assign_bit() where applicable\n auxdisplay: arm-charlcd: Use DEFINE_SIMPLE_DEV_PM_OPS for power management\n" }, { "commit": "bb436f2a8568d14f176475c79b0d5069f0a6f9e3", "tree": "3dac357c4e7176ec0e1b3e42bdc9c14d4201659d", "parents": [ "8279fb300585e0a8ee69bd0a12d343e59b6fe7be", "0f6be986ad0eb6fe7338d963a14eaf0dee87677d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:36:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:36:22 2026 -1000" }, "message": "Merge tag \u0027i2c-7.4-part1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c updates from Andi Shyti:\n \"The main changes are the new Novatek NT72676 driver, the qcom-cci\n clock and timing updates and a collection of smaller driver, core and\n DT binding improvements.\n\n Core and helpers:\n - acpi: run ASUS and Dell touchpads at 100 kHz to avoid lag\n - core: return bool from check_functionality() and update users\n - smbus: limit block reads to the caller\u0027s buffer size\n - acpi: mark I2C transfer buffers as DMA-safe\n\n Drivers:\n - qcom-geni: several firmware node and runtime PM improvements\n - qcom-cci: several patches rework clock selection and timings\n - qcom-cci: enable SCL clock stretching\n - imx-lpi2c: fix DMA mapping device selection and cleanup\n - designware: tune RX FIFO thresholds to reduce interrupts\n - i801: respect SPD write protection when probing DDR5 modules\n - bcm2835: fully initialize clock configuration data\n\n Generic cleanups:\n - mux: simplify channel lookup and firmware node handling\n - core, busses: tidy up ACPI device ID tables\n - docs: clarify adapter lookup and fix a client driver example\n - xlnx: update maintainer for Xilinx IIC bindings\n - ljca: remove redundant adapter deletion\n\n New support and DT bindings:\n - add DW compatibles for Synaptics SL2610 and UltraRISC DP1000\n - allow six DMA channels for R-Car Gen5\n - add Allwinner A733 compatible to mv64xxx bindings\n - add support for Novatek NT72676 (new driver)\"\n\n* tag \u0027i2c-7.4-part1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (37 commits)\n i2c: imx-lpi2c: remove dmaengine_desc_free()\n i2c: busses: use named initializers for acpi_device_id\n i2c: i2c-core-acpi: use named initializers for acpi_device_id\n i2c: i801: Gate SPD instantiation on SPD Write Disable bit\n i2c: acpi: Use I2C_M_DMA_SAFE in acpi_gsb_i2c_[read|write]_bytes()\n dt-bindings: i2c: dw: Add Synaptics sl2610 i2c\n i2c: designware: size the RX FIFO threshold to the queued transfer\n i2c: imx-lpi2c: use dmaengine_get_dma_device() for DMA mapping\n docs: i2c: writing-clients: Add missing end of command\n i2c: qcom-cci: skip core clock rates the clock cannot provide\n i2c: core: document preference for i2c_get_adapter_by_fwnode()\n i2c: qcom-cci: always enable SCL clock stretching\n MAINTAINERS: Add entry for Novatek NT72676 I2C controller driver\n i2c: nt72676: Add Novatek NT72676 I2C controller driver\n dt-bindings: i2c: Add Novatek NT72676 I2C controller\n i2c: acpi: Force ASUE140D touchpads to 100 kHz\n i2c: qcom-cci: Enforce the required CCI clock rate\n i2c: qcom-cci: Share the timing table across CCI revisions\n i2c: qcom-cci: Add 19.2 MHz timings for the v2 CCI\n i2c: qcom-cci: Support per-mode CCI clock rates\n ...\n" }, { "commit": "8279fb300585e0a8ee69bd0a12d343e59b6fe7be", "tree": "92d16536982b12ab0d7110a7b176c458104d5d4a", "parents": [ "22cbcdafe135752082853355168460c730d1c4aa", "30167fadbf87fa901a2fee49c30a5c5a506a43e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:34:52 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:34:52 2026 -1000" }, "message": "Merge tag \u0027for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux\n\nPull hte updates from Dipen Patel:\n\n - prevent releasing GPIO before time expires in the test code\n\n - initialize spin lock before registering the chip in the provider\n driver\n\n* tag \u0027for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux:\n hte: tegra194-test: shut down timer before GPIO release\n hte: tegra194: Initialize slice locks before registering chip\n hte: tegra194: Remove redundant dev_err()\n" }, { "commit": "22cbcdafe135752082853355168460c730d1c4aa", "tree": "db72161f4ac6693ead6ee146a366512e1c7abec0", "parents": [ "0e557fc68a1667183b5f4649ee76e833160c6714", "6276c8195e598361942082423114877265c17692" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:32:49 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:32:49 2026 -1000" }, "message": "Merge tag \u0027watchdog-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull watchdog updates from Guenter Roeck:\n \"Core/generic:\n - Replace __MODULE_STRING() with __stringify()\n - Use assign_bit() where applicable\n - Use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr for dev_pm_ops\n - Fix repeated words and typos in comments\n - Differentiate scenarios when watchdog is closed\n\n Added device support in existing drivers:\n - mtk_wdt: Support for MediaTek MT8167 and MT8127\n - apple_wdt: Support for T8140\n - s3c2410_wdt: Support for Exynos 5515\n\n Various other minor bug fixes and improvements\"\n\n* tag \u0027watchdog-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (22 commits)\n watchdog: mediatek: Apply the driver\u0027s mode to a watchdog left running\n dt-bindings: watchdog: apple,wdt: Add t8140 compatible\n watchdog: Replace __MODULE_STRING() with __stringify()\n watchdog: use assign_bit() where applicable\n watchdog: mediatek: Add support for mt8167 toprgu/watchdog\n dt-bindings: watchdog: Add compatible for MediaTek mt8167\n watchdog: sp805_wdt: fix suspend/resume handling of HW_RUNNING watchdog\n watchdog: PM: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr for dev_pm_ops\n watchdog: mediatek: Add wdt/toprgu resets for mt6589\n watchdog: msc313e: Replace commas with semicolons in probe()\n watchdog: sp805: Replace SIMPLE_DEV_PM_OPS with DEFINE_SIMPLE_DEV_PM_OPS\n watchdog: fix repeated words in comments\n watchdog: fix typos in comments\n watchdog: i6300esb: do not stop an already running watchdog\n dt-bindings: watchdog: mediatek: Add MT8127\n watchdog: Differentiate scenarios when watchdog is closed\n dt-bindings: watchdog: renesas,r9a09g057-wdt: Add CPG/MSSR syscon support\n watchdog: mediatek: acknowledge pretimeout interrupt\n watchdog: s3c2410_wdt: Add exynos5515-wdt compatible data\n dt-bindings: watchdog: samsung-wdt: Add exynos5515-wdt compatible\n ...\n" }, { "commit": "0e557fc68a1667183b5f4649ee76e833160c6714", "tree": "9ba10d6cbfc66303c188bc8abf7c2563d9279969", "parents": [ "03480653ddfd1b004dc622acb4fa913b05c3edaa", "6d318db9ffcb611f9b3b6b3201c963690541a943" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:31:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:31:02 2026 -1000" }, "message": "Merge tag \u0027pmdomain-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain updates from Ulf Hansson:\n \"pmdomain core:\n - Add a genpd config to support unknown initial status\n - Add support system wide resume latency constraints\n - Enable a non-CPU device in a CPU PM domain to do power on\n - Fall back to use device node name for domain idle states\n\n pmdomain providers:\n - cpuidle-psci: Initialize the PM domains in powered off state for OSI\n - cpuidle-psci: Move initialization a bit earlier in the boot sequence\n - qcom: Add NMXC power domain for Nord\n - qcom: Add support for SM7250, Kuno and MSM8952 power domains\n - renesas: Add support for r8a774a3 SYSC power domains\n - renesas: Fix lockdep false positive for r8a78000\n - riscv: Add RPMI device power service\n - st: Add the actual power domains on U8500\n - st: Convert Ux500 PM domains to schema\n\n pm qos:\n - Add a flag for system wide latency constraints\n - Add lockless read for flags\"\n\n* tag \u0027pmdomain-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (36 commits)\n dt-bindings: arm: Add the actual power domains on U8500\n dt-bindings: arm: ux500: Drop NR_DOMAINS\n dt-bindings: power: Convert Ux500 PM domains to schema\n dt-bindings: power: rpmpd: Add MSM8952 power domains\n pmdomain: rockchip: drop duplicated errno from supply failure message\n pmdomain: core: add support system-wide resume latency constraints\n pmdomain: core: add genpd_for_each_child() helper\n PM / QoS: add lockless read for flags\n PM / QoS: add flag to indicate latency applies system-wide\n pmdomain: renesas: rcar-sys: Add r8a774a3 support\n dt-bindings: power: Add r8a774a3 SYSC power domain definitions\n dt-bindings: power: renesas,rcar-sysc: Document vendor-prefixed header paths\n pmdomain: imx93-blk-ctrl: Use pm_runtime_resume_and_get()\n pmdomain: imx8m-blk-ctrl: Use pm_runtime_resume_and_get()\n pmdomain: imx: gpcv2: Use pm_runtime_resume_and_get()\n pmdomain: rockchip: Fix domain check in rockchip_pm_add_one_domain()\n pmdomain: core: Fall back to node name for idle states\n pmdomain: renesas: r8a78000: Fix lockdep false positive\n pmdomain: fix typo \"releated\" in comment\n pmdomain: imx: Propagate SCU provider registration failures\n ...\n" }, { "commit": "03480653ddfd1b004dc622acb4fa913b05c3edaa", "tree": "5523a2d035f09a3dfbb57c09f359b13c0ddf026f", "parents": [ "9aa54fb74ead1737b92a9dc2f7a5d9d5e48dc7b5", "fd9af27f6c2319713bb23832066585f8a59a1771" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:29:07 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:29:07 2026 -1000" }, "message": "Merge tag \u0027mmc-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC updates from Ulf Hansson:\n \"MMC core:\n - Add a power-off-delay-us DT property to support HW specific delays\n - Add mmc_send_tuning_timeout() to allow hosts to specify a timeout\n - Enable hosts to control the re-programming of the crypto keys\n\n MMC host:\n - dw_mmc: Add a common watchdog and convert the various timeouts to use it\n - dw_mmc: Expose the watchdog state in debugfs\n - dw_mmc-rockchip: Use a tighter per command tuning timeout\n - greybus-sdio: Convert to devm_mmc_alloc_host()\n - meson-gx: Enable the bus pipeline clock on T7\n - rtsx_usb_sdmmc: Start card power-up at 3.3V\n - sdhci-cadence: Add Altera Agilex5 SD6HC support\n - sdhci-cadence: Add Cadence SD6HC support\n - sdhci-msm: Add support for the MSM8952 and Maili variants\n - sdhci-msm: Use pm ops to better manage restoring of crypto keys\n - sdhci-of-dwcmshc: Disable CQE error halt request for Rockchip\n - sdhci-pxav3: Disable clock inversion for SD HS cards\n - sunplus: Fixup initialization for DDR modes\n - sunxi: Add support for Allwinner B288\n - vub300: Remove the driver for the obsolete HW\"\n\n* tag \u0027mmc-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (43 commits)\n dt-bindings: mmc: sun4i-a10-mmc: add Allwinner B288\n mmc: dw_mmc-rockchip: use a tighter per-command tuning timeout\n mmc: core: add mmc_send_tuning_timeout()\n mmc: sdhci-of-dwcmshc: Disable CQE error halt request for Rockchip\n dt-bindings: mmc: sdhci-msm: Add MSM8952 compatible\n mmc: use assign_bit() where applicable\n mmc: sdhci-pci: Replace deprecated PCI functions\n mmc: sunplus: initialise rd_crc_dly\u003d1 for DDR modes\n mmc: core: fix stale mmc_start_req() references in comments\n docs: mmc: fix stale async request documentation\n docs: mmc: document eMMC health status support in mmc-tools\n mmc: cavium-thunderx: Drop redundant calls to get|put_device()\n mmc: core: Turn mmc_alloc|free_host() into static functions\n staging: greybus: sdio: Convert to devm_mmc_alloc_host()\n mmc: vub300: Remove the driver for the obsolete HW\n mmc: dw_mmc: remove unused slot member\n mmc: sdhci-pxav3: avoid of_node\n CREDITS: Add Pierre Ossman\n mmc: fix typos in comments\n mmc: meson-gx: enable the bus pipeline clock on T7\n ...\n" }, { "commit": "9aa54fb74ead1737b92a9dc2f7a5d9d5e48dc7b5", "tree": "c6c88491978082614d156ae91e58aa9e2169a2a0", "parents": [ "6ef8f742f9008132db003313bf7a6ca2edb8bbae", "2dee91ee94eec85d09c13c7ca83e3005906d3732" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:23:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:23:27 2026 -1000" }, "message": "Merge tag \u0027regmap-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap updates from Mark Brown:\n \"This is a relatively busy release, mostly due to the general cleanup\n work which people have been doing throughout the kernel - for regmap\n that\u0027s mostly been some work from Peng Fan.\n\n I also added some more tests for the sparse caches to catch some\n gotchas people might run into trying to improve the maple cache.\n\n - Test very high register numbers to help people avoid a nasty gotcha\n trying to optimise the maple cache\n\n - Make more use of scoped lock and allocation guards\n\n - A couple of other smaller improvements and fixes\"\n\n* tag \u0027regmap-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: debugfs: Use __free(kfree) for regmap_reg_ranges_read_file\n regmap: debugfs: Use guard to simplify code\n regmap: debugfs: Use __free(kfree) in regmap_name_read_file()\n regmap: fix potential double-free of map-\u003ereg_defaults on cache reinit\n regmap: use krealloc_array() in regmap_register_patch()\n regcache: simplify control flow and reduce nesting\n regcache: extract __regcache_sync() to deduplicate sync dispatch\n regcache: extract locked helpers to replace open-coded lock/unlock pairs\n regmap: debugfs: use the regmap scoped lock guard\n regcache: rbtree: use the regmap scoped lock guard\n regcache: use the regmap scoped lock guard\n regmap: convert lock/unlock to a scoped guard\n regmap: fix typo \"asynchrnous\" in comment\n regmap: Test rbtree and maple caches for very high register numbers\n regmap: Allow a base register to be specified for the RAM regmap\n" }, { "commit": "6ef8f742f9008132db003313bf7a6ca2edb8bbae", "tree": "a0320a0403df3621a688d2e9424c676aa81ae850", "parents": [ "003e5a0c479e16f06b7684a1b82543aa941a5043", "d5acef12e819c1627c8bf6a0325845ab39d8c99d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:16:16 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:16:16 2026 -1000" }, "message": "Merge tag \u0027spi-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi updates from Mark Brown:\n \"Quite a lot of work in the SPI subsystem this time around, almost all\n in drivers rather than the core.\n\n As well as the general cleanup/fix work we\u0027re seeing over most of the\n kernel there\u0027s been some substantial performance work to two existing\n drivers and support for a number of new devices including a couple of\n new drivers. There was also a big overhaul of the spidev_test utility\n from the Pengutronix people.\n\n - Improvements for spidev_test to cover additional use cases, plus be\n a bit easier to use.\n\n - Substantial performance work in both DesignWare and Tegra210 QSPI\n drivers, making their interrupt handling more efficient to drive up\n hardware utilisation.\n\n - Documentation clarifications.\n\n - Fixes for some runtime PM and error handling issues.\n\n - Support for Nuvoton MA35D1, Qualcomm QPIC SNAND v2, Renesas R-Car\n Gen5 and X5H and Realtek RTD1625\"\n\n* tag \u0027spi-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (136 commits)\n spi: ch341: handle transfers without a TX or RX buffer\n spi: dt-bindings: spi-qpic-snand: Add IPQ9650 compatible\n spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout\n spi: amd: fix len\u003d\u003d0 underflow and FIFO overflow\n spi: tegra114: initialize native chip selects inactive\n spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op\n spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer\n spi: omap2-mcspi: handle DMA setup failures\n spi: jcore: fix divide-by-zero when speed_hz is zero\n spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path\n spi: cadence-xspi: reject SDMA transfers larger than the requested length\n spi: meson-spicc: fix invalid DMA unmap on mapping failure\n spi: s3c64xx: Use snprintf() instead of sprintf()\n spi: omap2-mcspi: Use snprintf() instead of sprintf()\n spi: tle62x0: Use kstrtoul() instead of simple_strtoul()\n spi: lm70llp: Use strscpy() instead of strcpy()\n spi: butterfly: Use strscpy() instead of strcpy()\n spi: jcore: Use devm_platform_ioremap_resource()\n spi: sh-hspi: Use devm_platform_ioremap_resource()\n spi: ljca: validate the response length before copying the data\n ...\n" }, { "commit": "003e5a0c479e16f06b7684a1b82543aa941a5043", "tree": "1e03fe19b81e1d03b99de0cca5830cb2dbf7b588", "parents": [ "5a12cbf26134d417531289e89375bbe580803dec", "ba83dd4a47bb47da3d2791b2ad6cd816a851b5d0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:08:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:08:48 2026 -1000" }, "message": "Merge tag \u0027regulator-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator updates from Mark Brown:\n \"This is quite a quiet release, especially given the general onslaught\n of cleanup patches seen elsewhere. There is some of that, but not as\n much as I\u0027m seeing elsewhere relatively to the size of the subsystem.\n We do have some new drivers as well, plus Linus Walleij has done a big\n overhaul of the AB8500 driver including feature buildout.\n\n - Substantial cleanups and feature additions for the ST Ericsson AB8500\n\n - Overhaul of the configuration for the LP872x.\n\n - A bunch of DT binding conversions\n\n - Support for Maxim MAX20024, MPS MPQ4210, Nexperia NEX10000UB\"\n\n* tag \u0027regulator-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (60 commits)\n regulator: rpi-panel-attiny: Fix probe failure after a host cold boot\n regulator: lp872x: Use macro to fill regulator descriptor\n regulator: lp872x: Add support for input and regulator power supplies\n regulator: lp872x: Remove platform_data based probing\n regulator: lp872x: Remove redundant regmap wrappers\n regulator: lp872x: Fold driver header into driver file\n regulator: dt-bindings: ti,lp872x: Document input supplies\n regulator: dt-bindings: ti,lp872x: Deprecate ti,dvs-gpio and ti,update-config\n regulator: dt-bindings: sy8827n: support standard properties\n regulator: dt-bindings: Reference Tegra regulator coupling schema\n regulator: dt-bindings: nvidia,tegra-regulators-coupling: Convert to DT schema\n regulator: dt-bindings: ti,lp872x: Convert to DT schema\n regulator: dt-bindings: Drop obsolete MAX8925 .txt binding\n regulator: 88pm886: Add Vbus regulator\n regulator: core: Export helpers used by regulator couplers\n regulator: core: Fix coupled regulators reference leak on removal\n regulator: dt-bindings: ti,tps6586x: Convert to DT schema\n regulator: dt-bindings: Add MAX20024 sd4\n regulator: dt-bindings: Convert mediatek,mt6380-regulator to DT schema\n regulator: mp886x: fix pontential division by zero\n ...\n" }, { "commit": "5a12cbf26134d417531289e89375bbe580803dec", "tree": "c694976186da755776bcae583317495ec608e851", "parents": [ "bfa231bb4c7eae56b9967da19d1678bf0847259d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:03:40 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 07:03:40 2026 -1000" }, "message": "rust: missed rustfmt fix up in rust/kernel/mem.rs\n\nMiguel had mentioned this rustfmt issue, but I overlooked this one when\ndoing the driver core merge.\n\nMake rustfmt happy again.\n\nReminded-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "bfa231bb4c7eae56b9967da19d1678bf0847259d", "tree": "857a1be5784d9e9600ea1dac5fcd6e4bd67a7eec", "parents": [ "74b1dbf6f236f4fe88bd1077ae4657ca4b2c339e", "47f16cf7a6017212230985f6bc7f1b55b6d234d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:59:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:59:20 2026 -1000" }, "message": "Merge tag \u0027gpio-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio updates from Bartosz Golaszewski:\n \"Nothing stands out as particularly interesting, it\u0027s been a calm\n cycle. We have three new drivers, support for more models and lots of\n updates across many modules (details are in the signed tag as usual).\n There are also some minor changes and additions to the in-kernel GPIO\n API.\n\n GPIO core:\n - provide a new controller API: gpiochip_generic_get_config()\n - return -EOPNOTSUPP instead of -ENODEV to user-space if it requests\n hardware timestamping on systems where it\u0027s unavailable (no\n user-space regressions reported)\n\n New drivers:\n - add a driver for ROHM BD73800 PMIC GPIO controller\n - add a driver for Axiado AX3005 SGPIO controller\n - add a driver for Analog Devices AD7768 GPIO controller\n\n New hardware support:\n - extend gpio-rcar with support for R-Car X5H (R8A78000)\n - extend gpio-tegra186 with support for Tegra 268\n\n Driver changes:\n - refactor and improve gpio-rtd1625: switch to modern or better\n fitting interfaces and improve coding style\n - improve error handling of return values of\n platform_get_irq_optional() in several drivers\n - normalize the return value of the gpio_chip::get() callback in\n gpio-siox in order to not propagate invalid values up to the GPIO\n core\n - implement gpio_chip::get_direction() for gpio-pcf857x\n - use managed variants of notifier registration functions in several\n drivers\n - remove legacy gpio_set_value_cansleep() as it has no more users\n - add pinctrl support to gpio-realtek-otto\n - add runtime PM support to the gpio-regmap helper module\n - add more ACPI GPIO quirks for various hardware\n - stop needlessly reading gpio_chip::base in gpio-pxa\n - add support for tracking of direction of generic GPIO chips with no\n direction registers via pinctrl backend to gpio-mmio (use the new\n core API: gpiochip_generic_get_config())\n - use the \"safe\" variants of debugfs_create_file() in\n gpio-sloppy-analyzer\n - use device name as GPIO chip label in gpio-omap\n - refactor bit ops in gpio-dln2\n - prepare gpio-it87 for upcoming kmalloc_obj() conversion\n\n Devicetree bindings:\n - document new model in gpio-pca95xx\n - allow the gpio-hogs property in gpio-zynq and fsl,qoriq-gpio\n - allow the gpio-ranges property in gpio-realtek-otto\n\n Misc fixes:\n - add missing MODULE_ALIAS() to gpio-crystalcove\n - fix a comment typo in example GPIO tools\n - fix unbalanced brackets in documentation\n - add names to regmaps in gpio-mvebu to avoid collisions in debugfs\n output\n - fix GPIO lookup using relative paths in GPIO ACPI\"\n\n* tag \u0027gpio-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (63 commits)\n gpiolib: acpi: Fix GPIO lookup using relative path\n gpio: legacy: Kill gpio_set_value_cansleep()\n dt-bindings: gpio: pca95xx: add onnn,pca9655 with nxp,pca9555 fallback\n gpiolib: acpi: Ignore GPIO 11 interrupt on Acer Nitro V 16S AI\n gpio: pxa: stop reading gpio_chip::base in direction callbacks\n gpio: axiado: add AX3005 SGPIO controller support\n dt-bindings: gpio: add Axiado AX3005 SGPIO controller\n gpiolib: acpi: Add quirk for Lenovo IdeaPad Slim 3 15ABR8\n MAINTAINERS: Add ROHM BD73800 PMIC files\n gpio: bd73800: Support ROHM BD73800 PMIC GPIOs\n clk: bd718x7: Support ROHM BD73800\n regulator: bd71828: Support ROHM BD73800\n rtc: bd70528: Support RTC on ROHM BD73800\n mfd: Support for ROHM BD73800 PMIC core\n dt-bindings: mfd: ROHM BD73800 PMIC\n dt-bindings: regulator: ROHM BD73800 regulators\n dt-bindings: rohm,bd*: Ref common ROHM bindings\n dt-bindings: mfd: Common ROHM PMIC properties\n gpio: siox: normalize return value of gpio_get()\n gpio: dln2: use assign_bit() where applicable\n ...\n" }, { "commit": "74b1dbf6f236f4fe88bd1077ae4657ca4b2c339e", "tree": "8ac15152cc01c612f89c25232b7e2738ae902b48", "parents": [ "b0e1eda687a2f19a8fa3958303fbb45d493ea46b", "eadea156f11b2c9a780b60c1699c2da145c9d1f2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:56:33 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:56:33 2026 -1000" }, "message": "Merge tag \u0027pwrseq-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull power sequencing updates from Bartosz Golaszewski:\n \"The bulk of added lines are kunit tests that comprehensively verify\n the core functionality of the power sequencing framework.\n\n Other than that, we have another pwrseq driver: Renesas RZ/G3L Power\n Ready and support for more models in pwrseq-pcie-m2. We also added a\n new consumer-facing API in the form of pwrseq_is_controllable()\n function which allows consumers to check if a given target resource is\n actually host-controllable.\n\n Summary:\n\n Power sequencing core:\n - add a suite of kunit test cases for the power sequencing core\n functionalities\n - provide a new consumer API: pwrseq_is_controllable()\n\n New Drivers:\n - add the Renesas RZ/G3L Power Ready driver which provides\n information on power readiness for various IPs on RZ/G3L\n\n Driver changes:\n - use pwrseq_is_controllable() to report controllability to consumers\n in pwrseq-qcom-wcn and pwrseq-pcie-m2\n - add support for PCIe switch topologies to pwrseq-pcie-m2\n - add the PCI ID for Foxconn WCN7850 to pwrseq-pcie-m2\"\n\n* tag \u0027pwrseq-updates-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n power: sequencing: pcie-m2: Add Foxconn WCN7850 subsystem PCI ID\n power: sequencing: qcom-wcn: Report power controllability\n power: sequencing: pcie-m2: Report power controllability\n power: sequencing: Add pwrseq_is_controllable() API\n power: sequencing: add kunit test cases\n power: sequencing: pwrseq-pcie-m2: Support PCIe switch topologies\n power: sequencing: Add Renesas RZ/G3L Power Ready driver\n" }, { "commit": "b0e1eda687a2f19a8fa3958303fbb45d493ea46b", "tree": "5b93d55489e7299b5649c5afbd66e24c55cacbe7", "parents": [ "7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614", "00e917df050d79ac26ec700717680ad6421d2808" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:44:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 22 06:44:27 2026 -1000" }, "message": "Merge tag \u0027pwm/for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux\n\nPull pwm updates from Uwe Kleine-König:\n \"The usual mix of fixes for older issues, devicetree changes and\n cleanups.\n\n Part of this is a shared branch that introduces device-managed\n variants of atomic_notifier_chain_register() and\n blocking_notifier_chain_register()\"\n\n* tag \u0027pwm/for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:\n dt-bindings: pwm: Add IPQ5210 binding\n pwm: tiehrpwm: Clear period on disable to allow reconfiguration\n pwm: Allow 32-bit tasks to use the character device\n pwm: lp3943: fix NULL pointer dereference for an unconfigured channel\n pwm: mtk-disp: Fix period readback\n pwm: ipq: Prevent potential 32-bit integer overflow in hi_div calculation\n pwm: loongson: Reload PWM configuration through counter reset\n pwm: Fix typos in comments\n dt-bindings: pwm: Convert TI PWM Subsystem to DT schema\n docs: pwm: Fix bracket and punctuation\n pwm: iqs620a: Use devm_blocking_notifier_chain_register()\n pwm: renesas-tpu: Fix runtime PM reference leak\n notifier: add device-managed registration APIs\n" }, { "commit": "1a2c35c49cc7c6be860038b8442b52424a8f123c", "tree": "74a0a06d9a09392c4f117115593686889c689cc6", "parents": [ "207dd12bc195153fe6ca614d8add9ecb0b636270" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 17:21:01 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 17:45:45 2026 +0200" }, "message": "Bluetooth: btusb: disable by default Qualcomm multi-subsystem\n\nNew knobs should default to \u0027n\u0027. The mentioned one depends on\nBT_HCIBTUSB, but the latter is enabled on most systems.\n\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47193113641e5e1f9b5758b73d7b7a0273acb836", "tree": "6eeec07677ff10922fe134ffb3bbb140b27f7380", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Mon Sep 28 20:17:32 2026 -0300" }, "committer": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Thu Oct 22 10:31:23 2026 -0300" }, "message": "coco/tsm: Update maintainership\n\nWith Dan\u0027s passing Alexey, Aneesh and Jason have volunteered to take this\non, with the support of their employers.\n\nReviewed-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nReviewed-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nReviewed-by: Lukas Wunner \u003clukas@wunner.de\u003e\nAcked-by: Aneesh Kumar K.V (Arm) \u003caneesh.kumar@kernel.org\u003e\nAcked-by: Suzuki K Poulose \u003csuzuki.poulose@arm.com\u003e\nAcked-by: Mathieu Poirier \u003cmathieu.poirier@linaro.org\u003e\nAcked-by: Jonathan Cameron \u003cjonathan.cameron@oss.qualcomm.com\u003e\nAcked-by: Dave Jiang \u003cdave.jiang@intel.com\u003e\nAcked-by: Ankit Agrawal \u003cankita@nvidia.com\u003e\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "207dd12bc195153fe6ca614d8add9ecb0b636270", "tree": "dbaa855c271985e94a813cea919eb9396c99da84", "parents": [ "f71ff7d406523748bfb8236830c7eaa6a308aaa1", "f4377bf85887f57b59abb5479f7660a81ffe4449" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 11:41:47 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 11:45:58 2026 +0200" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nMerge in late fixes in preparation for the net-next PR.\n\nConflicts:\n\nnet/netfilter/nf_conntrack_netlink.c\n cd37ab22a74e0 (\"netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter\")\n 1ae2d094b0200 (\"netfilter: ctnetlink: fix inverted IPv6 address match in dump filter\")\n\nAdjacent changes:\n\ndrivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c\n 8830e65ed46de (\"net: use assign_bit() where applicable\")\n 07bd391eb957 (\"octeontx2-af: Fix CQ enable state tracking after AQ writes\")\n\nnet/core/sock.c\n 31c5ea8a3296 (\"ipv6: Remove IPV6_ADDRFORM.\")\n 31b564f70d88 (\"net: use the full socket in sk_mc_loop()\")\n\nnet/mptcp/protocol.h\n 0cb6910130a3 (\"mptcp: remove thmac from subflow ctx\")\n 7538fa33bb2f (\"mptcp: fix subflow bitfield misuse\")\n\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f4377bf85887f57b59abb5479f7660a81ffe4449", "tree": "28bf081d9b549d234587a2de4621971a294b19a6", "parents": [ "473167593f42551ce6b00c05cee8cd20309d45ac" ], "author": { "name": "Henry Martin", "email": "bsdhenrymartin@gmail.com", "time": "Mon Oct 19 19:58:59 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 11:05:31 2026 +0200" }, "message": "tipc: fix broadcast sender hang on last acker departure\n\nTIPC group broadcast senders are blocked while a replicast still has\noutstanding member acks: tipc_group_bc_cong() returns true as long as\ngrp-\u003ebc_ackers is non-zero, and clears *grp-\u003eopen, which is what\ntipc_poll() uses to report EPOLLOUT (via tsk-\u003egroup_is_open).\n\nWhen the last outstanding acker departs before acking,\ntipc_group_delete_member() decrements grp-\u003ebc_ackers to zero but\nnever restores *grp-\u003eopen. As a result poll(EPOLLOUT) never fires\nagain. A writer blocked in sendmsg() is only released if some other\nwakeup happens after the deletion: with TIPC_GROUP_MEMBER_EVTS the\nleave event delivery calls sk_data_ready() and wakes it, but without\nmember events nothing does and it sleeps indefinitely, since the\ndefault send timeout is MAX_SCHEDULE_TIMEOUT.\n\nCommit 99cc2a62e07a (\"tipc: reject invalid and unexpected\nGRP_ACK_MSG to prevent bc_ackers underflow\") already calls this out\nin its changelog as a pre-existing issue.\n\nRestore the open state exactly on the 1-\u003e0 transition in the delete\npath, mirroring the GRP_ACK_MSG completion path, and invoke\nsk-\u003esk_write_space() from tipc_sk_filter_rcv() when the group just\nbecame writable again.\n\nAlso make the ack accounting precise. The delete path used to test\nless(m-\u003ebc_acked, grp-\u003ebc_snd_nxt - 1), which also matches members\nthat were never counted for the current replicast (JOINING/LEAVING\nmembers keep a stale bc_acked), and the GRP_ACK_MSG handler accepted\nan ack from any member whose bc_acked differed from the expected\nvalue. Either could zero bc_ackers on behalf of a member that owes\nnothing and silently void an ack still owed by a real acker. Track\nwhether a member owes an ack for the current replicast in a new\nper-member bc_pending flag, set when the member is counted and\ncleared when its ack arrives, and use it both to accept an ack and\nto decide on deletion. bc_acked has no remaining user and is\nremoved. Suggested by Tung Quang Nguyen.\n\nThis issue was discovered by Tencent CodeBuddy Security.\n\nCc: stable@vger.kernel.org\nFixes: 2f487712b893 (\"tipc: guarantee that group broadcast doesn\u0027t bypass group unicast\")\nSigned-off-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20261019115859.3471295-1-bsdhenrymartin@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "473167593f42551ce6b00c05cee8cd20309d45ac", "tree": "b6a8ce95b6694066b02969f999ab8b6a73ea492a", "parents": [ "ffdf678dd16610e3f006dac904bd37c09684673c" ], "author": { "name": "Binbin Deng", "email": "18983559317@163.com", "time": "Mon Oct 19 18:43:52 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 22 10:42:23 2026 +0200" }, "message": "tipc: fix use-after-free of broadcast reception link at node release\n\nWhen the last reference to a tipc_node is dropped, the node itself is\ndeferred to the RCU callback tipc_node_free(), but the nested broadcast\nreception link, n-\u003ebc_entry.link, is kfree()d synchronously in\ntipc_node_kref_release(), before call_rcu(), and the pointer is never\ncleared. Readers that obtained the node from node_list and then\ndereference bc_entry.link deep into the link (tipc_link_name() in\ntipc_nl_node_reset_link_stats(), bcl-\u003ename/stats in\ntipc_nl_add_bc_link() on the link dump path) therefore touch freed\nmemory although the enclosing node stays alive for a full grace period.\nThe sibling per-bearer links get \"kfree + NULL\" under the node write\nlock in tipc_node_clear_links(); the broadcast entry was missed.\n\nThe race is reachable through the node cleanup timer: once a peer has\nbeen unreachable for NODE_CLEANUP_AFTER (300 s), tipc_node_timeout() -\u003e\ntipc_node_cleanup() unlinks the node under the write lock, and the\nfinal tipc_node_put() at the caller runs outside node_list_lock, so the\nkfree executes in timer softirq context, concurrently with genl dump/\nreset walkers that hold only rcu_read_lock(). (A netlink \"peer remove\"\ncannot race those walkers itself: tipc_genl_family has no parallel_ops,\nso all doit/dumpit calls serialize on the global genl lock.)\n\nReproduced in a QEMU/KVM guest running v7.3.0 with KASAN and\nPREEMPT(full): 10 TIPC peer namespaces on veth bearers, bearer removal\nstaggered so the 300 s node cleanup timers expire while other tasks\nloop link dumps with the broadcast filter and reset-link-stats lookups.\nKASAN hit within two cleanup cycles:\n\n BUG: KASAN: slab-use-after-free in strlen+0x85/0xa0\n Read of size 1 at addr ffff88800b54a004 by task poc_eth/371\n strlen+0x85/0xa0\n tipc_nl_add_bc_link+0x2f9/0xd40\n __tipc_nl_add_node_links+0x10c/0x140\n tipc_nl_node_dump_link+0x8d5/0xd50\n Freed by task 0:\n kfree+0x121/0x380\n tipc_node_timeout+0xa33/0xcf0\n run_timer_softirq+0x144/0x250\n sysvec_apic_timer_interrupt\n\nwith the freed object being the kmalloc-1k tipc_link allocated by\ntipc_link_bc_create() during peer discovery. The same defect fires in\nstrcmp() called from tipc_nl_node_reset_link_stats().\n\nMove the kfree of n-\u003ebc_entry.link into the tipc_node_free() RCU\ncallback so the broadcast link lives exactly as long as the enclosing\nnode. All readers are covered: the netlink walkers are inside\nrcu_read_lock(), and the packet reception path reaches the node via\ntipc_node_find(), whose kref defers kref_release itself.\n\nFound during a static-analysis-assisted audit: candidate sites were\nsurfaced by a Coccinelle rule, and the reader/writer paths were\nconfirmed by LLM-assisted (GLM-5.3) code inspection.\n\nFixes: d25a01257e42 (\"tipc: fix crash during node removal\")\nAssisted-by: GLM-5.3 coccinelle\nSigned-off-by: Binbin Deng \u003c18983559317@163.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20261019104352.488347-1-18983559317@163.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614", "tree": "c5705f05f97dd869c257a1c35db062eba3fbd5c6", "parents": [ "4403278e4ea2f654f8130a5c03eb8b4516a0f201", "d4ffc4896b3e709c6a5d7e5a78a1fddfc774fa25" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 18:53:14 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 18:53:14 2026 -1000" }, "message": "Merge tag \u0027driver-core-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core updates from Danilo Krummrich:\n \"Core:\n\n - Add TAINT_FORCED_BIND to taint the kernel and driver module before\n manual sysfs bind/unbind operations; make add_taint_module()\n available to driver core and update taint decoding tools and\n documentation\n\n - Constify device_show/store_*() attribute parameters and adapt x86\n MCE and perf users to prepare for const dev_ext_attribute instances\n\n - Fix UAF in NUMA access node registration failure handling by\n dropping the device reference with put_device() instead of directly\n freeing the node\n\n debugfs:\n\n - Make debugfs_create_str() read-only to eliminate double-free races\n between concurrent writers; reject writable modes; convert\n interconnect and SoundWire users to local file operations with\n mutex-protected strings\n\n kobject:\n\n - Fix out-of-bounds access in kobject_action_type() when parsing\n action strings containing embedded NUL bytes\n\n - Fix the kobject_set_name() reference in kset_register() kernel-doc\n\n Rust:\n\n - DMA:\n\n - Tie Coherent, CoherentBox and CoherentHandle to the device\u0027s\n bound lifetime to prevent retaining DMA allocations beyond\n driver unbind; propagate the lifetime through nova-core and the\n DMA sample driver\n\n - I/O:\n\n - Require explicit base types for registers and replace relative\n registers with typed subregion projections; reimplement\n register!() as a proc macro, support registers using existing\n types without inline bitfields, and convert nova-core, Tyr and\n the PCI sample; add AsRepr/AsReprMut and transmute helpers with\n deferred size checks for representation conversions\n\n - Wrap ResourceSize in a transparent newtype with explicit\n conversions, including checked conversion to usize\n\n - PCI:\n\n - Add typed PCIe extended capability lookup and SR-IOV accessors\n for the First VF Offset and decoded VF BAR addresses and widths,\n keeping raw SR-IOV registers private to preserve PCI core\n ownership of their state\n\n - scatterlist:\n\n - Honor the device\u0027s maximum segment size as well as the DMA\n mapping limit when constructing SG tables\n\n - Return u32 from SGEntry::dma_len() to match the C segment length\n type\n\n - misc:\n\n - Validate auxiliary DeviceId name length explicitly to improve\n compile-time diagnostics for oversized device ID table entries\n\n - Drop unnecessary \u0027static bounds from debugfs ScopedDir file\n creation methods to support data containing non-\u0027static\n references, including DMA buffers\n\n Misc:\n\n - Add Johan Hovold as driver core maintainer\n\n - Simplify platform_device_alloc() by returning early on allocation\n failure\n\n - Fix typos in driver core and kernfs comments\"\n\n* tag \u0027driver-core-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)\n rust: pci: add extended capability and SR-IOV support\n kobject: Fix the kobj_set_name reference in kset_register() kernel-doc\n rust: io: convert ResourceSize into a transparent newtype\n rust: scatterlist: return u32 from SGEntry::dma_len()\n MAINTAINERS: add myself as driver core maintainer\n debugfs: make debugfs_create_str() read-only\n soundwire: debugfs: replace writable string helper\n interconnect: debugfs: replace writable string helper\n docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted\n driver core: platform: Simplify platform_device_alloc()\n kobject: fix out-of-bounds access in kobject_action_type()\n rust: scatterlist: honor the device\u0027s maximum segment size\n driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers\n module: fix up documentation for add_taint() and add_taint_module()\n module: pull out add_taint_module() to be public\n driver core: Constify the signature of device_show/store_*()\n drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute\n x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute\n rust: auxiliary: validate DeviceId name length\n driver core: fix typos in comments\n ...\n" }, { "commit": "f71ff7d406523748bfb8236830c7eaa6a308aaa1", "tree": "b44ca64862c2b2dea4e9fe2c572bbc40f3d046c4", "parents": [ "82858f249d65126539aa4297677b468fd6619041" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Tue Oct 20 12:15:42 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 18:07:08 2026 -0700" }, "message": "r8169: clear TX LPI on RTL8168h at link up after phylink conversion\n\nCommit 3cdeaef1754a (\"r8169: disable EEE on RTL8168h/8111h\") disables\nEEE on RTL_GIGA_MAC_VER_46 with phy_disable_eee() but keeps the version\nEEE-capable, so that link up still calls rtl_enable_tx_lpi(tp, false)\nand clears the MAC TX-LPI bits (ERI 0x1b0[1:0]). rtl_hw_start_8168h_1()\ndoes not clear them, so a warm reboot from an EEE-active state could\notherwise leave TX-LPI asserted while the PHY no longer negotiates EEE.\n\nIn net-next, commit 8a3c76523e44 (\"r8169: add support for phylink\")\nmoved link handling to phylink, and rtl_mac_link_up() does not touch\nthe TX-LPI bits. The merge of net into net-next kept the\nphy_disable_eee() quirk and its comment, but not the link-up clear it\ndepends on. The only remaining clear is rtl_mac_disable_tx_lpi(), which\nphylink calls from phylink_deactivate_lpi() only after\nphylink_activate_lpi() has enabled LPI. With EEE disabled on this chip\nthat never happens, so the bits are never cleared and the comment in\nr8169_mdio_register() no longer holds.\n\nClear TX-LPI explicitly in rtl_mac_link_up() for RTL_GIGA_MAC_VER_46.\n\nFixes: f49defea7668 (\"Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\")\nLink: https://lore.kernel.org/all/0e0b727e94d046b19ad463e7a1a9fe68@realsil.com.cn/\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nLink: https://patch.msgid.link/20261020161543.3712208-1-sashal@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ffdf678dd16610e3f006dac904bd37c09684673c", "tree": "5573d6630e8790e7a8bcfd10ca2752d3fa7c813a", "parents": [ "a55eb6a622141352131aa6156bbd6ce5da79d9b5" ], "author": { "name": "David Woodhouse", "email": "dwmw@amazon.co.uk", "time": "Tue Oct 20 10:48:10 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 18:05:49 2026 -0700" }, "message": "tun: Require CAP_NET_ADMIN to attach to an ownerless device\n\nTwenty years ago I made creating a tuntap device require CAP_NET_ADMIN\nin commit ca6bb5d7ab22 (\"[NET]: Require CAP_NET_ADMIN to create tuntap\ndevices.\")\n\nThe idea was to allow the permissions on /dev/net/tun to be relaxed to\n0666 and thus allow owners of tun devices assigned with TUNSETOWNER to\nactually open it and get at their devices.\n\nWhat we missed at the time was that persistent devices with *no* owner\nwere already essentially world-consumable, and anyone who could open\nthe device node could also attach to those.\n\nEven then, using persistent devices with no explicitly set owner — on\nthe (false) presumption that CAP_NET_ADMIN would be required to open\nthem — wasn\u0027t an egregious userspace bug. There are cases where it does\nmake sense to separate the creation/configuration of the netdevice, from\nthe process which shovels packets into it.\n\nSince then, TUNSETGROUP was added a year later in commit 8c644623fe7e\n(\"[NET]: Allow group ownership of TUN/TAP devices.\"). Its commit message\nnoted that if both uid and gid are set, both have to match (in itself a\nbizarre choice) — but still not that with *neither* set, no permission\nat all was required.\n\nThen in 2012 commit c8d68e6be1c3 (\"tuntap: multiqueue support\") allowed\nnew queues to be attached to a device from the moment of its creation,\nwith no way for userspace to close the race between creation and a\nsubsequent TUNSET{OWNER,GROUP}.\n\nIn 2024, commit 3ca459eaba1bf (\"tun: fix group permission check\") tried\nto fix things to be saner: only require the user *or* the group to\nmatch, in line with standard POSIX permissions, and require\nCAP_NET_ADMIN if neither the user nor group authorised the access\n(although it put the CAP_NET_ADMIN check first, and would wrongly have\nreported the capability as having been used even when it was not).\n\nThat fix was reverted in commit a70c7b3cbc06 (\"tun: revert fix group\npermission check\") due to allegedly causing a regression in an selinux\ntest suite which *expected* the attachment to succeed when authorised\nby none of user, group, nor CAP_NET_ADMIN:\nhttps://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/\n\nWe should not break UAPI. But we don\u0027t have to consider an selinux test\ncase which deliberately exercises a security flaw to be UAPI worth\npreserving either. To which end, I have fixed it in selinux-testsuite\ncommit b2f894f0016b (\"tests/tun_tap: set an owner on the device for the\nrelabel tests\").\n\nSo: fix the lack of CAP_NET_ADMIN check on devices which *haven\u0027t* been\nassigned an owner or group, while leaving the weird tun ownership model\nas it was (user *and* group have to match, if both are set). If someone\nstill wants to fix the latter (which wasn\u0027t actually the reason the\nprevious attempt was reverted), they can do it under separate cover.\n\nPermit attaching to an existing device only if an owner and/or group was\nset and the caller matches all that were set, or if the caller has\nCAP_NET_ADMIN. The only behavioural change is that a device with no\nowner or group now requires CAP_NET_ADMIN to attach — precisely the\nloophole we want to close.\n\nAnd put the CAP_NET_ADMIN check in the right place this time.\n\nFixes: ca6bb5d7ab22 (\"[NET]: Require CAP_NET_ADMIN to create tuntap devices.\")\nReported-by: Andrew Lutomirski \u003cluto@kernel.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw@amazon.co.uk\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/3c77f88acff5b3c2617b22d64faad15f6212619c.camel@infradead.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "82858f249d65126539aa4297677b468fd6619041", "tree": "a018db54f936f95c4f746f9d30fda25d6c3cf09f", "parents": [ "46cbf85155e5451b6682ea0c17bc62ec564aec36", "700b4c6c70d6a36e6878c5ea092c4877da3f10d8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:25 2026 -0700" }, "message": "Merge branch \u0027net-sched-sch_cake-fixes-for-accounting-and-reconfiguration\u0027\n\nJamal Hadi Salim says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: sch_cake: fixes for accounting and reconfiguration\n\nFour independent fixes in the CAKE qdisc. Three are follow-ups to the\nautorate reconfiguration work around commit 7cbfb180945c (\"net/sched:\nsch_cake: fix autorate reconfiguration throttling\") and the 32-bit\nadmission-counter wraps fixed in gred/bfifo/plug by commit 4c660ee8c809\n(\"net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue\");\nthe fourth is a dead-code cleanup found while auditing the dump path.\n\nPatch 1 serializes a \u0027tc qdisc change\u0027 with the datapath\u0027s autorate\nupdate under the qdisc lock, so the netlink writer and the autorate\nwriter can no longer lose the configured rate. rate_bps needs no atomic\n(it is only loaded and stored), so it stays a plain u64 with\nREAD_ONCE()/WRITE_ONCE() annotations.\n\nPatch 2 propagates the backlog reduction of the reconfigure-time tin\npurge to classful parents, so a CAKE leaf under HTB no longer leaves the\npurged packets in the parent\u0027s qlen/backlog forever.\n\nPatch 3 widens buffer_used and buffer_max_used to u64. The u32\naccumulator wraps once the resident truesize passes 2^32, bypassing the\nover-limit drop loop while the configured limit is a u32 attribute; the\nu32 MEMORY_USED export is clamped so widening the counter does not\ntruncate the reported value.\n\nPatch 4 drops an unreachable \u0027nla_nest_end() \u003c 0\u0027 error check: the\nhelper never returns a negative value.\n\nAll four are hardening for net-next (no Fixes:, no Cc: stable): the\ncounter wrap, the missing parent-backlog propagation and the\nreconfiguration race all predate any contract we could anchor a\nregression on. Patches 1-2 were reported by Sashiko (gemini) and patch\n3 comes from the gred 32-bit-wrap family; patch 4 is a static cleanup.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "700b4c6c70d6a36e6878c5ea092c4877da3f10d8", "tree": "a018db54f936f95c4f746f9d30fda25d6c3cf09f", "parents": [ "dc48c97e7c69215483beeb7d1d80e8e3adbd92c9" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:08 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:20 2026 -0700" }, "message": "net/sched/sch_cake: drop dead nla_nest_end() error check\n\ncake_dump_class_stats() closes the TCA_STATS_APP nest with\n\n\tif (nla_nest_end(d-\u003eskb, stats) \u003c 0)\n\t\treturn -1;\n\nnla_nest_end() never returns a negative value: it has a single\n`return skb-\u003elen;` and no error path (that is why the overflow-aware\nnla_nest_end_safe() helper was later added). The \u0027\u003c 0\u0027 test can never\nbe true, so the \u0027return -1\u0027 is unreachable dead code.\n\nDrop the check and close the nest with the bare statement, matching the\nsibling cake nests in the same file.\n\nThis issue was discovered while fixing a bug on the gate action, see:\nhttps://lore.kernel.org/netdev/QDISC-H19Z.v1.20261001053234@mojatatu.com/\n\nConditions to recreate the bug:\n- not runtime observable: the issue is found by inspection.\n\nLink: https://lore.kernel.org/netdev/87v77csd5q.fsf@toke.dk/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-4@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dc48c97e7c69215483beeb7d1d80e8e3adbd92c9", "tree": "177e4cc02968b0bfb60f1f590ff7ef4cb8030004", "parents": [ "d7010be1ba2337372ea32142951858f936c26e0d" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:07 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:19 2026 -0700" }, "message": "net/sched/sch_cake: widen buffer_used to u64\n\nThis is a follow-up to commit 4c660ee8c809 (\"net: sched: fix 32-bit\nbacklog wrap in gred, bfifo and plug enqueue\"), which promoted the\nbacklog + length admission sums in gred, bfifo and plug to u64. CAKE\u0027s\nown memory accounting has the same 32-bit wrap.\n\nThe issue:\ncake_sched_data.buffer_used accumulates skb-\u003etruesize and is compared\nagainst memory_limit:\n\n\tq-\u003ebuffer_used +\u003d skb-\u003etruesize;\n\tif (q-\u003ebuffer_used \u003c\u003d q-\u003ebuffer_limit)\n\t\treturn NET_XMIT_SUCCESS;\n\twhile (q-\u003ebuffer_used \u003e q-\u003ebuffer_limit)\n\t\tdrop...\n\nbuffer_used is u32, so once the resident truesize passes 2^32 it wraps to\na small value, the \u003c\u003d test passes and the drop loop is skipped even\nthough far more than the configured limit is queued. memory_limit is a\nu32 attribute (TCA_CAKE_MEMORY), so buffer_limit can be as large as\nU32_MAX and never caps buffer_used below the wrap point; with a large\nmemory_limit the queue then grows until the machine is out of memory.\n\nThe fix:\nWiden buffer_used and buffer_max_used to u64, the same shape as the\ngred/bfifo/plug fix. buffer_limit stays u32; the comparison promotes it\nto u64, so the bounded queue stops at the configured limit below 2^32 and\nthe counter can no longer wrap. buffer_used is subtracted on dequeue and\ndrop, so the widened type flows through unchanged. The ACK-filter\nreplacement applied the net delta as one expression,\nq-\u003ebuffer_used +\u003d skb-\u003etruesize - ack-\u003etruesize. Both operands are\nunsigned int, so the subtraction is evaluated at u32 and a larger removed\nACK wraps the delta; the old u32 accumulator folded that back to the\ncorrect net value, but the widened u64 accumulator would persist it as a\nroughly 4 GiB over-count. Apply the replacement as two exact operations\non the widened counter instead; the queue already accounts ack-\u003etruesize,\nso the subtraction cannot underflow.\n\nWidening the counters alone is incomplete because cake_dump_stats() still\nexports buffer_max_used through PUT_STAT_U32(MEMORY_USED, ...), and\ntc.yaml declares memory-used as u32. buffer_max_used only ever rises, so\nonce the widened counter passes 2^32 the export reports peak - 2^32 for\nthe rest of the qdisc\u0027s life. Clamp the exported value to U32_MAX; the\ncounter itself is unaffected.\n\nThe dump path runs without the qdisc lock: tc_fill_qdisc() passes NULL to\ngnet_stats_start_copy_compat(), so the reader races with the enqueue-side\nupdate. READ_ONCE() is not an atomic 64-bit load on 32-bit CPUs, so a\nreader can observe a torn high-water mark and report a bogus MEMORY_USED.\nPublish the counter as u64_stats_t under the qdisc lock, which the enqueue\npath already holds, and take a seqcount-protected snapshot in the dump.\nThe counter stays u64; only the exported value is bounded.\n\nConditions to recreate the bug:\nCAP_NET_ADMIN (root or a user namespace, the qdisc attach is gated by\nnetlink_net_capable(CAP_NET_ADMIN)).\n\nA TUN device is needed so the root qdisc can park packets instead of\ndropping them. Open /dev/net/tun, request TUNSETIFF with\nIFF_TUN | IFF_NO_PI | IFF_BACKPRESSURE and keep the fd open without\nreading it (run it in the background and stop it at teardown): with\nIFF_BACKPRESSURE the full tx ring calls netif_tx_stop_queue() rather than\ndropping, so the queue behind the qdisc can grow past 4 GiB of resident\ntruesize. A plain \u0027ip tuntap add\u0027 attaches no fd and does not request\nIFF_BACKPRESSURE, so it cannot park the queue this way.\n\n ip link set tun0 txqueuelen 32 up\n ip addr add 10.99.0.1/24 dev tun0\n tc qdisc add dev tun0 root handle 1: cake memlimit 4294967295\n\n # Then push more than 4 GiB of resident truesize through the qdisc: six\n # UDP senders using large SO_SNDBUFFORCE buffers send 1400-byte\n # datagrams (the reported OOM witness used 6 workers for 100 s on a\n # 12 GiB guest). On the unfixed kernel buffer_used wraps, the admission\n # test passes, the drop loop is bypassed and the guest runs out of\n # memory; with the fix the counter passes the limit without wrapping and\n # the excess is dropped.\n\n # The ACK-filter over-count is a separate corner: it needs ack-filter\n # enabled and a queued pure ACK whose truesize is larger than the\n # replacement ACK. Use a fresh interface (or \u0027tc qdisc change\u0027) rather\n # than a second root \u0027tc qdisc add\u0027 on an interface that already has a\n # qdisc:\n tc qdisc change dev tun0 root cake ack-filter\n\nCONFIG_NET_SCH_CAKE\u003dy and CONFIG_TUN\u003dy are required, and the\nmemory-residency recipe needs a root-run sender envelope with enough\nguest RAM to hold the queued data.\n\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260818095927.15901-1-jhs@mojatatu.com\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260818095927.15901-1-jhs@mojatatu.com\nLink: https://lore.kernel.org/netdev/20260818095927.15901-1-jhs@mojatatu.com/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-3@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d7010be1ba2337372ea32142951858f936c26e0d", "tree": "7f6037e124746b37de198c2a623d9438983a7e6e", "parents": [ "d23a16d907dc991614eb301830bff8e5b713fb56" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:06 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:19 2026 -0700" }, "message": "net/sched/sch_cake: reduce parent backlog when clearing a tin\n\nThe issue:\nCAKE has purged unused tins on DiffServ reconfiguration since commit\n83f8fd69af4f (\"sch_cake: Add DiffServ handling\") without propagating the\nresulting backlog reduction to classful parents. The issue was noticed\nwhile reviewing 7cbfb180945c, but predates that change.\n\ncake_clear_tin() drops every packet from a tin with\nkfree_skb_reason() but never calls qdisc_tree_reduce_backlog(), so a\nCAKE qdisc under a classful parent (e.g. HTB) leaves the dropped packets\nin the parent qdisc\u0027s and class\u0027s qlen/backlog accounting forever. The\nnormal dequeue path does reduce the parent; only the live reconfigure\npurge misses it.\n\nThe fix:\nTins are cleared from cake_reset() and, on reconfigure, from\ncake_configure_rates(). The qdisc core already owns the parent delta for\nthe reset path: qdisc_purge_queue() snapshots qlen/backlog, runs\nqdisc_reset(), then reduces the tree, so propagating the reduction from\ncake_clear_tin() itself would subtract the same backlog twice. Snapshot\nCAKE\u0027s qlen/backlog around only the reconfiguration purge in\ncake_configure_rates() and reduce the parent once afterwards, matching\nthe delta pattern already used by cake_enqueue().\n\nConditions to recreate the bug:\nput CAKE (diffserv8) under an HTB class, flood DSCP-classified traffic\ninto a high tin so it backlogs, then change CAKE to diffserv3. The HTB\nparent keeps the purged packets in its qlen and backlog; a kernel with\nthe fix shows the parent at the leaf\u0027s backlog (426b/5p) instead of\nretaining the purged packets.\n\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nLink: https://sashiko.dev/#/patchset/20260816012109.2865223-1-ooonea@gmail.com\nLink: https://lore.kernel.org/netdev/20260816012109.2865223-1-ooonea@gmail.com/\nLink: https://lore.kernel.org/netdev/8733ugtry8.fsf@toke.dk/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-2@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d23a16d907dc991614eb301830bff8e5b713fb56", "tree": "738394be55a8cfa8eb43d20c8b7215fa9d9ad031", "parents": [ "46cbf85155e5451b6682ea0c17bc62ec564aec36" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 20 07:00:05 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:58:19 2026 -0700" }, "message": "net/sched/sch_cake: serialize reconfiguration with the datapath\n\nThis is a follow-up to commit 7cbfb180945c (\"net/sched: sch_cake: fix\nautorate reconfiguration throttling\"). That change only stored\nlast_reconfig_time; it did not address the concurrency between the\nautorate rate update in cake_enqueue() and the netlink reconfiguration\npath, which the original review flagged.\n\nThe issue:\ncake_change() -\u003e cake_config_change() updates the fields of the shared\nstruct cake_sched_config under RTNL but not under the qdisc lock: it only\ntook sch_tree_lock() later, around cake_reconfigure(). The datapath in\nturn serializes cake_enqueue() with itself under the qdisc lock, and its\nautorate-ingress path stores the estimated rate into\nq-\u003econfig-\u003erate_bps. Two writers therefore update the same rate with no\ncommon lock:\n\n CPU0: cake_enqueue() sees CAKE_FLAG_AUTORATE_INGRESS, computes an\n estimate, and is about to store it.\n CPU1: \u0027tc qdisc change ... bandwidth X\u0027 clears autorate in its local\n rate_flags, writes rate_bps \u003d X, publishes the cleared flag, and\n waits in sch_tree_lock().\n CPU0: stores the estimate, calls cake_reconfigure(), and unlocks.\n CPU1: reconfigures from the estimate and returns.\n\nThe qdisc is left with autorate disabled but with the estimate installed\ninstead of X.\n\nThe fix:\nCommit the parsed configuration and reconfigure while holding the same\nqdisc lock that serializes the datapath, so the netlink writer and the\nautorate writer can no longer interleave. rate_bps needs no atomic: it is\nonly ever loaded and stored, so plain READ_ONCE()/WRITE_ONCE() annotations\nare enough for the accesses that run outside the lock. The lockless\npaths read the rate once into a local and reuse that value, so a single\ncoherent snapshot is used per operation.\n\nThe annotations do not make a 64-bit access single-copy atomic on 32-bit:\nREAD_ONCE()/WRITE_ONCE() are still two 32-bit accesses there. The lockless\nreaders -- cake_config_dump() and the cake_mq children, which observe the\nshared config under a different child\u0027s lock -- can therefore still see a\ntorn rate on 32-bit. That rate is an advisory shaper value and is accepted\nas best-effort; the state that must be consistent (the configured rate and\nthe autorate flag) is written under the qdisc lock.\n\nConditions to recreate the bug:\nThe lost update (a) needs no sanitizer. Put cake in autorate-ingress on a\ndevice, drive bursty traffic with gaps so the 250 ms autorate reconfiguration\nfires, and concurrently loop \u0027tc qdisc change ... cake bandwidth \u003cN\u003ekbit\u0027\nwithout autorate-ingress (specifying a bandwidth clears the flag).\nIf the autorate store lands after the change wrote its rate but before the\nchange reconfigures, the qdisc ends up with autorate disabled and the estimate\ninstalled instead of \u003cN\u003e; reading the rate back then shows the estimate, which\nan unfixed kernel can do and a fixed one cannot.\n(b) The unsynchronized access is reported by KCSAN: build with CONFIG_KCSAN\u003dy\nand run the same trigger with the change loop keeping autorate-ingress set;\nKCSAN reports a data race in cake_config_change / cake_enqueue.\nThe non-atomic 64-bit store only shows up as tearing on a 32-bit machine;\non 64-bit the store is atomic and KCSAN flags the access discipline instead.\n\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nLink: https://sashiko.dev/#/patchset/20260816012109.2865223-1-ooonea@gmail.com\nLink: https://lore.kernel.org/netdev/20260816012109.2865223-1-ooonea@gmail.com/\nLink: https://lore.kernel.org/netdev/875wzctsky.fsf@toke.dk/\nLink: https://lore.kernel.org/netdev/87ld7t3kl3.fsf@all.your.base.are.belong.to.us/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/QDISC-5RTM.v3.r0.20261020053711-1@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a55eb6a622141352131aa6156bbd6ce5da79d9b5", "tree": "d8033ec76ff1ca1420659e2d86b5ec7d166f68f6", "parents": [ "e0a958ddfc89f2e1c43448cdaeb5b30e54e19448" ], "author": { "name": "Travis Howard", "email": "thoward@lafayetteinstrument.com", "time": "Mon Oct 19 20:03:10 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:49:48 2026 -0700" }, "message": "tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table\n\nThe Datto SIRIS 5 1U Server is a Dell OEMR XL R640 (Dell\u0027s OEM-ready\nvariant of the PowerEdge R640) sold under Datto\u0027s identity. Its DMI\nstrings report sys_vendor \"datto\" and product_name \"SIRIS 5 1U Server\",\nso it does not match the existing \"PowerEdge R640\" entry in\ntg3_restart_aer_quirk_table.\n\nAs on the PowerEdge R640, a system restart triggers a fatal PCIe AER\non the BCM5720 during ACPI _PTS for S5, which the iDRAC logs as\nPCI1318 and which hangs the reboot. Power off is unaffected.\n\nClearing the same PCI_EXP_DEVCTL error-reporting bits on both BCM5720\nfunctions from userspace immediately before restart allows the system\nto reboot normally, confirming the quirk applies to this platform.\n\nFixes: e0efe83ed325 (\"tg3: Disable tg3 PCIe AER on system reboot\")\nSigned-off-by: Travis Howard \u003cthoward@lafayetteinstrument.com\u003e\nLink: https://patch.msgid.link/20261019-tg3-datto-aer-quirk-v1-1-f0eccfb2ab5d@lafayetteinstrument.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e0a958ddfc89f2e1c43448cdaeb5b30e54e19448", "tree": "e56e211e9c23b3fad7e6630a1bfcd5a30a6c3112", "parents": [ "4957ea03bf2696f5da12c09144f48d040696ecc2" ], "author": { "name": "Cosmin Ratiu", "email": "cratiu@nvidia.com", "time": "Tue Oct 20 18:36:59 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:48:38 2026 -0700" }, "message": "net/mlx5e: Stop asserting for RTNL when closing channels\n\nmlx5e_close_channels() has an ASSERT_RTNL() from the time when RTNL was\nrequired for closing channels.\nBut the driver has been switched to using the netdev lock a while back,\nand this fired from a flow which was forgotten during the conversion:\n\nmlx5e_tx_timeout_work()\n -\u003e mlx5e_reporter_tx_timeout()\n -\u003e mlx5e_health_report()\n -\u003e mlx5e_tx_reporter_timeout_recover()\n -\u003e mlx5e_safe_reopen_channels()\n -\u003e mlx5e_safe_switch_params()\n -\u003e mlx5e_close_channels()\n\nThe RTNL is not acquired here, but the netdev lock is, and it is enough.\n\nRather than switching to netdev_assert_locked(), simply drop the assert.\nUpper layers (networking core, ethtool core) provide locking and lower\nlayers (NAPI helpers) assert that the netdev lock is held.\n\nFixes: 8f7b00307bf1 (\"net/mlx5e: Convert mlx5 netdevs to instance locking\")\nSigned-off-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nReviewed-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261020153659.3440902-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4403278e4ea2f654f8130a5c03eb8b4516a0f201", "tree": "921a7aaf5b1143c9cb2f9b9a4828280208c03616", "parents": [ "df37e3924292fb41d325721008520ba93deced42", "503bb6e70bbf6304b8113373d09dfffcc4aa9183" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:38:01 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:38:01 2026 -1000" }, "message": "Merge tag \u0027thermal-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control updates from Rafael Wysocki:\n \"These are mostly updates of thermal drivers including a new Exynos\n ACPM thermal driver for Google GS101, new Renesas RZ/G3L thermal\n sensor support, new Qualcomm MSM8952 TSENS support, new Qualcomm\n PMAU0102 Master BandGap temperature monitor support in DT bindings,\n and new rugged Panther Lake support in intel_tcc_cooling. Moreover,\n the AN7583 driver is extended to register separate thermal zones for\n bandgap, GbE and CPU (its DT bindings are updated accordingly).\n\n There are also multiple fixes and assorted cleanups, as usual.\n\n Specifics:\n\n - Make the Intel powerclamp thermal driver reject invalid window_size\n values, drop redundant clamp() from duration_set() in it, and\n simplify 4 functions in it (Thorsten Blum)\n\n - Add rugged Panther Lake support to the intel_tcc_cooling thermal\n driver (Srinivas Pandruvada)\n\n - Fix temperature selection around 0 C in the int340x thermal driver,\n drop redundant else from proc_thermal_add() in it, and simplify\n slider_def_*_set() in it (Thorsten Blum)\n\n - Drop unbalanced paren from cpu-idle-cooling.rst (Manuel Ebner)\n\n - Use %pe to print error pointers symbolically in the thermal control\n code and fix assorted typos in comments in it (Sumeet Pawnikar and\n Hemanth Selam)\n\n - Add the Exynos ACPM thermal driver for Google GS101, along with DT\n bindings and a MAINTAINERS entry (Tudor Ambarus)\n\n - Add Renesas RZ/G3L thermal sensor support and DT bindings, and move\n default calibration values to per-SoC match data (Biju Das)\n\n - Add Qualcomm MSM8952 TSENS support and the corresponding DT binding\n compatible (Muzaffer Kadir)\n\n - Document the Qualcomm PMAU0102 Master BandGap temperature monitor\n compatible in the DT bindings (Dhruvin Rajpura)\n\n - Extend the QCom TSENS v2 trip temperature limits to the hardware\n range of -204°C to +204°C to prevent interrupt storms when\n operating beyond the previous software limits (Priyansh Jain)\n\n - Fix temperature threshold map indexing in the QCom SPMI temperature\n alarm driver to prevent out-of-bounds reads (Georgi Djakov)\n\n - Describe the additional bus clock required by the Amlogic T7\n thermal sensor and switch the driver to the clk_bulk API to manage\n multiple clocks (Ronald Claveau)\n\n - Request the Airoha EN7581 IRQ after thermal zone registration to\n prevent the interrupt handler from accessing an unregistered or\n already freed thermal zone (Vitaliy Sochnev)\n\n - Fix the Airoha AN7583 ADC mux field mapping, serialize access to\n the shared ADC, and verify mux selection to avoid invalid\n temperature readings and spurious critical shutdowns (Vitaliy\n Sochnev)\n\n - Register separate thermal zones for the AN7583 bandgap, GbE and CPU\n sensors, and update the DT bindings to use one thermal sensor cell\n to select the sensor (Vitaliy Sochnev)\n\n - Fix signed integer overflow in the Renesas RZ/G3E\n temperature-to-code conversion, preserve compare interrupt state\n across runtime PM, and prevent overlapping temperature conversions\n (Ovidiu Panait)\n\n - Remove redundant trip window validation and runtime PM\n pm_runtime_mark_last_busy() calls from the Renesas RZ/G3E driver\n (Ovidiu Panait)\n\n - Propagate reset assertion failures from Renesas RZ/G3E suspend and\n attempt to restore power if the sensor was active (Pengpeng Hou)\n\n - Stop the TI bandgap alert IRQ before removing sensor interfaces and\n cancel pending alert work to prevent use-after-free on driver\n removal (Weigang He)\n\n - Validate Spreadtrum sensor IDs read from the device tree before\n using them for register offsets and array indexing (Weigang He)\n\n - Convert the TI OMAP bandgap DT bindings to schema and document the\n DRA752 compatible and thermal sensor cells (Bhargav Joshi)\n\n - Use DT property helpers matching the signed temperature and\n unsigned hysteresis types defined by the thermal zone bindings (Rob\n Herring)\n\n - Reuse common error handling code in the power allocator governor\n bind callback (Markus Elfring)\n\n - Constify the thermal zone device operations in the i.MX9 driver\n (Christophe JAILLET)\n\n - Fix kernel-doc parameter names and firmware node references in the\n cooling device registration helpers (Aryan Sinha)\n\n - Correct the documented return value of ti_bandgap_get_sensor_data()\n to describe validation errors and potentially NULL stored data\n (Karl Mehltretter)\n\n - Ensure NUL-termination when copying the cooling device command-line\n argument in tmon and fix the associated string truncation warning\n (Florian Fainelli)\n\n - Fix undefined behavior caused by a signed shift in the tmon thermal\n zone binding display (Liu Jing)\n\n - Fix wording in tmon comments (Hemanth Selam)\n\n - Simplify cpufreq_set_cur_state() in the cpufreq_cooling thermal\n control driver (Thorsten Blum)\"\n\n* tag \u0027thermal-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (51 commits)\n thermal/drivers/rzg3e: Propagate reset assertion failure from suspend\n thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc\n thermal/fw: Fix kernel-doc parameter names\n thermal/qcom/tsens: Add support for MSM8952 tsens\n dt-bindings: thermal: tsens: Add MSM8952\n thermal/drivers/amlogic: Switch to clk_bulk API to support multiple clocks\n dt-bindings: thermal: amlogic: describe bus clock for t7-thermal\n tools/thermal/tmon: Fix string truncation warning in optarg copy\n thermal/drivers/airoha: Register a thermal zone per AN7583 sensor\n dt-bindings: arm: airoha: Use one thermal sensor cell for AN7583\n thermal/drivers/airoha: Serialise access to the shared ADC\n thermal/drivers/airoha: Fix AN7583 ADC mux field mapping\n thermal/drivers/sprd: validate the sensor id from the device tree\n thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove\n thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing\n thermal: gov_power_allocator: Use common error handling code in power_allocator_bind()\n tools/thermal/tmon: Fix signed shift UB in binding display\n MAINTAINERS: Add entry for Samsung Exynos ACPM thermal driver\n thermal/drivers/samsung: Add Exynos ACPM TMU driver GS101\n dt-bindings: thermal: Add Google GS101 TMU\n ...\n" }, { "commit": "4957ea03bf2696f5da12c09144f48d040696ecc2", "tree": "70be0e5a3d45a3015e517b15c3d014b32cc806c2", "parents": [ "d06e106229d6c5af67aed5146c22bdebf6eff0a0" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Tue Oct 20 17:19:54 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:32:26 2026 -0700" }, "message": "net: shrink the payload-only part of skb dataref to one bit\n\nskb_shinfo(skb)-\u003edataref is split in two 16-bit halves: the lower\none counts all references, the upper one the payload-only (nohdr)\nreferences.\n\n__skb_clone() increments dataref without bound, and skb_cloned()\nonly checks the low 16 bits. With 65,537 references the low half\nreads 1, the head looks private, and pskb_expand_head() (or\nskb_unclone(), skb_cow(), ...) frees it while clones still point\nto it.\n\nAn unprivileged user can reach this from a user and network namespace:\nabout 32,770 AF_PACKET sockets on lo bring dataref to 0x10001, then\nany pskb_expand_head() on the receive path (here a pull of a large\nIPv6 Hop-by-Hop header) frees the shared head:\n\nBUG: KASAN: slab-use-after-free in _copy_to_iter+0x187/0x1330\nRead of size 1590 at addr ff110001104a9002 by task dataref_wrap/87\n skb_copy_datagram_iter+0x60/0x190\n packet_recvmsg+0x1f5/0x12b0\n __sys_recvfrom+0x18d/0x290\nFreed by task 87:\n kfree+0xf3/0x3b0\n pskb_expand_head+0x344/0xeb0\n __pskb_pull_tail+0xf9/0x1bf0\n ipv6_parse_hopopts+0x377/0x4f0\n ip6_rcv_core+0xc67/0x1620\n\nThe upper half never holds more than 1. It is only set by\n__skb_header_release(), with atomic_set() on an skb owning its head\n(TCP/SCTP output, and GRO which never sees cloned skbs).\n__skb_clone() clears nohdr, and __copy_skb_header() does not copy it.\n\nMove SKB_DATAREF_SHIFT to 30, so that the reference count gets 30 bits,\nand dataref stays positive. Wrapping it would need 2^30 live clones of\na single skb, which socket buffer limits and memory make unreachable.\n\nThis issue was found by Anthropic using Claude, and validated by\nAda Logics.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Stephan Lipp \u003cStephan@adalogics.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261020151954.22953-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "46cbf85155e5451b6682ea0c17bc62ec564aec36", "tree": "4d239f99e6e4408806a1fdc3f3433208c66ea91e", "parents": [ "77dac783f113dcc4576efca6f4391d7324c0b1fc" ], "author": { "name": "Liu Chao", "email": "liuc63@xiaopeng.com", "time": "Tue Oct 20 17:42:49 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:31:01 2026 -0700" }, "message": "net: wwan: iosm: validate msg_head before indexing msg_ring\n\nipc_protocol_free_msg_get() reads msg_head from shared memory and\nuses it directly as an index into msg_ring[]. If the head is out\nof range, the subsequent memset() writes beyond the message ring.\n\nValidate head against IPC_MEM_MSG_ENTRIES before using it as an\nindex. The ring is a circular buffer, so a value outside the valid\nrange indicates a corrupted head pointer; report the error and fail\nthe allocation instead of writing out of bounds.\n\nFixes: 64516f633bfd (\"net: iosm: protocol operations\")\nCc: stable@vger.kernel.org\nReviewed-by: Fang Xieyan \u003cfangxy@xiaopeng.com\u003e\nSigned-off-by: Liu Chao \u003cliuc63@xiaopeng.com\u003e\nReviewed-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261020094254.4017726-1-liuc63@xiaopeng.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "77dac783f113dcc4576efca6f4391d7324c0b1fc", "tree": "d85af4e410a4824b16dcad80619b17a1f4a4f23a", "parents": [ "5a3dcad8e101ddcd3a886907c8992df54472f749" ], "author": { "name": "Rosen Penev", "email": "rosenp@gmail.com", "time": "Sun Oct 18 16:16:29 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:29:58 2026 -0700" }, "message": "net: bgmac: rate limit RX error messages\n\nWhen the RX ring is full the RX FIFO overflows. With RX overflow\ncontinue enabled, the DMA engine then writes one frame with a bogus\nlength (always 0x45c2 on a BCM4716), which the driver drops with\n\"Found oversized packet at slot %d, DMA issue!\".\n\nUnder sustained overload this happens on every NAPI poll. On an Asus\nRT-N16 a 950 Mbit/s UDP stream to the router printed about 1450 such\nlines in 20 seconds. The messages are printed from NAPI context, so\nwith a serial console the router spends most of its time printing.\n\nThe frames are already accounted in rx_length_errors and rx_errors.\nRate limit both RX error messages. With this change the same flood\nprinted 60 lines while rx_length_errors counted 14297 dropped frames.\n\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261018231629.39734-1-rosenp@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d06e106229d6c5af67aed5146c22bdebf6eff0a0", "tree": "12f8e171b26d3a0b84a86225afbcec622bc19840", "parents": [ "b5b8c81836e2bec7b444dfa2b14fd14e912e9d63", "a70575ae9e812908acf658ec785f81daeba1a23b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:41 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:41 2026 -0700" }, "message": "Merge branch \u0027veth-schedule-the-peer-s-napi-after-xdp_tx-when-only-gro-is-enabled\u0027\n\nTianyi Gao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nveth: schedule the peer\u0027s NAPI after XDP_TX when only GRO is enabled\n\nWhen an XDP program on a veth device returns XDP_TX and the peer has\nGRO enabled but no XDP program, the frames are queued on the peer\u0027s\nring, but the peer\u0027s NAPI is never scheduled to process them. Once the\nring is full, every XDP_TX frame is dropped.\n\nCommit 0e672f306a28 (\"veth: check for NAPI instead of xdp_prog before\nxmit of XDP frame\") made such a peer work as an XDP_REDIRECT target,\nwhere veth_xdp_xmit() both queues the frames and schedules the peer\u0027s\nNAPI. XDP_TX queues its frames through the same function but schedules\nthe NAPI in veth_xdp_flush(), which still checks xdp_prog.\n\nThe usual workaround is to load a dummy XDP program on the peer [1].\nThat turns off TSO on the device, and every skb it sends then goes\nthrough the peer\u0027s XDP path, where most of them are copied. In our\ntests, TCP sent from a namespace dropped from 22.1 to 14.8 Gbit/s with\nthe dummy program. With this fix the program is no longer needed.\n\nPatch 1 makes veth_xdp_flush() check the peer\u0027s napi pointer, as\nveth_xdp_xmit() does. Patch 2 adds a test for this case to veth.sh.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261016214217.16942-1-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a70575ae9e812908acf658ec785f81daeba1a23b", "tree": "12f8e171b26d3a0b84a86225afbcec622bc19840", "parents": [ "f16b8c6a656e62bfa7bb6a3b876f9ccdaf53bd43" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Fri Oct 16 22:42:17 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:36 2026 -0700" }, "message": "selftests: net: veth: test XDP_TX to a peer with GRO enabled\n\nTest that XDP_TX frames reach a peer that has GRO enabled and no XDP\nprogram. GRO enables NAPI on the peer, so the frames are queued on the\npeer\u0027s ring, and the peer\u0027s NAPI must be scheduled to process them.\n\nAttach a program that returns XDP_TX for every frame, send 5 echo\nrequests and check that all of them were sent back and that the peer\u0027s\nNAPI received them, as counted in its xdp_packets statistic. IPv6 is\ndisabled on both devices, so that only the echo requests are counted.\n\nAdd the program to xdp_dummy.bpf.c in a section of its own, so that the\ntests that load \"section xdp\" still get XDP_PASS.\n\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nLink: https://patch.msgid.link/20261016214217.16942-3-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f16b8c6a656e62bfa7bb6a3b876f9ccdaf53bd43", "tree": "56d30ca27a732aa0e7035f4dde937abe702bba0b", "parents": [ "b5b8c81836e2bec7b444dfa2b14fd14e912e9d63" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Fri Oct 16 22:42:16 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:25:36 2026 -0700" }, "message": "veth: schedule the peer\u0027s NAPI after XDP_TX when only GRO is enabled\n\nveth_xdp_xmit() queues XDP_TX frames on the peer\u0027s ring if the peer has\nNAPI. A peer with GRO enabled and no XDP program also has NAPI.\n\nveth_xdp_flush() then schedules the peer\u0027s NAPI, but only if the peer\u0027s\nxdp_prog is set, so for such a peer the frames are never processed.\nNothing else schedules that NAPI by default.\n\nOnce the ring is full, every XDP_TX frame is dropped, and so are the\nskbs that veth_xmit() queues on the same ring.\n\nCommit 0e672f306a28 (\"veth: check for NAPI instead of xdp_prog before\nxmit of XDP frame\") changed the check in veth_xdp_xmit() but not the one\nin veth_xdp_flush(). Make veth_xdp_flush() check the napi pointer\ninstead of xdp_prog, as veth_xdp_xmit() does.\n\nFixes: 0e672f306a28 (\"veth: check for NAPI instead of xdp_prog before xmit of XDP frame\")\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nReviewed-by: Mohsin Bashir \u003chmohsin@meta.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nLink: https://patch.msgid.link/20261016214217.16942-2-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "df37e3924292fb41d325721008520ba93deced42", "tree": "27ff6b17f0f540c5ecb76be9f18c21be313550bd", "parents": [ "4df4d2a577db2d3d57b888bcfb1206fc74661d16", "6c326a54b0738ec3b2cc89e1da953a3586c6a8c4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:24:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 21 14:24:26 2026 -1000" }, "message": "Merge tag \u0027pm-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management updates from Rafael Wysocki:\n \"This time, the most visible part are the ACPI CPPC updates from\n Christian Loehle, including CPPC cpufreq driver changes, even though\n updates of cpufreq drivers proper are still the largest topic group.\n However, the updates of cpufreq drivers depend on the ACPI CPPC\n updates, so they should really be counted together and that is well\n over 1/2 of the total commit count.\n\n Interestingly enough, almost all of the updates included here are\n fixes or cleanups, with some new feature support in the amd-pstate\n cpufreq driver and IPQ9650 support in the qcom-nvmem cpufreq driver.\n The runtime PM documentation improvements from Brian Norris can also\n be mostly regarded as fixes, but a new kunit test goes along with\n them.\n\n Specifics:\n\n - Fix multiple issues related to input validation, synchronization,\n access safety, memory layout and register field validation, and\n error handling in the ACPI CPPC library (Christian Loehle and Sumit\n Gupta)\n\n - Select the frequency-invariance callback per CPU in the CPPC\n cpufreq driver and create the FIE worker before enabling PCC\n callbacks in it to avoid queueing work through a missing worker and\n dereferencing a NULL pointer (Christian Loehle)\n\n - Update the CPPC cpufreq driver entry in MAINTAINERS and add a new\n entry for the ACPI CPPC library (Christian Loehle)\n\n - Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel\n Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,\n Sumeet Pawnikar, and Xueqin Luo)\n\n - Fix wrong behaviors on multi-node servers in the Loongson cpufreq\n driver (Huacai Chen)\n\n - Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet\n Koseoglu)\n\n - Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)\n\n - Fixups for a few bugs identified by Sashiko in the amd-pstate\n cpufreq driver (Mario Limoncielloi, Wentao Guan)\n\n - Initial support for maximum frequency capacity handling on Zen6\n client in amd-pstate (Mario Limonciello)\n\n - Fix for amd-pstate-ut with \u0027Requested CPU Min frequency\u0027 BIOS\n option (K Prateek Nayak)\n\n - New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,\n Vishal Badole)\n\n - amd-pstate documentation fix (Karl Mehltretter)\n\n - Restrict deferred downscaling to low load for shared policies in\n the conservative cpufreq governor to avoid undesirable CPU\n frequency reduction in some cases (Shengming Hu)\n\n - Serialize sugov_start() against rate limit updates in the schedutil\n cpufreq governor to avoid using a stale rate limit value (Hui Su)\n\n - Prevent cpuidle governors menu and teo from returning idle state 0\n after it has been disabled (Xueqin Luo)\n\n - Replace min_t() with the better alternatives in the intel_idle\n driver and make it use 2-argument strscpy() (Andy Shevchenko)\n\n - Fix two repeated phrase instances in cpuidle (Hemanth Selam,\n Syazwina Fazrul)\n\n - Add rugged Panther Lake support to the intel_rapl power capping\n driver and make it use %pe for printing error pointers (Srinivas\n Pandruvada and Sumeet Pawnikar)\n\n - Update and improve runtime PM documentation and add a kunit test\n for supplier idle/suspend (Brian Norris)\n\n - Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()\n to ensure autosuspend disabling on driver teardown (Joshua Crofts)\n\n - Ignore page-zero RAM in E820 checksum during hibernation on x86 to\n avoid rejecting images created after kexec() (Matthias Goergens)\n\n - Add resume event mapping for PMSG_POWEROFF to the PM core to allow\n it to carry out device shutdown in the future (Mario Limonciello)\n\n - Add DPM watchdog to prepare/late/early/noirq/complete phases of\n device suspend and resume (Mayank Rungta)\n\n - Update swsusp.txt references to swsusp.rst in hibernation\n documentation (Li Jun)\n\n - Fix use-after-free of perf domain in netlink doit handlers for\n energy models (Fan Wu)\n\n - Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it\n was removed inadvertently in previous development cycles to avoid\n use-after-free (Bradley Morgan)\n\n - Unregister CPU PM notifier outside the timer lock in the\n timer-ti-dm clocksource driver (Bradley Morgan)\n\n - Fix typo \"sucessfully\" in a comment in pm_clk_add_clk() kerneldoc\n comment and typo \"hierachy\" in a comment in pm-graph (Hemanth\n Selam)\n\n - Fix the return value in dev_pm_opp_get_of_node() kernel-doc (Karl\n Mehltretter)\"\n\n* tag \u0027pm-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (89 commits)\n cpufreq: loongson3: Replace IOCSR read/write with MMIO ones\n cpufreq: loongson3: Use global physical CPU ID in get/target callbacks\n cpufreq: loongson3: Replace per-package mutex with per-node\n cpufreq: loongson3: Adjust the width of id and val in smc_message\n cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64\n PM: runtime: Expand introduction with core concepts and structure\n cpufreq: schedutil: Serialize sugov_start() against rate limit updates\n MAINTAINERS: ACPI: Add a separate CPPC entry\n MAINTAINERS: cpufreq: Replace CPPC reviewer\n arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend\n cpufreq: mediatek: Enter system sleep at the suspend OPP\n cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing\n cpufreq: qcom-nvmem: Add IPQ9650 support\n cpufreq: Add Milos to cpufreq-dt-platdev blocklist\n cpufreq: Use %pe to print error pointers symbolically\n rust: rcpufreq_dt: add module alias\n cpufreq: sti: avoid NULL dereference in dev_err()\n cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv\n cpufreq: sparc-us2e: fix frequency table index copy-paste error\n rust: cpufreq: reject NULL from cpufreq_cpu_get()\n ...\n" }, { "commit": "b5b8c81836e2bec7b444dfa2b14fd14e912e9d63", "tree": "5c64d53c865248cbfe2787ce2380802b520f383c", "parents": [ "9770818b8a92fb5fb77725bd5055f165eee3f52e" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Tue Oct 20 17:21:11 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:24:20 2026 -0700" }, "message": "pppoe: delete session hash entries by pointer match\n\npppoe_connect() copies the requested PPPoE address to a socket before\nattempting to insert the socket into the session hash table. If the\ntuple already exists, __set_item() returns -EALREADY, but the copied\naddress and ifindex remain set on the failed socket.\n\nClosing that socket then deletes the existing socket\u0027s hash entry\nthrough pppoe_release(), preventing it from receiving further session\ntraffic. An unprivileged process in the same network namespace can\ntrigger this through a duplicate connection attempt.\n\nTo avoid the accidental delete, pass the pppox_sock to __delete_item(),\nand unlink only an entry whose pointer matches the requested socket.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nLink: https://patch.msgid.link/20261020092118.47416-1-qingfang.deng@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9770818b8a92fb5fb77725bd5055f165eee3f52e", "tree": "f5ce07edd92a9285e9de9fd61cf2afacd6e56384", "parents": [ "a031ec9ff5a2e55867430e74e9b497fe844116ba" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Tue Oct 20 10:57:27 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:22:07 2026 -0700" }, "message": "net: lan969x: don\u0027t disable hardirqs in fdma tx clear\n\nlan969x_fdma_tx_clear_buf() runs from the NAPI poll and frees the skbs\nof completed tx DCBs with napi_consume_skb(), under sparx5-\u003etx_lock.\n\nBefore this patch, the lock is taken with spin_lock_irqsave(), so the\nskbs are freed with hardirqs disabled. RX skbs are marked for page_pool\nrecycling, so when such an skb is forwarded back out and its tx\ncompletion frees it here, the free path reaches __page_pool_put_page(),\nwhich warns via lockdep_assert_no_hardirq().\n\nTake tx_lock with a plain spin_lock(), as the only other tx_lock user,\nsparx5_port_xmit_impl(), already does. tx_clear_buf() is only called\nfrom softirq context, so disabling hardirqs is not needed.\n\nFound with lockdep enabled (CONFIG_PROVE_LOCKING), which the assert\ndepends on. Reproduced on lan969x by redirecting received frames out of\nanother port with tc mirred.\n\nFixes: d84ad2c0d80c (\"net: lan969x: add FDMA implementation\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261020-lan969x-fdma-tx-clear-irq-v1-1-b9f9d1eda317@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5a3dcad8e101ddcd3a886907c8992df54472f749", "tree": "798f168beec2020cf86dfefe5b145a4b5472b7fc", "parents": [ "13c9735380f1bc0f62c2e41a57d1e651df10ff85" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Tue Oct 20 10:58:58 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:20:58 2026 -0700" }, "message": "net: sparx5/lan969x: do not clobber the PSFP cycle timer update period\n\nsparx5_psfp_init() enables the periodic stream gate cycle timer update,\nwhich keeps the cycle start time of each stream gate within one cycle\ntime of the current time. SG_CT_CLKS sets the update period, in system\nclock cycles.\n\nBefore this patch, the update is enabled with a full register write of\nSG_CT_UPDATE_ENA only, which also sets SG_CT_CLKS to zero. That is below\nthe documented minimum, the number of stream gates (1024 on sparx5 and\n256 on lan969x).\n\nWrite both fields, and set the period to the recommended 10 us,\ncomputed from the core clock since it differs per target (6250 cycles\nat 625 MHz, 3280 at 328 MHz).\n\nFound by an AI code review agent, and confirmed on lan969x and sparx5\nby reading the register back as 0x80000000.\n\nFixes: e116b19db202 (\"net: microchip: sparx5: initialize PSFP\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261020-sparx5-psfp-cycle-timer-v1-1-00f2908f096a@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a031ec9ff5a2e55867430e74e9b497fe844116ba", "tree": "fe5aaa91449314822a52550a3e415a5082f5f233", "parents": [ "b0e4ea3a0cd42eccad9cc4153afcad555480b9e6" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Tue Oct 20 10:58:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:20:28 2026 -0700" }, "message": "net: lan969x: fix DSM calendar for empty taxis\n\nlan969x_dsm_calendar_calc() computes the DSM calendar schedule of one\ntaxi. sparx5_config_dsm_calendar() calls it for each taxi, reusing the\nsame sparx5_calendar_data.\n\nBefore this patch, the schedule is only cleared after the n_devs \u003d\u003d 0\nearly return. For a taxi with no active ports, the function writes\nSPX5_DSM_CAL_EMPTY only to schedule[0] and leaves the remaining slots\nat whatever they held before. For the first taxi that is zero from\nkzalloc(), so sparx5_dsm_cal_len() returns a bogus length and\nsparx5_dsm_calendar_check() fails, which fails the probe:\n\n Port 0: distance 20 above limit 0\n\nA later empty taxi inherits the previous taxi\u0027s schedule instead, which\npasses the check, so only an empty taxi 0 triggers the failure.\n\nClear the full schedule up front on every path, and on the empty path\nplace a single idle marker (SPX5_DSM_CAL_MAX_DEVS_PER_TAXI) in slot 0,\nso the update step sees a calendar length of one and programs one idle\nslot into the hardware, matching what sparx5_dsm_calendar_calc() does.\n\nReported by a customer whose DT enables none of the ports in a taxi.\nReproduced on lan969x by disabling all taxi 0 ports in the DT.\n\nFixes: 5d2ba3941016 (\"net: lan969x: add function for calculating the DSM calendar\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261020-lan969x-dsm-empty-taxi-v1-1-14790f1e7430@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b0e4ea3a0cd42eccad9cc4153afcad555480b9e6", "tree": "c7b58dbc401b8bba41ae83926564382bbcecf53f", "parents": [ "9b8ae9aaa1b8e2b6c1cbf5613d3a37923cf53bc5" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Mon Oct 19 23:15:50 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 21 17:14:48 2026 -0700" }, "message": "virtio-net: fix frag overflow in big packets receive\n\nIn big packets mode with guest GSO, add_recvbuf_big() posts a chain of\nMAX_SKB_FRAGS + 1 pages. page_to_skb() copies only ETH_HLEN of the\nfirst page into the linear area and adds the rest of that page as a\nfrag, then one frag per remaining page. A device that fills the entire\nbuffer therefore causes MAX_SKB_FRAGS + 1 frags, writing one\nskb_frag_t past the end of skb_shinfo(skb)-\u003efrags[].\n\nPost one page less. The buffer still fits a maximal GSO packet. A well\nbehaved device does not trigger this, as GSO packets are at most 64KB.\n\nAlso check the frag count in page_to_skb() before adding any frag as\ndefense in depth.\n\nFixes: 9ab86bbcf8be (\"virtio_net: Defer skb allocation in receive path Date: Wed, 13 Jan 2010 12:53:38 -0800\")\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20261020032108.81879-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "9b8ae9aaa1b8e2b6c1cbf5613d3a37923cf53bc5" }