)]}' { "log": [ { "commit": "a90ee4305c4a5df72c11b31dacfdc76e00fcf78a", "tree": "18cdff87967594810218424b52c69529757a6a78", "parents": [ "7704c4c5bb127673b4f0ead839919db573559e38" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 13:45:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 13:45:25 2026 -0700" }, "message": "Linux 7.3-rc6\n" }, { "commit": "7704c4c5bb127673b4f0ead839919db573559e38", "tree": "4ef81e67f7f4443d263b44e8e2a8f6c1c5c8dbdc", "parents": [ "06ac073129191a01d77933ed381f89c67674db6f", "c98bf3b86609a18ab16d067280257326e557c636" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 09:38:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 09:38:11 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fixes from Andi Shyti:\n \"Three patches in xiic for fixing the block reads and a single cleanup\n in the at91 error path:\n\n - at91: also release DMA channels when deferring probe\n\n - xiic: fix SMBus block reads with PEC\"\n\n* tag \u0027i2c-fixes-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: at91: release DMA channels when probe defers\n i2c: xiic: don\u0027t clobber msg-\u003elen to signal block-read completion\n i2c: xiic: defer RX_FULL until all trailing bytes are in FIFO\n i2c: xiic: preserve PEC byte length in SMBus block read setup\n" }, { "commit": "06ac073129191a01d77933ed381f89c67674db6f", "tree": "6e3af9ede358aa55a108c39f519635b8882c243a", "parents": [ "942e4a0e46bfd0efd3f87f70bf186c54aaaeb138", "a661c34fe693c8f9ef29b45ee71cfa1fe593502b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:59:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:59:22 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Don\u0027t apply va_align to hugetlb mappings on AMD F15h systems\n that have custom va_align.bits values (Laurent Wandrebeck)\n\n - Fix PMD teardown handling regression flagged by lockdep\n (Mikhail Gavrilov)\n\n - Hide ptrace header register offset macros behind __ASSEMBLER__ or\n __FRAME_OFFSETS, to fix user-space build errors that may trigger\n if they happen to shadow these short and generic macro names\n (Nick Desaulniers)\n\n* tag \u0027x86-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n {x86,um}/uapi/ptrace: Guard register offset macros with __ASSEMBLER__ or __FRAME_OFFSETS\n x86/mm: Drop unnecessary PMD page copy when freeing\n x86/mm: Don\u0027t apply va_align to hugetlb mappings on AMD F15h\n" }, { "commit": "942e4a0e46bfd0efd3f87f70bf186c54aaaeb138", "tree": "5ced76ab872ab4d21cbee00b604182914e282d21", "parents": [ "a27611f8994c9a4772156432badb533af33fd32d", "28fa9af353bed2bb738c46e31f9b7d0347b759d1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:39:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:39:26 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n\n - Fix task work flags management regression in the hrtimer\n rearming code that can leave task work items unprocessed\n (Karl Mehltretter)\n\n* tag \u0027timers-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work\n" }, { "commit": "a27611f8994c9a4772156432badb533af33fd32d", "tree": "3be31c125e2364108e97ed71a17753093c4fa324", "parents": [ "1c915d6007fab5b87a8c2516dfd37dd614875f9c", "357e8a77a501d96c9517f01f4a211eed5e9c9184" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:35:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:35:29 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix race between perf_event_exit_task() and perf_pending_task()\n (Luo Gengkun)\n\n - Fix perf header output management regressions (Ian Rogers)\n\n - Require kernel access for text poke events (Zhengchuan Liang)\n\n* tag \u0027perf-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Require kernel access for text poke events\n perf: Replace perf_event_header__init_id with full header init\n perf: Fix race between perf_event_exit_task() and perf_pending_task()\n" }, { "commit": "1c915d6007fab5b87a8c2516dfd37dd614875f9c", "tree": "0f849230583ce24a91f1b4c3090cad78d15d0c7c", "parents": [ "6addb4f385570ebc11c4eb499a4f1c149f313e84", "f35e3b5784221654f9cdbd6222275a7fa203f6c3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:29:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 04 08:29:27 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Don\u0027t run refcount kunit self-test when !CONFIG_KUNIT_ALL_TESTS\n (Kuan-Wei Chiu)\n\n - Fix futex private hash use-after-free on resize (Chris Mason)\n\n* tag \u0027locking-urgent-2026-10-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n futex: Fix private hash use-after-free on resize\n irq: Make refcount_interrupt kunit test selectable\n" }, { "commit": "6addb4f385570ebc11c4eb499a4f1c149f313e84", "tree": "c08b6a707840aaab9d4b67937568792f9d9b411f", "parents": [ "a74306e2e676f9775457366fc047a660fbf02f26", "5f43a2d35d5e748c09a50a98fc766dc95bb3a6bd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 21:14:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 21:14:25 2026 -0700" }, "message": "Merge tag \u0027edac_urgent_for_v7.3_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fixes from Borislav Petkov:\n \"This is more of the new normal of LLM-induced fixes of error paths. Oh\n well, they should be done eventually and hopefully we\u0027ll be back to\n normal soon-ish... one would hope... :-P\n\n AMD Versal NET:\n\n - Properly release a remote processor reference which was acquired at\n probe time, on memory controller instance remove\n\n A handful of Altera EDAC driver fixes:\n\n - Fix device node reference leaks covering both the success path and\n the various error paths, and route the single-bit setup function\n through the common exit label\n\n - Fix a use-after-free by releasing the devres group before freeing\n the control info structure in the error paths, since managed IRQ\n handlers could reference the freed dci struct if they fire at just\n the right time\n\n - Fix a memory leak by freeing the allocated control info structure\n when the devres group open fails in the Altera SDMMC setup path\n\n - Remove the __init marking from the Altera Arria10 setup paths and\n their helpers so they remain safely callable at runtime, including\n after deferred or re-triggered probing\n\n - Prevent the Altera driver from being unbound by removing their\n -\u003eremove callbacks and marking them to suppress bind/unbind sysfs\n attributes, since unbinding could erase active system memory\"\n\n* tag \u0027edac_urgent_for_v7.3_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/versalnet: Drop remote processor handle refcount on driver removal\n EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup\n EDAC/altera: Fix use-after-free in error paths\n EDAC/altera: Fix memory leak on dci allocation failure\n EDAC/altera: Drop __init from ECC setup paths for re-probe safety\n EDAC/altera: Do not allow driver unbinding\n" }, { "commit": "a74306e2e676f9775457366fc047a660fbf02f26", "tree": "8760c1c92ae6f61e39339bc0e1873dd9763e5a16", "parents": [ "25d576ed11108470d0999054265108400db1b881", "81493c1dd1b1ebecb2843a7815973a5bd9a37e5a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 10:57:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 10:57:47 2026 -0700" }, "message": "Merge tag \u0027clk-fixes-for-linus-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fixes from Brian Masney:\n \"Two small clk driver fixes:\n\n - spacemit: k3: Fix an issue that will trigger a system hang due to\n unavailable frequency\n\n - ti: composite: Reverts a commit that breaks OMAP3\"\n\n* tag \u0027clk-fixes-for-linus-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: spacemit: k3: add CPU PLL rate tables\n clk: ti: composite: resolve parent clocks by name again\n" }, { "commit": "25d576ed11108470d0999054265108400db1b881", "tree": "622b4ee6a88dbfe7f5437c0c0eea96ac2763ac3d", "parents": [ "9a32e0754d637c1d386a533ae36e41c8f4be8b10", "8e242ada093af7d2ee82037f09c287fbc6f1e3f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 09:05:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 09:05:47 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc/IIO fixes from Greg KH:\n \"Here is a set of char/misc/iio and other small driver subsystem fixes\n for 7.3-rc6 that resolve a number of reported issues. Included in here\n are:\n\n - lots of small iio driver fixes for reported problems\n\n - interconnect driver revert to resolve a regression\n\n - nitro_enclaves driver fix for a use-after-free\n\n - binder driver fixes for reported problems (in both the rust and C\n versions)\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027char-misc-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (63 commits)\n iio: adc: ad_sigma_delta: fix use-after-free on unbind\n iio: accel: kxcjk-1013: reject duplicate event disable\n iio: buffer: serialize buffer teardown with mode claims\n iio: cdc: ad7150: fix OF matching and publish module aliases\n iio: adc: ade9000: fix NULL pointer dereference in clkout registration\n iio: adc: ad4030: fix invalid oversampling_ratio validation\n iio: adc: ad7173: Fix digital filter configuration\n iio: adc: stm32-adc: fix possible division by zero in processed channel\n iio: adc: stm32-adc: fix check on internal channel availability\n iio: proximity: isl29501: Fix return type of isl29501_register_write\n iio: imu: inv_icm42607: restore runtime PM on system resume errors\n iio: imu: inv_icm42607: propagate runtime suspend errors\n iio: adc: pac1934: check ACPI label duplication\n rust_binderfs: add transaction_report feature entry\n rust_binder: reschedule node refcount update on thread exit\n rust_binder: cancel deferred work items in thread exit\n binderfs: fix UAF write in binder_add_device\n binder: fix is_failure flag for superseded transaction cleanup\n binder: fix leaked fd fixups on TF_UPDATE_TXN supersede\n Revert \"interconnect: qcom: x1e80100: enable QoS configuration\"\n ...\n" }, { "commit": "9a32e0754d637c1d386a533ae36e41c8f4be8b10", "tree": "4a60136eb86c3b4f27344c276159b148fa4ac7c0", "parents": [ "903e23eda5af2a5491e698838645f84a8f90379b", "6c95ca52f27855dd2fb74131c8d4e8325d2af7de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:59:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:59:37 2026 -0700" }, "message": "Merge tag \u0027tty-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty/serial fixes from Greg KH:\n \"Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major\n here, just lots of small fixes for reported issues, some of them very\n long-standing:\n\n - tty hangup fixes that have been there since the BKL days and kept\n tripping people up over time.\n\n - vt selection bugfix\n\n - other vt bugfixes (memory leaks and screen update fixes)\n\n - n_gsm bugfix\n\n - qcom-geni serial driver bugfix\n\n - 8250 serial driver bugfixes\n\n - other tiny serial driver fixes\n\n All of these have been in linux-next, the last few only a few days but\n testing here seems solid (this pull request was generated on that\n tree)\"\n\n* tag \u0027tty-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (37 commits)\n tty: add missing driver flag kernel-doc colon\n vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n vt: skip screen update for DEC alignment test on backgroup consoles\n vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n serial: sc16is7xx: reduce TX refill rate with half-FIFO trigger\n serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL\n serial: tegra: don\u0027t clear the Tx FIFO on an Rx-only reset\n serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around\n tty: fix saved termios reset race\n tty: serial: mpc52xx_uart: move static declarations up.\n tty: serial: max3100: shut down timer before freeing port\n tty: add break_wait kernel-doc\n serial: qcom-geni: keep registered console runtime active\n serial: qcom-geni: Fix unbalanced runtime PM resume for no_console_suspend\n serial: qcom-geni: avoid unused-function warning\n tty: serial: qcom_geni_serial: Keep console RX functional after deep idle\n soc: qcom: geni-se: Correct QUP Core ICC vote constants\n serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()\n serial: vt8500: Fix clock reference leak in vt8500_serial_probe()\n kgdboc: Fix tty driver reference leak in configure_kgdboc()\n ...\n" }, { "commit": "903e23eda5af2a5491e698838645f84a8f90379b", "tree": "9d6001d74e512aea4fe4dbaf5b236050e224e11d", "parents": [ "8623551a424d34a311bab3fb9243535c98e08c26", "a93862fa670a9c99fd9a24fb2ef69e4f948d9bd5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:42:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:42:54 2026 -0700" }, "message": "Merge tag \u0027usb-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB/Thunderbolt fixes from Greg KH:\n \"Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6.\n They were delayed on my side due to conference travel, not the fault\n of the submitters at all. Included in here are:\n\n - lots of small thunderbolt fixes for reported issues due to more\n testing and devices and a few reverts as well based on that work\n\n - more usb-serial device ids added\n\n - usb-serial and cdc-acm driver hangup and other fixes\n\n - dwc3 driver fixes for reported problems\n\n - lots of usb gadget driver fixes as people again fuzz these drivers\n and send in fixes, which is nice to finally see\n\n - typec driver fixes for reported problems\n\n - octeon-hcd driver fixes for reported problems\n\n - more usb-storage quirks added\n\n - other small USB driver bugs resolved for reported problems\n\n All of these have been in linux-next without any reported issues\"\n\n* tag \u0027usb-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (63 commits)\n usb: dwc3: gadget: fix IRQ storm on invalid event buffer count\n Revert \"usb: dwc3: gadget: fix IRQ storm on invalid event buffer count\"\n USB: gadget: dummy-hcd: Fix wait for outstanding request completions\n usb: typec: port-mapper: Only match USB4 port if host interface is available\n usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe\n usb: dwc3: gadget: fix IRQ storm on invalid event buffer count\n usb: typec: ucsi: Get the connector fwnode based on reg value\n usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd\n usb: core: clear both ep_in and ep_out for non-ep0 control endpoints\n USB: cdc-acm: skip URB restart in port_shutdown if disconnected\n usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC\n usb: gadget: aspeed-vhub: cancel wake work on device removal\n thunderbolt: Disable CL states for the Anker Prime TB5 dock\n thunderbolt: stream: Announce support for FMODE_NOWAIT\n usb: typec: ucsi: displayport: Current CAM OOB index fixup\n usb: ohci-st: disable controller wakeup on removal\n usb: ohci-spear: disable controller wakeup on removal\n usb: ohci-s3c2410: disable controller wakeup on removal\n usb: ohci-da8xx: disable controller wakeup on cleanup\n usb: cdns3: fix use-after-free in cdns3_gadget_exit()\n ...\n" }, { "commit": "8623551a424d34a311bab3fb9243535c98e08c26", "tree": "9917bc816456825d796d32c4843c3502082045fa", "parents": [ "f7c918b8d9f789e79ebedbc7660b682aa1984210", "3bf8d603fd45649c106cae6290a10f20b1bbb569" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:10:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:10:37 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - A fix for the Samsung S6SY761 touchscreen driver to power on the\n controller before unmasking interrupts during resume and to re-enable\n touch sensing when the device is open\n\n - Updates to the Synaptics touchpad driver to enable SMBus/RMI4 mode on\n Lenovo ThinkPad T490 and restrict the ThinkPad T440p InterTouch\n disable quirk to LEN0036 so that ThinkPad L440 retains SMBus support\n\n - A quirk for the AT keyboard driver (atkbd) to skip keyboard\n deactivation on Lenovo IdeaPad Slim 3 15IWC11 so the internal\n keyboard functions properly\n\n - A DMI quirk for the i8042 controller to disable active multiplexing\n on Fujitsu LIFEBOOK U7410, preventing the internal keyboard and\n touchpad from dying shortly after boot.\n\n* tag \u0027input-for-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11\n Input: s6sy761 - fix resume ordering and restore sensing\n Input: synaptics - limit T440p InterTouch quirk to LEN0036\n Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410\n Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490\n" }, { "commit": "f7c918b8d9f789e79ebedbc7660b682aa1984210", "tree": "a7ca27699ca23c06796d1ac9d0f64bce7fbc28d7", "parents": [ "c5adb6c8a26d653fe1d0ee52908d998f7471e9eb", "9c979cba980522f044ea2b14d8cab87ea3cddb56" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:02:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 08:02:40 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-10-03\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Live from Brisbane airport, it\u0027s Saturday Night drm fixes.\n\n The misc fixes tree didn\u0027t get a PR this week, so I\u0027ll probably have\n that to you when I see it, there were a few patches in there.\n\n Otherwise amdgpu is the main act, mediatek has a guest spot, and\n xe/i915 bring in a fix each.\n\n xe:\n - keep VF LMEM bar size low if no VFs enabled\n\n i915:\n - Disable VRR DC balance by default to fix timing issues\n\n mediatek:\n - Add missing IS_ERR check for ovl_adaptor platform device\n - Fix VID_DOWNSAMPLE_CONFIG register offset\n - Fix pdev reference leak in mtk_drm_bind()\n - Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()\n - Fix ovl adaptor platform device leak\n\n amdgpu:\n - dc_state_create_copy() fix\n - HDMI RGB limited range fix\n - eDP ASSR fix\n - DCE 6 fixes\n - DCE 8.1 fix\n - SI DPM fixes\n - Reset fixes\n - Workaround for multiple SDMA entities with DCC\n - PWM backlight fix\n - GPUVM fixes\n - Switcheroo fix\n - Error handling leak fixes\n - GC 6 unload FW leak fix\n - SDMA 7.1 fix\n - DML frame size limit fix\n - RGB vs YCbCr 4:4:4 fix\n - DP MST fix\n - DC Power module fixes\n - MacBookPro14,3 fix\n\n amdkfd:\n - SVM fix\n\n radeon:\n - sparc64 fix\"\n\n* tag \u0027drm-fixes-2026-10-03\u0027 of https://gitlab.freedesktop.org/drm/kernel: (36 commits)\n drm/mediatek: Fix ovl adaptor platform device leak\n drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()\n drm/mediatek: Fix pdev reference leak in mtk_drm_bind()\n drm/amdgpu: reset VI ASIC on MacBookPro14,3\n drm/amd/pm/si: Fix updating clock limits on AC/DC\n drm/amd/display: Fix stale replay_events after mod_power stream removal\n drm/radeon: Read the VRAM VBIOS signature with readb()\n drm/amd/display: guard dc_sink dereferences in MST mode validation\n drm/amd/display: Try RGB before YCbCr 4:4:4 in stream validation\n drm/amd/display: Fix sanitizer check for the DML frame size limit\n drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub()\n drm/amdgpu: drop userq callback assignment for sdma 7.1\n drm/amdgpu/gfx6: fix firmware leak on teardown\n drm/amdgpu: fix ACP MFD device leak on init failure\n drm/amdgpu: fix IP instance memory leak on kobject add failure\n drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU\n drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()\n drm/amd/display: map PWM brightness through custom backlight curve\n drm/amdgpu: implement workaround for sdma dcc corruption\n drm/amdkfd: Fix always mapped range mapping to all ACCESS GPUs\n ...\n" }, { "commit": "c5adb6c8a26d653fe1d0ee52908d998f7471e9eb", "tree": "b5981e7e04235ab461ec3732e4113782779654cf", "parents": [ "e767a4ea70a3992c37ed604157d32f0dfbf9b1e3", "e060d9069b49fe55f38057dfe592068014652671" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 07:54:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 03 07:54:58 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"Half of this is broken hardware (AMU counters and TLB invalidation)\n and the other half is broken software (frequency scaling and signals).\n So it seems as though we\u0027re all as bad as each other.\n\n The AMU workaround is a little noisy, as it refactors an existing\n workaround so that it can more easily be applied to additional CPUs.\n\n Summary:\n\n - Fix handling of CPU erratum #2645198 when batching pte updates\n\n - Fix truncation of CPU frequency calculation by using 64-bit\n arithmetic in arch_freq_get_on_cpu()\n\n - Work around AMU erratum #3821522 on Cortex-A725\n\n - Fix panic when trying to restore an SVE sigframe on a CPU that only\n supports SME\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems\n arm64: errata: Add Cortex-A725 erratum 3821522 workaround\n arm64: errata: Factor out broken AMU const counter cap\n arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz\n arm64: mm: Fix the break-before-make flush range for erratum 2645198\n" }, { "commit": "3bf8d603fd45649c106cae6290a10f20b1bbb569", "tree": "6ee4d7b7a68f25fabbf28fd605aae3f96bbe9e8e", "parents": [ "a215720959c5450b3699e243904b39c3f8f68888" ], "author": { "name": "Martino Papero", "email": "martino.papero@lcb.to.it", "time": "Wed Sep 30 22:10:41 2026 +0200" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 02 22:07:54 2026 -0700" }, "message": "Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11\n\nThe internal keyboard on the Lenovo IdeaPad Slim 3 15IWC11 (83RR)\ndoes not work correctly with the default i8042 settings. Using\ni8042.nopnp\u003d1 and i8042.dumbkbd\u003d1 restores keyboard input, but prevents\nthe Caps Lock LED from working. Using i8042.nopnp\u003d1 alone does not fix\nthe keyboard.\n\nThe laptop works correctly when atkbd_deactivate_fixup is used instead.\nAdd a DMI quirk for the 83RR to enable it.\n\nThis was tested without any i8042 command-line parameters. Keyboard\ninput and the Caps Lock LED work correctly, including after suspend\nand resume and after a cold boot.\n\nLink: https://lore.kernel.org/all/4f43465f-98ba-4722-8e29-03df20315369@kernel.org/\nSigned-off-by: Martino Papero \u003cmartino.papero@lcb.to.it\u003e\nReviewed-by: Hans de Goede \u003cjohannes.goede@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/c0b597b8-e7ad-4fba-a2bb-5d252e3dfbd3@lcb.to.it\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "e767a4ea70a3992c37ed604157d32f0dfbf9b1e3", "tree": "7cca9c9cd6221921d03ab4daea0eecc571258b51", "parents": [ "ff47652a4b66c067c765a7ad464d930b5a9367cc", "7a39c732a22ec4a369af9e19fbe3d666ec83eec4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 17:34:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 17:34:18 2026 -0700" }, "message": "Merge tag \u0027probes-fixes-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull probes fixes from Masami Hiramatsu:\n\n - fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\n Exit handlers early if !rcu_is_watching() to prevent potential\n use-after-free during unregistration in idle/quiescent states. Switch\n to guard(rcu_sched_notrace) to avoid fast-path lockdep overhead and\n recursion while ensuring safe grace period synchronization.\n\n - kprobes: Skip disarmed probes when checking optkprobe overlap\n\n Continue past disarmed or unprepared probes in get_optimized_kprobe()\n to find active optimized probes. This avoids overwriting active jump\n displacements which can lead to panic.\n\n* tag \u0027probes-fixes-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n kprobes: Skip disarmed probes when checking optkprobe overlap\n fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n" }, { "commit": "9c979cba980522f044ea2b14d8cab87ea3cddb56", "tree": "ec937dfeac49f6a27f4edfc943f8b37c9c1621d7", "parents": [ "47400a32d0d2041a294fc6592a7956b4ec9ce0a0", "a22e5e4f2ebbdbb962cc3233094d189c4dfaa051" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Oct 03 09:32:39 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Oct 03 09:32:49 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-10-01\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-10-01:\n\namdgpu:\n- dc_state_create_copy() fix\n- HDMI RGB limited range fix\n- eDP ASSR fix\n- DCE 6 fixes\n- DCE 8.1 fix\n- SI DPM fixes\n- Reset fixes\n- Workaround for multiple SDMA entities with DCC\n- PWM backlight fix\n- GPUVM fixes\n- Switcheroo fix\n- Error handling leak fixes\n- GC 6 unload FW leak fix\n- SDMA 7.1 fix\n- DML frame size limit fix\n- RGB vs YCbCr 4:4:4 fix\n- DP MST fix\n- DC Power module fixes\n- MacBookPro14,3 fix\n\namdkfd:\n- SVM fix\n\nradeon:\n- Sparc64 fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20261001230115.1319089-1-alexander.deucher@amd.com\n" }, { "commit": "47400a32d0d2041a294fc6592a7956b4ec9ce0a0", "tree": "09cc0108314e42f2f6249ced5e9ea3728fb54423", "parents": [ "26fe67ec0dca018767b038fe65c9fc9da058ac19", "048739be3e9cacae5301b68245668002fe6f0ce5" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Oct 03 09:27:36 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Oct 03 09:30:15 2026 +1000" }, "message": "Merge tag \u0027mediatek-drm-fixes-20261002\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes\n\nMediatek DRM Fixes - 20261002\n\n1. Add missing IS_ERR check for ovl_adaptor platform device\n2. Fix VID_DOWNSAMPLE_CONFIG register offset\n3. Fix pdev reference leak in mtk_drm_bind()\n4. Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()\n5. Fix ovl adaptor platform device leak\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\nLink: https://patch.msgid.link/20261001234906.14940-1-chunkuang.hu@kernel.org\n" }, { "commit": "ff47652a4b66c067c765a7ad464d930b5a9367cc", "tree": "ec2b19252312016e6f521c287f69ced542eb0c85", "parents": [ "8f150ccedfbd610aa25509ff42365d70fb20478f", "19465a9aeb664f1d710d0d22c07c31bfb7c85446" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 14:04:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 14:04:11 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc6\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n \"Fix a series of data corruption and I/O error bugs found by running\n generic/363 (fsx) in a loop against Windows Server 2022 and Samba.\n\n - Stop data dirtied past EOF through an mmap from reappearing as file\n content once the file is extended by a write, truncate, zero range,\n copy range or clone range\n\n - Flush dirty data and drain in-flight I/O before operations that\n assume the pagecache and the server agree on the file: querying\n allocated ranges, the O_TRUNC open, interior zero range, and\n server-side copy/clone\n\n - Stop a genuine size-extending zero range or preallocate from being\n refused with -EOPNOTSUPP when the inode is not read caching, by\n querying the server\u0027s authoritative EOF instead of trusting a stale\n cached i_size\n\n - Zero the untransferred tail of a short read, both in the netfs\n read-gaps path (where stale folio content could otherwise be\n written back to the server) and in the DIO/unbuffered read\n collector, and tell a real EOF apart from a stale cached\n remote_i_size after a lease downgrade\n\n - Require stable pages on signed connections so a buffered write\n can\u0027t modify a folio whose signature has already been computed and\n is in flight, which the server rejected with STATUS_ACCESS_DENIED\n and the client surfaced as -EIO\n\n - Split several cifsFileInfo flags out of a shared bitfield byte so\n concurrent updates taken under different locks no longer clobber\n each other through a byte-level RMW\"\n\n* tag \u0027cifs-fixes-7.3-rc6\u0027 of https://git.manguebit.org/linux:\n smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races\n smb: client: require stable pages for signed connections\n smb: client: distinguish real EOF from a stale remote_i_size on read\n netfs: zero the tail of a short DIO/unbuffered read\n smb: client: only require read lease for size-extending preallocate\n netfs: zero gaps in read-gaps folio to avoid writing back stale data\n smb: client: only require read lease for size-extending zero range\n smb: client: drain and invalidate before server-side copy/clone\n smb: client: flush dirty data before zeroing a range\n smb: client: drain outstanding I/O before truncating on O_TRUNC open\n smb: client: flush and commit data before querying allocated ranges\n smb: client: discard post-EOF pagecache when extending a file via clone range\n smb: client: discard post-EOF pagecache when extending a file via copy range\n smb: client: discard post-EOF pagecache when extending a file via zero range\n smb: client: clear post-EOF pagecache when extending a file via truncate\n netfs: clear post-EOF pagecache when extending a file via write\n" }, { "commit": "8f150ccedfbd610aa25509ff42365d70fb20478f", "tree": "1b22e147a9f8464940fcfa0483c96b8842c953c5", "parents": [ "d2dbe503fd806082acb0ca79a9d6641822988c2c", "de020dc8049bfb2b22e3b6d99c031feb2e22d112" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:59:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:59:32 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix overflow of backward jump offset in constant blinding\n (Alexei Starovoitov)\n\n - Fix packet range of packet pointers sharing an id when var_off\n tightens umax of one pointer and not the other (Alexei Starovoitov)\n\n - Fix objects stuck in free_by_rcu_ttrace list of bpf memalloc\n (Alexei Starovoitov)\n\n - Fix use-after-free of progs detached from busy trampolines: wait for\n an RCU tasks grace period before freeing trampoline progs, and patch\n detached progs out of trampoline images that are still in use\n (Florent Revest)\n\n - Hold map BTF for the memory allocator destructor record to fix UAF in\n deferred bpf_mem_alloc destruction (Kumar Kartikeya Dwivedi)\n\n - Fix missing migration protection in resizable hashtab\n lookup_and_delete batch operation (Ömer Mete Kaya)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()\n selftests/bpf: Add a test for objects stuck in free_by_rcu_ttrace\n bpf: Fix objects stuck in free_by_rcu_ttrace\n bpf: Factor out __do_call_rcu_ttrace()\n selftests/bpf: Test packet range of pointers sharing an id\n bpf: Fix packet range of pointers sharing an id\n selftests/bpf: Detach a trampoline prog while a task sleeps before it\n bpf: Skip detached progs in trampoline images that are still in use\n bpf: Wait for an RCU tasks grace period before freeing trampoline progs\n bpf: Hold map BTF for the memory allocator destructor record\n bpf: Fix overflow of jump offset in constant blinding\n" }, { "commit": "d2dbe503fd806082acb0ca79a9d6641822988c2c", "tree": "4aeb0221839d47a8b52718b10db52dd2f4d64f59", "parents": [ "3b7cab693ba2bab63774bf5b988e8a61b2ef0f32", "40cce45b921f7930886bcba43069edc579725457" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:45:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:45:08 2026 -0700" }, "message": "Merge tag \u0027pci-v7.3-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fix from Bjorn Helgaas:\n\n - Allow driver to use AtomicOps if already enabled by hypervisor; fixes\n regression when Root Port is not visible in a guest (Nikola Prica)\n\n* tag \u0027pci-v7.3-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI: Accept AtomicOps already enabled by the hypervisor\n" }, { "commit": "3b7cab693ba2bab63774bf5b988e8a61b2ef0f32", "tree": "90e364f2004af7eb6c8ff0c205ffd15fd0c2144b", "parents": [ "3f1fe48a36b0b6722dc3fd421d93512bac138e9a", "684b413b5483f57c890c171b9400076a0143b918" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:25:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:25:40 2026 -0700" }, "message": "Merge tag \u0027block-7.3-20261002\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - Fix an out-of-bounds write in nvmet_auth_challenge(), where\n sizeof() on a void pointer undercounted the challenge header and\n let a short AUTH_RECEIVE buffer pass the check\n - nvme-multipath fixes for an ANA log bounds check underflow, the\n command effects log lifetime for multipath heads, and only\n setting BLK_FEAT_ZONED after the zone info is known.\n - nvmet fixes for ns-\u003eenabled teardown ordering, rejecting I/O\n after the percpu ns reference is killed, device path preservation\n on allocation failure, and too-short SGL segments in pci-epf\n - nvme-tcp: revert the per-socket dynamic lockdep keys, and delay\n the socket reclassification\n - A DMA pool alignment quirk for the Micron 4100AT\n - Controller state/reset race fixes, and -Wformat-security\n workarounds\n\n - blk-mq: set RQF_USE_SCHED when the operation is known, and allow\n cached requests to be used for flush operations\n\n - Reject polled dio with user integrity metadata\n\n - Save the IRQ state in blkg_tryget_closest()\n\n - Set the zone write granularity in virtio_blk\n\n - ublk selftest fixes\n\n* tag \u0027block-7.3-20261002\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (23 commits)\n virtio_blk: set the zone write granularity\n nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known\n nvme: fix command effects log lifetime for multipath heads\n nvmet: don\u0027t allow I/O admission after percpu ns reference is killed\n nvmet: defer setting ns-\u003eenabled to false in nvmet_ns_disable()\n nvmet: copy the hostid into the ctrl before creating PR pc_refs\n nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n nvmet: pci-epf: reject too-short SGL segments\n nvme-multipath: fix underflow in ANA log bounds checks\n nvme: work around all -Wformat-security warnings\n nvme: work around -Wformat-security warning\n nvme: do not reset controllers in NVME_CTRL_NEW state\n nvme-tcp: delay nvme_tcp_reclassify_socket()\n Revert \"nvme-tcp: lockdep: use dynamic lockdep keys per socket instance\"\n drbd: remove unused drbd_nl_mcgrps[] array\n blk-mq: allow cached requests to be used for flush operations\n blk-mq: set RQF_USE_SCHED when the operation is known\n block: reject polled dio with user integrity metadata\n selftests: ublk: fix unused_result error\n blk-cgroup: save IRQ state in blkg_tryget_closest()\n ...\n" }, { "commit": "3f1fe48a36b0b6722dc3fd421d93512bac138e9a", "tree": "b767d7f6e26bc64334d3f14f8422d187239dc45d", "parents": [ "5d144c294ae21c1bfb275ba06ec73c2d1ab7cf92", "a92193c91e8839fe5fc209616ea95465ae4b919d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:17:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:17:24 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.3-20261002\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix a task_work add use-after-free with SQPOLL.\n\n The sqpoll thread could pop and complete the last request while\n io_req_normal_work_add() was still looking at them after the mpscq\n push.\n\n Use the same approach as DEFER_TASKRUN to protect from that, holding\n an RCU read lock across the add, and have exit wait for an RCU grace\n period for SQPOLL rings as well.\n\n - CQE32 ring fixes: correct the free entry check for 32b CQEs, zero the\n big_cqe for aux CQEs, and only post the dummy skip CQE on CQE_MIXED\n rings\n\n - Mark the source filter table as COW when cloning bpf filters, so\n registering another filter on the source doesn\u0027t modify the shared\n table in place\n\n - Initialize the task context before running the BPF loop\n\n - Requeue zcrx multishot receives stopped by a local resource\n\n - End a TX_TIMESTAMP multishot cmd when the CQ is full (lollipopkit)\n\n* tag \u0027io_uring-7.3-20261002\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: fix task_work add use-after-free with SQPOLL\n io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full\n io_uring/zcrx: requeue multishot receives stopped by a local resource\n io_uring: initialize task context before running the BPF loop\n io_uring: zero big_cqe for aux CQEs on CQE32 rings\n io_uring: fix free entry check for 32b CQEs on CQE32 rings\n io_uring: only post the dummy skip CQE on CQE_MIXED rings\n io_uring/bpf_filter: mark source as COW when cloning filters\n" }, { "commit": "5d144c294ae21c1bfb275ba06ec73c2d1ab7cf92", "tree": "4c9573797591ff341eede4bd81d5e1649869fe88", "parents": [ "ac7445c28e7a28d5131bc9f9a143261e79495027", "b4e7fc36e31f59b318d38afe621ac20650314d27" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:08:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 12:08:41 2026 -0700" }, "message": "Merge tag \u0027sound-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A fair amount of small fixes, which became much larger as a pile of\n pending homework during my vacation in the last weeks.\n\n The majority of changes are device-specific quirks and ASoC updates,\n along with a few ALSA core fixes and USB-audio hardening as well as a\n few regression fixes.\n\n ALSA Core:\n - Serialize ALSA sequencer compat port-info ioctls\n\n HD-audio:\n - Fix ALC235 codec headset handling\n - Fix regression on Tegra194 controller support\n - Quirks / fixes for Lenovo, ASUS, Acer, Dell, Higole, HP, and IPASON\n laptops\n\n USB-audio:\n - Hardening for line6 and ua101 drivers to deal with malformed\n packets\n - Fix input device leak on probe error in caiaq driver\n - Apply quirks generically for Audient and Behringer devices\n - Quirks for ASUS SupremeFX Hi-Fi, HiBy FC4 (native DSD), and MSI MAG\n B850M MORTAR WIFI\n\n ASoC:\n - Runtime PM fixes for SDCA class function driver\n - Fix uninitialized stream configs in RT1017 and MAX98363 SDW codecs\n - AMD ACP SoundWire support for ASUS and Lenovo models\n - Quirks for Intel machines (Lenovo Yoga Slim 7, Chuwi Hi8)\n - Qualcomm LPASS fixes for playback constraints and WSA macro volume\n - Codec / platform fixes for rt274/rt286, cs42l43, wm8903, Tegra ASRC\n\n Misc:\n - Regression fix for silent playback on Creative Titanium HD\n - Error handling fix at probe via auto-cleanup in ice1712\"\n\n* tag \u0027sound-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)\n spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260\n ALSA: ice1712: Fix the error handling via auto-cleanup at probe\n ALSA: core: Define auto-cleanup for snd_card_free()\n ALSA: hda/realtek: Add ALC235 support for headset mode\n ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72\n ALSA: hda/realtek: Fix mute and micmute LEDs on HP ENVY x360 15-ey0xxx\n ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 14-dv1001TU\n ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270)\n ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices\n ALSA: usb-audio: Apply boot quirk for Behringer models generically\n ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after enabling clocks\n ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA\n ALSA: hda/realtek: Add quirk for HP Pavilion AiO 24 speaker\n ALSA: hda/realtek: Add mute LED quirk for HP Laptop 15-fd2xxx\n ASoC: amd: acp-config: Add ACP70 DMI quirk for ASUS UM5406GA\n ALSA: hda/realtek: Add mute LED quirks for HP Pavilion 15-eh3174nw and HP Laptop 15-dw1xxx\n ASoC: Intel: Add quirk to block match table for Lenovo Yoga Slim 7\n ALSA: hda/realtek: Add mute LED quirk for HP Victus 15-fb2xxx\n ALSA: hda/realtek: Add quirk for Acer Nitro AN515-45\n ALSA: hda/realtek: Add quirk for Lenovo ThinkBook G8+\n ...\n" }, { "commit": "ac7445c28e7a28d5131bc9f9a143261e79495027", "tree": "8b7767d7ccd9879b553855af76cfcd63abcefa25", "parents": [ "4e9a2de02fedd0137f058a6e69848072a20f8f34", "eb13a1ff271b0d180687eebb30611b0b276d5193" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 11:28:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 11:28:45 2026 -0700" }, "message": "Merge tag \u0027random-7.3-rc6-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random\n\nPull random number generator fixes from Jason Donenfeld:\n\n - VMGENID memory needs to be mapped with the decrypted tag, so that\n SEV-SNP machines can boot\n\n - A fix for an initialization race in VMGENID, followed by a cleanup\n\n - Trivial kernel doc cleanups in siphash and random.c\n\n - A fix for a new compilation failure with recent clang on PPC and\n RISC-V, due to generating an out-of-line memset in the vDSO\n\n* tag \u0027random-7.3-rc6-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random:\n random: vDSO: avoid call to memset() when zeroing reserved parameter\n random: fix vgetrandom_opaque_params kernel-doc\n random: vDSO: fix repeated word \u0027to\u0027 in comment\n siphash: clean up kernel-doc comments\n virt: vmgenid: move to using dev_set/get_drvdata\n virt: vmgenid: set driver_data before registering notification handlers\n virt: vmgenid: remap memory as decrypted\n" }, { "commit": "4e9a2de02fedd0137f058a6e69848072a20f8f34", "tree": "0c8eefc2ee12b51791633626849191126c1225e0", "parents": [ "5e0f8396d4805a3e7f753fa58c8c55f1f3cc2160", "af2fb3ee6679b517e2fdbd3ba16ec276a8b74312" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 10:51:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 10:51:34 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab\n\nPull slab fixes from Vlastimil Babka:\n\n - Stable fix for a potential deadlock in kfree_rcu() when called\n from set_cpus_allowed_force() (Harry Yoo)\n\n - MAINTAINERS update of the slab.git URL\n\n* tag \u0027slab-for-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab:\n mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()\n MAINTAINERS: update slab.git URL\n" }, { "commit": "5e0f8396d4805a3e7f753fa58c8c55f1f3cc2160", "tree": "2cb0b720fa49063541d1e977ac73579242122628", "parents": [ "17a58009754886eeacb9b826aa6d7bf5e294454d", "3f35b678a1d6b4c2dc773ad73623b1515cfc5bc5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 09:51:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 09:51:11 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026100201\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Benjamin Tissoires:\n\n - Revert of the Bolt integration into hid-logitech-dj (Benjamin\n Tissoires)\n\n - A couple of buffer overflow in Intel-thc-hid (Even Xu)\n\n - A couple of Sashiko findings fixes in hid-multitouch and HID-BPF\n (Aldo Ariel Panzardo and Benjamin Tissoires)\n\n* tag \u0027hid-for-linus-2026100201\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n selftest/hid: add test for negative return codes for hid_bpf_hw_request\n HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow\n HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow\n HID: universal-pidff: Add support for Turtle Beach VelocityOne Race\n HID: multitouch: stop the release timer from being rearmed on remove\n Revert \"HID: logitech: add Bolt receiver support for Logitech HID++ devices\"\n" }, { "commit": "40cce45b921f7930886bcba43069edc579725457", "tree": "b4c55916d7e55b570bd010b5690847ae84719e07", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Nikola Prica", "email": "nikola.prica@amd.com", "time": "Mon Sep 21 13:19:03 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri Oct 02 11:21:28 2026 -0500" }, "message": "PCI: Accept AtomicOps already enabled by the hypervisor\n\npci_enable_atomic_ops_to_root() currently fails when no Root Port is\nvisible. That is common in passthrough guests (ESXi, Hyper-V): the Endpoint\nis assigned to the VM, but the Root Port above it is not visible in the\nguest topology.\n\nIn those setups the hypervisor may already have enabled AtomicOp Requester\nEnable on the device. If PCI_EXP_DEVCTL2_ATOMIC_REQ is set, treat AtomicOps\nas already enabled and return success instead of failing the Root Port\nwalk.\n\nAfter 1ae8c4ce1570 (\"PCI: Enable AtomicOps only if Root Port supports\nthem\"), pci_enable_atomic_ops_to_root() always returns failure if the Root\nPort is not visible, so drivers don\u0027t use atomics when they could. On\nsystems where the Root Port is not visible but *does* support AtomicOps,\nthis is a regression: prior to 1ae8c4ce1570, it enabled AtomicOps in the\nendpoint and returned success.\n\nFixes: 1ae8c4ce1570 (\"PCI: Enable AtomicOps only if Root Port supports them\")\nSigned-off-by: Nikola Prica \u003cnikola.prica@amd.com\u003e\n[bhelgaas: commit log, code comment]\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Gerd Bayer \u003cgbayer@linux.ibm.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nReviewed-by: Gerd Bayer \u003cgbayer@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260921111903.978687-1-nikprica@amd.com\n" }, { "commit": "17a58009754886eeacb9b826aa6d7bf5e294454d", "tree": "3effaa92c1a57d8090509f3e85cc16f4bb52521c", "parents": [ "ce1e0223d8ad4211275c82a17ed6d43ab81e13d9", "015fb29a748342a186f37b602ac70017098c8251" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 09:07:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 02 09:07:36 2026 -0700" }, "message": "Merge tag \u0027for-next-tpm-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull tpm fixes from Jarkko Sakkinen.\n\n - tpm error handling and buffer size fixes\n\n* tag \u0027for-next-tpm-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n tpm: Disable TPM on null key name mismatch\n tpm: fix off-by-four bounds check in tpm2_get_random()\n tpm: Fix auth session leak in tpm2_get_random() error path\n tpm: Fix heap buffer overflow in tpm_transmit_cmd()\n" }, { "commit": "b4e7fc36e31f59b318d38afe621ac20650314d27", "tree": "57761a2fd10aef9bc18d69c0d4aa7f4aa77fcc76", "parents": [ "e6229c0402ea4863ec74802d79d5b52b9398d66c", "cad16d850e3759dd82cd869f739b56e9844a1fee" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Oct 02 14:45:01 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Oct 02 14:45:01 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.3-rc5\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.3\n\nA bigger collection of fixes than usual due to your vacation but nothing\nhugely remarkable here, just fairly standard quirks and driver specific\nbugfixes.\n" }, { "commit": "de020dc8049bfb2b22e3b6d99c031feb2e22d112", "tree": "a17397b47c633d1462b7caf82df94f14e1a3080e", "parents": [ "7b12c538697f2d5014dfd378c73be193d700c7a9" ], "author": { "name": "Ömer Mete Kaya", "email": "omermetekaya0@gmail.com", "time": "Tue Sep 29 11:10:34 2026 +0300" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Oct 02 11:34:15 2026 +0000" }, "message": "bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()\n\nbpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration\nto be disabled. All callers of rhtab_delete_elem() disable migration\nexcept __rhtab_map_lookup_and_delete_batch(), which calls it under\nrcu_read_lock() only.\n\nOn CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or\nmigration, so the task can migrate between CPUs during the delete loop,\ncausing this_cpu_ptr() to trigger:\n\n BUG: using smp_processor_id() in preemptible [00000000] code\n\nFix by wrapping the delete loop in migrate_disable()/migrate_enable()\nin __rhtab_map_lookup_and_delete_batch(), matching the migration\nprotection that the other callers already provide.\n\nFixes: 818e00848227 (\"bpf: Implement iteration ops for resizable hashtab\")\nReported-by: syzbot+fd7e415d891073b83e1f@syzkaller.appspotmail.com\nSigned-off-by: Ömer Mete Kaya \u003comermetekaya0@gmail.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nAcked-by: Mykyta Yatsenko \u003cyatsenko@meta.com\u003e\nLink: https://patch.msgid.link/20260929081609.557899-1-omermetekaya0@gmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dfd7e415d891073b83e1f\n" }, { "commit": "eb13a1ff271b0d180687eebb30611b0b276d5193", "tree": "03fd4fbd2665a1e8816353cf8e7f3bf7f5b6ce90", "parents": [ "703749b069d53b55f92499e088b30b031e47b8f9" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Fri Sep 25 22:46:32 2026 +0100" }, "committer": { "name": "Jason A. Donenfeld", "email": "Jason@zx2c4.com", "time": "Fri Oct 02 12:12:13 2026 +0200" }, "message": "random: vDSO: avoid call to memset() when zeroing reserved parameter\n\nAfter a recent change in LLVM [1], builds with the random vDSO\nimplementation, such as PowerPC and RISC-V, fail when checking the vDSO:\n\n arch/powerpc/kernel/vdso/vdso32.so.dbg: dynamic relocations are not supported\n arch/riscv/kernel/vdso/vdso.so.dbg: dynamic relocations are not supported\n\nmemset() is now generated when zeroing params-\u003ereserved for some builds\nbecause LLVM has an optimization (now run in more instances) that can\nrecognize at compile time when it is assigning a static value to a\ncontiguous area of memory and turn that into a call to memset(). Both\nclang and GCC assume memset() is always available [2].\n\nClang has an internal fiddly hook, -max-store-memset, which we can set\nto a high number, to disable generating out of line memset calls [3].\nSimilarly, GCC has -finline-stringops\u003dmemset to do the same [4], should\nthis issue ever hit future version of GCC. While these options wouldn\u0027t\nmake sense for normal kernel code, it is fine for the extremely limited\nand intentionally compact vDSO code.\n\nLink: https://github.com/llvm/llvm-project/commit/90cebef1411617fc3eedd359bdf00cb44b1c2439 [1]\nLink: https://gcc.gnu.org/onlinedocs/gcc-16.2.0/gcc/Standards.html#index-ffreestanding [2]\nLink: https://github.com/llvm/llvm-project/commit/b28eeb28bea39148738dc375e8a97072a1907e64 [3]\nLink: https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-finline-stringops [4]\nCloses: https://github.com/ClangBuiltLinux/linux/issues/2183\nCc: stable@vger.kernel.org # v6.12+\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\n" }, { "commit": "f35e3b5784221654f9cdbd6222275a7fa203f6c3", "tree": "350ec1fdd8ac210722291f1241c187bdef4eef44", "parents": [ "26f6b6357b1b06e6aaa9b8d796989cca785d8e1d" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Thu Oct 01 13:50:22 2026 +0000" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Oct 02 11:47:13 2026 +0200" }, "message": "futex: Fix private hash use-after-free on resize\n\npoll_state_synchronize_rcu(mm-\u003efutex.phash.batches) is used by\nfutex_ref_drop() to check that a grace period has passed since the\ncurrent hash was published. This relies on batches referencing a grace\nperiod which started after the hash pointer was assigned.\n\n__futex_pivot_hash() sets mmph-\u003ebatches before it replaces mmph-\u003ehash:\n\n scoped_guard(rcu) {\n mmph-\u003ebatches \u003d get_state_synchronize_rcu();\n rcu_assign_pointer(mmph-\u003ehash, new);\n }\n\nThe scoped_guard(rcu) doesn\u0027t stop new grace periods from starting, and\nif one starts between those two assignments, futex_ref_drop() can move\nforward while a reader still holds a pointer to the old hash.\n\nFix things by setting mmph-\u003ebatches after assigning mmph-\u003ehash. The\nscoped_guard(rcu) isn\u0027t needed, so let\u0027s drop that as well.\n\nFixes: 56180dd20c19 (\"futex: Use RCU-based per-CPU reference counting instead of rcuref_t\")\nAssisted-by: kres\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nLink: https://patch.msgid.link/20261001135022.2220288-1-mason@kernel.org\n" }, { "commit": "26f6b6357b1b06e6aaa9b8d796989cca785d8e1d", "tree": "946846adf875e05918005a175b6487070a71fe1f", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Kuan-Wei Chiu", "email": "visitorckw@gmail.com", "time": "Thu Oct 01 10:25:15 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Oct 02 11:40:12 2026 +0200" }, "message": "irq: Make refcount_interrupt kunit test selectable\n\nCurrently, refcount_interrupt_test is built unconditionally when\nCONFIG_KUNIT is enabled, causing it to run unexpectedly during boot.\n\nFix this by introducing CONFIG_REFCOUNT_INTERRUPT_KUNIT_TEST so the\ntest can be configured independently, following standard kunit\npractices.\n\nFixes: 07a88e2bcd5b (\"irq: Add KUnit test for refcounted interrupt enable/disable\")\nSigned-off-by: Kuan-Wei Chiu \u003cvisitorckw@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nReviewed-by: Radu Rendec \u003cradu@rendec.net\u003e\nReviewed-by: Boqun Feng \u003cboqun@kernel.org\u003e\nLink: https://patch.msgid.link/20261001082519.16195-2-boqun@kernel.org\n" }, { "commit": "6c95ca52f27855dd2fb74131c8d4e8325d2af7de", "tree": "8383f6f3e73b3c17139053eb9b5cc4ff64a272d9", "parents": [ "39495ef5d6f8019e62d65807f217a7ca8232727a" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Fri Oct 02 09:27:36 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Oct 02 11:15:22 2026 +0200" }, "message": "tty: add missing driver flag kernel-doc colon\n\nA recent change adding a new TTY driver flag left out a colon required\nfor well-formed kernel-doc.\n\nFixes: 8df07fe93573 (\"tty: fix saved termios reset race\")\nReported-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nLink: https://lore.kernel.org/ec3a09d6-4ba4-41b8-abb1-b59e265f4532@infradead.org\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nLink: https://patch.msgid.link/20261002072736.2063004-1-johan@kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7a39c732a22ec4a369af9e19fbe3d666ec83eec4", "tree": "58fdbe99f1eb36067d3bc2cce87313c46d894a47", "parents": [ "e0a6249190402a28f1e2925a81acf573157d55ef" ], "author": { "name": "Leon Hwang", "email": "leon.hwang@linux.dev", "time": "Wed Sep 30 13:36:18 2026 +0800" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Oct 02 15:51:57 2026 +0900" }, "message": "kprobes: Skip disarmed probes when checking optkprobe overlap\n\nOn x86, an optkprobe at A replaces five bytes with a jump. If a disabled\nprobe B is at A+2, get_optimized_kprobe() stops at B when arming a new\nprobe C at A+4. It leaves A optimized:\n\n A A+1 A+2 A+3 A+4\n A\u0027s jump | e9 | d0 | d1 | d2 | d3 |\n after C | e9 | d0 | d1 | d2 | cc |\n\nThe INT3 for C overwrites the last byte of A\u0027s jump displacement, so\nexecution can jump to the wrong address. B can have prepared optinsns\nwhile disarmed, but has no jump to unoptimize.\n\nContinue past disarmed and unprepared probes to find the active optimized\nprobe before arming a probe in its jump.\n\nLink: https://lore.kernel.org/all/20260930053618.104498-1-leon.hwang@linux.dev/\n\nFixes: afd66255b9a4 (\"kprobes: Introduce kprobes jump optimization\")\nCc: stable@vger.kernel.org\nSigned-off-by: Leon Hwang \u003cleon.hwang@linux.dev\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "26fe67ec0dca018767b038fe65c9fc9da058ac19", "tree": "4e38aed123b6bf3928600fc35c0323039a6fdedf", "parents": [ "d87d131d18a1929441b9e48a6f8378938ae87098", "c034e8a46e4cb703018fe7e10fe5a3a974d6a7c3" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 02 11:26:46 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 02 11:26:47 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-10-01\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for v7.3-rc6:\n- Disable VRR DC balance by default to fix timing issues\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/5a9a11777f605b59550783923add4568e974a6ea@intel.com\n" }, { "commit": "d87d131d18a1929441b9e48a6f8378938ae87098", "tree": "8d23b1ec906291bd56f928e18ac14bc14ba9c65d", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e", "72207463f7a4a6818a88f4ef57802b42da534301" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 02 10:34:50 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Oct 02 11:26:20 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-10-01\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nOnly 1 fix to Keep VF LMEM BAR size low if no VFs enabled from\nMarcin and a preparation patch for that.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ar5qJ-OV2gNI1TwN@intel.com\n" }, { "commit": "048739be3e9cacae5301b68245668002fe6f0ce5", "tree": "73b3e95af1cce3418325b4cda23836ba16e281cf", "parents": [ "2af45da333bdd7be2666688a0f861e0750e40e49" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 21:11:56 2026 +0800" }, "committer": { "name": "Chun-Kuang Hu", "email": "chunkuang.hu@kernel.org", "time": "Thu Oct 01 23:06:43 2026 +0000" }, "message": "drm/mediatek: Fix ovl adaptor platform device leak\n\nmtk_drm_probe() creates an OVL adaptor platform device with\nplatform_device_register_data() when the display pipeline requires the\nOVL adaptor.\n\nIf a later initialization step fails, the probe error path releases\nthe DRM resources without unregistering the already registered OVL\nadaptor device. The normal remove path likewise leaves the device\nregistered after the DRM driver is unbound.\n\nKeep track of whether the OVL adaptor was successfully registered and\nunregister it on probe failure. Also recover the platform device from\nthe stored DDP component device and unregister it during normal\nremoval.\n\nThe issue was identified by a static analysis tool I developed and\nconfirmed by manual review.\n\nFixes: 0d9eee9118b7 (\"drm/mediatek: Add drm ovl_adaptor sub driver for MT8195\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nLink: https://patchwork.kernel.org/project/linux-mediatek/patch/20260921131156.403652-1-lgs201920130244@gmail.com/\nSigned-off-by: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\n" }, { "commit": "2af45da333bdd7be2666688a0f861e0750e40e49", "tree": "b4516198d9d529a9c02d67bcf8be3ae5aef90a8b", "parents": [ "3753e34b73fcbe2a2edbe984614a008a261697ef" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Wed Sep 16 17:42:29 2026 +0000" }, "committer": { "name": "Chun-Kuang Hu", "email": "chunkuang.hu@kernel.org", "time": "Thu Oct 01 22:52:44 2026 +0000" }, "message": "drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()\n\npm_runtime_get_sync() unconditionally bumps the usage counter, but\nnothing puts it back when devm_i2c_add_adapter() fails, leaving the DDC\nruntime-resumed after a failed probe. Drop the reference on that error\npath.\n\nFixes: 8d0f79886273 (\"drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188\")\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nLink: https://patchwork.kernel.org/project/linux-mediatek/patch/20260916174229.2088824-1-vulab@iscas.ac.cn/\nSigned-off-by: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\n" }, { "commit": "3753e34b73fcbe2a2edbe984614a008a261697ef", "tree": "97b7cbb515e78c0194e6ddea0aa86135092183ed", "parents": [ "3e292c56bf5e338efcda7f9bfa603180855cd1be" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Wed Sep 16 17:40:58 2026 +0000" }, "committer": { "name": "Chun-Kuang Hu", "email": "chunkuang.hu@kernel.org", "time": "Thu Oct 01 22:40:43 2026 +0000" }, "message": "drm/mediatek: Fix pdev reference leak in mtk_drm_bind()\n\nWhen the device is not the mmsys master, mtk_drm_bind() returns early\nafter taking a reference on the disp-mutex device via\nof_find_device_by_node(), without ever dropping it: mtk_drm_unbind()\nonly puts mutex_dev for the master. Drop the reference before returning\nfrom the non-master path.\n\nFixes: 1ef7ed48356c (\"drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nLink: https://patchwork.kernel.org/project/linux-mediatek/patch/20260916174058.2088709-1-vulab@iscas.ac.cn/\nSigned-off-by: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\n" }, { "commit": "a22e5e4f2ebbdbb962cc3233094d189c4dfaa051", "tree": "48c253c71b52e3f5645c30e83a23387704cbb86c", "parents": [ "08c9100f65299c64439e22e6057d750ae0e6c660" ], "author": { "name": "Francisco Beltrán Millalén", "email": "fbeltranmillalen@gmail.com", "time": "Thu Sep 24 18:05:23 2026 -0300" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:34 2026 -0400" }, "message": "drm/amdgpu: reset VI ASIC on MacBookPro14,3\n\nOn a MacBookPro14,3 with a Radeon Pro 555 (Polaris11), the framebuffer\nis at MC address 0 when amdgpu loads after a cold boot, as the firmware\nleaves it (MC_VM_FB_LOCATION \u003d 0x007f0000), while the VBIOS ASIC_Init\ntable places it at 0xF4_0000_0000 (0xf47ff400). amdgpu reads the\nlocation once, at init, so after a re-POST (S3 resume or GPU reset)\nthe framebuffer has moved and the driver keeps programming the old\none: the SMU is handed a table that was never written and the GPU\ndoes not come back, which leaves the internal panel black.\n\nResetting the ASIC on load makes ASIC_Init run before the driver reads\nthe location, so the driver uses the VBIOS placement from the start and\nevery later re-POST puts the framebuffer back where it already is.\n\nAdd the Radeon Pro 555 used in this machine to the existing VI reset\nquirk table.\n\nTested on a MacBookPro14,3 on 6.18.49 with the quirk table backported\n(the kernel also carries unrelated local PCI and ACPI patches for this\nmachine). The framebuffer is at 0x000000F400000000 after both cold and\nwarm boot, and the GPU survived 9 S3 cycles (lid close and rtcwake, one\nof them with the lid closed for about 7.5 minutes and a USB-C disk\nattached), each followed by a few minutes of 3D load; no ring timeouts\nor VM faults were reported. The reset adds about 0.23 s to amdgpu init.\n\nSuggested-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSuggested-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://lore.kernel.org/all/20260924132952.25054-1-fbeltranmillalen@gmail.com/\nAssisted-by: Claude:claude-opus-5-5\nSigned-off-by: Francisco Beltrán Millalén \u003cfbeltranmillalen@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit b6b1d97218518003107d4446fac278fa3e0a19a0)\nCc: stable@vger.kernel.org\n" }, { "commit": "08c9100f65299c64439e22e6057d750ae0e6c660", "tree": "1a0a135a1d07a1b9372b2a2906b5c2ad3a852015", "parents": [ "b76a5b7bee22556914f7cde210f695ef162d81bf" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Wed Sep 23 14:03:54 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:14 2026 -0400" }, "message": "drm/amd/pm/si: Fix updating clock limits on AC/DC\n\nAssume that the AC limits are the maximum of all power states,\nand the DC limits are the maximum of battery power states.\nThis shouldn\u0027t make any difference in practice, but is\ncleaner and more robust against bogus information in the VBIOS.\n\nFixes: e6c5d36756e7 (\"drm/amd/pm/si: Fix updating clock limits from power states\")\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://patch.msgid.link/20260923120354.1027996-2-timur.kristof@gmail.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit ef8cb9dcc7db7b7abcbdbe870a080cc81e4f0bf3)\nCc: stable@vger.kernel.org\n" }, { "commit": "b76a5b7bee22556914f7cde210f695ef162d81bf", "tree": "b4207346e6416fc0ab6e55ff2b6c29205bfc988a", "parents": [ "de1eab13efef83fd2b76f4688de5bf672644596f" ], "author": { "name": "Simon Polack", "email": "spolack+git@mailbox.org", "time": "Thu Sep 17 12:42:34 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:05 2026 -0400" }, "message": "drm/amd/display: Fix stale replay_events after mod_power stream removal\n\n[Why]\nmod_power_remove_stream() shifts the remaining power_entity slots down\nbut does not move replay_events, and mod_power_add_stream() does not\ninitialize it. replay_events therefore stay bound to the map slot\ninstead of the stream.\n\nWhen several streams are disabled in one atomic commit,\namdgpu_dm_mod_power_update_streams() removes them one after another.\nThe eDP stream can then be looked up in a slot whose stale\nreplay_events already have replay_event_hw_programming set, so\namdgpu_dm_replay_set_event() returns early (\"already in desired state\")\nwithout calling mod_power_set_replay_event(). Replay is not disabled\nbefore the eDP panel is powered off. After DPMS on, the sink reports\nneither replay state nor frame lock (DPCD 0x378 \u003d 0x00, no error bits),\nso the HPD IRQ recovery does not trigger and the panel stays black\nuntil a full modeset.\n\nSeen with an eDP panel using FreeSync Replay plus two DP-MST displays:\nDPMS off/on of all outputs leaves eDP black, while DPMS of eDP alone\nworks. Doing an eDP-only DPMS first makes the next all-output DPMS\nfail reliably.\n\n[How]\nShift replay_events together with the PSR cached fields in\nmod_power_remove_stream() and initialize it to replay_event_vsync in\nmod_power_add_stream(), matching the psr_event_vsync initial value used\nfor PSR (both vsync events are driven together by\namdgpu_dm_crtc_set_static_screen_optimze()).\n\nTested on 7.3.0-rc3 (238650ef6c7c): the reproducer above now recovers\nreliably, and Replay still engages when the screen is idle.\n\nThe issue was debugged with help from an AI assistant (Claude), which\nanalysed ftrace/kprobe traces and the driver source, pointed to the\nmissing replay_events handling and suggested this change. I collected\nthe traces and built and tested the fix on the affected hardware.\n\nFixes: 4cef2ac4c795 (\"drm/amd/display: Introduce power module on Linux\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Simon Polack \u003cspolack+git@mailbox.org\u003e\nReviewed-by: Ray Wu \u003cray.wu@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 3d47e38e271195435e125527b224d11cfdb777b1)\nCc: stable@vger.kernel.org\n" }, { "commit": "de1eab13efef83fd2b76f4688de5bf672644596f", "tree": "2086c897e05c886be227cda55d051a024a02890c", "parents": [ "217f64f348c90cba62164e7ff38e0ccf78a5ca09" ], "author": { "name": "Imre Kaloz", "email": "kaloz@kernel.org", "time": "Sun Sep 27 16:55:04 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:05 2026 -0400" }, "message": "drm/radeon: Read the VRAM VBIOS signature with readb()\n\nigp_read_bios_from_vram() checked bios[0]/bios[1] with a plain\n__iomem load, which faults on sparc64 before the copy runs at all.\nradeon_read_bios() already reads its two signature bytes with\nreadb() ahead of its own copy; use the same accessor here, keeping\nthe check before the allocation.\n\nFixes: b442962a9e82 (\"drm/radeon/kms: add support for \"Surround View\"\")\nSigned-off-by: Imre Kaloz \u003ckaloz@kernel.org\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 09155b8932e5013dbce0f5cdff7d75264a279ee5)\nCc: stable@vger.kernel.org\n" }, { "commit": "217f64f348c90cba62164e7ff38e0ccf78a5ca09", "tree": "e5eddbe206ebf7d8ba2e285707768d9efff53bc5", "parents": [ "106b4a2a78b2a2f14885604891957b84bba502db" ], "author": { "name": "Hari Mishal", "email": "harimishal1@gmail.com", "time": "Wed Sep 16 16:23:32 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:05 2026 -0400" }, "message": "drm/amd/display: guard dc_sink dereferences in MST mode validation\n\ndm_dp_mst_is_port_support_mode() reads\naconnector-\u003edc_sink-\u003edsc_caps... for the DSC branch-throughput check,\nand get_conv_frl_bw()\u0027s HDMI-PCON FRL-bandwidth path reads\naconnector-\u003edc_sink-\u003eedid_caps.max_frl_rate, both without a NULL\ncheck. dc_sink is cleared asynchronously on MST unplug, and both\nfunctions run from paths that the driver\u0027s own comments document as\nracing that teardown: the connector probe worker\u0027s -\u003emode_valid\ncallback and a compositor\u0027s atomic check, neither of which holds the\nMST manager lock that the teardown path uses. The former does have an\nexisting dsc_aux NULL check, but dsc_aux isn\u0027t reliably cleared in\nevery path that clears dc_sink, so it doesn\u0027t cover this.\n\nFail the port-support check and skip the FRL conversion path when the\nsink is already gone.\n\nFixes: f04d275d94e1 (\"drm/amd/display: add mst port output bw check\")\nFixes: 5c9b8b27a883 (\"drm/amd/display: Tie FRL support into amdgpu_dm\")\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Hari Mishal \u003charimishal1@gmail.com\u003e\nReviewed-by: Fangzhi Zuo \u003cjerry.zuo@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)\nCc: stable@vger.kernel.org\n" }, { "commit": "106b4a2a78b2a2f14885604891957b84bba502db", "tree": "5d40eef2428fb1a4791ab46a4b19091a5910eac2", "parents": [ "fbc988f236a60cf50a89da78fc6b7213daa9999c" ], "author": { "name": "Adrian Betschart", "email": "adrian.betschart@cinemaone.ch", "time": "Fri Sep 11 17:13:14 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:05 2026 -0400" }, "message": "drm/amd/display: Try RGB before YCbCr 4:4:4 in stream validation\n\namdgpu_dm_create_validate_stream_for_sink() walks encoding_order[] and\nuses the first encoding that validates. YCbCr 4:4:4 is listed before\nRGB, so an HDMI sink that advertises 4:4:4 gets YCbCr 4:4:4 whenever the\n\"color format\" property is left at AUTO, even though RGB fits the same\nlink.\n\nThat contradicts the documented AUTO behaviour for HDMI in enum\ndrm_connector_color_format (RGB, falling back to YCbCr 4:2:0 only when\nthe bandwidth is not available or the mode is 4:2:0-only), which the\namdgpu implementation of the property also describes. It also leaves\nthe \"Broadcast RGB\" property without effect on such sinks, since the\nquantization range it selects only applies to RGB output.\n\nTry RGB first. The mask still holds every encoding the sink supports,\nso a mode that cannot carry RGB falls back exactly as before.\n\nFor reference, v7.2 picked RGB here unless YCbCr 4:4:4 was forced\nthrough debugfs, while earlier kernels picked YCbCr 4:4:4 for any HDMI\nsink that advertised it.\n\nFixes: 0b0ff65d3ca1 (\"drm/amd/display: Refactor stream validation\")\nSuggested-by: Adolfo Rodrigues \u003cadolfotregosa@gmail.com\u003e\nAssisted-by: Claude Code:claude-fable-5-1\nSigned-off-by: Adrian Betschart \u003cadrian.betschart@cinemaone.ch\u003e\nReviewed-by: Fangzhi Zuo \u003cjerry.zuo@amd.com\u003e\nTested-by: Adolfo Rodrigues \u003cadolfotregosa@gmail.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 7de432bc753133764dc40d37f9388da56de251e7)\n" }, { "commit": "fbc988f236a60cf50a89da78fc6b7213daa9999c", "tree": "424b11c7d844278857aea1fa18bc13c8d5cf054f", "parents": [ "e3e7fdece7069d09ddd818564853174865d4796a" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Sun Sep 27 12:16:01 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:05 2026 -0400" }, "message": "drm/amd/display: Fix sanitizer check for the DML frame size limit\n\nBuilding x86_64 allmodconfig with clang fails:\n\n .../dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:10491:13:\n error: stack frame size (3128) exceeds limit (3072) in\n \u0027dml_core_mode_programming\u0027 [-Werror,-Wframe-larger-than]\n\nThat config enables both KASAN and UBSAN, and should get the 4096\nbyte limit meant for clang COMPILE_TEST sanitizer builds. The check\nin the dml and dml2_0 Makefiles concatenates the three symbols with\nno separator:\n\n ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)$(CONFIG_UBSAN)),y)\n\nKASAN and KCSAN cannot be enabled together, so before UBSAN was\nadded the string was at most \"y\". UBSAN can be enabled alongside\neither of them, and with both set the string becomes \"yy\",\n$(filter y,yy) is empty, and the build falls through to the\nnon-sanitizer limit of 3072. Adding UBSAN to the check therefore\nlowered the limit for the most heavily instrumented builds instead\nof raising it.\n\nSeparate the symbols with spaces so that $(filter) sees individual\nwords, and test for a non-empty result. Only the configs with two\nsanitizers enabled change behaviour.\n\nFound by KernelCI builds of the linus-next tree.\n\nFixes: ebf8b0fd8508 (\"drm/amd/display: Relax DML frame limit with UBSAN\")\nAssisted-by: LLM\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 0400d53fd03e7d4beb09fdabda42a7b2c4ca465d)\nCc: stable@vger.kernel.org\n" }, { "commit": "e3e7fdece7069d09ddd818564853174865d4796a", "tree": "a5d9fc9ca93e323daa7a73fb0c64828eae34ed01", "parents": [ "1d1f1acecddf742eb1f305122209bc2034fd90b1" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Sep 25 16:11:38 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:05 2026 -0400" }, "message": "drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub()\n\nIn gmc_v12_1_flush_gpu_tlb(), flush_type was not properly\npassed to gmc_v12_1_flush_vm_hub(). This only affected\nthe MMIO path. In most cases the flush would go through\nMES.\n\nReviewed-by: Mukul Joshi \u003cmukul.joshi@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 1f0f66fab18dfa8f14db82b8a6b82dcc21926248)\nCc: stable@vger.kernel.org\n" }, { "commit": "1d1f1acecddf742eb1f305122209bc2034fd90b1", "tree": "c7e57142d24630db4dc92a962ac7e514328a2775", "parents": [ "cc172e177795c5f87bc2d71768d077e1c10633e8" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Sep 22 12:10:40 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:18:01 2026 -0400" }, "message": "drm/amdgpu: drop userq callback assignment for sdma 7.1\n\nNot enabled in 7.1 so drop the assignment.\n\nCc: Horatio Zhang \u003chongkun.zhang@amd.com\u003e\nCc: Hawking.Zhang@amd.com\nFixes: 4ed5116aacf6 (\"drm/amdgpu: Add sdma v7_1_0 support\")\nReviewed-by: Hawking Zhang \u003cHawking.Zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 106e19f69a066fb6354dac04e5f5ed43a06727f7)\nCc: stable@vger.kernel.org\n" }, { "commit": "cc172e177795c5f87bc2d71768d077e1c10633e8", "tree": "cb58206bcdf27bf41f9f807159358840a9744712", "parents": [ "f0013046151b7467e62c471c1c83d63ea255799c" ], "author": { "name": "Willian Oliveira", "email": "williandossantosdeoliveira287@gmail.com", "time": "Mon Sep 21 22:54:10 2026 -0300" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:58 2026 -0400" }, "message": "drm/amdgpu/gfx6: fix firmware leak on teardown\n\nThe firmware requested in gfx_v6_0_init_microcode() is not released\nwhen the GFX block is torn down, leaking the firmware resources.\n\nAdd gfx_v6_0_free_microcode() and call it from gfx_v6_0_sw_fini()\nto release the PFP, ME, CE and RLC firmware.\n\nSigned-off-by: Willian Oliveira \u003cwilliandossantosdeoliveira287@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 386e81346f95ab0be5a82c5535de932e7a456924)\nCc: stable@vger.kernel.org\n" }, { "commit": "f0013046151b7467e62c471c1c83d63ea255799c", "tree": "b7c5e47be1bcf387e5e0fe1739298dfc97864707", "parents": [ "f5a5add3605935163dd0f75749b6a7869e9765af" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 18:33:18 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:57 2026 -0400" }, "message": "drm/amdgpu: fix ACP MFD device leak on init failure\n\nacp_hw_init() registers ACP child devices with mfd_add_devices() before\nattaching them to the ACP power domain and initializing the hardware.\n\nIf attaching a child to the power domain fails, or if the ACP reset or\nclock enable operation times out, the failure path frees only the\nsource cell, resource, and platform-data allocations. The child\nplatform devices already registered by mfd_add_devices() remain\nregistered and are never released.\n\nRemove the children from the power domain and unregister the MFD\ndevices on failures that occur after mfd_add_devices() succeeds. Keep\nmfd_add_devices() failures on the existing cleanup path since the MFD\ncore already rolls back partially registered children itself.\n\nThe issue was identified by a static analysis tool I developed and\nconfirmed by manual review.\n\nFixes: 25030321ba28 (\"drm/amd: add pm domain for ACP IP sub blocks\")\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 63da68d6a2279ec945581c990c5a59a5ae8b5560)\nCc: stable@vger.kernel.org\n" }, { "commit": "f5a5add3605935163dd0f75749b6a7869e9765af", "tree": "f2cb471801b14b15bbd04cf78888b94db1ef9c7f", "parents": [ "eadb85cca111152bd334b861fb53747ab851d13a" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Sun Sep 20 00:55:11 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:57 2026 -0400" }, "message": "drm/amdgpu: fix IP instance memory leak on kobject add failure\n\namdgpu_discovery_sysfs_ips() allocates ip_hw_instance with\nkzalloc_flex() and initializes its embedded kobject before calling\nkobject_add().\n\nIf kobject_add() fails, the return value is ignored and execution\ncontinues without dropping the initial kobject reference. The failed\nkobject is not retained in the kset list, so the normal sysfs teardown\npath cannot find it. As a result, ip_hw_instance_release() is never\ncalled and the ip_hw_instance allocation is leaked.\n\nCall kobject_put() when kobject_add() fails so the initial reference is\ndropped and ip_hw_instance_release() can free the allocation. Keep the\nexisting best-effort sysfs behavior by continuing with the remaining IP\nentries after the failed registration.\n\nThe issue was identified by a static analysis tool I developed and\nconfirmed by manual review.\n\nFixes: a6c40b178092 (\"drm/amdgpu: Show IP discovery in sysfs\")\nReviewed-by: Lijo Lazar \u003clijo.lazar@amd.com\u003e\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 5c75fbcca8af1096d8d9415b91d8ea6212c22ee1)\nCc: stable@vger.kernel.org\n" }, { "commit": "eadb85cca111152bd334b861fb53747ab851d13a", "tree": "d4f123ee9f015a8ea203d6b10ecb370179b269f5", "parents": [ "0bfb1bfc82e8fa386d4fad1caa5812b6afafa626" ], "author": { "name": "Theo Andersen Carton", "email": "andersen.theo@gmail.com", "time": "Thu Sep 17 21:15:12 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:57 2026 -0400" }, "message": "drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU\n\namdgpu_pmops_suspend_noirq() resets the ASIC unconditionally. When the GPU\nhas been parked by vga_switcheroo it has neither power nor a PCIe link, so\nthe reset cannot reach it: pci_set_power_state() reports the device as\ninaccessible and amdgpu_asic_reset() returns -EINVAL. A failure there\naborts the entire noirq suspend phase, and with it the system suspend, so\nthe machine cannot sleep at all while the GPU is switched off.\n\namdgpu_device_prepare(), amdgpu_device_suspend() and amdgpu_device_resume()\nall bail out early on DRM_SWITCH_POWER_OFF. This callback was added later,\nfor an unrelated reason, and did not inherit the check. nouveau guards\nevery one of its PM callbacks the same way.\n\nBail out the same way here. On a single-GPU system switch_power_state is\nnever DRM_SWITCH_POWER_OFF, so this is a no-op there.\n\nFound on a MacBookPro11,5, where the Radeon is powered down through\napple-gmux so that the internal panel can be driven by the iGPU instead.\nEvery suspend failed in amdgpu_pmops_suspend_noirq() while the card was\noff; with this check a full S3 cycle completes.\n\nFixes: 9e051720f9d3 (\"drm/amdgpu: Ensure HDA function is suspended before ASIC reset\")\nSigned-off-by: Theo Andersen Carton \u003candersen.theo@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 539d0558638a6dcc066f1cf592b6b9a52adc8ea4)\nCc: stable@vger.kernel.org\n" }, { "commit": "0bfb1bfc82e8fa386d4fad1caa5812b6afafa626", "tree": "395ea0bf08a572ad6dc99b6abbc1ac7cf7c46494", "parents": [ "51cc916648d1421e0271090fb4fa86550a7a96d9" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Sep 25 13:46:19 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:57 2026 -0400" }, "message": "drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()\n\nIn gmc_v12_0_flush_gpu_tlb(), flush_type was not properly\npassed to gmc_v12_0_flush_vm_hub(). This only affected\nthe MMIO path. In most cases the flush would go through\nMES.\n\nReviewed-by: Mukul Joshi \u003cmukul.joshi@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 6498e33f22a12fdc759a0c78bfe0547819277a36)\nCc: stable@vger.kernel.org\n" }, { "commit": "51cc916648d1421e0271090fb4fa86550a7a96d9", "tree": "a2cd200d769bfa2d164083f67d5ba01cfdf32043", "parents": [ "eaeac1498b289b342449b678a567a9012360f91a" ], "author": { "name": "Ray Wu", "email": "ray.wu@amd.com", "time": "Fri Sep 18 11:05:46 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:47 2026 -0400" }, "message": "drm/amd/display: map PWM brightness through custom backlight curve\n\n[Why/How]\nOn the PWM path, convert the userspace brightness to an input signal and\nderive the target luminance from the custom backlight curve, then pass\nthe resulting millipercent to the power module.\n\nThis keeps PWM programming and backlight curve mapping in the power\nmodule, aligning the Linux path with the Windows behavior.\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/issues/5723\nFixes: 3c108046e1d6 (\"drm/amd/display: Add power module on Linux\")\nAssisted-by: Cursor:Claude-Opus-4.8\nSigned-off-by: Ray Wu \u003cray.wu@amd.com\u003e\nSigned-off-by: Fangzhi Zuo \u003cjerry.zuo@amd.com\u003e\nReviewed-by: ChiaHsuan (Tom) Chung \u003cchiahsuan.chung@amd.com\u003e\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit bc4e099caa85e8d4c3555851a0feb07058c4a1fe)\nCc: stable@vger.kernel.org\n" }, { "commit": "eaeac1498b289b342449b678a567a9012360f91a", "tree": "4b4a207a077b1528703d1bb63467e71da675a322", "parents": [ "0e4101c11aed803e6e69a83f8cc48160a676c19d" ], "author": { "name": "Pierre-Eric Pelloux-Prayer", "email": "pierre-eric.pelloux-prayer@amd.com", "time": "Thu Sep 24 09:37:28 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:42 2026 -0400" }, "message": "drm/amdgpu: implement workaround for sdma dcc corruption\n\nFor unknown reasons, on gfx12 using multiple entities can causes\nrandom corruption of BOs with DCC.\nThis workaround seems to prevent the issue until the root cause\nis understood and fixed.\n\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/5663\nFixes: 3a6f6eeb3db5 (\"drm/amdgpu: give ttm entities access to all the sdma scheds\")\nSigned-off-by: Pierre-Eric Pelloux-Prayer \u003cpierre-eric.pelloux-prayer@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit cd647796ac1334acec0468fae49a0dacbba2a34c)\nCc: stable@vger.kernel.org\n" }, { "commit": "0e4101c11aed803e6e69a83f8cc48160a676c19d", "tree": "e1dd7eb9eb10fdd9245455ed8006152be0519d43", "parents": [ "8228688eb40cc116127e80394cb8157417854c70" ], "author": { "name": "Andrew Martin", "email": "andrew.martin@amd.com", "time": "Mon Sep 14 12:19:10 2026 +0000" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:16 2026 -0400" }, "message": "drm/amdkfd: Fix always mapped range mapping to all ACCESS GPUs\n\nCWSR ranges use the always mapped flag and only need a mapping on the\nGPU running the queue. However, svm_range_validate_and_map now updates\nthe mapping on every GPU with the ACCESS attribute, which is all\nsupported GPUs when XNACK is on. After the range is prefetched to VRAM,\nthose GPUs may span different XGMI hives, so the page owner mismatches\nand is set to NULL. hmm_range_fault then tries to migrate the VRAM\npages back to system memory, but svm_migrate_to_ram skips it because\nmigrating pages back to system memory is not allowed while the GPU\nmapping is being updated, so the CPU page fault is never resolved.\n\nOnly map to the ACCESS GPUs if the range is not mapped to any GPU and\nis not in VRAM.\n\nFixes: b96f26104946 (\"drm/amdkfd: Unmap svm range from GPU set to no-access\")\nSigned-off-by: Andrew Martin \u003candrew.martin@amd.com\u003e\nAssisted-by: Claude:claude-opus-5\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReviewed-by: Philip Yang \u003cphilip.yang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 093cf8842ace35ce212858d5059fee007ec8e778)\nCc: stable@vger.kernel.org\n" }, { "commit": "8228688eb40cc116127e80394cb8157417854c70", "tree": "fc29d51e2795517a09a39a7396c1581c6d76b830", "parents": [ "9fe5745f9d8eca38d31d9b672a1998edf856f651" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Wed Sep 16 13:44:41 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:16 2026 -0400" }, "message": "drm/amdgpu/gfx11: set KMD_QUEUE for kernel gfx queues\n\nSet KMD_QUEUE in the GFX MQD and kernel ring control registers so CP\npreserves kernel IB VMIDs instead of replacing them with the queue VMID.\nUse prop-\u003ekernel_queue to distinguish kernel and user MQDs.\n\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 893642e0e3b2f5aa818e0ee4a49e2d401d541e3a)\n" }, { "commit": "9fe5745f9d8eca38d31d9b672a1998edf856f651", "tree": "b3476fb2c4aa6d0f16e55c6d6cd6275aecf2c42a", "parents": [ "56b2b97e7893f495b2e2a91cd3e405b6358c61f0" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Wed Sep 16 13:44:27 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:15 2026 -0400" }, "message": "drm/amdgpu/gfx12: set KMD_QUEUE for kernel gfx queues\n\nSet KMD_QUEUE in the GFX MQD and kernel ring control registers so CP\npreserves kernel IB VMIDs instead of replacing them with the queue VMID.\nUse prop-\u003ekernel_queue to distinguish kernel and user MQDs.\n\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 14741c01680a803050e949744089b57fa53e02f7)\n" }, { "commit": "56b2b97e7893f495b2e2a91cd3e405b6358c61f0", "tree": "ff50b1df608ff6123fab06f98bc55250811ffcbc", "parents": [ "6b6c4fab8815bd1da5643c19278d364026b8665b" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Sun Sep 20 17:20:21 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:15 2026 -0400" }, "message": "drm/amdgpu: fix empty fence backup and replay intervals\n\namdgpu_ring_set_fence_errors_and_reemit() and\namdgpu_ring_backup_unprocessed_commands() masked last_seq and sync_seq to\nfence-array indices before the loop, then walked a do/while until the two\nindices met. When hardware completed every command before the driver\nsignalled the fences, last_seq \u003d\u003d sync_seq, but the masked-index do/while\ncould not tell that empty interval from a full table and walked the whole\nfence array, backing up and replaying already-completed commands.\n\nRead the raw sequence numbers, return early through amdgpu_fence_process()\nwhen they are equal, and mask only at the array index. Guard the\nforce-completion against a NULL guilty_fence so a non-guilty backup does\nnot dereference it.\n\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 78fbe156637a11456fcd29615a56e098ec8a6990)\n" }, { "commit": "6b6c4fab8815bd1da5643c19278d364026b8665b", "tree": "5d2cc4f6102fdccc303cb636244303b5cd393fa1", "parents": [ "cd883d0a3937df82a5ea03709ba8ba623b868419" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Thu Sep 17 15:31:04 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:15 2026 -0400" }, "message": "drm/amdgpu: support non-guilty job save on ring backup\n\namdgpu_ring_backup_unprocessed_commands() is also used to preserve a\nring that carries no guilty command - for example a collateral kernel\ngfx ring that shares the faulting pipe during a gfx user-queue pipe\nreset. Such a ring is backed up with a NULL guilty_fence and all of its\nunprocessed commands must be saved so they can be replayed after the\nreset rebuilds the ring\u0027s MQD.\n\nThe early-return that skips an already-seen guilty fence compared\n\"ring-\u003eguilty_fence \u003d\u003d guilty_fence\", which is also true when both are\nNULL. A non-guilty save therefore hit the early return and left\nring_backup_entries_to_copy at 0, so the pending commands were dropped\nwhen the ring was rebuilt.\n\nGuard the early return with a non-NULL guilty_fence so a NULL fence\nnever takes it and every unprocessed command is backed up.\n\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit b3f73daa1c2498273981b68b7534e540614069e3)\n" }, { "commit": "cd883d0a3937df82a5ea03709ba8ba623b868419", "tree": "4f85bfca59eef15f1e5bba14512a8b5edbd77e14", "parents": [ "3a52d587d1fc8e8bf94ba1b07374f7ec91aaffb4" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Wed Sep 23 14:03:53 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:17:02 2026 -0400" }, "message": "drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC\n\nUnfortunately, some desktop boards eg. the FirePro D500\nhave the HARDWAREDC platform flag set and also have\na battery power state configured in their VBIOS.\nThis makes no sense for a desktop GPU and results in\nincorrect behaviour: the clocks are stuck at lowest.\n\nWe observed that the kernel driver can work around\nthe issue in two possible ways:\n1. Set PPSMC_SWSTATE_FLAG_DC on all power states\n2. Clear PPSMC_SYSTEMFLAG_GPIO_DC\n\nWe think that the PPSMC_SYSTEMFLAG_GPIO_DC flag\nmakes the SMC assume it\u0027s running on battery even\nthough this is a desktop machine with no battery,\nand that\u0027s why it doesn\u0027t do DPM on power states\nwithout PPSMC_SYSTEMFLAG_GPIO_DC.\n\nIssue was uncovered by \"Fix updating clock limits from\npower states\" because previously the limits for the\nbattery state were not tracked separately. However,\nbattery power state has lower frequencies and voltages,\nso the kernel doesn\u0027t set the DC flag on the current\npower state anymore. That causes the SMC to be stuck\non the lowest clocks.\n\nLet\u0027s clear PPSMC_SYSTEMFLAG_GPIO_DC on desktop GPUs.\nWe can use the AMD_IS_MOBILITY flag to determine that.\n\nFixes: e6c5d36756e7 (\"drm/amd/pm/si: Fix updating clock limits from power states\")\nCloses: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/16352\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://patch.msgid.link/20260923120354.1027996-1-timur.kristof@gmail.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 58473c7c49ce9f5f5a4a1c24ffb9aa1d3c8771f4)\nCc: stable@vger.kernel.org\n" }, { "commit": "3a52d587d1fc8e8bf94ba1b07374f7ec91aaffb4", "tree": "b37a247d0f46dfb6262b140cf8cb295dbf862ef7", "parents": [ "687d31ea9ac76b299817060fa1e5582d6c752ae0" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Wed Sep 23 14:20:33 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:16:55 2026 -0400" }, "message": "drm/amd/display: Mark DCE 6.4 as not APU\n\nDCE 6.4 is found in Oland chips, which were advertised\nas low-end gaming GPUs in 2013~2015 and then have been\nsold as low-end workstation GPUs until 2017~2019.\n\nThese are not APUs.\n\nFixes: 7c15fd86aaec (\"drm/amd/display: dc/dce: add initial DCE6 support (v10)\")\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://patch.msgid.link/20260923122033.1046651-3-timur.kristof@gmail.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 1072aa811ea1e61d5f763e4ec1bc6d24bb61f14a)\nCc: stable@vger.kernel.org\n" }, { "commit": "687d31ea9ac76b299817060fa1e5582d6c752ae0", "tree": "5059d1397ca07f196ed1b4f42fcf208766678a84", "parents": [ "88427119e1f039c8cdffd63726c136a986ef519f" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Wed Sep 23 14:20:32 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:16:49 2026 -0400" }, "message": "drm/amd/display: Fix fast updates on DCE 8.1\n\nDCE8 should use legacy fast updates.\nThis was already set for DCE 8.0 and 8.3, but it seems\nthat DCE 8.1 (found in Kaveri chips) was forgotten.\n\nThis fix should be backported to all kernel versions that\nhave \"Refactor fast update to use new HWSS build sequence\",\nbut this patch won\u0027t apply cleanly to older kernels due to\nanother refactor in \"Remove dc param from check_update\".\n\nFixes: 0baae6246307 (\"drm/amd/display: Refactor fast update to use new HWSS build sequence\")\nFixes: 9ec11bb842b6 (\"drm/amd/display: Remove dc param from check_update\")\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://patch.msgid.link/20260923122033.1046651-2-timur.kristof@gmail.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 57605379559e3b5044c8274a1010ec658e5e73af)\nCc: stable@vger.kernel.org\n" }, { "commit": "88427119e1f039c8cdffd63726c136a986ef519f", "tree": "f31290cd342d46baf57981b08917a0b21cdaebc4", "parents": [ "5e08102d1d336593160d1434261d50b0c0f6cbe6" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Wed Sep 23 14:20:31 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 17:16:31 2026 -0400" }, "message": "drm/amd/display: Fix fast updates on DCE 6.x\n\nDCE6 should use legacy fast updates, just like all DCE8 - DCN2.\nSet that flag for DCE 6.0, 6.1 and 6.4 (all DCE6 versions).\n\nTechnically DCE6 should have been included when the fast update\ncode was refactored, but it just happened to work until now.\n\nA recent commit \"Attach only plane updates that actually changed\"\nhas exposed this issue because with that commit, DC accidentally\ntook the new fast update code path for DCE6 as well, which caused\nit to boot into a black screen with a flip done timeout.\n\nThis fix should be backported to all kernel versions that\nhave \"Refactor fast update to use new HWSS build sequence\",\nbut this patch won\u0027t apply cleanly to older kernels due to\nanother refactor in \"Remove dc param from check_update\".\n\nFixes: 0baae6246307 (\"drm/amd/display: Refactor fast update to use new HWSS build sequence\")\nFixes: 9ec11bb842b6 (\"drm/amd/display: Remove dc param from check_update\")\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://patch.msgid.link/20260923122033.1046651-1-timur.kristof@gmail.com\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 698fda6e360625850413a2d1a90b72ae5f03073d)\nCc: stable@vger.kernel.org\n" }, { "commit": "5e08102d1d336593160d1434261d50b0c0f6cbe6", "tree": "14becd33debda12243c93edbfc40d9e849c87487", "parents": [ "eb5650d1f367722d0136de18998749008fe7d2a7" ], "author": { "name": "Arthur Heymans", "email": "arthur@aheymans.xyz", "time": "Sat Sep 12 17:11:37 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 16:38:47 2026 -0400" }, "message": "drm/amd/display: Preserve eDP mode on initial ASSR failure\n\nCommit 56d8ce9d8c17 (\"drm/amd/display: Apply correct panel mode when\nreinitializing hardware\") made ASSR failure fall back to the default panel\nmode unless eDP mode had previously been applied.\n\nHowever, dc_link is zero-initialized and DP_PANEL_MODE_DEFAULT is zero.\nBefore the first call to dp_set_panel_mode(), panel_mode therefore looks\nlike a previously applied default mode. If ASSR setup fails during the\nfirst link training attempt, the driver incorrectly trains the eDP link\nusing the default scrambling mode.\n\nOn a Google Vilboz Chromebook running self-built coreboot firmware and\nPSP verstage, this leaves the panel mostly black with corrupted output\nalong the top edge.\n\nTrack whether panel_mode has actually been initialized, and only consult\nthe saved mode after it has been applied. This retains the recovery\nbehavior while preserving eDP mode during initial link training.\n\nFixes: 56d8ce9d8c17 (\"drm/amd/display: Apply correct panel mode when reinitializing hardware\")\nAssisted-by: Pi:gpt-5.6-sol\nReviewed-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Arthur Heymans \u003carthur@aheymans.xyz\u003e\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit ccb6c2702033f1002b45807fb3cc938760f26f78)\nCc: stable@vger.kernel.org # 6.4.x\n" }, { "commit": "eb5650d1f367722d0136de18998749008fe7d2a7", "tree": "18c217433d11195d7b5935a1b0513d2604267d0d", "parents": [ "015e72cde567d2450e282c2790773463156b2d0a" ], "author": { "name": "Adrian Betschart", "email": "adrian.betschart@cinemaone.ch", "time": "Thu Sep 10 20:56:48 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 16:37:18 2026 -0400" }, "message": "drm/amd/display: Default HDMI RGB output to limited range on CTA modes\n\nWith the Broadcast RGB property at Automatic,\namdgpu_dm_get_output_color_space() selects COLOR_SPACE_SRGB for RGB\noutput, so DC neither compresses the pixels nor, without a QS-capable\nsink, signals full range in the AVI InfoFrame. A sink that follows\nCTA-861 treats the default quantization of a CTA video format as limited\nand expands 16-235 to 0-255: everything below 16 is crushed to black,\neverything above 235 clips.\n\nFollow the CTA-861 default for Automatic instead, as the DRM HDMI state\nhelper (hdmi_is_limited_range()) and i915 do: limited range on an HDMI\nsink for CTA modes other than 640x480, full range elsewhere. Full and\nLimited keep their explicit meaning. The same rule applies to the\nBT.2020 RGB branch. With commit 892659399f64 (\"drm/amd/display:\nPropagate HDMI RGB quantization selectability\") the AVI InfoFrame then\ncarries the matching Q value on sinks that support selection.\n\nMeasured on a Radeon RX 7600 (DCN 3.2.1) driving a JVC DLA-RS4100 at\n1920x1080p24 RGB 12 bpc: the sink reports the signal as limited range\nwhile the picture shows crushed shadows; rendering limited range in the\nclient makes it match a reference source.\n\nThe KUnit fixtures that reach amdgpu_dm_get_output_color_space() now\ncarry a connector, since Automatic reads its display_info, and five\ncases cover the new rule.\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/issues/5796\nReviewed-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Adrian Betschart \u003cadrian.betschart@cinemaone.ch\u003e\nAssisted-by: Claude Code:claude-fable-5-1\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit d23f735d0eac52c673d91e21d146b09588537efc)\n" }, { "commit": "015e72cde567d2450e282c2790773463156b2d0a", "tree": "78b05b965d4c5ff9b641206cc4f3b14f9d894cac", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Jiangshan Yi", "email": "yijiangshan@kylinos.cn", "time": "Fri Sep 04 17:18:17 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Oct 01 16:28:03 2026 -0400" }, "message": "drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend\n\ndc_state_create_copy() can return NULL on allocation failure.\ndm_suspend() only conditionally skips dm_gpureset_toggle_interrupts()\nand continues execution, returning success. dm_resume() then\ndereferences the NULL cached_dc_state in link_enc_cfg_copy() and the\nfollowing dc_state-\u003estream_count loop, crashing during GPU reset\nrecovery.\n\nReturn -ENOMEM immediately if the copy fails, so the caller aborts\nsuspend instead of leaving a NULL cached state for resume.\n\nFixes: 8092aa3ab8f7 (\"drm/amd/display: Add null checker before passing variables\")\nReviewed-by: George Zhang \u003cgeorge.zhang@amd.com\u003e\nSigned-off-by: Jiangshan Yi \u003cyijiangshan@kylinos.cn\u003e\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 84b6d7932fdd2857795a257f9f258562a3cddcab)\nCc: stable@vger.kernel.org\n" }, { "commit": "ce1e0223d8ad4211275c82a17ed6d43ab81e13d9", "tree": "6d116d396db084bf670e1755faef2805392dc1cc", "parents": [ "100638f0f016cb0e6c75e95ff2b0495bca0b3054", "30724547b221e0e670ddfef140fc7d816b2aaec6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 12:47:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 12:47:16 2026 -0700" }, "message": "Merge tag \u0027devicetree-fixes-for-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux\n\nPull devicetree fixes from Rob Herring:\n\n - Fix another case of refcount leaks in of_irq_init()\n\n - Avoid refcount leak in coreboot node check\n\n - Fix overlay handling of a root node target path\n\n - Various error path fixes in the overlay code\n\n* tag \u0027devicetree-fixes-for-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:\n of/irq: Fix remaining refcount leaks in of_irq_init()\n of: Put coreboot node after compatibility check\n of/overlay: don\u0027t create \"//\" paths for fragments targeting the root\n of/overlay: don\u0027t leak fragment references when changeset init fails\n of/overlay: only treat a positive changeset id as registered\n of/overlay: put property on deadprops only after changeset add succeeds\n" }, { "commit": "100638f0f016cb0e6c75e95ff2b0495bca0b3054", "tree": "82d54fd334ffe5da73e29e143aac5303c4eb0fbb", "parents": [ "bd35955b089ad881f57a5a2619687c804d057fec", "f341dc4d934a69ffbe6c21e3609ee725790188f1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 11:46:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 11:46:39 2026 -0700" }, "message": "Merge tag \u0027pm-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fix from Rafael Wysocki:\n \"Restore the previous behavior on systems where the cpufreq pressure\n was not visible in the scheduler and is not expected to be visible\n there.\n\n It became visible after a change made during the 7.2 development cycle\n that had gone too far\"\n\n* tag \u0027pm-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq: intel_pstate: Fix max_freq fallback in cpufreq_update_pressure()\n" }, { "commit": "bd35955b089ad881f57a5a2619687c804d057fec", "tree": "c367d4ed9a4bc7bc10280987a10d78bfc1a8cfc1", "parents": [ "a940b03cee1524c10c16e0f73ec878bbd36202a2", "572af6872e520c7102e58362ef7cd7c2ed4342be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 11:04:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 11:04:27 2026 -0700" }, "message": "Merge tag \u0027libcrypto-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux\n\nPull crypto library fixes from Eric Biggers:\n\n - Fix a performance regression in certain AES encryption modes on\n certain architectures, introduced this cycle\n\n - Fix a small performance regression in the x86_64 optimized AES-GCM\n code, introduced in 6.15\n\n* tag \u0027libcrypto-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:\n crypto: aes - Fix undesired override of some optimized AES modes\n crypto: x86/aes-gcm - fix always true check for last AAD segment\n" }, { "commit": "a940b03cee1524c10c16e0f73ec878bbd36202a2", "tree": "931c568ee3aa3bbab3da762e80adc54c4f4bce0a", "parents": [ "d24e8ac715de2e16a53c144005b1863660a5fbea", "f9bfc323e76120c2cd1fdea93bbf315eec5eb934" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 10:57:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 10:57:19 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"The most intrusive change is reverting a commit from 7.3-rc1 that made\n struct kvm a bit too large, and fixing the same issue otherwise.\n\n There are again a lot of selftests lines; the sheer number of commits\n is not small but I don\u0027t expect much more for 7.3 due to people\n travelling to Plumbers next week.\n\n ARM:\n\n - Take a reference on the last IRQ loaded into an LR to prevent it\n from being freed while running the guest (Marc Zyngier)\n\n - Ensure that the ITS MOVALL command only affects LPIs that were\n previously affined to the source redistributor (Marc Zyngier)\n\n - Fix + test for honoring the host\u0027s trap configuration when running\n non-protected VMs while KVM is in protected mode (Fuad Tabba)\n\n - Use the host stage-1 mapping granularity for VM_PFNMAP mappings at\n stage-2 (Mostafa Saleh)\n\n x86:\n\n Various bugfixes where the guest could do stupid things on purpose to\n cause problems in the host:\n\n - Failed VMRUNs can cause pending TLB flushes to be dropped, and in\n general some actions done through VMCB control fields have to be\n redone if VMRUN fails\n\n - Toggling MSR interceptions or eVMCS execution controls can cause\n the host to use a stale MSR permission bitmap\n\n - Bad page tables can cause a WARN.\n\n Also fix issues in last week\u0027s pull request (my fault, for changing\n email workflow and thus missing feedback sent to kvm@ but not LKML).\n\n Generic:\n\n - Take kvm_lock when creating vCPUs. For almost two decades everybody\n thought it was not done for some unspecified performance reasons,\n but in reality it was only done because kvm_lock was originally a\n spinlock.\n\n This is a better fix than 97d65b544f48 (\"KVM: Check for duplicate\n vcpu_id as early as possible\", from the 7.3 merge window), and does\n not waste 2K per VM, hence its inclusion here\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (29 commits)\n KVM: arm64: Use stage-1 leaf size for VM_PFNMAP\n KVM: arm64: selftests: Check a feature hidden in an ID register is UNDEF\n KVM: arm64: Use the host\u0027s HCR_EL2 for non-protected VMs in pKVM\n KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs\n KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT\n KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor\n KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq\n KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not overflowing\n KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state\n KVM: SEV: Nullify \"have run CPUs\" mask pointer when freeing it\n KVM: selftests: Extend nested x2APIC test to validate using eVMCS for vmcs12\n KVM: selftests: Extend nested x2APIC test to validate disabling x2APIC virt\n KVM: selftests: Verify that L0\u0027s TPR doesn\u0027t get clobbered\n KVM: selftests: Run the nested x2APIC with and without APICv being inhibited in L2\n KVM: selftests: Add x2APIC MSR test for inhibiting APICv while nested\n KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified\n KVM: SVM: Use the active VMCB\u0027s MSR bitmap when checking if MSR is intercepted\n KVM: SVM: Sync guest\u0027s PERF_CNTR_GLOBAL_CTL from h/w only on successful VMRUN\n KVM: SVM: Don\u0027t mark ASID fields as dirty when setting control.tlb_ctl\n KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded\n ...\n" }, { "commit": "f9bfc323e76120c2cd1fdea93bbf315eec5eb934", "tree": "2dd10da50f985e08d1dc71386f9164ad2309b3c9", "parents": [ "973ea70393e885e540f714904e51bc6cac80e3d7", "71cc2c67fb8f8d5aa8154eb482e9846d2214f11b" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Thu Oct 01 13:13:57 2026 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Thu Oct 01 13:13:57 2026 -0400" }, "message": "Merge tag \u0027kvmarm-fixes-7.3-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 7.3, round #2\n\n - Take a reference on the last IRQ loaded into an LR to prevent it\n from being freed while running the guest (Marc Zyngier)\n\n - Ensure that the ITS MOVALL command only affects LPIs that were\n previously affined to the source redistributor (Marc Zyngier)\n\n - Fix + test for honoring the host\u0027s trap configuration when running\n non-protected VMs while KVM is in protected mode (Fuad Tabba)\n\n - Use the host stage-1 mapping granularity for VM_PFNMAP mappings at\n stage-2 (Mostafa Saleh)\n" }, { "commit": "7b12c538697f2d5014dfd378c73be193d700c7a9", "tree": "c1c2bdbb4b6b7174a5bbe9e4c2c1f1c0204adcb5", "parents": [ "33a154a96e71a34a1bcca9f40da343dbbf7b38b4", "aeb709c767aeca996e6011133e4f7bdb2a4af652" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Thu Oct 01 18:40:06 2026 +0200" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Thu Oct 01 18:40:06 2026 +0200" }, "message": "Merge branch \u0027bpf-fix-objects-stuck-in-free_by_rcu_ttrace\u0027\n\nAlexei Starovoitov says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Fix objects stuck in free_by_rcu_ttrace\n\nFrom: Alexei Starovoitov \u003cast@kernel.org\u003e\n\nThe objects that bpf_mem_alloc frees while RCU tasks trace GP is in flight\nstay in free_by_rcu_ttrace list until the same bpf_mem_cache frees or\nallocates in bulk again.\n\nPatch 1 - refactoring. No functional change.\nPatch 2 - the fix.\nPatch 3 - selftest.\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260930095920.601738-1-alexei.starovoitov@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "aeb709c767aeca996e6011133e4f7bdb2a4af652", "tree": "c1c2bdbb4b6b7174a5bbe9e4c2c1f1c0204adcb5", "parents": [ "fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Sep 30 09:59:20 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Thu Oct 01 18:40:05 2026 +0200" }, "message": "selftests/bpf: Add a test for objects stuck in free_by_rcu_ttrace\n\nDelete all elements of BPF_F_NO_PREALLOC hash map in one batch. The first\nfree_bulk() starts RCU tasks trace GP and the rest of the elements are\nfreed while it\u0027s in flight. Wait for call_rcu_ttrace_in_progress to clear\nin bpf_mem_cache of every cpu and check that free_by_rcu_ttrace and\nwaiting_for_gp_ttrace lists are empty.\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260930095920.601738-4-alexei.starovoitov@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043", "tree": "f41257f69266bb67c1070253c9c36d7a8f9eaa9c", "parents": [ "47f4f695cec1eb82d961fdb466cd7c99d2865b7c" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Sep 30 09:59:19 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Thu Oct 01 18:40:04 2026 +0200" }, "message": "bpf: Fix objects stuck in free_by_rcu_ttrace\n\ndo_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set\nand leaves the objects in free_by_rcu_ttrace. __free_rcu() frees\nwaiting_for_gp_ttrace only and clears the flag. Hence the objects that\nfree_bulk() or __free_by_rcu() added while RCU tasks trace GP was in flight\nstay in free_by_rcu_ttrace until free_bulk() or alloc_bulk() is called for\nthe same bpf_mem_cache again, which may never happen. The number of such\nobjects is not bounded.\n\nTurn call_rcu_ttrace_in_progress into three states:\n0 - idle\n1 - __free_rcu() is queued\n2 - __free_rcu() is queued and free_by_rcu_ttrace got more objects since\n\ndo_call_rcu_ttrace() sets 2. __free_rcu() does cmpxchg(1 -\u003e 0) and starts\nthe next GP when it fails. It cannot clear the flag first and check\nfree_by_rcu_ttrace later, since bpf_mem_alloc_destroy() frees bpf_mem_cache\nwithout waiting for RCU callbacks when the flag is zero.\n\nNow __free_rcu() queues itself, so the one that didn\u0027t see \u0027draining\u0027 may\ndo call_rcu_tasks_trace() after rcu_barrier_tasks_trace() in\nfree_mem_alloc(). Queue it under rcu_read_lock() and do synchronize_rcu()\nbefore the barriers. Calling rcu_barrier_tasks_trace() twice works too, but\ncreating and destroying hash maps in a loop on many cpus slows down to one\nfree_mem_alloc() per GP and kworkers pile up.\n\nFixes: 8d5a8011b35d (\"bpf: Batch call_rcu callbacks instead of SLAB_TYPESAFE_BY_RCU.\")\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260930095920.601738-3-alexei.starovoitov@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "47f4f695cec1eb82d961fdb466cd7c99d2865b7c", "tree": "4f324ec5dcc8b2970d64e459cad9c4871fcefd8c", "parents": [ "33a154a96e71a34a1bcca9f40da343dbbf7b38b4" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Sep 30 09:59:18 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Thu Oct 01 18:40:04 2026 +0200" }, "message": "bpf: Factor out __do_call_rcu_ttrace()\n\nMove the part of do_call_rcu_ttrace() that runs after\ncall_rcu_ttrace_in_progress is set into __do_call_rcu_ttrace().\nThe next patch will call it from __free_rcu().\nNo functional change.\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260930095920.601738-2-alexei.starovoitov@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "33a154a96e71a34a1bcca9f40da343dbbf7b38b4", "tree": "543be8029ab3d8a3a63994ae23385a053ed30029", "parents": [ "b88822d2584f78cbdad1d8256510dcac108b5630" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Oct 01 14:52:55 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Thu Oct 01 18:39:27 2026 +0200" }, "message": "selftests/bpf: Test packet range of pointers sharing an id\n\nAdd tests where two packet pointers share an id and tightening one\npointer\u0027s umax from its var_off would put it less than their constant\ndistance from the other\u0027s umax: with an index \u0026 0x38 capped at 50, the\nbase pointer keeps umax 50, so the pointer 8 bytes further on must keep\numax 58, even though its known bits allow at most 56.\n\nThese refused a valid program or accepted an out-of-bounds access before\nthe fix:\n\n- check the advanced copy, load through the base: valid, was refused;\n- check the base, load the byte at base + 1 through a copy advanced by\n 8: was accepted;\n- check base + 4, load 4 bytes at base + 2 through base + 8: reads two\n bytes past the checked range, was accepted;\n- the same as the second with data_meta pointers checked against data:\n was accepted.\n\nThese pass with and without the fix and cover nearby paths:\n\n- subtract an unknown scalar from a checked pointer and load below it\n (the range is kept across a new id);\n- reach a load through two paths whose checks cover 8 and 7 bytes after\n the loaded pointer; the second path must not be pruned by the first;\n- spill a copy of a pointer, check the pointer, fill the copy and load\n one byte past the checked range: the load is refused, and the copy\n has the range of the check.\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20261001145255.855630-2-alexei.starovoitov@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "b88822d2584f78cbdad1d8256510dcac108b5630", "tree": "6419f8033337b525879d5296415882bbac920d0f", "parents": [ "564b7e8e09ec9b47921dc11de0de05da358335d9" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Oct 01 14:52:54 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Thu Oct 01 18:39:27 2026 +0200" }, "message": "bpf: Fix packet range of pointers sharing an id\n\nSince commit 022ac0750883 (\"bpf: use reg-\u003evar_off instead of reg-\u003eoff\nfor pointers\"), find_good_pkt_pointers() sets the range of all packet\npointers sharing an id from the umax of the compared pointer, and\ncheck_packet_access() requires umax + off + size \u003c\u003d range. That assumes\nthe umax of two such pointers differ by exactly their constant distance.\nreg_bounds_sync() breaks it when var_off tightens one umax and not the\nother:\n\n\tr4 \u0026\u003d 0x38\n\tif r4 \u003e 50 goto exit ; umax 50, var_off (0x0; 0x38)\n\tr5 \u003d pkt + r4 ; umax 50\n\tr6 \u003d r5\n\tr6 +\u003d 8 ; umax 56, not 58\n\nComparing r6 with pkt_end sets the range to 56, and the valid 8-byte\nload at r5 is rejected (50 + 8 \u003e 56). Comparing r5 sets it to 50, and\nthe out-of-bounds 1-byte load at r6 - 7, i.e. r5 + 1, is accepted\n(56 - 7 + 1 \u003c\u003d 50).\n\nDon\u0027t call reg_bounds_sync() on a packet pointer that keeps its id (a\nconstant was added or subtracted) or its range (an unknown non-negative\nvalue was subtracted), so that var_off cannot tighten its umax. Only\nupdate the 32-bit bounds from var_off: reg_bounds_sanity_check() wants\nthem constant when the lower half of var_off is, e.g. for pkt + 8.\n\nThis relies on nothing else changing the 64-bit bounds of a packet\npointer, which holds today.\n\nvar_off of such a pointer is no longer narrowed by its bounds. Adjust\nthree verifier_align expectations; the low bits, which the alignment\nchecks use, don\u0027t change. veristat on the selftests shows no verdict\nchanges and +0.8% insns in test_cls_redirect_subprogs.\n\nFixes: 022ac0750883 (\"bpf: use reg-\u003evar_off instead of reg-\u003eoff for pointers\")\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20261001145255.855630-1-alexei.starovoitov@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "71cc2c67fb8f8d5aa8154eb482e9846d2214f11b", "tree": "a5016ddf8af58fcde7acdb8f7e2f56a3c0a6d558", "parents": [ "afb4334fb52c7b416bbc9c4b166f6806509f734b" ], "author": { "name": "Mostafa Saleh", "email": "smostafa@google.com", "time": "Tue Sep 29 20:02:09 2026 +0000" }, "committer": { "name": "Oliver Upton", "email": "oupton@kernel.org", "time": "Thu Oct 01 09:27:26 2026 -0700" }, "message": "KVM: arm64: Use stage-1 leaf size for VM_PFNMAP\n\nWhen commit 2aa53d68cee6 (\"KVM: arm64: Try stage2 block mapping for\nhost device MMIO\") added VM_PFNMAP support to get_vma_page_shift(),\nstage-1 page tables did not support huge PFNMAP (as in VFIO-PCI\nvfio_pci_mmap_huge_fault()) and transparent_hugepage_adjust() was\nunsafe for MMIO as it dereferenced struct page.\n\nSince commit 6011cf68c885 (\"KVM: arm64: Walk userspace page tables to\ncompute the THP mapping size\"), transparent_hugepage_adjust() instead\nwalks the host stage-1 page tables via get_user_mapping_size() without\ntouching struct page. Meanwhile, commit 3e509c9b03f9 (\"mm/arm64:\nsupport large pfn mappings\") enabled stage-1 huge PFNMAP.\n\nSo. we can drop the VMA-based VM_PFNMAP size calculation in\nget_vma_page_shift() and let transparent_hugepage_adjust() derive\nthe stage-2 mapping size directly from the populated stage-1 leaf\nfor non-cacheable mappings as well.\n\nAssisted-by: LLM\nCc: stable@vger.kernel.org\nFixes: 2aa53d68cee6 (\"KVM: arm64: Try stage2 block mapping for host device MMIO\")\nReviewed-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nSigned-off-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nSigned-off-by: Oliver Upton \u003coupton@kernel.org\u003e\n" }, { "commit": "e060d9069b49fe55f38057dfe592068014652671", "tree": "5cce4a97fd865638aa9b41287ba34dd9570d1857", "parents": [ "45f7304679875eb000d67e194090ee7abd05c89c" ], "author": { "name": "Mark Rutland", "email": "mark.rutland@arm.com", "time": "Thu Oct 01 14:08:36 2026 +0100" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Oct 01 15:45:23 2026 +0000" }, "message": "arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems\n\nWhen system_supports_sme() is true but system_supports_sve() is false,\nrestoring a specifically crafted SVE signal context can result in the\ntask erroneously having non-streaming SVE state. Subsequent attempts to\nmanipulate the task\u0027s FPSIMD/SVE/SME state can result in a variety of\nproblems, including fatal EL1 UNDEFs.\n\nIn such configurations, the kernel always creates an SVE signal context\nwhen delivering a signal, and this can only be in one of two states:\n\n(1) SVE_SIG_FLAG_SM is set, and an SVE payload is present containing\n streaming mode SVE state. The recorded VL is the task\u0027s live\n streaming VL.\n\n(2) SVE_SIG_FLAG_SM is clear, and an SVE payload is not present. The\n FPSIMD context contains the non-streaming mode FPSIMD state. The\n recorded VL is 0.\n\nCurrently restore_sve_fpsimd_context() correctly rejects cases where\nSVE_SIG_FLAG_SM is set and an SVE payload is not present, but fails to\nreject cases where SVE_SIG_FLAG_SM is clear and an SVE payload is\npresent. Consequently, restore_sve_fpsimd_context() can place the task\nin a state where it has non-streaming SVE state even when this is not\nsupported by HW.\n\nFor example, this can cause a later EL1 UNDEF when the kernel attempts to\nrestore the task\u0027s ZCR_EL1 value:\n\n| # ./sme-sigcontext-to-sve\n| Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP\n| Modules linked in:\n| CPU: 0 UID: 0 PID: 131 Comm: sme-sigcontext- Not tainted 7.3.0-rc1 #1 PREEMPT\n| Hardware name: linux,dummy-virt (DT)\n| pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE\u003d--)\n| pc : fpsimd_restore_current_state+0x258/0x458\n| lr : exit_to_user_mode_loop+0xb8/0x188\n| sp : ffff80008056be40\n| x29: ffff80008056be40 x28: fff00000c1670000 x27: 0000000000000000\n| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\n| x23: ffff80008056bec0 x22: 0000000000000008 x21: 0000000000000040\n| x20: 0000000000000081 x19: 0000000008800010 x18: 0000000000000000\n| x17: 0000fffffd412570 x16: 0000000000001000 x15: 0000fffffd4123b0\n| x14: 0000fffffd412780 x13: 0000fffffd412be8 x12: 0000000047435300\n| x11: 0000fffffd412570 x10: 0000000000000000 x9 : 0000000045585401\n| x8 : fff00000c18a6c44 x7 : 0000000000000000 x6 : 0000000000000002\n| x5 : 0000000000000002 x4 : ffff800080568000 x3 : 0000000000000001\n| x2 : 0000000008800010 x1 : fff00000c1670000 x0 : 0000000008800000\n| Call trace:\n| fpsimd_restore_current_state+0x258/0x458 (P)\n| exit_to_user_mode_loop+0xb8/0x188\n| el0_svc+0x1cc/0x1d0\n| el0t_64_sync_handler+0xa0/0xe4\n| el0t_64_sync+0x198/0x19c\n| Code: d5384101 f9400020 53175c03 36b80de0 (d5381202)\n| ---[ end trace 0000000000000000 ]---\n| Kernel panic - not syncing: Oops - Undefined instruction: Fatal exception in interrupt\n| Kernel Offset: 0x291fb1000000 from 0xffff800080000000\n| PHYS_OFFSET: 0x40000000\n| CPU features: 0x0,00000000,0052802f,ffb88f43,3afcf73f\n| Memory Limit: none\n\nRework restore_sve_fpsimd_context() to reject cases where\nSVE_SIG_FLAG_SM is clear and an SVE payload is not present. As\nparse_user_sigframe() rejects SVE signal frames when neither SVE nor SME\nare supported, it isn\u0027t necessary for restore_sve_fpsimd_context() to\nhandle the case where neither are supported.\n\nFixes: 7dde62f0687c (\"arm64/signal: Always accept SVE signal frames on SME only systems\")\nSigned-off-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nReviewed-by: Mark Brown \u003cbroonie@kernel.org\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "cad16d850e3759dd82cd869f739b56e9844a1fee", "tree": "a25d7b48d243ce48b6a43d79bb72ba7248a83737", "parents": [ "b2047b8cadadccb1c9269ce756c399cd9aef2c82" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Thu Oct 01 09:58:30 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 01 16:38:05 2026 +0100" }, "message": "spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260\n\nOn Dell XPS 13 DX13260 create an acpi_gpio_mapping with exactly two\nGPIO entries to point at the two pins in the GpioIo(). Use this to\nread the speaker ID GPIOs.\n\nThis fixes problems on Dell XPS 13 DX13260:\n\n- No speaker audio\n- The wrong firmware was loaded so the speaker protection did not match\n the speaker characteristics.\n\nThe Dell XPS 13 DX13260 has two speaker ID GPIOs, to form a 2-bit ID. The\nACPI GpioIo() has both pins but the Linux-specific spk-id-gpios property\nonly has a mapping to the first pin. This meant that the speaker ID was\nwrong in most cases, and that would lead to the codec driver loading the\nwrong amp firmware, or not finding a firmware (as 0 is not a valid ID on\nthis laptop).\n\nAssisted-by: Codex:gpt-6-sol\nReported-by: Wiza Jalakasi \u003cwjalakasi@gmail.com\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221956\nTested-by: Wiza Jalakasi \u003cwjalakasi@gmail.com\u003e\nFixes: f3c605147741e (\"spi: cs42l43: Add GPIO speaker id support to the bridge configuration\")\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nReviewed-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20261001085830.4014291-1-rf@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "e6229c0402ea4863ec74802d79d5b52b9398d66c", "tree": "d938a91d39aaa210a39869f66fa81e319e460e8b", "parents": [ "f1d565dc92955f05383794e0fa27e61ee0555027" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 01 17:10:36 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 01 17:23:37 2026 +0200" }, "message": "ALSA: ice1712: Fix the error handling via auto-cleanup at probe\n\nWe used the auto-cleanup via snd_card_unref() for errors at probe of\nice1712 driver, but this may be problematic in a subtle way when an\nerror happens at snd_card_register(); since snd_card_unref() skips the\nsnd_card_disconnect() call, it may miss some resource clearance.\n\nFor fixing the issue, use the new __free(snd_card_free) instead, which\ndoes call snd_card_free() explicitly at errors for avoiding such a\npitfall.\n\nFixes: d736eba9c453 (\"ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup\")\nLink: https://patch.msgid.link/20261001151039.592033-2-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "f1d565dc92955f05383794e0fa27e61ee0555027", "tree": "36929bb94b59890670038f6ff8c19b7c96502610", "parents": [ "9ee4266827cfb67b9fbb89136ea6a8f3d7809f5c" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 01 17:10:35 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Oct 01 17:23:37 2026 +0200" }, "message": "ALSA: core: Define auto-cleanup for snd_card_free()\n\nFor the errors at the probe time, we\u0027d need to call rather\nsnd_card_free() instead of the snd_card_unref() -- the former calls\nexplicitly snd_card_disconnect() that cleans up the registered\ndevices, etc, while the latter may leak in corner cases.\n\nFor convenience, define a new auto-clean with snd_card_free.\n\nLink: https://patch.msgid.link/20261001151039.592033-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "d24e8ac715de2e16a53c144005b1863660a5fbea", "tree": "a4ff1dfd0dc65098e222e3dc0a45b8860babf3f3", "parents": [ "703033e2350c8c9fcacd652f36675e1327221b10", "e23a64eb244356ee47c0620f0722d51bd88db522" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:41:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:41:59 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from Bluetooth, WiFi and netfilter.\n\n We are actively retargeting several non-urgent fixes towards next,\n but the traffic on the ML looks ever-increasing, and propagating the\n push-back towards subsystems is not immediate.\n\n No known outstanding regressions.\n\n Current release - regressions:\n\n - netfilter: nft_set_rbtree: skip transaction elements during GC\n\n Previous releases - regressions:\n\n - sched: cls_api: reclaim an empty proto on the error path\n\n - core:\n - fix checksum offsets in skb_splice_from_iter()\n - cap skb-\u003equeue_mapping when the tx queue is picked\n\n - page_pool: fix use-after-free in page_pool_recycle_ring_bulk()\n\n - wifi:\n - mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()\n - mac80211: drop oversized fragments to avoid extra_len overflow\n\n - netfilter:\n - flowtable: restore ieee80211 forward path\n\n - bluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\n - eth:\n - bcmgenet: allocate RX buffers as page fragments\n - stmmac: fix rx Scatter-Gather support\n - octeontx2-pf: fix aura BPID assignment when CONFIG_DCB is enabled\n - gve: DQO: accept TSO packets with non-protocol gso_type bits\n - r8169: disable EEE on RTL8168h/8111h\n\n Previous releases - always broken:\n\n - tcp: refresh TS.Recent for accepted old ACKs\n\n - wifi:\n - ath11k: reset ar-\u003enum_stations on hardware start\n - cfg80211: fix RTS threshold setting for single-radio PHY\n\n - bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\n\n - eth: bcmgenet: fix NULL dereference in set_coalesce before first open\n\n Misc:\n - Eric is retiring from google and updating his contact info\"\n\n* tag \u0027net-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits)\n net: phy: aquantia: fix system interface type not updated in forced mode\n net: usb: qmi_wwan: add Rolling Wireless RN947R\n net: mvneta: clear XDP pfmemalloc flag between frames\n ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()\n net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference\n r8169: disable EEE on RTL8168h/8111h\n octeontx2-pf: Fix RSS indirection table size\n sctp: check RCV_SHUTDOWN after the sendmsg connect wait\n net: sparx5: make ports inherit the switch base mac address type\n net: microchip: vcap: stop scanning after deleting key field\n netfilter: flowtable: restore ieee80211 forward path\n netfilter: flowtable: generalize pending status bit\n netfilter: bpf: reject invalid NAT manipulation types\n netfilter: nft_set_rbtree: skip transaction elements during GC\n ipvs: filter some flags received in the backup server\n ipvs: do not create invisible templates\n ipvs: bound LBLCR and LBLC cache growth\n ipvs: fix missing counter decrement in lblc\n netfilter: nft_flow_offload: drop flowtable reference on init error path\n selftests: net: check timestamp echo after an old ACK\n ...\n" }, { "commit": "703033e2350c8c9fcacd652f36675e1327221b10", "tree": "233cf8780df2ea92103e8a86b643ae3dbbfa5dc4", "parents": [ "5cd9813d848d6565f0ca7825a8405c4e48441cf9", "fdd6553e1e53b0421d89c7469c8a36d2eadb1115" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:31:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:31:40 2026 -0700" }, "message": "Merge tag \u0027sysctl-7.03-fixes-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fixes from Joel Granados:\n \"Fix sysctl jiffies conversions errors introduced in 2dc164a48e6f\n (\"sysctl: Create converter functions with two new macros\")\n\n - Ensure that mult_hz does *not* wrap\n\n - Ensure we pass just the magnitude for the negative branch in\n proc_int_k2u_conv_kop\"\n\n* tag \u0027sysctl-7.03-fixes-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n time/jiffies: Saturate in mult_hz() instead of wrapping\n sysctl: Negate before converting in the int read path\n" }, { "commit": "8e242ada093af7d2ee82037f09c287fbc6f1e3f5", "tree": "028f01781c37eb178ce6378fd21ae76ed54cfdc9", "parents": [ "540f55de8c9f79c83f13e44910955faf82b0d79c", "9ee8306121495d2a25aa5d1bfd519f2748786b83" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 14:57:00 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 14:57:00 2026 +0200" }, "message": "Merge tag \u0027iio-fixes-late-7.3\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus\n\nJonathan writes:\n\nIIO: Fixes for 7.3, or 7.4 merge window.\n\nNothing here strikes me as particularly urgent.\n\nThe core buffer one has been there a long time and is a race only seen\nduring driver removal.\n\ncore\n- Ensure buffer teardown on remove occurs under same locks as in other\n paths, preventing races around access to active_scan_mask.\nadi,ad-sigma-delta\n- Fix a use-after-free in driver unbind path by just always allocating\n a buffer that is large enough rather than trying to resize at runtime.\nadi,ad4030\n- Fix validation of oversampling_ratio to check if value is in range before\n using it.\nadi,ad7173\n- Fix swapped masks for filter fields being written.\nadi,ad9000\n- Fix a potential NULL dereference.\nkionix,kxcfjk-1013\n- Reject disable of disabled event with underflows on runtime PM.\ninv,icm42607\n- Don\u0027t eat runtime suspend errors.\n- Make sure to put runtime PM back on errors in system resume.\nisil,isl29501\n- Fix a wrong return type for register_write function so it can return\n error codes.\nst,stm32-adc\n- Fix checking for whether a channel actually exists.\n- Avoid a possible division by zero.\nti,pac1934\n- Fix missing memory allocation check.\n\n* tag \u0027iio-fixes-late-7.3\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio:\n iio: adc: ad_sigma_delta: fix use-after-free on unbind\n iio: accel: kxcjk-1013: reject duplicate event disable\n iio: buffer: serialize buffer teardown with mode claims\n iio: cdc: ad7150: fix OF matching and publish module aliases\n iio: adc: ade9000: fix NULL pointer dereference in clkout registration\n iio: adc: ad4030: fix invalid oversampling_ratio validation\n iio: adc: ad7173: Fix digital filter configuration\n iio: adc: stm32-adc: fix possible division by zero in processed channel\n iio: adc: stm32-adc: fix check on internal channel availability\n iio: proximity: isl29501: Fix return type of isl29501_register_write\n iio: imu: inv_icm42607: restore runtime PM on system resume errors\n iio: imu: inv_icm42607: propagate runtime suspend errors\n iio: adc: pac1934: check ACPI label duplication\n" }, { "commit": "45f7304679875eb000d67e194090ee7abd05c89c", "tree": "201366055eeffdb0369e9eaf624419961392488e", "parents": [ "573371caf7aea8582212da81dcead2c3f48fac4b" ], "author": { "name": "Beata Michalska", "email": "beata.michalska@arm.com", "time": "Thu Oct 01 11:00:32 2026 +0200" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Oct 01 12:22:40 2026 +0000" }, "message": "arm64: errata: Add Cortex-A725 erratum 3821522 workaround\n\nCortex-A725 erratum 3821522 affects the CNT_CYCLES event, which can\nincur a significant increment error when a CPU enters and subsequently\nexits WFE or WFI, and may no longer track the system counter\nfrequency.\n\nThe AMEVCNTR01_EL0 counter is used as the AMU constant counter for\nfrequency invariance and CPPC FFH feedback counters. Wire the affected\nCortex-A725 range into the shared broken AMU constant-counter capability\nso the affected counter is treated as unavailable by returning zero in\nthe AMU counter paths. This prevents the broken counter from being used\nas a reference source.\n\nThe erratum can also affect PMUv3 users of the CNT_CYCLES event,\nbut this workaround intentionally does not change PMU event handling.\nHiding or rejecting the PMU event from the erratum code would change\nthe perf-visible PMU event interface, including raw event selection,\nand would need a separate PMU-specific approach rather than being\nfolded into the AMU reference-counter workaround.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Beata Michalska \u003cbeata.michalska@arm.com\u003e\nReviewed-by: Vladimir Murzin \u003cvladimir.murzin@arm.com\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "573371caf7aea8582212da81dcead2c3f48fac4b", "tree": "e301c57b467cf817ae7d8fd99f0a267cc7a27c08", "parents": [ "3872cc6b92940af0f73c6f9a45d65300492d648d" ], "author": { "name": "Beata Michalska", "email": "beata.michalska@arm.com", "time": "Thu Oct 01 11:00:31 2026 +0200" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Oct 01 12:22:39 2026 +0000" }, "message": "arm64: errata: Factor out broken AMU const counter cap\n\nMove the workaround from the erratum 2457168-specific cpucap to a generic\nbroken AMU constant-counter one. This keeps the existing Cortex-A510\nhandling unchanged while allowing other errata with similar AMU constant\ncounter issue to share the capability bit and call sites.\n\nSigned-off-by: Beata Michalska \u003cbeata.michalska@arm.com\u003e\nReviewed-by: Vladimir Murzin \u003cvladimir.murzin@arm.com\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "357e8a77a501d96c9517f01f4a211eed5e9c9184", "tree": "bbdffc21a20e1ec35170513edb5de6df22101985", "parents": [ "b9d1fdc6f4ac1b6e49f9deafaf137da1407d9af1" ], "author": { "name": "Zhengchuan Liang", "email": "zcliangcn@gmail.com", "time": "Mon Sep 28 10:59:35 2026 -0700" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Oct 01 14:02:06 2026 +0200" }, "message": "perf: Require kernel access for text poke events\n\nPerf events with exclude_kernel\u003d1 can be opened without kernel perf\naccess. However, exclude_kernel does not suppress text-poke sideband\nrecords. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL\nand contains a raw kernel instruction address.\n\nAn unprivileged task can therefore open and mmap a task-local software\nevent with text_poke\u003d1. Both opening a count-only tracepoint event and\nconfiguring UDP GRO for ESP-in-UDP cause updates to inline static calls;\nthe observer receives the relocated addresses of the modified instructions.\nFor a known kernel image, any such address reveals the runtime kernel\ntext base despite KASLR.\n\nCall perf_allow_kernel() whenever attr.text_poke is set, regardless of\nexclude_kernel. Events that neither monitor kernel execution nor request\ntext-poke records retain their existing permissions.\n\nFixes: e17d43b93e54 (\"perf: Add perf text poke event\")\nAssisted-by: LLM\nSigned-off-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/99131354c41e23188f778b92f90363775b482395.1790573390.git.zcliangcn@gmail.com\n" }, { "commit": "b9d1fdc6f4ac1b6e49f9deafaf137da1407d9af1", "tree": "3136fb2d281dcbcbd878310c6fee5644ac283526", "parents": [ "ffb684f2aa141eeb0caa6308422e7e05d1ded7c4" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Tue Sep 29 15:23:32 2026 -0700" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Oct 01 14:02:06 2026 +0200" }, "message": "perf: Replace perf_event_header__init_id with full header init\n\nperf_iterate_sb() invokes its callback for each matching perf_event on\nthe CPU and task context, passing a shared caller-allocated event\nstructure.\n\nperf_event_header__init_id() mutated header-\u003esize in place by adding\nevent-\u003eid_header_size, requiring sideband output callbacks to save and\nrestore header fields across iterations. Three sideband callbacks failed\nto save and restore header.size around perf_event_header__init_id():\n - perf_event_ksymbol_output()\n - perf_event_bpf_output()\n - perf_event_text_poke_output()\n\nWhen multiple events with attr.ksymbol, attr.bpf_event, or\nattr.text_poke and sample_id_all are active on the same CPU, each\nsubsequent event receives a record whose header.size is inflated by all\npreceding events\u0027 id_header_size values while only a single id_sample is\nwritten, leaving uninitialized ring-buffer bytes at the end of the\nrecord and causing userspace perf to fail with -EFAULT (\"Bad address\")\nwhen parsing the sample_id trailer.\n\nSimilarly, perf_event_mmap_output() set PERF_RECORD_MISC_MMAP_BUILD_ID\nin mmap_event-\u003eevent_id.header.misc when event-\u003eattr.build_id was\nenabled, but only saved and restored header.size and header.type. If an\nevent with attr.build_id was followed by an event with attr.mmap2 and\n!attr.build_id, the second event received PERF_RECORD_MISC_MMAP_BUILD_ID\nin header.misc while its payload contained maj/min/ino/ino_generation\ninstead of a build ID.\n\nRather than splitting header initialization between callers and output\ncallbacks and saving/restoring mutated header fields, replace\nperf_event_header__init_id() with perf_event_header__init(), which\ninitializes header-\u003etype, header-\u003emisc, and header-\u003esize alongside the\nsample_id fields on each invocation.\n\nFixes: 76193a94522f (\"perf, bpf: Introduce PERF_RECORD_KSYMBOL\")\nFixes: 6ee52e2a3fe4 (\"perf, bpf: Introduce PERF_RECORD_BPF_EVENT\")\nFixes: e17d43b93e54 (\"perf: Add perf text poke event\")\nFixes: 88a16a130933 (\"perf: Add build id data in mmap2 event\")\nAssisted-by: Antigravity:gemini-3.1-pro\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20260929222332.973435-1-irogers@google.com\nCc: stable@vger.kernel.org\n" }, { "commit": "ffb684f2aa141eeb0caa6308422e7e05d1ded7c4", "tree": "aa7eb2c587cd15c15e802fb9b47249d7f4fdcaf6", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Luo Gengkun", "email": "luogengkun2@huawei.com", "time": "Sun Sep 20 07:50:26 2026 +0000" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Oct 01 14:02:05 2026 +0200" }, "message": "perf: Fix race between perf_event_exit_task() and perf_pending_task()\n\nA race condition exists between perf_event_exit_task() and\nperf_pending_task() during begin_new_exec().\n\nDuring begin_new_exec(), perf_event_exit_task() may be called, and the\nPF_EXITING flag is not set on task. So perf_sigtrap() continues to execute\nand triggers WARN_ON_ONCE(event-\u003ectx-\u003etask !\u003d current).\n\nSince both task exit and exec paths can call perf_event_exit_task() which\nsets ctx-\u003etask to TASK_TOMBSTONE, fix this by explicitly checking if\nevent-\u003ectx-\u003etask equals TASK_TOMBSTONE and dropping the redundant\nPF_EXITING check.\n\nFixes: 97ba62b27867 (\"perf: Add support for SIGTRAP on perf events\")\nSigned-off-by: Luo Gengkun \u003cluogengkun2@huawei.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20260920075026.990582-1-luogengkun2@huawei.com\n" }, { "commit": "c98bf3b86609a18ab16d067280257326e557c636", "tree": "eb6432da9d1b1e2e1005027ff641ef6563663acb", "parents": [ "840d8acc87925deb3c75566fde9ca81d2f47f98c" ], "author": { "name": "Hongjian Dai", "email": "daihongjian@kylinsec.com.cn", "time": "Wed Sep 30 00:43:40 2026 +0800" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Thu Oct 01 13:51:54 2026 +0200" }, "message": "i2c: at91: release DMA channels when probe defers\n\nat91_twi_probe_master() can return -EPROBE_DEFER from\nat91_init_twi_recovery_info() after at91_twi_configure_dma() has already\nclaimed the tx/rx DMA channels. at91_twi_probe() then returns without\nreleasing them, and since dma_request_chan() is not devres-managed the\nchannels leak on every deferred probe attempt.\n\nRelease the channels before deferring the probe.\n\nFixes: f7eeb1af8537 (\"i2c: at91: release DMA channels on remove and probe error\")\nAssisted-by: LLM\nSigned-off-by: Hongjian Dai \u003cdaihongjian@kylinsec.com.cn\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/7D85C6CB6BF0A82E+20260929164340.41628-1-daihongjian@kylinsec.com.cn\n" }, { "commit": "a93862fa670a9c99fd9a24fb2ef69e4f948d9bd5", "tree": "dc4b9c87ac944efe64bd7160fc391f81be41a904", "parents": [ "1ff77cbefe5a653ea12874c213ea4bd0d72c1067", "395e9f2967a7ac6898026e8f136c369805dc2fd9" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 13:26:31 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 13:26:31 2026 +0200" }, "message": "Merge tag \u0027thunderbolt-for-v7.3-rc6\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus\n\nMika writes:\n\nthunderbolt: Fixes for v7.3-rc6\n\nThis includes following USB4/Thunderbolt fixes:\n\n - Fix XDomain property parser to reject oversized properties\n responses.\n - Revert a quirk that causes deadlock at shutdown.\n - Fix USB4STREAM to announce FMODE_NOWAIT.\n - Add a quirk that disables CL states for Anker Prime TB5 dock to\n avoid link instability.\n\nAll these have been in linux-next with no reported issues.\n\n* tag \u0027thunderbolt-for-v7.3-rc6\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt:\n thunderbolt: Disable CL states for the Anker Prime TB5 dock\n thunderbolt: stream: Announce support for FMODE_NOWAIT\n Revert \"thunderbolt: Add quirk to reset host interface on DMA path teardown for AMD USB4 routers\"\n thunderbolt: Reject oversized XDomain properties responses\n" }, { "commit": "e23a64eb244356ee47c0620f0722d51bd88db522", "tree": "a18ad75b41511e252617333828d0cec7e378de1b", "parents": [ "6e0022b5ae3dc5b833af0fcc1578dc20a1d6bc71", "3ae37eafd36694bb2d3227f60ac98fbf602470a2" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 01 12:00:40 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 01 12:00:40 2026 +0200" }, "message": "Merge tag \u0027nf-26-09-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter/IPVS fixes for net\n\nThe following batch contains Netfilter fixes for net. This batch\nfixes crashes as recent feature regression, one of the due to a\ndependency that has been pulled into -stable:\n\n1) Expand existing ipset fix for bitmap sets to disallow comments\n updates from kernel-side adds, from Florian Westphal.\n\n2) Drop flowtable reference if nf_ct_netns_get() fails, otherwise\n flowtable cannot ever be removed, from Aohan Mei.\n\n3) nft_rbtree GC should collect end elements that contained in\n this transaction batch, new or deleted elements are never\n expired. From Weiming Shi.\n\n4) Restrict nf_nat_bpf so it does not set unknown NF_NAT_MANIP_*\n values, from Fernando F. Mancera.\n\n5) Flowtable GC must skip flows that are pending hardware updates,\n generalize the PENDING flag and use it to inhibit GC.\n\n6) Restore flowtable with ieee80211 which broke due to a relatively\n recent commit, which was pulled in by -stable, causing a regression\n in 6.18 kernels.\n\nAnd the following IPVS fixes:\n\n1) Fix accounting of cache entries in IPVS LBLC for destinations,\n which eventually fills up the table and trigger recurrent\n resizing, from Julian Anastasov.\n\n2) Limit IPVS cache growth for LBLCR and LBLC schedulers,\n from Zhiling Zou.\n\n3) Restrict IP_VS_CONN_F_ONE_PACKET for normal connections,\n do not allow to use it with templates. Also from Julian.\n\n4) Sanitize flags in IPVS sync messages received in the backup.\n From Julian Anastasov.\n\nnetfilter pull request 26-09-30\n\n* tag \u0027nf-26-09-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: flowtable: restore ieee80211 forward path\n netfilter: flowtable: generalize pending status bit\n netfilter: bpf: reject invalid NAT manipulation types\n netfilter: nft_set_rbtree: skip transaction elements during GC\n ipvs: filter some flags received in the backup server\n ipvs: do not create invisible templates\n ipvs: bound LBLCR and LBLC cache growth\n ipvs: fix missing counter decrement in lblc\n netfilter: nft_flow_offload: drop flowtable reference on init error path\n netfilter: ipset: do not update comments from kernel-side adds\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260930074142.298353-1-pablo@netfilter.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "39495ef5d6f8019e62d65807f217a7ca8232727a", "tree": "4e18a1d371957dff072c9f415c03dc63bc59d561", "parents": [ "0928ed9bd7946baee911efa401088697836e3b1e" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Sat Sep 19 11:00:41 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 11:15:46 2026 +0200" }, "message": "vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty-\u003ereceive_room) bytes per iteration into\ntty_ldisc_receive_buf() and increments pasted +\u003d count.\n\nBecause the selection mutex (vc_sel.lock) is dropped inside the loop\nWhenever the line discipline buffer fills up and paste_selection()\nsleeps on tty-\u003ewrite_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl\ncan replace vc_sel.buffer with a shorter selection and reduce\nvc_sel.buf_len below pasted.\n\nWhen paste_selection() resumes, vc_sel.buf_len - pasted underflows as an\nunsigned integer to a large positive value, causing\ntty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read\nup to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.\n\nFix this by terminating the loop when pasted \u003e\u003d vc_sel.buf_len.\n\nKernel stack trace (Linux 7.3.0-rc3):\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650\n Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65\n Workqueue: events_unbound flush_to_ldisc\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x70/0xa0\n print_report+0x153/0x4c6\n kasan_report+0xf1/0x120\n kasan_check_range+0x11c/0x200\n __asan_memcpy+0x29/0x70\n n_tty_receive_buf_common+0xa01/0x1650\n tty_ldisc_receive_buf+0x66/0x110\n tty_port_default_receive_buf+0x6b/0xb0\n flush_to_ldisc+0x1b4/0x410\n process_one_work+0x6ff/0x1110\n worker_thread+0x4a8/0xb70\n kthread+0x307/0x3e0\n ret_from_fork+0x3ed/0x680\n \u003c/TASK\u003e\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: e8c75a30a23c (\"vt: selection, push sel_lock up\")\nCc: stable \u003cstable@kernel.org\u003e\nAssisted-by: LLM\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nLink: https://patch.msgid.link/20260919110041.3763078-1-benquike@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0928ed9bd7946baee911efa401088697836e3b1e", "tree": "25ad58d0866afd5c0ff894460b76a204101596a4", "parents": [ "226bd5603371cd9f6642cbb9e9a677f445de3530" ], "author": { "name": "Zizhi Wo", "email": "wozizhi@huawei.com", "time": "Sat Sep 05 14:43:37 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 11:15:34 2026 +0200" }, "message": "vt: skip screen update for DEC alignment test on backgroup consoles\n\n[BUG]\nRecently, we encountered a KASAN warning as follows:\n\nBUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140\nRead of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239\nCPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n ...\n kasan_report+0xf0/0x120\n fb_pad_aligned_buffer+0x11f/0x140\n ccw_putcs+0x86c/0xa80\n fbcon_putcs+0x338/0x410\n do_update_region+0x21d/0x450\n do_con_write+0x1e0e/0x4880\n con_write+0x13/0x80\n n_tty_write+0x374/0x1010\n file_tty_write.isra.0+0x404/0x7a0\n ...\n\nreproduce:\n1) open /dev/tty0, set a KDFONTOP ioctl with op.op \u003d KD_FONT_OP_SET,\nop.width \u003d 8 and op.height \u003d 16 (visible VC1)\n2) open /dev/tty1, set a KDFONTOP ioctl with op.op \u003d KD_FONT_OP_SET,\nop.width \u003d 28 and op.height \u003d 24 (invisible VC2)\n3) echo 3 \u003e /sys/devices/virtual/graphics/fbcon/rotate_all\n4) write EShash8(esc hash8) to tty1\n\n[CAUSE]\nAll VCs render to the framebuffer. setfont only modifies the target VC\u0027s\nfont without resizing the framebuffer backing buffer (par-\u003erotated.buf);\nthe buffer is only resized for the visible VC\n(fbcon_do_set_font -\u003e ... -\u003e vc_do_resize -\u003e update_screen). This relies on\nthe con_should_update() check performed before every update_region().\n\nHowever, the ESC # 8 path (do_con_trol -\u003e do_update_region) omits the\ncon_should_update() check. After changing the font size of an invisible VC,\ndo_update_region() fills using the new font size against a buffer that was\nnever resized, causing an out-of-bounds access.\n\n[FIX]\nOnly push the update when the console is visible and not blanked, add\nthe con_should_update() check in the do_con_trol() like every other call\nsite of do_update_region() (update_region(), invert_screen(), ...).\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Zizhi Wo \u003cwozizhi@huawei.com\u003e\nLink: https://patch.msgid.link/20260905064337.3083103-1-wozizhi@huaweicloud.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "226bd5603371cd9f6642cbb9e9a677f445de3530", "tree": "95cefdfa8fd5d00fb0ee0e1979cd616f3a1deef2", "parents": [ "d9feaa93328a6f885afb8ac6374897fafc294222" ], "author": { "name": "Yi Yang", "email": "yiyang13@huawei.com", "time": "Tue Sep 01 11:31:31 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 11:15:09 2026 +0200" }, "message": "vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of \u0027vc\u0027 added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n\u0027if (ret)\u0027 block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()\u0027d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n\u0027if (written \u0026\u0026 vc) vcs_scr_updated(vc)\u0027 is reached with a stale\nnon-NULL vc. The \u0027\u0026\u0026 vc\u0027 guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param-\u003evc-\u003evc_num from freed memory:\n\n BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n Read of size 2 at addr ffff888007149190\n Call Trace:\n vcs_notifier+0x7c/0xd0\n atomic_notifier_call_chain+0x70/0xa0\n vcs_scr_updated+0x77/0xa0\n vcs_write+0x71b/0x7e0\n Allocated by task: vc_allocate -\u003e con_install -\u003e tty_open\n Freed by task: kfree \u003c- vt_ioctl (VT_DISALLOCATE -\u003e vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before \u0027if (ret)\u0027,\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated().\n\nFixes: a287620312dc (\"vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write\")\nCc: stable@kernel.org\nSigned-off-by: Yi Yang \u003cyiyang13@huawei.com\u003e\nLink: https://patch.msgid.link/20260901113131.2760010-1-yiyang13@huawei.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d9feaa93328a6f885afb8ac6374897fafc294222", "tree": "3731901e196d1edfc1db773c1524d4acbdbf6739", "parents": [ "527484911a40f6e84cf47e8bc490f7da61ab4151" ], "author": { "name": "Paul Mbewe", "email": "paultyson.mbewe@ziehl-abegg.de", "time": "Wed Sep 30 16:56:28 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Oct 01 11:07:24 2026 +0200" }, "message": "serial: sc16is7xx: reduce TX refill rate with half-FIFO trigger\n\nWith the TX trigger set to 8 free spaces, THRI is generated roughly once\nper 8 transmitted bytes. At 115200 baud 8N1, this corresponds to\napproximately 0.7 ms between TX refill events.\n\nSet the TX trigger to 32 free spaces via TLR[3:0]. This makes each refill\nlarger and reduces the refill rate by about 4x. At 115200 baud 8N1, the\nrefill cadence becomes approximately 2.8 ms.\n\nThe trade-off is that the time-to-empty after THRI asserts is reduced\nfrom 56 to 32 byte times. The fresh-TXLVL refill loop fills the hardware\nTX FIFO strictly below whichever trigger is selected. This patch changes\nonly the refill frequency and the associated latency trade-off.\n\nWith the two TX gap fixes applied in both configurations, changing the\ntrigger from 8 to 32 free spaces produced the following median values\nfrom repeated top snapshots under the same continuous Modbus RTU load.\nEach transaction used an 8-byte RX request and a 255-byte TX response,\nso the workload was dominated by TX traffic:\n\n trigger\u003d8 trigger\u003d32\n SPI IRQ thread CPU 15% 5%\n system CPU 44% 29%\n idle CPU 40% 52%\n one-minute load 2.02 0.99\n\nThe datasets contain 547 snapshots with trigger\u003d8 and 535 snapshots with\ntrigger\u003d32.\n\nOnly TLR[3:0] is changed. TLR[7:4] remains zero so the RX trigger retains\nits FCR setting. RX trigger tuning may also be useful, but generic RX/TX\ntrigger configuration is left for follow-up work.\n\nSC16IS7XX_TX_TRIGGER_LEVEL is used for both the programmed TLR value and\nthe TXLVL refill-loop threshold, keeping the hardware trigger and the\nsoftware refill condition synchronized.\n\nTCR/TLR access requires EFR[4] and MCR[2], which are already enabled by\nthe TCR setup immediately preceding the TLR write.\n\nReviewed-by: Joachim Knorr \u003cjoachim.knorr@ziehl-abegg.de\u003e\nLink: https://lore.kernel.org/linux-serial/20260623112225.82386-3-paultyson.mbewe@ziehl-abegg.de/\nSigned-off-by: Paul Mbewe \u003cpaultyson.mbewe@ziehl-abegg.de\u003e\nLink: https://patch.msgid.link/20260930145628.566535-3-paultyson.mbewe@ziehl-abegg.de\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" } ], "next": "527484911a40f6e84cf47e8bc490f7da61ab4151" }