)]}' { "log": [ { "commit": "9b87fdc9af2fbfcdb5c24a64139685ef80f6573f", "tree": "02d84ef44728f925cb130f487e55dbca8141de7e", "parents": [ "6fb20c02710dabc2f63aa21cb23a154d76ef9921", "a9e3760b0838299649c0d57cca44daaf40ba3c33" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 15 11:57:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 15 11:57:51 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - An error raised by a BPF program before the scheduler finished\n enabling was consumed by the disable path\u0027s pre-enable shortcut,\n leaving a running scheduler that couldn\u0027t be disabled and was later\n freed while in use.\n\n - Two compat kfuncs dereferenced a NULL scheduler when handed an exited\n or idle task, oopsing the kernel.\n\n - Keep-running decisions in the dispatch path used the root scheduler\u0027s\n flags for tasks belonging to a sub-scheduler, causing warnings and\n stalls.\n\n - Schedulers with their own CPU ID mapping had no way to learn which\n IDs are online. Add a kernel-maintained online mask to plug the hole.\n\n - Cgroup idle state: the initial cpu.idle state wasn\u0027t passed on cgroup\n init and same-value rewrites delivered spurious callbacks.\n\n - Example scheduler fixes for a reenqueue loop on attach, placements on\n CPUs without effective grants, stalled partition work and stale idle\n tracking.\n\n* tag \u0027sched_ext-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Maintain an online cid mask in the scheduler arena\n sched_ext: scx_qmap: Restore unused idle claims from ops.dispatch()\n sched_ext: Close the pre-enable ops error claim window\n sched_ext: scx_qmap: Fix pending partition work handoff\n sched_ext: scx_qmap: Place only on cids whose caps are in effect\n sched_ext: scx_qmap: Do not add IMMED to rescue inserts\n sched_ext: Use @prev\u0027s scheduler for the keep decisions in dispatch_one()\n sched_ext: Rename sch to root_sch in dispatch_one()\n sched_ext: Fix NULL sched deref in kfunc sub-sched error paths\n sched_ext: Don\u0027t deliver duplicate ops.cgroup_set_idle() for same value\n sched_ext: Pass the initial cpu.idle state in scx_cgroup_init_args\n" }, { "commit": "6fb20c02710dabc2f63aa21cb23a154d76ef9921", "tree": "e76741241f710ec122bbf9c78e5dd76c64c9ee65", "parents": [ "f6e7b42bf05b2427fb8a7a1d1c387a86638bb413", "057dac23d329d5c5ed62352f2659a39fd46c6d4a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 15 11:40:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 15 11:40:30 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fix from Tejun Heo:\n\n - The task iterator could pick up a dying task whose refcount had\n already dropped to zero and resurrect it, leading to a use-after-free\n when reading cgroup.procs. Skip such tasks.\n\n* tag \u0027cgroup-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup: Avoid iteration of dying tasks with zero refcount\n" }, { "commit": "a9e3760b0838299649c0d57cca44daaf40ba3c33", "tree": "95807ff0e511c05602ef34808cfc660303309057", "parents": [ "9a0b159ff18c8f6fcf982bb81e15a9ceb14db43a" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Sep 14 22:12:34 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Sep 15 06:57:20 2026 -1000" }, "message": "sched_ext: Maintain an online cid mask in the scheduler arena\n\nSchedulers on the default cid mapping treat [0, nr_online_cids) as the\nonline set and restart on hotplug. Schedulers that install their own mapping\nwith scx_bpf_cid_override() have no way to learn which cids are online: the\ncount no longer identifies members and the CPU-form cpumask is unusable from\ncid programs. This is an obvious hole in the cid API.\n\nAdd scx_bpf_online_cmask(), a kernel-maintained cmask in the scheduler\u0027s\narena, allocated alongside the per-CPU scratch masks and populated after the\ncid mapping is finalized and before ops.init(), for child schedulers too.\nThe pointer stays valid through ops.exit() with no reference to take. It is\nthe arena offset as a void pointer, the same form struct_ops arena arguments\narrive in. The verifier types the void return as a scalar for the program\u0027s\narena cast.\n\nThe mask follows the SCX hotplug notifications: seeded from cpu_active_mask\nand updated before ops.cid_online/offline() runs, so it lags cpu_online_mask\nonly inside a hotplug transition. Updates walk the scheduler list under the\nlock that also serializes unlinking. Reads are live, not atomic snapshots.\nRoot initialization excludes hotplug.\n\nv2: Reworded the getter kerneldoc (Andrea Righi).\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "9a0b159ff18c8f6fcf982bb81e15a9ceb14db43a", "tree": "227dcf1362145ed7fb4c37d3915afc446ec525fe", "parents": [ "c7a1c6e8004ab12a9c9bfdcb603f60f9bf4a3cee" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Sep 14 22:12:34 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Sep 15 06:57:19 2026 -1000" }, "message": "sched_ext: scx_qmap: Restore unused idle claims from ops.dispatch()\n\nscx_qmap tracks idle cids itself. pick_direct_dispatch_cid() claims a cid by\nclearing its bit and the task is inserted into that cid\u0027s local DSQ, which\nkicks the CPU. When the task does not arrive, for example because the insert\nfell back to the global DSQ after an affinity change, the CPU wakes, finds\nnothing and picks idle again. That is not an idle transition, so\nops.update_idle() is not called and the cid stays marked busy until an\nunrelated task runs on it.\n\nRestore the claim from ops.dispatch(). The kick guarantees a dispatch on the\nkicked CPU, and when it finds nothing to run with a NULL @prev, the CPU is\ngoing back to idle. Document the pattern in ops.update_idle(), which reports\nonly actual transitions.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\nCc: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "f6e7b42bf05b2427fb8a7a1d1c387a86638bb413", "tree": "9a0f43558466de114b05420028fd9f001c999d86", "parents": [ "587858367581b9c55c3690f4e63382ad622719d4", "afdf35cfae0d039a4a6c907fa5d8391f1ef0a0aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 15 09:43:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 15 09:43:15 2026 -0700" }, "message": "Merge tag \u0027sysctl-7.03-fixes-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fixes from Joel Granados:\n\n - Re-add the range check for millisecond to jiffy conversion in sysctl\n\n They where removed in d174174c6776 (\"sysctl: replace\n SYSCTL_INT_CONV_CUSTOM macro with functions\") and b96b5c6708ea\n (\"sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec\")\n\n - Fix type truncation in sysctl_msec_to_jiffies\n\n Previously truncated millisecond values now get converted into\n MAX_JIFFY_OFFSET\n\n* tag \u0027sysctl-7.03-fixes-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n sysctl: Fix type truncation in sysctl_msec_to_jiffies\n sysctl: Check range in do_proc_ulong_conv_ms_jiffies\n sysctl: Check range in proc_dointvec_ms_jiffies_minmax\n" }, { "commit": "afdf35cfae0d039a4a6c907fa5d8391f1ef0a0aa", "tree": "c76b363328e9e6bdc753bf3c9ff938f3e10217e2", "parents": [ "318012c56576e09806747f64f89f8f3cde1f999f" ], "author": { "name": "Joel Granados", "email": "joel.granados@kernel.org", "time": "Thu Sep 10 12:22:16 2026 +0200" }, "committer": { "name": "Joel Granados", "email": "joel.granados@kernel.org", "time": "Tue Sep 15 09:20:58 2026 +0200" }, "message": "sysctl: Fix type truncation in sysctl_msec_to_jiffies\n\nReturn MAX_JIFFY_OFFSET for all the values truncated when val (u64) is\npassed to msecs_to_jiffies (u32). This aligns with how very large\nmillisecond values get translated into MAX_JIFFY_OFFSET.\n\nFixes: b96b5c6708ea (\"sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec\")\nSuggested-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Joel Granados \u003cjoel.granados@kernel.org\u003e\n" }, { "commit": "318012c56576e09806747f64f89f8f3cde1f999f", "tree": "f8139edf92b3a0aef913359343a595b5afe09c46", "parents": [ "82431877d837a6c2593efd8e66ba28b35a220ca4" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sat Sep 05 23:36:31 2026 +0000" }, "committer": { "name": "Joel Granados", "email": "joel.granados@kernel.org", "time": "Tue Sep 15 09:20:58 2026 +0200" }, "message": "sysctl: Check range in do_proc_ulong_conv_ms_jiffies\n\nAdd the range check back to do_proc_ulong_conv_ms_jiffies that commit\nb96b5c6708ea (\"sysctl: Replace do_proc_do{int,ulong,uint}vec with\ndo_proc_vec\") incorrectly removed. Append \"_minmax\" to the end of\ndo_proc_ulong_conv_ms_jiffies so it is clear that there should be a\nrange check.\n\nFixes: b96b5c6708ea (\"sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Joel Granados \u003cjoel.granados@kernel.org\u003e\n" }, { "commit": "82431877d837a6c2593efd8e66ba28b35a220ca4", "tree": "632182ad1a7d160468fc4da37bcc21bd003d4f05", "parents": [ "fd73f4a6659897191fa0d40695fe370925dd3780" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sat Sep 05 23:36:30 2026 +0000" }, "committer": { "name": "Joel Granados", "email": "joel.granados@kernel.org", "time": "Tue Sep 15 09:20:58 2026 +0200" }, "message": "sysctl: Check range in proc_dointvec_ms_jiffies_minmax\n\nAdd the range check to do_proc_int_conv_ms_jiffies_minmax that commit\nd174174c6776 (\"sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with\nfunctions\") incorrectly removed.\n\nFixes: d174174c6776 (\"sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Joel Granados \u003cjoel.granados@kernel.org\u003e\n" }, { "commit": "057dac23d329d5c5ed62352f2659a39fd46c6d4a", "tree": "432eb28090de9a8e089fda8fe3e2ba49ee99d8f8", "parents": [ "3f4b7d1a49c5c826f3be9b684313eea5b83ac232" ], "author": { "name": "Michal Koutný", "email": "mkoutny@suse.com", "time": "Mon Sep 14 14:19:10 2026 +0200" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Sep 14 12:43:50 2026 -1000" }, "message": "cgroup: Avoid iteration of dying tasks with zero refcount\n\nThe commit 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from\ncgroup_task_release() to cgroup_task_free()\") extended the lifetime of\ntasks on the dying_tasks list.\nThe iterators have provision to go through dying_tasks because of\ndying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,\nit was expected that such tasks can obtain a new reference (that is\npossible before cgroup_task_release()/put_task_struct_rcu_user()).\nThe tasks after cgroup_task_release() and before cgroup_task_free()\nare subject to race when they may or may not have -\u003eusage count \u003e 0.\n\nThe race window is between css_task_iter_next() invocations\nwhen css_set_lock is released and we may arrive at a new -\u003etask_pos.\nThe iterator should not attempt to resurrect tasks whose -\u003eusage count\ndropped to zero. (When that happens, __put_task_struct_rcu_cb() is\nalready imminent and the returned task_struct would could be used\nafter free.)\n\nAs for the fix, we cannot simply check the signal-\u003elive count of a task\non the dying list because that won\u0027t distinguish regular zombies waiting\nto be reaped from RCU remnant tasks that are going to be free\u0027d.\nTherefore add an extra check to rule out -\u003eusage\u003d\u003d0 tasks from any\niteration.\n\nThe repeat: loop in css_task_iter_advance() doesn\u0027t consider -\u003eusage\ncount, so add a new loop to css_task_iter_next() to skip de-used tasks\non the dying_list.\n\nRough illustration of the possible race\n\n R (reader of cgroup.procs) T (thread) L (group leader)\n --------------------------------- -------------------------------- --------------------------------\n L exits, signal-\u003elive \u003e 0\n cgroup_task_dead(L)\n css_set_skip_task_iters() // skips only cset-\u003etasks\n list_add_tail(\u0026L-\u003ecg_list, \u0026cset-\u003edying_tasks)\n css_task_iter_next()\n take css_set_lock\n css_task_iter_advance()\n leader \u0026\u0026 signal-\u003elive !\u003d 0\n \u003d\u003e it-\u003etask_pos \u003d \u0026L-\u003ecg_list\n release css_set_lock\n T exits\n --signal-\u003elive \u003d\u003d 0\n\t\t\t\t cgroup_task_dead(T) // css_set_lock\n release_task(T)\n cgroup_task_release(T)\n release_task(L) // zap_leader\n cgroup_task_release(L)\n put_task_struct_rcu_user(L)\n ...RCU...\n put_task_struct(L)\n L-\u003eusage \u003d 0\n /* L still on dying_tasks */\n ...RCU...\n __put_task_struct(L)\n css_task_iter_next() // another iteration\n take css_set_lock\n it-\u003etask_pos \u003d \u0026L-\u003ecg_list\n get_task_struct(L)\n \u003d\u003e addition on 0\n drop css_set_lock\n cgroup_task_free(L)\n css_set_skip_task_iters() // dying skip comes too late\n free_task(L)\n cgroup_procs_show()\n task_pid_vnr(L)\n\nFixes: 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from cgroup_task_release() to cgroup_task_free()\")\nCc: stable@vger.kernel.org # v6.19+\nLink: https://lists.debian.org/debian-kernel/2026/08/msg00220.html\nReported-by: Noah Elias Feldt \u003cN.Feldt@mittwald.de\u003e\nReported-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nSigned-off-by: Michal Koutný \u003cmkoutny@suse.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "587858367581b9c55c3690f4e63382ad622719d4", "tree": "ee8992a89ee73041aec86568874afabc5b67aa8c", "parents": [ "59826bc5a42a5e85dc21d4cdf3892f22dcda65f8", "f76017a7663c4ce5e379f8a8d39f032bdb1fd865" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 10:41:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 10:41:30 2026 -0700" }, "message": "Merge tag \u0027nfsd-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux\n\nPull nfsd fix from Chuck Lever:\n\n - Fix handling of NFSEXP_PNFS in the netlink codepath\n\n* tag \u0027nfsd-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:\n nfsd: fix handling of NFSEXP_PNFS in the netlink codepath\n" }, { "commit": "59826bc5a42a5e85dc21d4cdf3892f22dcda65f8", "tree": "1fee0589c6e3180513b4c07edac8ce90702fe4b8", "parents": [ "01414b70cb6f7a5911b65de0cc97225061f60a59", "c60ae98c5aa64021751b38ab1313b19d620bf640" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 10:20:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 10:20:28 2026 -0700" }, "message": "Merge tag \u00279p-for-7.3-rc4\u0027 of https://github.com/martinetd/linux\n\nPull 9pfs fix from Dominique Martinet:\n \"This is a single fix for a 9p/netfs regression that got in 7.1 (and\n was backported to 7.0)\n\n We need to rework how cached attributes, and in particular i_size, are\n handled in 9p more thoroughly but that will take more time and this\n appears to be enough for the most obvious problems\"\n\n* tag \u00279p-for-7.3-rc4\u0027 of https://github.com/martinetd/linux:\n 9p: Fix v9fs_issue_write() to update i_size and remote_i_size\n" }, { "commit": "01414b70cb6f7a5911b65de0cc97225061f60a59", "tree": "999f353d353774a9d2a85f2f01eaaa5c8313f7c7", "parents": [ "ebb58ec7f8539450804741d974acbb985da0f071", "9ff797e516dbc1ecb73701ec4c24055712d44411" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 09:58:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 09:58:12 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma fixes from Jason Gunthorpe:\n \"Lots of bug fixes from the last weeks:\n\n - Various error unwind bugs\n\n - Several more races and bugs in siw and rxe, including remote\n triggerable\n\n - HFI1 corruption with its credit scheme\n\n - Remove a bogus user triggerable dev_warn\n\n - Lock __ethtool_get_link_ksettings() properly\n\n - Fix a lockdep loop with diassociation\n\n - Several storage related bugs, some triggerable remotely\n\n - Do no leak physical addresses to userspace in bnxt_re\n\n - Fix wrong irq context for the xarrays in erdma\n\n - User triggerable race in ucma with multicast\n\n - Race in ipoib with multicast flushing and destruction\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits)\n RDMA/siw: Bound fragmented header copies by the remaining length\n RDMA/efa: Keep EQ resources alive while IRQ is registered\n RDMA/efa: Keep admin queues alive while IRQ is registered\n RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()\n IB/IPoIB: Avoid restoring OPER_UP after multicast flush\n RDMA/ucma: Serialize join and leave on copy_to_user failure\n RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted\n RDMA/irdma: Enforce local fence for IB_WR_REG_MR\n RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables\n RDMA/mad: Fix receive buffer leak when PKey enforcement fails\n RDMA/uverbs: Fix potential leak of resources-\u003ecollection in flow_resources_alloc()\n RDMA/bnxt_re: Avoid exposing umdbr to userspace\n RDMA/rtrs: guard against null kobj name\n RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup\n IB/isert: wait for deferred control PDU completions before releasing the connection\n IB/iser: reject a remote invalidation of an unregistered direction\n RDMA/srp: Fix srp_remove_target()\n IB/mlx4: Fix use-after-free on pkey sysfs registration failure\n RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency\n RDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n ...\n" }, { "commit": "ebb58ec7f8539450804741d974acbb985da0f071", "tree": "eaffbf7c81cf3dbcc1489766bccedaade579161b", "parents": [ "164f652b6ef9209437ca016beedfcab626ff4f02", "6e33dc90df108c76899dc544a42d17adcba61668" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 09:36:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 09:36:43 2026 -0700" }, "message": "Merge tag \u0027fixes-2026-09-14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock\n\nPull memblock fixes from Mike Rapoport:\n \"Fix for regions display in debugfs and MAINTAINERS update:\n\n - Make sure that multiple flags on a memblock region are all\n displayed in debugfs\n\n - Update memblock tree tags in MAINTAINERS\"\n\n* tag \u0027fixes-2026-09-14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock:\n MAINTAINERS: update memblock tree URLs\n mm: memblock: show all region flags in debugfs\n" }, { "commit": "164f652b6ef9209437ca016beedfcab626ff4f02", "tree": "078529adb4e2dc18358ddd236a2582c5325294e3", "parents": [ "704340f1cd0dcef829eb62f5b48ae95a2ce17bdf", "7891fbb9512f127826e1d5dbf380ee212bd15eb0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 08:59:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 14 08:59:09 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-09-13-21-50\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"14 hotfixes. 10 are cc:stable. 11 are for MM.\n\n All are singletons - please see the changelogs for details\"\n\n* tag \u0027mm-hotfixes-stable-2026-09-13-21-50\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/folio: EXPORT_SYMBOL_FOR_KVM(lru_cache_drain_for_folio)\n mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory\u003dnokmem\n mm/vma: correctly unaccount on mmap_prepare() failure\n mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()\n remove old lib/alloc_tag.c\n fs/dax: check zero or empty entry before converting xarray entry\n fs: fix missed removal of super_fs_objects_eligible()\n mm: filemap: retain mapped dropbehind folios\n mailmap: update entry for Christopher Obbard\n memcg: avoid charging the root memcg from obj_cgroup_charge_pages()\n mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count\n mailmap: map Coiby Xu\u0027s address\n mm/mremap: account mm-\u003elocked_vm correctly for MREMAP_DONTUNMAP\n mm/huge_memory: bypass THP tuneables for huge pfnmap mappings\n" }, { "commit": "704340f1cd0dcef829eb62f5b48ae95a2ce17bdf", "tree": "c514ab12f0849eb5297fd0a541216c812e1e57e7", "parents": [ "fd73f4a6659897191fa0d40695fe370925dd3780", "27600805e62f800bacf990354632eae4e487d34c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 17:50:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 17:50:28 2026 -0700" }, "message": "Merge tag \u0027x86_urgent_for_7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Dave Hansen:\n \"The most notable fix is THP not silently losing user data and having\n been around for a couple of years. The main explanation I\u0027d have for\n its longevity is that it requires a few different things to align at\n the same time: MADV_FREE, THP and heavy reclaim.\n\n - Fix user-space data loss with THP\n\n - Fix set_memory oopses\n\n - Fix addition of large constants in mul_u64_add_u64_div_u64()\n\n - Fix FineIBT hash offset in cfi_get_func_hash()\n\n - Fix PCI device reference counting in amd_smn_init()\"\n\n* tag \u0027x86_urgent_for_7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/amd_node: Fix PCI device reference counting in amd_smn_init()\n x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64()\n x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()\n x86/mm: Fix user-space data loss with MADV_FREE and THP\n x86/mm/pat: Allocate split page tables as kernel page tables\n x86/alternatives: Exclude text poking against change_page_attr()\n x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF\n x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF\n" }, { "commit": "fd73f4a6659897191fa0d40695fe370925dd3780", "tree": "cbae8a48f2303e6f3b038bd8b28a9052a6dfd91e", "parents": [ "22098763a10d9c1340827fcf6edab66f153b27f0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 14:38:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 14:38:02 2026 -0700" }, "message": "Linux 7.3-rc3\n" }, { "commit": "22098763a10d9c1340827fcf6edab66f153b27f0", "tree": "3962f95a34df034652ff93686cdd156c7197f2d9", "parents": [ "d681d7ef617ef83d6a4de36e5cb4418ef602e122", "d860c67c051685abb0460b593b193f0f45f4fa92" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 12:27:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 12:27:00 2026 -0700" }, "message": "Merge tag \u0027trace-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Don\u0027t destroy user event fields when removal fails\n\n User event fields are destroyed before the event is removed from\n visibility. But that can fail leaving the still visible event with no\n fields. Move the destroying of the fields to after the event is\n successfully removed from visibility.\n\n - Initialize function graph state is fork before calling\n copy_exec_state()\n\n For non-CLONE_VM forks, copy_exec_state() allocates a new\n task_exec_state. If that allocation fails, ftrace_graph_exit_task()\n will free the tasks ret_stack pointer. Since that pointer is still\n using the parent\u0027s ret_stack, it mistakenly frees the parent\u0027s\n pointer too.\n\n Call ftrace_graph_init() on the task first which will NULL out the\n new tasks\u0027s ret_stack and if the copy fails, it will not free\n anything.\n\n - Remove FGRAPH_MAX_INDEX\n\n The macro FGRAPH_MAX_INDEX was added but never used. Remove it.\n\n - Save ent_size in function graph printing of nested functions\n\n The function graph tracer needs to look at the next event to see if\n the next event is the return of the current function entry. If it is,\n it prints a single line:\n\n\tktime_get();\n\n Otherwise it prints it like a nested function:\n\n\ttick_nohz_irq_exit() {\n\t ktime_get();\n\t kcpustat_irq_exit();\n\t}\n\n In order to look at the next event, it must save the current event so\n that it has the information to print from it. It saves the event in\n the iterator descriptor called \"ent\". What it doesn\u0027t save is the\n ent_size of the event which is now used to know if the function graph\n arguments are to be printed. The peek doesn\u0027t save the size so the\n size used happens to be that of the size of the last event that was\n seen.\n\n Save the entry event size in the iterator descriptor so that the\n correct size is used.\n\n - Fix several errors with freeing data in the histogram code\n\n The histogram code had a lot of leaked or or incorrect accounting\n when failures happen. Correct them.\n\n - Fix histogram regression of .percent and .graph modifiers\n\n Up until 6.3 histogram values could have \"percent\" or \"graph\"\n modifiers that changed how they were printed. But a change that added\n restricting histograms values from being strings, stack traces and\n other modifiers inadvertently prevented them from using the percent\n and graph modifiers, which were legal use cases for values.\n\n Put back the percent and graph modifiers.\n\n - Fix various typos in the comments\n\n - Set the trace_clock before initializing a histogram with clock\n argument\n\n The histogram API allows the user to specific which trace clock to\n use via a \"clock\u003d\" string. The histogram is set up first before the\n clock is checked. If the passed in clock is not valid, it exits\n without fully fixing up the histogram leaving it on the list and a\n use-after-free can trigger.\n\n Update the clock argument first and if it fails then exit gracefully\n before the histogram trigger is placed on any lists.\n\n - Restore :mod: trailer after parsing in ftrace_set_clr_event\n\n The function ftrace_set_clr_event() modifies the parse string and\n needs to put it back to what was passed in. It searches for \":mod:\"\n via a strsep() but fails to put back the first \u0027:\u0027 in the string.\n\n Add back the \u0027:\u0027 in the passed in string.\n\n - Take trace_array reference when opening a tracer options file\n\n The options files are dynamically created and some tracers add their\n own options. When a tracer adds their own list of options, the\n trace_array holding them has an array to hold the list of options for\n each tracer. This array increases in size via a krealloc(), and the\n new entry gets a newly allocated array to hold the options of the new\n tracer being added.\n\n The element in each entry of the tracer\u0027s option array holds a\n pointer back to the trace_array, a pointer to the tracer it is\n associated to, a pointer to the flags of the option.\n\n The issue is that these arrays are freed when the trace_array is\n freed when its instance it represents is removed from the instances\n directory. There\u0027s a race that an open of one of these options files\n can happen when the instance is being removed.\n\n Add a new helper function to be called by the open function of the\n options file to iterate all existing trace_arrays under a lock and\n find the one that has the given option element in one of it\u0027s tracer\n arrays. If found, then update the associated trace_array\u0027s reference\n counter to keep it from being freed. If not found, have the open call\n return -ENODEV.\n\n - Disable interrupts when acquiring the lock in rb_wake_up_waiters()\n\n The function rb_wake_up_waiters() assumes it will be called in\n interrupt context and does not disable irqs when taking\n cpu_buffer-\u003ereader_lock, which can be called in hard interrupt\n context. The issue is in PREEMPT_RT, this function is called in\n thread context leaving this lock open to a deadlock.\n\n Take the lock with interrupts disabled.\n\n - Use rcu_assign_pointer() for tmp_ops filter hash\n\n The tmp_ops used in update_ftrace_direct_mod() assigns its\n filter_hash field directly, but that field is annotated as __rcu and\n sparse complains. Assign it with rcu_assign_pointer()\n\n - Fix use-after-free in enable_trigger_private_data_free()\n\n The trace_event_call is accessed through the event_trigger_data\u0027s\n trace_event_file pointer to put the trace_event_call on freeing. The\n issue is that the trace_event_file data may have been freed already\n causing a use-after-free. Add a field to the event_trigger_data that\n points directly to the trace_event_call so that it can decrement its\n reference directly without needing to go through the\n trace_event_file.\n\n - Fix accounting of buffer data remote headers\n\n trace_buffer_desc_size() and trace_remote_alloc_buffer() undercount\n the number of pages is needed for the asked for size as it doesn\u0027t\n take into account the meta data on each page. Add a helper function\n to do the calculation properly and use that in these functions.\n\n - Catch nr_page_va overflow in ring_buffer_desc sizing\n\n The number of pages per remote ring buffer is capped by\n ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to\n overflow that field would silently allocate a descriptor smaller than\n what was asked for.\n\n - Do not resize the subbuf order if any per_cpu buffer is disabled\n\n The mmapping of ring buffers disables resizing the subbuffers, but it\n is done per-cpu whereas the subbuf size change is done for all the\n per_cpu buffers under the buffer-\u003emutex. It could change the size of\n some while the mapping is happening on others. Have the resize of the\n subbuf order check all the per_cpu buffers under the lock to see if\n any of them is disabled before starting and causing an inconsistency\n between buffers that are being mapped.\n\n* tag \u0027trace-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (25 commits)\n ring-buffer: Check resize_disabled before publishing the new subbuf order\n tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing\n tracing/remotes: Account for ring buffer page header in size calculation\n tracing: Don\u0027t dereference trace_event_file in deferred trigger free\n ftrace: Use rcu_assign_pointer() for tmp_ops filter hash\n ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()\n tracing: Take trace_array reference when opening a tracer options file\n tracing: Fix ring_buffer_read_page_size() kernel-doc\n tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event()\n tracing: Fix memory corruption from a \"STACKTRACE\" histogram key\n tracing: Fix memory corruption from the histogram stacktrace modifier\n tracing: Undo the registration when enabling the histogram trigger fails\n tracing: Take the reference before publishing the named histogram trigger\n tracing: Set the trace clock before registering the histogram trigger\n tracing: Fix typo \"preceeded\" in comment\n tracing: Fix typo \"availabe\" in comment\n tracing: Let histogram values keep the percent and graph modifiers\n tracing: Keep the entry count when the histogram stats allocation fails\n tracing: Free histogram the field rejected for a bad modifier\n tracing: Free histogram the var ref when its initialization fails\n ...\n" }, { "commit": "d681d7ef617ef83d6a4de36e5cb4418ef602e122", "tree": "accfd28199fc30b26ecd833a5ef905932f7ad510", "parents": [ "180534c09b2dd877c3ec83c900253765923c2e42", "856c562c94964a74f63c6d5f38a1509a59a2357d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 10:18:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 10:18:23 2026 -0700" }, "message": "Merge misc regression fixes that seem to have fallen through the cracks\n\nThorsten continues to track regressions, and reporting on known issues\nwith fixes that don\u0027t seem to make any progress.\n\nI\u0027m going to do an rc3 release later today - let\u0027s not keep these known\nissues pending for yet another rc for no obvious reason.\n\nReported-by: Thorsten Leemhuis \u003cregressions@leemhuis.info\u003e\nLink: https://lore.kernel.org/all/46403cf8-9a81-4596-87eb-dde58ae4c5db@leemhuis.info/\n\n* regressions:\n media: ipu-bridge: do not use the CVS device lookup for IVSC\n wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe\n wifi: mt76: mt7921: skip unknown CLC firmware records\n" }, { "commit": "856c562c94964a74f63c6d5f38a1509a59a2357d", "tree": "accfd28199fc30b26ecd833a5ef905932f7ad510", "parents": [ "7825de3f75d184612d77655669a04ea0da252c17" ], "author": { "name": "Sergey Zagursky", "email": "gvozdoder@gmail.com", "time": "Wed Sep 02 22:15:24 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 10:15:16 2026 -0700" }, "message": "media: ipu-bridge: do not use the CVS device lookup for IVSC\n\nSince commit c6b1b34b5090 (\"media: pci: intel: Add CVS support for IPU\nbridge driver\") the internal camera no longer works on laptops where the\nsensor sits behind an IVSC, for example a Dell XPS 16 9640 (IPU6,\nINTC10CF, ov02c10):\n\n intel-ipu6 0000:00:05.0: Found supported sensor OVTI02C1:00\n intel-ipu6 0000:00:05.0: Connected 1 cameras\n ivsc_csi intel_vsc-92335fcf-3203-4472-af93-7b4453ac29da: mei-csi probed\n without device fwnode!\n\nNo sensor subdevice is registered, the media graph has no sensor entity\nand userspace finds no camera at all.\n\nipu_bridge_get_ivsc_csi_dev() first looks for the platform device named\n\"intel_vsc\" and returns its mei-csi child. That device is created by\nmei_vsc, which on this machine only appears once the LJCA USB bridge and\nits SPI controller have probed, about a second after the IPU6 probe that\nruns the bridge:\n\n 07:59:29.297 platform INTC10CF:00 created (ACPI scan)\n 07:59:41 intel-ipu6 probe -\u003e ipu_bridge_init()\n 07:59:42.391 platform intel_vsc created (mei_vsc)\n\nThe commit above added two fallbacks for CVS which match on the ACPI\ncompanion alone. They are reached for every entry of ivsc_acpi_ids[],\nIVSC IDs included. The IVSC ACPI device has two physical nodes:\n\n INTC10CF:00/physical_node -\u003e platform/INTC10CF:00 (no driver bound)\n INTC10CF:00/physical_node1 -\u003e platform/intel_vsc (mei_vsc)\n\nso bus_find_device_by_acpi_dev(\u0026platform_bus_type, adev) returns the bare\nplatform device. ipu_bridge_instantiate_ivsc() then attaches the IVSC\nsoftware node to that device instead of to the mei-csi client, the bridge\nreports success, and the probe is never retried. mei_csi later probes\nwithout a fwnode, the CSI-2 link is never described, and the sensor ACPI\ndevice, which has an honoured _DEP on the IVSC device, is never\nenumerated.\n\nBefore those fallbacks existed the lookup returned NULL here, the bridge\nfailed with -ENODEV and the probe was retried once the IVSC device had\nshown up.\n\nSkip those fallbacks for IVSC devices, keying on the IVSC IDs rather than\nthe CVS ones: new CVS IDs keep being added, whereas the IVSC list is\ncomplete. CVS binds a driver to the ACPI device itself, so matching on the\ncompanion stays unambiguous there.\n\nFixes: c6b1b34b5090 (\"media: pci: intel: Add CVS support for IPU bridge driver\")\nLink: https://lore.kernel.org/linux-media/20260901194526.6369-1-gvozdoder@gmail.com/\nCc: stable@vger.kernel.org\nAssisted-by: Claude Code:claude-opus-5\nSigned-off-by: Sergey Zagursky \u003cgvozdoder@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7825de3f75d184612d77655669a04ea0da252c17", "tree": "778300c7dac6832f8b583177dce4dab4ab3561d7", "parents": [ "1a296bfd3e775e515233f746218824fc7dd5ff16" ], "author": { "name": "Devin Wittmayer", "email": "lucid_duck@justthetip.ca", "time": "Tue Aug 25 11:17:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 10:15:16 2026 -0700" }, "message": "wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe\n\nSome laptops carry a MediaTek power table in their firmware, and the\ndriver reads it to set a transmit limit for each frequency range. It\nonly fills in the ranges themselves when it registers the device.\n\nThe startup step that does this existed already, but it never programmed\nanything. Two recent commits made it run a regulatory update instead,\nwhich sets the limits on the way through, long before registration.\n\nAs a result, on a machine that has the table the driver reads through an\nempty pointer and the interface never appears:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000004\n RIP: 0010:mt792x_init_acpi_sar_power\n Call Trace:\n mt7921_set_tx_sar_pwr\n mt7921_mcu_regd_update\n mt7921_regd_update\n mt7921_run_firmware\n mt7921e_mcu_init\n mt7921_init_work\n\nSkip it when the ranges are missing. They are applied again once the\ndevice is up, which is where they came from before.\n\nReported-by: Klara Modin \u003cklarasmodin@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-wireless/aoyxqHYvSuaBeubf@soda.int.kasm.eu/\nFixes: 9b80bd9cab40 (\"wifi: mt76: mt7921: add regulatory wiphy self manager support\")\nFixes: e9f3f1cc133f (\"wifi: mt76: mt7925: add regulatory wiphy self manager support\")\nSigned-off-by: Devin Wittmayer \u003clucid_duck@justthetip.ca\u003e\nTested-by: David Gow \u003cdavid@davidgow.net\u003e\nTested-by: Klara Modin \u003cklarasmodin@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1a296bfd3e775e515233f746218824fc7dd5ff16", "tree": "c0dbafafc598c41b34c5bc40fbc9299cd5972512", "parents": [ "180534c09b2dd877c3ec83c900253765923c2e42" ], "author": { "name": "Laxman Acharya Padhya", "email": "acharyalaxman8848@gmail.com", "time": "Sun Aug 16 23:33:40 2026 +0545" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 10:15:16 2026 -0700" }, "message": "wifi: mt76: mt7921: skip unknown CLC firmware records\n\nTreat an out-of-range CLC index as newer firmware rather than a\nmalformed image. linux-firmware 20260810 ships MT7922 records with\nidx 3, and rejecting them made mt7921e fail to probe.\n\nKeep the record-length checks, and report those as errors so a\ntruncated table is visible instead of a silent retry loop.\n\nFixes: 9417c5818a01 (\"wifi: mt76: mt7921: validate CLC firmware records\")\nReported-by: Mikhail Gavrilov \u003cmikhail.v.gavrilov@gmail.com\u003e\nSigned-off-by: Laxman Acharya Padhya \u003cacharyalaxman8848@gmail.com\u003e\nReviewed-by: Junjie Cao \u003cjunjie.cao@intel.com\u003e\nTested-by: Mikhail Gavrilov \u003cmikhail.v.gavrilov@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d860c67c051685abb0460b593b193f0f45f4fa92", "tree": "a26aab3d22b87970eb65a593a5feb7d76e7abdbe", "parents": [ "d059d8bf2c9b5d563d15e7552d73e17d7535013a" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Sat Sep 12 11:39:38 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sun Sep 13 13:06:43 2026 -0400" }, "message": "ring-buffer: Check resize_disabled before publishing the new subbuf order\n\nring_buffer_subbuf_order_set() stores the new order and only then walks\nthe CPUs, returning -EBUSY if any of them has resizing disabled. A user\nmapped buffer has resizing disabled, and __rb_map_vma() reads\nbuffer-\u003esubbuf_order without buffer-\u003emutex, so an mmap of an already\nmapped CPU racing the failing order change sizes the mapping with the\nnew order and inserts pages past the sub-buffer into the VMA.\n\nCheck the CPUs before storing the new order.\n\nCc: stable@vger.kernel.org\nFixes: 117c39200d9d (\"ring-buffer: Introducing ring-buffer mapping functions\")\nLink: https://patch.msgid.link/20260912103938.1127021-1-devnexen@gmail.com\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d059d8bf2c9b5d563d15e7552d73e17d7535013a", "tree": "a958db6ff48b5c897c2da0c2801844e27e135781", "parents": [ "442ffa742daa65a0e8fe003abe9fbe472366e4de" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri Sep 11 20:39:36 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sun Sep 13 13:06:43 2026 -0400" }, "message": "tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing\n\nThe number of pages per remote ring buffer is capped by\nring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to\noverflow that field would silently allocate a descriptor smaller than\nwhat was asked for.\n\nReturn SIZE_MAX from trace_buffer_desc_size() on nr_page_va overflow.\n\nLink: https://patch.msgid.link/20260911193937.602202-3-vdonnefort@google.com\nFixes: 2e67fabd8b77 (\"ring-buffer: Introduce ring-buffer remotes\")\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "442ffa742daa65a0e8fe003abe9fbe472366e4de", "tree": "1f72c21dd26526d26b19bee8d453a6b8387755a0", "parents": [ "bcfe2816e6ec46c3f4c58aa4264476665ddb3f69" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri Sep 11 20:39:35 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sun Sep 13 13:06:29 2026 -0400" }, "message": "tracing/remotes: Account for ring buffer page header in size calculation\n\ntrace_buffer_desc_size() and trace_remote_alloc_buffer() undercount the\nrequired pages because every ring buffer page contains a header\n(BUF_PAGE_HDR_SIZE). Account for that header to ensure allocated remote\nring buffers aren\u0027t smaller than requested by the user.\n\nThe newly introduced helper __calc_nr_pages_ring_buffer_desc() can\nreturn a value that overflows the descriptor nr_pages field (32 bits).\n\nLink: https://patch.msgid.link/20260911193937.602202-2-vdonnefort@google.com\nFixes: 2e67fabd8b77 (\"ring-buffer: Introduce ring-buffer remotes\")\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "180534c09b2dd877c3ec83c900253765923c2e42", "tree": "770efa5f988b3105677ebf42b80800cb018a935c", "parents": [ "6a0b3fb48d485754661dd648a0cf9533cfcfa3e5", "f4c3e38111fd84c2c7ae5785755f4a4d476e1cba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:28:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:28:28 2026 -0700" }, "message": "Merge tag \u0027rust-fixes-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull Rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Work around a \u0027bindgen\u0027 0.73.2 bug that emits an \u0027allow\u0027 attribute\n for \u0027unnecessary_transmutes\u0027, which is unknown in older compilers\n\n - Clean \u0027clippy::as_underscore\u0027 lints in generated code by the new\n \u0027bindgen\u0027 0.73.0+ releases\n\n - Clean new \u0027clippy::needless_range_loop\u0027 lint for the upcoming Rust\n 1.100.0 (expected 2026-11-12)\n\n \u0027kernel\u0027 crate:\n\n - \u0027num\u0027 module: fix soundness issue in \u0027Bounded\u0027 by sealing the\n \u0027Integer\u0027 trait\n\n \u0027pin-init\u0027 crate:\n\n - Fix unreachable warning for the upcoming Rust 1.100.0 (expected\n 2026-11-12) due to \u0027Infallible\u0027 becoming an alias of \u0027!\u0027\n\n Samples:\n\n - Add missing newlines in \u0027pr_*!\u0027s macro calls\"\n\n* tag \u0027rust-fixes-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: allow `unknown_lints` in generated bindings for Rust \u003c 1.88\n rust: allow `clippy::as_underscore` in the generated bindings\n rust: num: seal Integer\n drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0\n rust: samples: add missing newlines in rust_print_main\n rust: pin-init: use irrefutable pattern for `stack_pin_init`\n" }, { "commit": "6a0b3fb48d485754661dd648a0cf9533cfcfa3e5", "tree": "2f76d861593832109998a9f03e9d3a3ef8fcfda0", "parents": [ "c874ace034a9cb647fe5e2a28fdb262b49c846e4", "7812d6dab0698001e50e8c2f901e17da3eb6f429" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:16:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:16:36 2026 -0700" }, "message": "Merge tag \u0027bootconfig-fixes-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull bootconfig fixes from Masami Hiramatsu:\n \"Fix integer overflow and truncation in size checks.\n\n - Fix size check bypasses caused by integer overflow and truncation\n when parsing initrd or standalone bootconfig files, preventing\n buffer overflow and out-of-bounds writes in the userspace tool.\n\n - Fix pointer arithmetic wrap-around in get_boot_config_from_initrd()\n when handling crafted huge size values, preventing fatal kernel\n page faults during early boot\"\n\n* tag \u0027bootconfig-fixes-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n bootconfig: Fix integer overflow in initrd size check\n tools/bootconfig: Fix integer overflow and truncation in size checks\n" }, { "commit": "c874ace034a9cb647fe5e2a28fdb262b49c846e4", "tree": "590a3b0b6d212564dc8867c447245f1166654838", "parents": [ "b2a8a7669e9befcec50fec990e1e1ee96f040cdf", "c5dcb3aadc18d7b82ba64790721b005d18193d35" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:10:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:10:38 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fixes from Ingo Molnar:\n\n - Fix clockevents replacement race when a broadcast\n device is replaced which may trigger a BUG() crash\n (朱恺乾 - Zhu Kaiqian)\n\n - Fix potential timerqueue ordering bug when rearming\n a queued timer with nonzero slack (Andrea Parri)\n\n* tag \u0027timers-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n hrtimer: Use hard expiry when updating timers on the same base\n tick/broadcast: Plug clockevents replacement race\n" }, { "commit": "b2a8a7669e9befcec50fec990e1e1ee96f040cdf", "tree": "894e2d4836b531fdceeffccde116abdd344e478e", "parents": [ "85855f85de484c464adb39076ebcb090c7eeb3b5", "f5741d2b34519d387edf6e9798fc7030c20a35f3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:03:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 09:03:22 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix EEVDF se-\u003emax_slice value on enqueueing (Vincent Guittot)\n\n - Fix EEVDF augmented rb-trees re-balancing with multiple\n fields (Vincent Guittot)\n\n - In proxy scheduling, account cgroup CPU time to the execution\n context, not the scheduling context (Hui Su)\n\n - Likewise, call wq_worker_tick() for the execution context,\n not the scheduling context (Hui Su)\n\n* tag \u0027sched-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/core: Call wq_worker_tick() for the execution context\n sched: Account cgroup CPU time to the execution context\n sched/eevdf: Fix rb augmented with multi fields\n sched/eevdf: Fix augmented max_slice\n" }, { "commit": "c7a1c6e8004ab12a9c9bfdcb603f60f9bf4a3cee", "tree": "f69ecd21fd9526406ebacf4611a66b6876e6b15d", "parents": [ "89ff16f0713917303210c560eec5cd0c13bd651f" ], "author": { "name": "fangqiurong", "email": "fangqiurong@kylinos.cn", "time": "Sat Sep 12 21:15:18 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sun Sep 13 05:53:33 2026 -1000" }, "message": "sched_ext: Close the pre-enable ops error claim window\n\nscx_alloc_and_add_sched() publishes ops-\u003epriv before\nscx_root_enable_workfn() switches the state to SCX_ENABLING. An error\nclaimed via scx_bpf_error_bstr() from an associated BPF program in that\nwindow is consumed by scx_disable_workfn(), which takes the pre-enable\nshortcut in scx_root_disable(). The shortcut returns without any teardown\nand restores SCX_DISABLED with an unconditional scx_set_enable_state() xchg\nracing the enable workfn\u0027s own transition. The enable then completes with\nthe claim consumed: the scheduler stays up but can never be disabled again,\nand bpf_scx_unreg() frees it while still in use, resulting in a\nuse-after-free. Both WARN_ON_ONCE()s fire back to back:\n\n WARNING: kernel/sched/ext/ext.c:7522 at\n scx_root_enable_workfn+0xeec/0x1be0, CPU#3: scx_enable_help/276\n\n WARNING: kernel/sched/ext/ext.c:6398 at scx_root_disable+0xb50/0xdb8,\n CPU#0: sched_ext_helpe/664\n\nscx_root_enable_workfn() switches to SCX_ENABLING before the scheduler\nallocation, so ops-\u003epriv is never visible while SCX_DISABLED. The allocation\nfailure path restores SCX_DISABLED.\n\nFixes: 105dcd005be2 (\"sched_ext: Introduce scx_prog_sched()\")\nCc: stable@vger.kernel.org\nSigned-off-by: fangqiurong \u003cfangqiurong@kylinos.cn\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "85855f85de484c464adb39076ebcb090c7eeb3b5", "tree": "5feecba8336077197f5553bb61c9d4f65c141d31", "parents": [ "feb66eea6b095e488755052e96f1e0d8b51e42c4", "a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:44:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:44:54 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar\n\n - Fix sched_cb_list corruption on PMU callbacks that\n invoke list_del() during perf_event_overflow()\n calls (Thomas Richter)\n\n - Fix PEBS pt_regs-\u003eflags snapshot data that\n regressed with the introduction of adaptive\n PEBS v4 support (Dapeng Mi)\n\n - Fix possible drain_pebs() re-entry bug when\n intel_pmu_drain_pebs_buffer() is called from\n process context (Dapeng Mi)\n\n* tag \u0027perf-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/intel: Prevent drain_pebs() reentry\n perf/x86/intel: Correct pt_regs-\u003eflags update for PEBS path\n perf/core: Allow list_del during perf_event_overflow()\n" }, { "commit": "feb66eea6b095e488755052e96f1e0d8b51e42c4", "tree": "2b5f5475e2d67cafbb73067576702be6effebf6f", "parents": [ "f10ae89f3d7994e680a1190c27f383f76f5ea73e", "ac323c9467092479dc1e5bc138c9abbe015b0069" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:37:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:37:11 2026 -0700" }, "message": "Merge tag \u0027objtool-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull objtool fixes from Ingo Molnar:\n\n - Fix potential klp-build allocation leak in cleanup\n functionality handling kzalloc() failure (Yafang Shao)\n\n - Fix KLP checksum false positives triggering with GCC, caused\n by quirks in string literal symbol generation (Josh Poimboeuf)\n\n* tag \u0027objtool-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n objtool/klp: Fix checksums for constant pool references\n klp-build: Fix wrong index in funcs cleanup error path\n" }, { "commit": "f10ae89f3d7994e680a1190c27f383f76f5ea73e", "tree": "6956fb7afddbad9c7244a5fecebcc816217197fc", "parents": [ "086fd27ee9c41f1a3ae040ffe5c9c00b45296f82", "1017911fcc03584b6854b1b8f0aafeb25f5a8d25" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:28:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:28:08 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fix from Ingo Molnar:\n\n - Fix ARM gic-v5 irqchip driver regression, where its\n enable/disable functions may corrupt unrelated\n ICC_CR0_EL1 hardware state (Sascha Bischoff)\n\n* tag \u0027irq-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/gic-v5: Preserve ICC_CR0_EL1 state\n" }, { "commit": "086fd27ee9c41f1a3ae040ffe5c9c00b45296f82", "tree": "7e5c53972f4f84f1a5f42ac37aae76bd104b8e75", "parents": [ "ff4b61e3b7b338a92cbea555013937e69c25fa52", "954f7a48fa2ae7310c67729fb556caf726783436" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:23:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 13 08:23:41 2026 -0700" }, "message": "Merge tag \u0027core-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull entry code fix from Ingo Molnar:\n\n - Fix generic entry code cross-build failure on\n !CONFIG_AUDITSYSCALL kernels using older\n RISCV64 and S390 cross-compilers (Thomas Gleixner)\n\n* tag \u0027core-urgent-2026-09-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n entry: Guard syscall_enter_audit() invocation with CONFIG_AUDITSYSCALL\n" }, { "commit": "ff4b61e3b7b338a92cbea555013937e69c25fa52", "tree": "6e3f21127c8ee3aaf8065e7164ce73c8b82738df", "parents": [ "2f0c1cf72f4682178506f513bbf015e591b1aa4a", "9868f5c077dfe0b606331f2e782484f91a5789a5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 17:32:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 17:32:14 2026 -0700" }, "message": "Merge tag \u0027edac_urgent_for_v7.3_rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fix from Borislav Petkov:\n\n - A single fix to altera_edac to use the proper objects when performing\n managed device operations instead of using temporary shallow struct\n copies which can cause dangling list pointers and havoc eventually\n\n* tag \u0027edac_urgent_for_v7.3_rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/altera: Use parent device for devres in altr_portb_setup()\n" }, { "commit": "2f0c1cf72f4682178506f513bbf015e591b1aa4a", "tree": "6a0d9322c1c028e257c2ce6403c65f2f2bcc748d", "parents": [ "3ce99a68f7d5b878a7746d479591a18651a8238f", "dc2136341be9835e70ba7c6b36904cf3683fd029" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 16:22:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 16:22:25 2026 -0700" }, "message": "Merge tag \u0027s390-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix NULL pointer dereferences in s390dbf when setting debug levels or\n resizing debug areas while logging events. Remove duplicate messages\n about kernel parameter overrides\n\n - Fix PAI perf crashes when per task events move to newly onlined CPUs.\n Add CPU hotplug callbacks to allocate and free the per-CPU data\n\n - Fix mutex use in atomic context in AES and PAES CTR code by using\n semaphore trylocks instead. Remove conditional locking and enable\n Clang CONTEXT_ANALYSIS for the crypto code\n\n - Fix scatterlist walk error handling in AES and PAES and avoid freeing\n PAES walk resources twice\n\n - Fix missing scrubbing of temporary AES and PAES buffers, including\n AES GCM error paths\n\n - Set missing CRYPTO_ALG_ASYNC and CRYPTO_ALG_NO_FALLBACK flags for\n PAES\n\n - Fix -EBUSY handling in PAES and PHMAC to avoid cleaning up requests\n already queued to the crypto engine\n\n - Fix PAES and PHMAC requests being completed twice on errors\n\n - Fix PAES and PHMAC hangs when key conversion keeps returning -EBUSY\n by returning -EIO after the last retry\n\n* tag \u0027s390-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/crypto: Enable CONTEXT_ANALYSIS\n s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly\n s390/crypto: Fix wrong return code to engine in asynch callbacks\n s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine\n s390/crypto: Fix handling of EBUSY in PAES when req is pushed to crypto engine\n s390/crypto: Fix missing cra_flags in paes_s390\n s390/crypto: Fix use of mutex in atomic context in PAES\n s390/crypto: Fix missing scrub of temp buffers with PAES algorithm\n s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms\n s390/crypto: Fix use of mutex in atomic context\n s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm\n s390/crypto: Fix skcipher_walk return code handling in aes_s390\n s390/debug: Fix race between debug area resize and event logging\n s390/debug: Do not repeat parameter override notice on debug_set_level()\n s390/debug: Fix NULL pointer dereference in debug_set_level()\n s390/pai: Support CPU hotplug for PMU PAI\n s390/pai: Move locking to event init and delete\n s390/pai: Use PAI PMU index as parameter replacing event\n" }, { "commit": "3ce99a68f7d5b878a7746d479591a18651a8238f", "tree": "bb157d9c3b95daf4bb02bdd6e9f89487016ca7b6", "parents": [ "cba2348ab114391f5b1a00fa65c5b739f13f0563", "59351365ac271b5e0eb180f211c531476a36221f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 11:29:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 11:29:20 2026 -0700" }, "message": "Merge tag \u0027kbuild-fixes-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nicolas Schier:\n \"Fix a build race and builds on stable branches.\n\n The other two are low-hanging fruits from Lorenzo\u0027s recent kbuild\n speed-up patch set that fix older symbol leakages.\n\n - don\u0027t delete in-flight filechk temporaries in asm-headers\n\n A rule for generating header files was changed from using make\n $(wildcard) fnglob to \u0027find\u0027 instead; as \u0027find\u0027 finds \"hidden\"\n files by default, temporary files from Kbuild\u0027s \u0027filechk\u0027, used for\n generating asm header files, may get deleted and break header file\n generating.\n\n - scripts/sorttable: Mark long_size as __maybe_unused\n\n Fix builds with clang-23 or newer on trees w/o commit b055f4c431e3\n (\"sorttable: Move ELF parsing into scripts/elf-parse.[ch]\");\n targetting for backport to stable kernels \u003c 6.19.\n\n - scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms\n\n Update regexp to remove kallsyms entries from kernel binary, saves\n about 32 KiB of bzImage.\n\n - scripts/mksysmap: fix escape of \u0027$\u0027 in the __pi_ pattern\n\n Prevent arm64 PIE namespace local symbols from appearing System.map\n and /proc/kallsyms\"\n\n* tag \u0027kbuild-fixes-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n scripts/mksysmap: fix escape of \u0027$\u0027 in the __pi_ pattern\n scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms\n scripts/sorttable: Mark long_size as __maybe_unused\n kbuild: don\u0027t delete in-flight filechk temporaries in asm-headers\n" }, { "commit": "59351365ac271b5e0eb180f211c531476a36221f", "tree": "d41f4050105dffde43904c3cc37251543ac16008", "parents": [ "281b61d408d4c39544583e393c6707af0ef5ee50" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Tue Sep 08 21:55:02 2026 +0100" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:19 2026 +0200" }, "message": "scripts/mksysmap: fix escape of \u0027$\u0027 in the __pi_ pattern\n\nCommit b18b047002b7 (\"kbuild: change scripts/mksysmap into sed script\")\nconverted scripts/mksysmap from a shell script to a sed script.\n\nHowever an error was made - escaping of \u0027$\u0027 required \\\\ escaping in shell\nbut only \\ in a sed script.\n\nThis was mostly corrected in commit 7a6c355b55c0 (\"scripts/mksysmap: Fix\nescape chars \u0027$\u0027\"), but this fix missed arm64 PIE namespace local symbols\nlike __pi_$x and __pi_$d which appear in System.map and /proc/kallsyms:\n\n$ grep __pi_\\\\$ /proc/kallsyms | sort -u\n0000000000000000 d __pi_$d\n0000000000000000 t __pi_$x\n\nFix the escaping properly.\n\nFixes: b18b047002b7 (\"kbuild: change scripts/mksysmap into sed script\")\nAssisted-by: LLM\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nReviewed-by: Nicolas Schier \u003cnsc@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-build-speedup-v1-2-5dc1ac01672d@kernel.org\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "281b61d408d4c39544583e393c6707af0ef5ee50", "tree": "37b815d016c0a843fcf8a90385c90c583cb0a01f", "parents": [ "4f73462856576797b8f3c55564a9be99f76dc67b" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Tue Sep 08 21:55:01 2026 +0100" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:19 2026 +0200" }, "message": "scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms\n\nCommit 3e86e4d74c04 (\"kbuild: keep .modinfo section in vmlinux.unstripped\")\nkeeps .modinfo symbols out of System.map and kallsyms, which assumes unique\nIDs have a format like \u0027__UNIQUE_ID_modinfo123\u0027.\n\nHowever, commit afb026b6d35c (\"compiler: Tweak __UNIQUE_ID() naming\"), sent\nin the same cycle, changes this to \u0027__UNIQUE_ID_modinfo_123\u0027.\n\nAs a result this regexp has never matched and every kernel since v6.18 has\ncarried one kallsyms entries for every MODULE_INFO() declaration in the\nkernel whether the modules are compiled or not.\n\nThat\u0027s 5,810 entries for an x86 defconfig build and 15,200 for arm64.\n\nOn x86 defconfig that is 113 KiB of kallsyms tables and 32 KiB of bzImage,\nand every lookup walks past them.\n\nFix the pattern.\n\nFixes: 3e86e4d74c04 (\"kbuild: keep .modinfo section in vmlinux.unstripped\")\nAssisted-by: LLM\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Nicolas Schier \u003cnsc@kernel.org\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-build-speedup-v1-1-5dc1ac01672d@kernel.org\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "4f73462856576797b8f3c55564a9be99f76dc67b", "tree": "80c7ed0413854f2f54c1be274c2d19a59be96cce", "parents": [ "06bb43d8c79762fa3452f292cd080e54bef5d431" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Mon Aug 31 18:46:31 2026 -0700" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:18 2026 +0200" }, "message": "scripts/sorttable: Mark long_size as __maybe_unused\n\nWhen building in a kernel tree prior to commit b055f4c431e3 (\"sorttable:\nMove ELF parsing into scripts/elf-parse.[ch]\") with clang-23 or newer,\nwhich implements a new warning under -Wunused-but-set-variable for\nstatic global variable, there is a warning from sorttable because\nlong_size is unused when MCOUNT_SORT_ENABLED is not set:\n\n scripts/sorttable.c:452:12: error: variable \u0027long_size\u0027 set but not used [-Werror,-Wunused-but-set-global]\n 452 | static int long_size;\n | ^\n\nMark long_size as __maybe_unused to avoid inserting more ugly #ifdef\ndirectives while insuring the warning does not reappear, as the\naforementioned change does not alter the uses of long_size, so it\nappears to be coincidence that the warning disappears after this\nrefactoring.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nTested-by: Nicolas Schier \u003cn.schier@fritz.com\u003e\nLink: https://patch.msgid.link/20260831-sorttable-long_size-unused-but-set-global-v1-1-8a96b88697e5@kernel.org\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "06bb43d8c79762fa3452f292cd080e54bef5d431", "tree": "2e60278e074e77ed844dc12fff9492611ca2f594", "parents": [ "df2908090cda368b01ff43709f51890076c56157" ], "author": { "name": "Vlad Poenaru", "email": "vlad.wing@gmail.com", "time": "Wed Sep 02 09:13:47 2026 -0700" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:13 2026 +0200" }, "message": "kbuild: don\u0027t delete in-flight filechk temporaries in asm-headers\n\nCommit 2d69b891e646 (\"kbuild: Support generated asm-headers in\nsubdirectories\") switched the stale-wrapper sweep in\nscripts/Makefile.asm-headers from $(wildcard $(obj)/*.h) to a find(1)\ninvocation, so that generated headers in subdirectories are considered.\n\nThe two do not match the same set of files. Make\u0027s $(wildcard) uses glob\nsemantics, where a leading \u0027.\u0027 has to be matched explicitly, whereas\nfind\u0027s -name uses fnmatch() without FNM_PERIOD, so \u0027*.h\u0027 matches\ndotfiles as well. filechk writes its output to $(dir $@).tmp_$(notdir $@)\nbefore renaming it into place, so such a scratch file, if it happens to\nexist in $(obj) when the sub-make is parsed, is now picked up in\nold-headers. It appears in neither generic-y, generated-y nor syscall-y,\nis therefore classified as unwanted, and cmd_remove deletes it.\n\nOn x86 this races with archprepare, which lists both asm-generic and\narch/x86/include/generated/asm/cpufeaturemasks.h as prerequisites. Under\n-j they run concurrently against the same directory, and the build fails\nintermittently:\n\n mv: cannot stat \u0027arch/x86/include/generated/asm/.tmp_cpufeaturemasks.h\u0027: No such file or directory\n make[1]: *** [arch/x86/Makefile:269: arch/x86/include/generated/asm/cpufeaturemasks.h] Error 1\n\nThe same commit also converted the generic wrapper rule to filechk, so\nthose wrappers now create .tmp_*.h in $(obj) too and can race among\nthemselves.\n\nRestore the previous behaviour by excluding dotfiles from the sweep.\nSubdirectories, which is what the find(1) conversion was for, keep being\ndescended into. While at it, quote the -name argument: it is currently\nexpanded by the shell against the build directory before find sees it.\n\nFixes: 2d69b891e646 (\"kbuild: Support generated asm-headers in subdirectories\")\nSigned-off-by: Vlad Poenaru \u003cvlad.wing@gmail.com\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nReviewed-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nReviewed-by: Nicolas Schier \u003cn.schier@fritz.com\u003e\nLink: https://patch.msgid.link/20260902161347.4163577-1-vlad.wing@gmail.com\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "bcfe2816e6ec46c3f4c58aa4264476665ddb3f69", "tree": "ad4f8d85fb6280eb6cf9ef6b194977dbfa8a75b8", "parents": [ "b4dcc18b97913888e8d009624e07c8014ce41b84" ], "author": { "name": "Ali Ahmet Memiş", "email": "aliamemis@disroot.org", "time": "Fri Sep 11 18:56:47 2026 +0300" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Sep 12 13:27:41 2026 -0400" }, "message": "tracing: Don\u0027t dereference trace_event_file in deferred trigger free\n\nThe enable_event trigger defers trace_event_put_ref() to the\ntrigger free kthread, but the trace_event_file can already be freed\nwhen the instance is removed.\n\nKeep the trace_event_call directly in enable_trigger_data so the\ndeferred free does not access the freed trace_event_file.\n\nCc: stable@vger.kernel.org\nFixes: e091351b3881 (\"tracing: Delay module ref count for \"enable_event\" trigger\")\nReported-by: Alexander Gordeev \u003cagordeev@linux.ibm.com\u003e\nCloses: https://lore.kernel.org/all/20260828134340.2501683A24-agordeev@linux.ibm.com/\nLink: https://patch.msgid.link/20260911155650.354844-1-aliamemis@disroot.org\nSigned-off-by: Ali Ahmet Memiş \u003caliamemis@disroot.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b4dcc18b97913888e8d009624e07c8014ce41b84", "tree": "8cb9fec28c29104b47c391e8b0e4198f263dc172", "parents": [ "815e07c8fe885a87751c2496a30ae0dcd4118210" ], "author": { "name": "Leon Hwang", "email": "leon.hwang@linux.dev", "time": "Fri Sep 11 22:25:12 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat Sep 12 13:27:29 2026 -0400" }, "message": "ftrace: Use rcu_assign_pointer() for tmp_ops filter hash\n\ntmp_ops.func_hash-\u003efilter_hash is annotated __rcu, but\nupdate_ftrace_direct_mod() assigns hash to it directly. Sparse reports an\naddress-space mismatch.\n\nUse rcu_assign_pointer() for the assignment.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260911142512.19344-1-leon.hwang@linux.dev\nFixes: 50b35c9e50a8 (\"ftrace: Use hash argument for tmp_ops in update_ftrace_direct_mod\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202609110704.Q3M5vCDV-lkp@intel.com/\nSigned-off-by: Leon Hwang \u003cleon.hwang@linux.dev\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "cba2348ab114391f5b1a00fa65c5b739f13f0563", "tree": "3cbc431c93c6d9cc166e68365793de55bb37556c", "parents": [ "95deca8dd9a91063babb2ef3a69f5248b1fa824e", "ad4497a92caba4630f75c80d49cb947026213280" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:44:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:44:12 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"More than the usual amount of fixes.\n\n The highlights here are a block under reservation fix which caused an\n assert to be triggered in non-default configurations. The assert,\n initially added on 7.3-rc2 just makes the problem explicit but is not\n the cause. Another highlight is a missed lock/unlock mutex in the xfs\n healthmonitor which was causing lockdeps warnings.\n\n Besides those two, this also contains a myriad of fixes for random\n bugs found by LLM tools in the healthmon, scrub and online repair.\n\n A few bug fixes for zoned xfs are also included.\n\n This also includes an accounting fix for our buffer slab cache where\n the memory payload associated to each object was not being properly\n accounted for.\n\n The remaining of the patches are a few lock context annotations added\n and/or fixed. They are mostly disabled by now, but still worth fixing\n before we get them enabled.\n\n And last but not least, a few clean ups\"\n\n* tag \u0027xfs-fixes-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (75 commits)\n xfs: advance the findparent inode scan cursor while holding ILOCK\n xfs: reset parent pointer args before each dir tree unlink repair\n xfs: fix replaying dirent removals into the temporary directory\n xfs: fix termination logic in xchk_bmap\n xfs: fix rtrmap cross-referencing elision logic\n xfs: actually check internal-rtdev fields in the superblock\n xfs: fix under-reservation of blocks when repairing sf directories\n xfs: take hm-\u003elock in xfs_ioc_health_monitor() before insert\n xfs: set IOMAP_F_INTEGRITY for zoned writes on integrity devices\n xfs: avoid extra cache flushes for multi-device file systems in xfs_fsync\n xfs: don\u0027t continue on error in xfs_fsync\n xfs: also flush the RT device cache in xlog_write_iclog\n xfs: bail out on bitmap errors in xrep_agfl_fill\n xfs: snapshot old AGFL before rewriting it\n xfs: remove redundant function declaration\n xfs: report runtime failures in scrub\n xfs: report healthy filesystem events in scrub stats\n xfs: snapshot scrub stats when rendering them\n xfs: remove several unused and never-implemented declarations\n xfs: count escaped corruption errors in scrub stats\n ...\n" }, { "commit": "95deca8dd9a91063babb2ef3a69f5248b1fa824e", "tree": "5a427ef1b0ebaa1f29088f91b04785f62663979c", "parents": [ "4d85a45df03118ade0eb34486fb7948bca17acf8", "09f1294ee2abee7fe1c2d600671498b7642e0fe0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:31:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:31:48 2026 -0700" }, "message": "Merge tag \u0027for-7.3-rc2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - tree-checker updates, validate values in b-tree item keys, other item\n length checks\n\n - don\u0027t do unnecessary transaction commit fallback when logging parent\n directories\n\n - in zoned mode, initialize space info of a block group early enough so\n it does not lead to NULL pointer dereference\n\n* tag \u0027for-7.3-rc2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: tree-checker: validate name length for extref items\n btrfs: tree-checker: validate parent field for inode extref items\n btrfs: tree-checker: validate key offset for inode ref keys\n btrfs: fix unnecessary transaction commit fallback from btrfs_log_all_parents()\n btrfs: set space_info before adding new free space in btrfs_make_block_group()\n" }, { "commit": "4d85a45df03118ade0eb34486fb7948bca17acf8", "tree": "d3127fb0277496a56938961826caad5ccf1c06a3", "parents": [ "31a4327ffe2d8cbd0f51a3af6a3ffc5ecd7fdbee", "135d84c66f85426299db01a09d93a79a87af18ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:18:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:18:50 2026 -0700" }, "message": "Merge tag \u0027erofs-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs updates from Gao Xiang:\n \"The most impactful fix here is to disable LZ4 rolling decompression\n for now.\n\n AWS folks recently found their systems could get corrupted data with\n some rare, specific LZ4 datasets, and after a deeper analysis, I found\n the root cause is that there could be uncontrolled backward memory\n copies in the current LZ4 implementation and it breaks the assumption\n of the rolling decompression optimization, since the kernel LZ4\n codebase is out of our control and it needs more time to plan how to\n do next, so disable LZ4 rolling decompression for now to ensure data\n correctness for real production on these rare cases first. The\n technical details also see the corresponding commit.\n\n Other changes are random minor fixes.\n\n Summary:\n\n - Disable LZ4 rolling decompression for now due to the uncontrolled\n LZ4 implementation\n\n - Fix missing sysfs feature entry for xattr prefixes\n\n - Fix invalid LZMA decoders on resize failure\n\n - Rearrange the inode_share cache key to avoid potential collisions\n\n - Fix erofs_bread() when fsoffset is used on sub-page-block EROFS\n filesystems\"\n\n* tag \u0027erofs-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: add missing buf-\u003eoff in erofs_bread()\n erofs: delimit inode_share cache key components\n erofs: disable LZ4 rolling decompression for now\n erofs: preserve LZMA decoders on resize failure\n erofs: add sysfs feature entry for xattr prefixes\n" }, { "commit": "31a4327ffe2d8cbd0f51a3af6a3ffc5ecd7fdbee", "tree": "a53dd0ee2af18ff8dfc922b14f50066d590cadc0", "parents": [ "f6e213d5a2a94255b31926f0e9f7c1eb234bbf22", "a0a34a40ed299c9c7cff6af163a5b883ee9d6d73" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:06:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:06:04 2026 -0700" }, "message": "Merge tag \u0027fbdev-for-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev\n\nPull fbdev fixes from Helge Deller:\n \"Two patches for VT core code and fbcon prevent potential out-of-bounds\n reads on font or screen size changes, one fix limits the Superblitter\n in atafb to supported modes only, and some minor fixes for vfb,\n ssd1307fb and omapfb\"\n\n* tag \u0027fbdev-for-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:\n fbdev: vfb: defer cleanup until the last reference\n fbdev: atafb: Restrict SuperBlitter to supported formats\n fbdev: ssd1307fb: fix NULL pointer dereference on missing match data\n fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo\n fbdev: omapfb: Fix __be32 sparse warning in panel_enabled()\n vt: hide cursor prior to font changes to avoid out-of-bound reads\n" }, { "commit": "f6e213d5a2a94255b31926f0e9f7c1eb234bbf22", "tree": "ee541b499a544b516aad68c0766cdad53b95acdd", "parents": [ "52311be52f66f1a3c71bc808d156482feb1eb79f", "b63c3c26726576e2a87baeee80bc202a5a43c9e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:55:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:55:52 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull IOMMU fixes from Joerg Roedel:\n \"RISC-V:\n\n - Serialize command queue publication to prevent concurrent producers\n from exposing incomplete or out-of-order commands to hardware\n\n - Wait for queue space outside the command queue lock\n\n - Avoid waiting for IOFENCE completion when command enqueue failed\n\n AMD:\n\n - Prevent GA log buffers from being reallocated and leaked during\n resume, where allocation also occurs in an unsuitable syscore\n callback context\n\n - Fix a regression on older systems whose firmware advertises\n incorrect IOMMU features\n\n - Preserve allocation errors when assigning host domain IDs to nested\n domains\n\n s390:\n\n - Prevent a NULL dereference when translating an unmapped IOVA with\n five-level ZPCI translation tables\n\n Misc:\n\n - Remove a stale MAINTAINERS entry and clean up unused or redundant\n AMD IOMMU declarations, macros, and checks\"\n\n* tag \u0027iommu-fixes-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/amd: Remove unused macro\n iommu/amd: Remove redundant checks from interrupt handler path\n iommu/amd: Remove redundant check in irq_remapping_select()\n iommu/amd: Make iommu_sva_set_dev_pasid as static\n MAINTAINERS: Drop the nonexistent vsi-iommu.h file entry\n iommu/amd: Fix ineffective error check in nested domain allocation\n iommu/amd: Fix premature break in init_iommu_one() again\n iommu/amd: Do not reallocate GA log buffers on resume\n iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX\n iommu/riscv: Avoid waiting on failed command enqueue\n iommu/riscv: Serialize command queue publishing\n iommu/riscv: Add command queue lock\n" }, { "commit": "52311be52f66f1a3c71bc808d156482feb1eb79f", "tree": "e055921392335069c3655b60888fa377967d642c", "parents": [ "5225b8eec4c9bb21aecff6295fab6346a3c3738e", "9e5c53d75c560a058abef0e4338c5e3e52cb432a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:45:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:45:01 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n\n - powerpc/entry: Fix double accounting of user time on interrupt entry\n\n - Fix leak in htmdump_init_debugfs\n\n - KVM: PPC: Book3S HV: Set irqfd-\u003eproducer only on success\n\n - powerpc/kexec_file: print configured kernel command line\n\n - Remove redundant early_init_dt_scan_root() call\n\n - misc fixes and cleanup\n\nThanks to Aboorva Devarajan, Amit Machhiwal, Athira Rajeev, Christophe\nLeroy, Christophe Leroy (CS GROUP), Kunwu Chan, leixiang, longlong yan,\nMichail Tatas, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM),\nShivang Upadhyay, Sourabh Jain, Thibault Ferrante, Vaibhav Jain, and\nVenkat Rao Bagalkote\n\n* tag \u0027powerpc-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs\n powerpc/prom: Remove redundant early_init_dt_scan_root() call\n selftests/powerpc: use MAP_FAILED instead of (void *)-1 in tm-signal-context-force-tm\n powerpc/kexec_file: print configured kernel command line\n KVM: PPC: Book3S HV: Set irqfd-\u003eproducer only on success\n powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs\n selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value\n selftests/powerpc/pmu/ebb: fix lost_exception_test hang with sched yield change\n powerpc/entry: Fix double accounting of user time on interrupt entry\n" }, { "commit": "c60ae98c5aa64021751b38ab1313b19d620bf640", "tree": "d3b0109bf52330459fc246eeb8ed5065a567930a", "parents": [ "df2908090cda368b01ff43709f51890076c56157" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Sep 11 10:25:04 2026 +0100" }, "committer": { "name": "Dominique Martinet", "email": "asmadeus@codewreck.org", "time": "Sat Sep 12 07:49:22 2026 +0000" }, "message": "9p: Fix v9fs_issue_write() to update i_size and remote_i_size\n\nFix v9fs_issue_write() to update i_size and remote_i_size to the new size\nof the server file if we made it larger, using the start fpos and the count\nreturned by p9_client_write() to calculate the new minimum file size.\n\nThis assumes that if the 9P server makes a short write (say it hits\nENOSPC), a reduced count is returned.\n\nFixes: 5fb70e7275a6 (\"netfs, 9p: Implement helpers for new write code\")\nReported-by: Michael Mulqueen \u003cmike@method-b.uk\u003e\nCloses: https://lore.kernel.org/r/fbb9e395-1e07-4212-8f70-23f3cd498074@method-b.uk/\nCc: stable@vger.kernel.org\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nMessage-ID: \u003c2226525.1789118704@warthog.procyon.org.uk\u003e\nSigned-off-by: Dominique Martinet \u003casmadeus@codewreck.org\u003e\n" }, { "commit": "5225b8eec4c9bb21aecff6295fab6346a3c3738e", "tree": "6cab48fce372373e9de81566c2b48c44b52db3cc", "parents": [ "114f73092b5d1bbea2554a6a784f5ebb53d47bdb" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Sep 11 15:45:37 2026 -0600" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:41:26 2026 -0700" }, "message": "mailmap: update entry for Jens Axboe\n\nI recently changed jobs, let\u0027s update the .mailmap entry so that patches\nare attributed to the right (current) company.\n\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "114f73092b5d1bbea2554a6a784f5ebb53d47bdb", "tree": "e99dba314e3855036cd5eb214d1dbd6b91528636", "parents": [ "0fb234ce373a331a21c1d33cffef28e53cee4ddb", "f3e6ef13e24c9f26dca0d35de57fcdf04f78e378" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:24:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:24:21 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"One fix for pf1550 which checked for errors on multiple regulators\n but always notified via one of them regardless of which one had the\n problem, plus one device ID addition in the fan53555 DT bindings\"\n\n* tag \u0027regulator-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: pf1550: fix which regulator is notified\n regulator: dt-bindings: fan53555: add tcs,tcs4526\n" }, { "commit": "0fb234ce373a331a21c1d33cffef28e53cee4ddb", "tree": "905161fe9c45d16ee4e0a8061ed94ce8ad8c383a", "parents": [ "525f0f99a4f775060288b3069e12b1d3e2b576da", "f77de4c33f0edbb33411f92a35d7196965597e6d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:10:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:10:31 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fix from Mark Brown:\n \"New device ID for v7.3: update the DesignWare DT binding to say how to\n describe the UltraRISC DP1000 instance of the controller\"\n\n* tag \u0027spi-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: snps,dw-apb-ssi: Add compatible for UltraRISC DP1000 SoC\n" }, { "commit": "525f0f99a4f775060288b3069e12b1d3e2b576da", "tree": "9886c73eb74988419d3aa4b5db805566551e45d8", "parents": [ "827751b699b79a6e569983359c02dce67f81b94c", "b1edd3a3e00369080012b2e4c665fc662b96ecbd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:50:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:50:47 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-09-12\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull, this seems relatively quiet for the new world,\n scattered fixes, mostly amdgpu leading the way, but lots of minor\n fixes in other drivers.\n\n drm_exec:\n - fix 0 object handling\n\n sched:\n - null ptr deref fix in kunit tests\n\n amdgpu:\n - Freesync fix\n - GPUVM fix\n - Debugfs fixes\n - HDMI fixes\n - IPS fix\n - GPU reset fix\n - RGB quantization fixes\n - SMU 13.0.x fixes\n\n xe:\n - runtime PM guard fix\n - cache flushing fix\n\n i915:\n - Fix a memleak on perf config query error path\n - Fix UHBR SST SDP splitting when sink doesn\u0027t support it\n\n bridge:\n - fix ti-sn65dsi83 error handling\n - tc358768: Enforce input bus flags via atomic_check\n\n ast:\n - fix blend mode property on cursor plane\n\n qxl:\n - fix blend mode property on primary/cursor planes\n\n virtio:\n - fix blend mode property on cursor plane\n\n vboxvideo:\n - fix blend mode property on planes\n\n rockchip:\n - fix endpoint name length\n - fix Kconfig issues\n\n ivpu:\n - limit firmware log prints to field size\n - validate buffer range in ivpu address translation\n - validate fw log buffers\n\n ethosu:\n - ensure SRAM sizing\n - ensure cmd stream formatting\n - drop IRQF_SHARED\n - fix open return value\n\n adp:\n - fix Kconfig\n\n logicvc:\n - fix Kconfig\"\n\n* tag \u0027drm-fixes-2026-09-12\u0027 of https://gitlab.freedesktop.org/drm/kernel: (38 commits)\n drm/amd/pm: report energy accumulator for smu 13.0.0\n drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7\n drm/amd/display: Rebuild InfoFrames on output color space changes\n drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output\n drm/amd/display: Propagate HDMI RGB quantization selectability\n Revert \"drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_info\"\n drm/amdgpu: skip gfx switch_power_profile during GPU reset\n drm/amd/display: Fix HF-VSDB DSC bpc detection to be cumulative\n drm/amd/display: Exit IPS before connector detection on resume\n drm/amd/display: Shorten hdmi_frl_status_polling_workqueue\n dm/amdgpu: fix malformed link_settings debugfs output\n drm/amdgpu: skip the VMID 0 flush for VRAM\n drm/amd/display: Consult MCCS FreeSync cap only if requested \u0026 supported\n drm/i915: Fix memory leak in query_perf_config_list()\n drm/i915/dp: Gate UHBR SST SDP splitting on sink capability\n drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches\n drm/xe: Guard page-fault worker with runtime PM check\n drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()\n drm/bridge: tc358768: Enforce input bus flags via atomic_check\n drm/drm_exec: fix up contended obj when num_objects is 0\n ...\n" }, { "commit": "827751b699b79a6e569983359c02dce67f81b94c", "tree": "bb42ac375bb79d1ad6f73c5c6ef1bec0fae21e7b", "parents": [ "1235ff329981ecde9ccbf49b83bd4d71e827d541", "b94cec5761d22624d109d859467d7d4ce0a1b88b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:15:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:15:13 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"From a RISC-V point of view, there\u0027s one notable fix here, reverting\n an earlier bogus fix to the pointer masking code. Fortunately the\n practical impact appears to be small.\n\n - Revert a bad fix, likely LLM-generated, in the pointer masking code\n that confused the RISC-V hardware pointer masking implementation\n with the Linux kernel tagged address feature\n\n - Fix unexpected faults caused by kprobe instruction slot writes when\n !CONFIG_STRICT_MODULE_RWX\n\n - Fix unexpected faults on minimal configurations during runtime code\n patching on !CONFIG_STRICT_MODULE_RWX systems\n\n - Fix a misplaced variable clear causing incorrect reuse of previous\n values in the RISC-V hardware feature probing code\n\n - Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather\n than BIT on 64-bit masks; and use a bitmap rather than an unsigned\n long on a quantity that can exceed 32 bits\n\n And a few miscellaneous cleanups:\n\n - Avoid a potential dereference-before-NULL-pointer-check bug in the\n PMU SBI perf driver\n\n - Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug\n table code (like x86 and PPC)\n\n - Report the RISC-V standard ISA extensions Z[v]fhmin when support is\n claimed for the superset RISC-V standard ISA extensions Z[v]fh; and\n simplify our FPU test code to only check for the presence of the D\n extension\n\n - Use an existing kernel string helper in place of some open-coded\n code in kernel/usercfi.c\n\n - Fix some yamllint issues in the RISC-V DT bindings for CPUs\n\n - Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into\n the RISC-V CFI selftest code\n\n - Update the translation for the simplified Chinese translation of\n the RISC-V kernel patch acceptance policy\"\n\n* tag \u0027riscv-for-linus-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS\n kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__\n docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation\n dt-bindings: riscv: cpus: Fix yamllint style issues\n riscv: hwprobe: simplify has_fpu() to check D extension only\n perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ\n riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present\n perf: RISC-V: store available counter mask as bitmap\n perf: RISC-V: use BIT_ULL for u64 overflow masks\n riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS\n riscv: hwprobe: initialize pair-\u003evalue in hwprobe_one_pair()\n riscv: use string helper in setup_global_riscv_enable()\n Revert \"riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set\"\n riscv: patch: skip fixmap mapping when kernel text is already writable\n riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX\n" }, { "commit": "1235ff329981ecde9ccbf49b83bd4d71e827d541", "tree": "3b3028c74f05f060ad143520b821ab9b603eb977", "parents": [ "707662b40a82c96e416fe17f3c116a4d648f1fdb", "d144a494d81fcf2d1c5cf58b01c655bb8bafc701" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:52:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:52:48 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - amd/pmf: Fix build on !CONFIG_AMD_PMF_DEBUG\n\n - asus-laptop: Fix ACPI event handling\n\n - hp-wmi: Fix board_params typo for 8DD6 board\n\n - x86-android-tablets: Fix Arizona and Crystal Cove GPIO lookups\n\n* tag \u0027platform-drivers-x86-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n MAINTAINERS: fix sysfs-platform-ayaneo-ec documentation path\n platform/x86: x86-android-tablets: fix gpio_secondary_fwnode_init() not working\n platform/x86: x86-android-tablets: use shared battery swnode group on Yoga Tab 2\n platform/x86: x86-android-tablets: drop redundant swnode group on YT3\n platform/x86: x86-android-tablets: add Crystal Cove GPIO swnode support\n platform/x86: x86-android-tablets: pass node group to gpio_secondary_fwnode_init()\n platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown\n platform/x86: x86-android-tablets: fix Arizona GPIO swnode references\n platform/x86/amd/pmf: fix build on !CONFIG_AMD_PMF_DEBUG\n platform/x86: asus-laptop: Fix ACPI event handling\n platform/x86: hp-wmi: Fix board_params typo for 8DD6 board\n" }, { "commit": "707662b40a82c96e416fe17f3c116a4d648f1fdb", "tree": "e56a1a637446a7cc8317eb2b8737df2325b35fa5", "parents": [ "35ef102063fd6f39e045e6d4e92ac04d3d29c0bf", "a19d4f9b8befdcfcd5a87bab91312fe64af3bbb8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:44:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:44:11 2026 -0700" }, "message": "Merge tag \u0027ata-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fix from Niklas Cassel:\n\n - Drop documentation for no longer existing pata_legacy kernel\n parameters (Ethan)\n\n* tag \u0027ata-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: pata_legacy: remove documentation for removed module parameters\n" }, { "commit": "35ef102063fd6f39e045e6d4e92ac04d3d29c0bf", "tree": "c983305e3d61e027ee05f9617e7490e0619cbfb3", "parents": [ "42f961c42b6b29532c7c75e028b4192ed333fbcb", "94b1a3ca9b8db3151f1416263704c159a9470da5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:38:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:38:44 2026 -0700" }, "message": "Merge tag \u0027block-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Fix the start and length check added to iov_iter_extract_bvecs(),\n which used iter_iov_addr()/iter_iov_len() helpers that aren\u0027t safe\n for the ITER_BVEC/FOLIOQ/etc iterator types passed\n\n - sunvdc fixes for an -EIO issue from lack of retries, and unmapping\n LDC cookies when the descriptor send fails\n\n - Clear force_abort in ublk_queue_reset_io_flags()\n\n - ublk selftest install fix\n\n* tag \u0027block-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n selftests: ublk: add batch IO cases to recover_03\n ublk: clear force_abort in ublk_queue_reset_io_flags()\n sunvdc: fix -EIO issue due to lack of retries\n sunvdc: unmap LDC cookies when the descriptor send fails\n block: Fix start and length check added to iov_iter_extract_bvecs()\n selftests: ublk: install test_common.sh and trace/ scripts\n" }, { "commit": "42f961c42b6b29532c7c75e028b4192ed333fbcb", "tree": "47d493c32786d9df7124b4dd5b470b566d1ef1a0", "parents": [ "3026c6e4f223bdded6448fefe53ff85d9cbe51bd", "47ccc3f1c615a46c25cbf7f3ae60df30b40eb2e6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:36:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:36:13 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix a deadlock in the write path with superblock freezing\n\n - Fix an issue where a provided buffer ring would overconsume when\n using MSG_TRUNC\n\n - Keep the CQE flags on iopoll requests when adding kbuf flags\n\n* tag \u0027io_uring-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/rw: keep CQE flags on iopoll requests when adding kbuf flags\n io_uring/net: don\u0027t overconsume buffers when using MSG_TRUNC\n io_uring/net: let io_recv_buf_select return the length of the buffer region\n io_uring/rw: end write accounting from -\u003eki_complete\n" }, { "commit": "3026c6e4f223bdded6448fefe53ff85d9cbe51bd", "tree": "c35e30a6111540b43cabfe93db95c13a925ead3e", "parents": [ "576da3462c991923ee4aed4bcc22d94531beb0dd", "4a724bcf5d703e18957397914d79156fa2cf1174" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 11:56:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 11:56:33 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab\n\nPull slab fixes from Vlastimil Babka:\n\n - Stable fix for an ABA issue causing slab list corruption introduced\n in 7.2 (Harry Yoo, with big thanks to Hyunwoo Kim for the thorough\n report and initial version of the fix)\n\n - Fix for 7.3 regression of kvfree_rcu() on PREEMPT_RT which can cause\n a deadlock from the set_cpus_allowed_force() caller (Vlastimil Babka)\n\n* tag \u0027slab-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab:\n mm/slab: take n-\u003elist_lock in __slab_try_return_freelist() to avoid race\n mm/slab: disallow kfree_rcu_sheaf() on PREEMPT_RT again\n" }, { "commit": "815e07c8fe885a87751c2496a30ae0dcd4118210", "tree": "ac96bc0eaeab706e445fd000af0c2cdbd59f6f9b", "parents": [ "ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Fri Sep 11 12:21:52 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:09:42 2026 -0400" }, "message": "ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()\n\nrb_wake_up_waiters() is a irq_work callback which is initialized with\ninit_irq_work(). As such it will be invoked in thread context on\nPREEMPT_RT. Invoking the callback in IRQ context on PREEMPT_RT is not an\noption due its usage of wake_up_all(). Since this callback may run in\nthread context, it needs to acquire ring_buffer_per_cpu::reader_lock with\ndisabling interrupts and may not assume that they are disabled.\n\nUse raw_spinlock_irqsave() to acquire ring_buffer_per_cpu::reader_lock.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260911102152.YEtwkBj9@linutronix.de\nFixes: 68282dd930ea3 (\"ring-buffer: Fix resetting of shortest_full\")\nReviewed-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80", "tree": "dbe60c2126eab4535128a9099e08a9092613b122", "parents": [ "7e645147dfba67edb3ed3090a1ed1d89df77fc27" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Sep 10 22:12:09 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:04:14 2026 -0400" }, "message": "tracing: Take trace_array reference when opening a tracer options file\n\nWhen a tracer option file is opened, it is passed a descriptor that points\nto an element on the trace_array\u0027s topts array. This element has\ninformation to find the trace array and other information. It uses this\nelement to take a reference of the trace_array so that the trace_array\ndoes not get removed while this file is opened.\n\nUnfortunately, there\u0027s a race condition where the element itself could be\nfreed by the removal of the instance the trace_array represents causing a\nuse-after-free as this element that is used to find the trace_array to\nincrement its reference counter is also freed when the instance is\nremoved.\n\nTo solve this, add a trace_array_tracer_options_get() helper function that\nwill take the address of the element that is passed to the open function\nby the inode-\u003ei_private pointer and search all the trace_arrays under a\nlock to find the one that the element\u0027s address is in the range of the\ntrace_arrays topts array elements. When a match happens, that trace_array\u0027s\nreference would be increased.\n\nNote, there\u0027s a race where if an admin was deleting and creating trace\ninstances at the same time and the memory of the old trace_array\u0027s array\nmatched the memory of the new trace_array that it could in theory open the\noption from the wrong trace array. But we do not care because it would be\nstupid to perform that kind of action. As long as the only thing that can\nhappen is that the option from the wrong trace array is used and doesn\u0027t\ncrash the kernel it will only make the user confused. But if they are\ndoing something stupid like this, they are already confused, so no harm\ndone.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260910221209.62dad8d3@robin\nFixes: 7e2cfbd2d3c86 (\"tracing: Have option files inc the trace array ref count\")\nReported-by: sashiko-bot@kernel.org\nCloses: https://lore.kernel.org/linux-trace-kernel/20260902121918.5a9e9d1b@gandalf.local.home/\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "7e645147dfba67edb3ed3090a1ed1d89df77fc27", "tree": "c42ce1ddedb7c7e222552aac71c8057dbac8cf2a", "parents": [ "911002e99e15f640f1fdc6d276206beaef59e790" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Wed Sep 09 08:29:17 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:04:05 2026 -0400" }, "message": "tracing: Fix ring_buffer_read_page_size() kernel-doc\n\nring_buffer_read_page_size() takes a parameter named rpage, but its\nkernel-doc describes page. As a result, kernel-doc reports rpage as\nundescribed and page as an excess parameter description.\n\nRename the documentation entry to match the function.\n\nLink: https://patch.msgid.link/20260909062917.89482-1-kmehltretter@gmail.com\nFixes: dae8dda341d2 (\"tracing: Fix subbuf resize races with trace_pipe_raw readers\")\nAssisted-by: LLM\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "911002e99e15f640f1fdc6d276206beaef59e790", "tree": "c0b5bf1b5038b529e8252af8cd36f7a400a6a074", "parents": [ "7f711e62355bb3123a2ca2f97a2facbfebc678c6" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Tue Sep 08 08:22:15 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:01:46 2026 -0400" }, "message": "tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event()\n\nWhile ftrace_set_clr_event() modifies its input buffer during parsing,\nbefore returning to the caller the buffer is supposed to be restored\nto its original state.\n\nThis works correctly for the colon between the subsystem and event\nbut not the colon at the beginning of :mod:.\n\nRestore the colon, so the :mod: trailer is not stripped after\nftrace_set_clr_event().\n\nCc: stable@vger.kernel.org\nFixes: 4c86bc531e60 (\"tracing: Add :mod: command to enabled module events\")\nLink: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-1-05396a3fb663@linutronix.de\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "7f711e62355bb3123a2ca2f97a2facbfebc678c6", "tree": "8161b2c6319259dcf8878ebd9a84661fcbdc551e", "parents": [ "a5e70ba87ca8ebc79b4e63de302d03b0625fe153" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Tue Sep 08 00:50:45 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:01:36 2026 -0400" }, "message": "tracing: Fix memory corruption from a \"STACKTRACE\" histogram key\n\n\"cpu\", \"CPU\", \"stacktrace\" and \"STACKTRACE\" are generic fields, defined\nwith an offset and a size of zero so that the filter code can match them\nby name. parse_field() maps them onto their common_* equivalents for\nbackward compatibility, but unlike the common_* names it hands the\nplaceholder back to the caller instead of NULL.\n\ncreate_hist_field() takes a non-NULL field as a promise that the record\ncarries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc\nword is read from offset 0, that is from common_type, and its low 16\nbits are followed as an offset into the record. What is found there\nbecomes the length of an unbounded memcpy. Pick an event whose id is\nsmall enough that the offset stays inside its own record and the length\nis a kernel text address:\n\n # cd /sys/kernel/tracing\n # echo \u0027hist:keys\u003dSTACKTRACE\u0027 \u003e events/ftrace/print/trigger\n # echo hello \u003e trace_marker\n\n Oops: general protection fault, probably for non-canonical address\n RIP: 0010:rb_next+0x23/0x60\n \u003c/IRQ\u003e\n RIP: 0010:memcpy+0xc/0x30\n event_hist_trigger+0x2e7/0x12c0\n Kernel panic - not syncing: Fatal exception in interrupt\n\nLeave the field NULL, which is what the comment above the branch says\nthe code does and what common_stacktrace already does. FILTER_CPU and\nFILTER_COMM are left alone, their create_hist_field() branches never\nlook at the field.\n\nCc: stable@vger.kernel.org\nFixes: 4b512860bdbd (\"tracing: Rename stacktrace field to common_stacktrace\")\nLink: https://patch.msgid.link/20260907155045.692664-3-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "a5e70ba87ca8ebc79b4e63de302d03b0625fe153", "tree": "0e9a30779eba14f0efe0c06b30c27203006cbf3a", "parents": [ "92383cef66791a0c63a2f27755cadbdb2fbf270b" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Tue Sep 08 00:50:44 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:01:16 2026 -0400" }, "message": "tracing: Fix memory corruption from the histogram stacktrace modifier\n\nparse_field() sets HIST_FIELD_FL_STACKTRACE from the \".stacktrace\"\nmodifier before it looks the field name up, and nothing afterwards\nchecks that the name resolved to a field which holds a stacktrace.\ncreate_hist_field() picks HIST_FIELD_FN_STACK on the strength of the\nfield pointer alone, which reads a __data_loc word from the record and\nfollows its low 16 bits as an offset into the same record.\nevent_hist_trigger() takes the first word there as an entry count and\ncopies that many longs into a 31 entry array:\n\n\tn_entries \u003d *stack;\n\tmemcpy(entries, ++stack, n_entries * sizeof(unsigned long));\n\nNeither end of that copy is bounded, and the count is whatever the event\nholds at the offset, so any field will do:\n\n # cd /sys/kernel/tracing/events/sched/sched_process_fork\n # echo \u0027hist:keys\u003dparent_pid.stacktrace\u0027 \u003e trigger\n # (true)\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n RIP: 0010:rb_insert_color+0x18/0x130\n timerqueue_linked_add+0x7e/0xd0\n enqueue_hrtimer+0x39/0xb0\n __hrtimer_run_queues+0x10f/0x1f0\n \u003c/IRQ\u003e\n RIP: 0010:memcpy+0xc/0x30\n event_hist_trigger+0x165/0x690\n\nThe timer interrupt landed on the rbtree the copy had already run over.\nNo debug options are needed for this; KASAN reports the same write as an\nout-of-bounds read of 13835058055416381440 bytes.\n\nDocumentation/trace/histogram.rst already states the rule, \"must be a\nlong[] type\", so enforce it once the name has been resolved. Names which\nresolve to no field at all, \"hitcount.stacktrace\" and the common_*\npseudo-fields, are refused for the same reason: they hold no stacktrace\nto read.\n\nCc: stable@vger.kernel.org\nFixes: cc5fc8bfc961 (\"tracing/histogram: Add stacktrace type\")\nLink: https://patch.msgid.link/20260907155045.692664-2-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "92383cef66791a0c63a2f27755cadbdb2fbf270b", "tree": "636c923c516b32ef81fe8f88f69faf042bb5c389", "parents": [ "0fe23b8eaba0d3372c66b7b31204408da0715edc" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 07 21:44:20 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:00:41 2026 -0400" }, "message": "tracing: Undo the registration when enabling the histogram trigger fails\n\nCommit 6f86bdeab633 (\"tracing: Fix bad hist from corrupting named_triggers\nlist\") described how a trigger that is registered but not on file-\u003etriggers\nends up freed while still on the global named_triggers list, and moved the\nregistration down so that hist_trigger_enable() follows it immediately. One\npath still gets there. hist_trigger_enable() adds the trigger and takes it\nstraight back out when the event cannot be enabled:\n\n\tlist_add_tail_rcu(\u0026data-\u003elist, \u0026file-\u003etriggers);\n\n\tupdate_cond_flag(file);\n\n\tif (trace_event_trigger_enable_disable(file, 1) \u003c 0) {\n\t\tlist_del_rcu(\u0026data-\u003elist);\n\t\tupdate_cond_flag(file);\n\t\tret--;\n\t}\n\nso the list walk in hist_unregister_trigger() matches nothing, test stays\nNULL, and the -\u003efree() that would call del_named_trigger() is skipped.\nout_unreg falls through to out_free, which frees the trigger anyway:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff8880091d3160 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0xa00\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 69:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nLeave the trigger where hist_unregister_trigger() can find it and let that\nundo the registration, which is the only code that knows all of what\ncmd_ops-\u003einit() took: the named list entry, the hist_pad reference, the\nreference on the trigger a named histogram is shared with, and the copied\ncmd_ops. It also pairs the failed trace_event_trigger_enable_disable(),\nwhose sm_ref and buffered event reference are otherwise left behind.\n\nSince -\u003efree() releases trigger_data and, for a trigger that does not share\nits histogram, hist_data with it, out_unreg can no longer fall through to\nout_free. For a trigger that does share, hist_register_trigger() has\nalready destroyed the caller\u0027s hist_data, so the fall-through was reading\nfreed memory there as well.\n\nMove the enable_timestamps check in hist_unregister_trigger() above the\n-\u003efree() call for the same reason: hist_data does not outlive it once the\ntrigger being removed is the one that owns it.\n\nCc: stable@vger.kernel.org\nFixes: 067fe038e70f (\"tracing: Add variable reference handling to hist triggers\")\nReported-by: Sashiko AI \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00A3D@smtp.kernel.org/\nLink: https://patch.msgid.link/20260907124420.607097-3-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "0fe23b8eaba0d3372c66b7b31204408da0715edc", "tree": "ff77d24576facb7232f1aee97ec63bf236cc7137", "parents": [ "6ede78d0563a2a3ae3e46f9c07cedb5d79645429" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 07 21:44:19 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 14:00:32 2026 -0400" }, "message": "tracing: Take the reference before publishing the named histogram trigger\n\nevent_hist_trigger_named_init() puts the trigger on the global\nnamed_triggers list and only then takes the reference on the trigger it\nshares its histogram with:\n\n\tdata-\u003eref++;\n\n\tsave_named_trigger(data-\u003enamed_data-\u003ename, data);\n\n\tret \u003d event_hist_trigger_init(data-\u003enamed_data);\n\tif (ret \u003c 0) {\n\t\tkfree(data-\u003ecmd_ops);\n\t\tdata-\u003ecmd_ops \u003d \u0026trigger_hist_cmd;\n\t}\n\n\treturn ret;\n\nevent_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and\nnothing takes the trigger back off the list on the way out.\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the\nfreed object:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff888009346860 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0xa00\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 67:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nDo the reference first and publish once it has succeeded, so that nothing\nwhich can fail runs after the trigger becomes findable.\n\nCc: stable@vger.kernel.org\nFixes: 7ab0fc61ce73 (\"tracing: Move histogram trigger variables from stack to per CPU structure\")\nReported-by: Sashiko AI \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00A3D@smtp.kernel.org/\nLink: https://patch.msgid.link/20260907124420.607097-2-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAcked-by: Tom Zanussi \u003czanussi@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "6ede78d0563a2a3ae3e46f9c07cedb5d79645429", "tree": "048d2840572376578436ca9f37c131038da8276d", "parents": [ "0999d3e16d13b6299fd7cc7a7fb2825c18e90dd0" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 07 18:14:15 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:54:36 2026 -0400" }, "message": "tracing: Set the trace clock before registering the histogram trigger\n\nhist_register_trigger() puts the trigger on the global named_triggers\nlist in cmd_ops-\u003einit(), and only then sets the trace clock:\n\n\tif (data-\u003ecmd_ops-\u003einit) {\n\t\tret \u003d data-\u003ecmd_ops-\u003einit(data);\n\t\tif (ret \u003c 0)\n\t\t\tgoto out;\n\t}\n\n\tif (hist_data-\u003eenable_timestamps) {\n\t\tret \u003d tracing_set_clock(file-\u003etr, hist_data-\u003eattrs-\u003eclock);\n\t\tif (ret) {\n\t\t\thist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));\n\t\t\tgoto out;\n\t\t}\n\nThe clock string is not checked anywhere before that call, so a named\ntrigger using common_timestamp with an unknown clock fails after it has\nalready become findable. event_hist_trigger_parse() then frees it\nwithout taking it off the list, and the next lookup by name reads the\nfreed object:\n\n ~# cd /sys/kernel/tracing/events/sched/sched_switch\n ~# echo \u0027hist:name\u003dfoo:keys\u003dcommon_pid:ts\u003dcommon_timestamp:clock\u003dbogus\u0027 \u003e trigger\n bash: echo: write error: Invalid argument\n ~# echo \u0027hist:name\u003dfoo:keys\u003dcommon_pid\u0027 \u003e trigger\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff88800915d760 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0x900\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 63:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nSet the clock before the trigger is registered, so that nothing which\ncan fail runs after it is published, the way commit 6f86bdeab633\n(\"tracing: Fix bad hist from corrupting named_triggers list\") moved the\nregistration below the rest of the setup.\n\ntracing_set_filter_buffering() is reference counted, so the init failure\npath has to drop the reference that the clock block now takes first.\n\nCc: stable@vger.kernel.org\nFixes: a4072fe85ba3 (\"tracing: Add a clock attribute for hist triggers\")\nLink: https://patch.msgid.link/20260907091415.554535-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "0999d3e16d13b6299fd7cc7a7fb2825c18e90dd0", "tree": "e51bb3d0a38e46ac316adb94745e186dcd6db6a1", "parents": [ "89b000ba0796593aa61f6eec24d369337594588b" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Mon Sep 07 12:26:07 2026 +0530" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:54:32 2026 -0400" }, "message": "tracing: Fix typo \"preceeded\" in comment\n\nCorrect \"preceeded\" to \"Preceded\", reported by scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Only touches comments, no\ncode changes.\n\nLink: https://patch.msgid.link/20260907065607.36615-1-hemanth.selam@gmail.com\nAssisted-by: Cursor:claude-opus-5\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "89b000ba0796593aa61f6eec24d369337594588b", "tree": "52cabf363a3aa92ef6e4aac2f7130b85394182ba", "parents": [ "3d617bfd79330ae3acf94862c18bb3ccf5f5a0f9" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Mon Sep 07 11:56:08 2026 +0530" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:54:14 2026 -0400" }, "message": "tracing: Fix typo \"availabe\" in comment\n\nCorrect \"availabe\" to \"available\", reported by scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Only touches comments, no\ncode changes.\n\nLink: https://patch.msgid.link/20260907062608.13924-1-hemanth.selam@gmail.com\nAssisted-by: Cursor:claude-opus-5\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "3d617bfd79330ae3acf94862c18bb3ccf5f5a0f9", "tree": "ec60e023581a02f12a65ff46c8ec87eb22a0d23a", "parents": [ "06f5634ec5584954177f9a22e36b3bfb398a971b" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 07 14:21:13 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:48:32 2026 -0400" }, "message": "tracing: Let histogram values keep the percent and graph modifiers\n\nThe .percent and .graph modifiers exist only for histogram values, but a\nvalue carrying either of them has been rejected since v6.3. The example\nin Documentation/trace/histogram.rst,\n\n # echo \u0027hist:keys\u003dprev_comm:vals\u003dhitcount.percent:nohitcount\u0027 \u003e \\\n\t events/sched/sched_switch/trigger\n\nreturns -EINVAL.\n\nparse_field() sets the two flags only when the field is neither a key nor\na variable, that is, only on a value:\n\n\t} else if (strncmp(modifier, \"percent\", 7) \u003d\u003d 0) {\n\t\tif (*flags \u0026 (HIST_FIELD_FL_VAR | HIST_FIELD_FL_KEY))\n\t\t\tgoto error;\n\t\t*flags |\u003d HIST_FIELD_FL_PERCENT;\n\n__create_val_field() then rejects a value for carrying them, so no field\ncan reach hist_trigger_print_val(), where both are implemented.\n\ncommit e0213434fe3e (\"tracing: Do not let histogram values have some\nmodifiers\") added the check after a value with .buckets oopsed in\nhist_field_name(). That happens because .buckets and .log2 make\ncreate_hist_field() build a nested field in operands[0] which\nhist_field_name() then walks into. The percent and graph flags do not\ncreate an operand and are not read by hist_field_name(); they are only\nused when printing a value.\n\nStop rejecting the two flags on a value. The check for variables is left\nalone, where they are unreachable anyway because parse_field() rejects a\nvariable carrying them first.\n\nWith the two flags removed, the trigger above installs and prints as\ndocumented:\n\n { prev_comm: rcu_preempt } hitcount (%): 0.00\n { prev_comm: init } hitcount (%): 99.98\n Totals:\n Hits: 237896\n\nCc: stable@vger.kernel.org\nFixes: e0213434fe3e (\"tracing: Do not let histogram values have some modifiers\")\nLink: https://patch.msgid.link/20260907052113.430818-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "06f5634ec5584954177f9a22e36b3bfb398a971b", "tree": "10a854703d1718e798c556ad5082e96cfb7d02ad", "parents": [ "230234d12ce42ab04132a32c3a848f07a5d27a71" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 07 15:03:23 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:47:42 2026 -0400" }, "message": "tracing: Keep the entry count when the histogram stats allocation fails\n\nprint_entries() uses n_entries both as the number of sort entries and as\nits own return value, so the -ENOMEM it stores when the stats allocation\nfails overwrites the count that the cleanup still needs:\n\n\tn_entries \u003d tracing_map_sort_entries(map, ...);\n\tif (n_entries \u003c 0)\n\t\treturn n_entries;\n\t...\n\t\t\tif (!stats) {\n\t\t\t\tn_entries \u003d -ENOMEM;\n\t\t\t\tgoto out;\n\t\t\t}\n\t...\n out:\n\ttracing_map_destroy_sort_entries(sort_entries, n_entries);\n\ntracing_map_destroy_sort_entries() takes an unsigned int and loops up to\nit, so -ENOMEM arrives as 4294967284. It walks an array of at most\nmap-\u003emax_elts pointers and calls destroy_sort_entry(), which dereferences\nand frees, on whatever lies past the end.\n\nReading the hist file of a trigger with a .percent value, with that\nallocation forced to fail:\n\n BUG: KASAN: vmalloc-out-of-bounds in tracing_map_destroy_sort_entries+0xa0/0xb0\n Read of size 8 at addr ffffc90000045000 by task init/1\n tracing_map_destroy_sort_entries+0xa0/0xb0\n hist_show+0x6f7/0x1df0\n seq_read_iter+0x2b8/0x1190\n vfs_read+0x176/0xa40\n The buggy address belongs to a 4-page vmalloc region starting at\n ffffc90000041000 allocated at tracing_map_sort_entries+0x5c/0xd50\n\nA few pages further the fault is fatal. The registers at the oops confirm\nthe bound: the loop\u0027s end pointer less the array start, over the pointer\nsize, is 4294967284.\n\nReturn the error in a separate variable and leave n_entries holding the\ncount, the way tracing_map_sort_entries() does on its own error path.\n\nThe stats block is only entered for a value carrying .percent or .graph,\nwhich __create_val_field() has rejected since v6.3, so this cannot be\nreached in mainline as it stands. It becomes reachable again with\n\"tracing: hist: let values keep the percent and graph modifiers\", so it\nshould be applied first.\n\nCc: stable@vger.kernel.org\nFixes: abaa5258ce5e (\"tracing: Add .percent suffix option to histogram values\")\nLink: https://patch.msgid.link/20260907060323.480728-1-donggeunyoo.kernel@gmail.com\nReported-by: sashiko-bot@kernel.org\nCloses: https://lore.kernel.org/all/20260907053113.1CED91F00A3A@smtp.kernel.org/\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "230234d12ce42ab04132a32c3a848f07a5d27a71", "tree": "5b50ad03f137f7868eb13279879516e28caf9486", "parents": [ "516001d53e6b2ea95a251ee2ef54a1a689a3fd58" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Mon Sep 07 12:49:48 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:46:40 2026 -0400" }, "message": "tracing: Free histogram the field rejected for a bad modifier\n\nWriting a hist trigger whose value or variable carries a modifier that is\nnot allowed there leaks the fields that were built for it.\n\n__create_val_field() takes the field from parse_expr() and stores it in\nhist_data-\u003efields[] only after the modifier checks have run:\n\n\thist_field \u003d parse_expr(hist_data, file, field_str, flags, var_name,\n\t\t\t\t\u0026n_subexprs);\n\t...\n\tif (hist_field-\u003eflags \u0026 HIST_FIELD_FL_VAR) {\n\t\tif (hist_field-\u003eflags \u0026 (...))\n\t\t\tgoto err;\n\t} else {\n\t\tif (hist_field-\u003eflags \u0026 (...))\n\t\t\tgoto err;\n\t}\n\n\thist_data-\u003efields[val_idx] \u003d hist_field;\n\nBoth checks jump past that store, and the err label returns without\nfreeing anything. The error unwinds to create_hist_data(), which calls\ndestroy_hist_data() -\u003e destroy_hist_fields(), and that reaches a field\nonly by walking fields[]. A field that never got there is unreachable.\n\ncommit e0213434fe3e (\"tracing: Do not let histogram values have some\nmodifiers\") set ret to -EINVAL and fell through to the store, which left\nthe field owned by fields[] and freed along with the rest of hist_data.\nSplitting the check into a value case and a variable case replaced that\nfall-through with a goto that skips it.\n\nWith CONFIG_DEBUG_KMEMLEAK, 200 writes of\n\n # echo \u0027hist:keys\u003dprev_pid:vals\u003dnext_pid.log2\u0027 \u003e \\\n\t events/sched/sched_switch/trigger\n\neach correctly rejected with -EINVAL, leave 332 unreferenced objects\n(63744 bytes) reported at create_hist_field(); 200 install and remove\ncycles of a valid trigger leave none. A \u0027.log2\u0027 field is two\nallocations, since create_hist_field() puts the plain field in\noperands[0] of the log2 field, and both are reported.\n\nUse destroy_hist_field() rather than __destroy_hist_field() so that\noperands[0] is freed as well. It returns early for HIST_FIELD_FL_VAR_REF,\nwhich is what an operand owned by hist_data-\u003evar_refs[] needs; the\nrejected field itself is never a var ref, because a var ref never carries\na modifier flag.\n\nCc: stable@vger.kernel.org\nFixes: e30fbc618e97 (\"tracing/histograms: Allow variables to have some modifiers\")\nLink: https://patch.msgid.link/20260907034948.240387-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "516001d53e6b2ea95a251ee2ef54a1a689a3fd58", "tree": "aee916bbc5fa96c0d55d344bb09de431f5bb11ef", "parents": [ "4bddcb346a6cf4615ca77f69a589623b877ca267" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Sun Sep 06 22:33:52 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:46:34 2026 -0400" }, "message": "tracing: Free histogram the var ref when its initialization fails\n\ncreate_var_ref() allocates a VAR_REF hist_field and then calls\ninit_var_ref() to fill it in. When that fails the field is leaked.\n\ncommit 656fe2ba85e8 (\"tracing: Use hist trigger\u0027s var_ref array to destroy\nvar_refs\") made destroy_hist_field() return early for\nHIST_FIELD_FL_VAR_REF, since var refs are freed by walking the trigger\u0027s\nvar_refs[] array instead. create_var_ref() adds the field to that array\nonly after init_var_ref() has succeeded, so on this path the field is in\nneither place and nothing frees it. The call was correct when it was\nwritten, before var refs were taken out of destroy_hist_field().\n\ninit_var_ref() cannot free it either. The caller owns the field, so\ninit_var_ref() undoes only its own string allocations and leaves the\nfield alone. Freeing it there would leave create_var_ref() passing freed\nmemory to destroy_hist_field(), which reads its flags.\n\nCall __destroy_hist_field(), which frees the field without consulting\nthe flag.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260906133352.3815019-1-donggeunyoo.kernel@gmail.com\nFixes: 656fe2ba85e8 (\"tracing: Use hist trigger\u0027s var_ref array to destroy var_refs\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "4bddcb346a6cf4615ca77f69a589623b877ca267", "tree": "b2eec68341d0bbccc299a86edb36ec60329b98d3", "parents": [ "0701995aaf8fc2281154db829ca85e231951e51d" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Sun Sep 06 21:40:25 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:46:03 2026 -0400" }, "message": "tracing: Free histogram var refs regardless of how often they are referenced\n\nUsing the same variable three or more times in one hist trigger leaks the\nvariable reference and its strings when the trigger is removed.\n\ncommit 656fe2ba85e8 (\"tracing: Use hist trigger\u0027s var_ref array to destroy\nvar_refs\") made a trigger\u0027s var_refs[] array the only owner of a var ref:\ndestroy_hist_field() returns early for HIST_FIELD_FL_VAR_REF, so the field\nexpressions never destroy one. One entry, freed once, no count needed.\n\ncommit 8bcebc77e85f (\"tracing: Fix histogram code when expression has same\nvar as value\") then made repeated references share one object and added a\ncount of them. Only the increment side exists, since those expressions\nstill return early and never drop a reference, so __destroy_hist_field()\nsees how many references were created rather than how many are left. It\nfrees when the decremented count is 0 or 1, so two references work and\nthree or more leak.\n\nSharing kept one array entry per object, and create_var_ref() searches and\nappends within a single trigger, so nothing outside it holds the object.\nRemoving a trigger whose variables are still referenced is already refused\nby check_var_refs() with -EBUSY. Drop the count and free unconditionally.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260906124025.3550596-1-donggeunyoo.kernel@gmail.com\nFixes: 8bcebc77e85f (\"tracing: Fix histogram code when expression has same var as value\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "0701995aaf8fc2281154db829ca85e231951e51d", "tree": "dcb371a00e2da72dd123511f981e595e45eed76e", "parents": [ "b22845487096247f5370c412376a472304627847" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Sun Sep 06 12:44:06 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:39:08 2026 -0400" }, "message": "function_graph: Use the saved entry\u0027s size when reprinting it\n\nWhen a graph entry does not fit in the trace_seq, print_graph_entry()\nsaves it in the iterator\u0027s fgraph_data and reprints it on the next read.\nThe entry has already been consumed from the ring buffer by then, so the\ncopy is all that is left of it.\n\nThe copy is sized with iter-\u003eent_size, which no longer describes the\nsaved entry but whatever entry the iterator has moved on to. The\nargument count is derived from the same field, so a 72 byte entry saved\nand then reprinted ahead of a 48 byte return entry loses its arguments.\n\nRecord the size next to the failure flag, so that the two are always set\ntogether, and restore it before reprinting.\n\nCc: stable@vger.kernel.org\nFixes: ff5c9c576e75 (\"ftrace: Add support for function argument to graph tracer\")\nLink: https://patch.msgid.link/20260906034406.1335316-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b22845487096247f5370c412376a472304627847", "tree": "607d789d8f28e0e821f5fd0fe889e2ea9a66c013", "parents": [ "08cacffeef8f64f1a222c93467ca84f24a46c953" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Sun Sep 06 06:19:22 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:37:50 2026 -0400" }, "message": "fgraph: Remove unused FGRAPH_MAX_INDEX\n\nFGRAPH_MAX_INDEX has no user, and it expands to FGRAPH_INDEX_SIZE and\nFGRAPH_RET_INDEX, neither of which is defined anywhere in the tree. It\nwas added in that form by commit 91c46b0aa917 (\"function_graph:\nImplement fgraph_reserve_data() and fgraph_retrieve_data()\"), which\nintroduced the current data word layout under new names, so anything\nreferencing it would have failed to build ever since.\n\nRemove it.\n\nLink: https://patch.msgid.link/20260905211922.1196366-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "08cacffeef8f64f1a222c93467ca84f24a46c953", "tree": "c9f3e4888b06c3cca6f52c76030b429aa52e680e", "parents": [ "2deb753127d7b7035e893955c5e91875e767d1f8" ], "author": { "name": "Jérémy Jean", "email": "Jeremy.Jean@oss.cyber.gouv.fr", "time": "Sat Aug 22 19:53:22 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:33:54 2026 -0400" }, "message": "ftrace: fork: Initialize function graph state before copy_exec_state()\n\ndup_task_struct() copies the parent\u0027s task_struct, including ret_stack.\nftrace_graph_init_task() clears the copied function graph state, but it\ncurrently runs after copy_exec_state().\n\nFor non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state.\nIf that allocation fails, copy_process() reaches bad_fork_free and\nfree_task() calls ftrace_graph_exit_task(). Since the child still carries\nthe parent\u0027s ret_stack pointer, the unwind frees the parent\u0027s active\nfunction graph return stack. The parent subsequently accesses freed memory\nfrom function_graph_enter_regs().\n\nKASAN reports:\n\n[ 22.190920] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76/0xb90\n[ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1\n[ 22.205134]\n[ 22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy)\n[ 22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 22.213750] Call Trace:\n[ 22.215271] \u003cTASK\u003e\n[ 22.216242] ? ftrace_stub_direct_tramp+0x10/0x10\n[ 22.217774] dump_stack_lvl+0x4e/0x70\n[ 22.220531] print_report+0x157/0x4b4\n[ 22.223202] ? fixup_red_left+0x9/0x30\n[ 22.224407] ? complete_report_info+0x83/0x110\n[ 22.226679] ? function_graph_enter_regs+0xa76/0xb90\n[ 22.228084] kasan_report+0xce/0x100\n[ 22.230109] ? function_graph_enter_regs+0xa76/0xb90\n[ 22.232860] ? stack_trace_save+0x4/0xd0\n[ 22.234156] function_graph_enter_regs+0xa76/0xb90\n[ 22.236090] ? kasan_save_stack+0x30/0x50\n[ 22.237752] ? __pfx_function_graph_enter_regs+0x10/0x10\n[ 22.238694] ? ring_buffer_lock_reserve+0x345/0xf80\n[ 22.239628] ? stack_trace_save+0x4/0xd0\n[ 22.242121] ? stack_trace_save+0x4/0xd0\n[ 22.243588] ftrace_graph_func+0xda/0x160\n[ 22.245362] ? ftrace_stub_direct_tramp+0x10/0x10\n[ 22.246520] 0xffffffffa0000095\n[ 22.250528] ? stack_trace_save+0x9/0xd0\n[ 22.251757] ? ring_buffer_unlock_commit+0x11d/0x5c0\n[ 22.253152] stack_trace_save+0x9/0xd0\n[ 22.254264] kasan_save_stack+0x30/0x50\n[ 22.273631] kasan_save_track+0x14/0x30\n[ 22.276763] kasan_save_free_info+0x3b/0x70\n[ 22.278296] __kasan_slab_free+0x43/0x70\n[ 22.280157] kmem_cache_free+0xbf/0x3b0\n[ 22.282963] ? ftrace_stub_direct_tramp+0x10/0x10\n[ 22.284001] free_task+0xa2/0x160\n[ 22.285699] ? ftrace_stub_direct_tramp+0x10/0x10\n[ 22.286752] copy_process+0x2aae/0x7bc0\n\nInitialize the child function graph state immediately after\ndup_task_struct(), before the first fallible operation.\n\nCc: stable@vger.kernel.org\nFixes: 6b1c66c9cca9 (\"exec_state: relocate dumpable information\")\nReviewed-by: Bradley Morgan \u003cinclude@grrlz.net\u003e\nLink: https://patch.msgid.link/20260822195321.962383-2-Jeremy.Jean@oss.cyber.gouv.fr\nAssisted-by: Codex:gpt-5\nSigned-off-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "2deb753127d7b7035e893955c5e91875e767d1f8", "tree": "ba127086f5232648327efe1838d96d9ece1196c1", "parents": [ "df2908090cda368b01ff43709f51890076c56157" ], "author": { "name": "Henry Martin", "email": "bsdhenrymartin@gmail.com", "time": "Fri Sep 04 19:52:23 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 11 13:30:15 2026 -0400" }, "message": "tracing/user_events: Don\u0027t destroy fields when event removal fails\n\ndestroy_user_event() destroys the event\u0027s fields before attempting to\nremove the trace event call. If user_event_set_call_visible() fails,\ne.g. because the event is still enabled and trace_remove_event_call()\nreturns -EBUSY, the event is left registered with an irreversibly\ndestroyed field list. Any subsequent interaction with the event then\noperates on an empty field list while it is still fully visible in\ntracefs.\n\nMove the field destruction after the call removal, and splice the\nfield list back onto the event when the removal fails so the event\nremains in a consistent state.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260904115223.2976446-1-bsdhenrymartin@gmail.com\nFixes: 7f5a08c79df35 (\"user_events: Add minimal support for trace_event into ftrace\")\nSigned-off-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nReviewed-by: Beau Belgrave \u003cbeaub@linux.microsoft.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "576da3462c991923ee4aed4bcc22d94531beb0dd", "tree": "74eaded2954ec9736a953ad58d765a87e7a89f21", "parents": [ "d5d6c9d244c6d447c356df70d5c754b145dccd5c", "e10f2b7e28be3e1ce42a4be8fa9b0684d1d354ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 10:00:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 10:00:07 2026 -0700" }, "message": "Merge tag \u0027sound-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of device-specific small fixes. At this time, the\n majority of changes are about ASoC while we have usual suspects like\n HD- and USB-audio quirks. Some highlights below.\n\n ASoC Intel / SoundWire:\n - Fix bus and stream resource leaks at error path in avs and hda-ext\n - More fixes and refactoring in avs for constraining MSBs, async\n handling D0ix\n - Add support for TAC5xx2 SoundWire family and NVL MAX98360A RT5682\n machines\n - Fix uninitialized stream configurations in Realtek SoundWire codecs\n - Adjust latency control to fix no-sound issue on RT721-SDCA\n\n ASoC AMD:\n - Avoid binding for the acp-da7219-max98357a machine driver\n - Add quirks for Acer Nitro AN17-41 and HP 255R G10\n - Fix memory leaks in ACP6x\n\n ASoC Codecs \u0026 Platforms:\n - Fixes for cs35l56 to avoid deadlock, kexec race, and runtime PM\n imbalances\n - Split stereo streams across mono amps on tas2783-sdw\n - Fix pop noise on es8326 and enable_count underflow on es8389\n - Various fixes for fsl_micfil, sprd, sti, and publish OF module\n aliases\n - Fixes \u0026 cleanups for Ux500 (MSP/I2S) and AB8500 codecs\n\n HD-audio:\n - Fix for channel status notification changes\n - Quirks for HP laptops\n\n USB-audio:\n - Fix embedded URBs in caiaq, 6fire, hiface, and ua101 drivers\n - More hardening in usx2y and us122l drivers\n - Quirks for Behringer devices\n\n Misc:\n - Add PCI ID for RME HDSPe AIO PCI Express audio card in hdspm\n - Fix S/PDIF passthrough on CA20K2 in ctxfi\"\n\n* tag \u0027sound-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (65 commits)\n ALSA: hdspm: Add a new PCI device ID (1d18:3fc6) for RME HDSPe AIO PCI express audio\n ASoC: amd: acp-da7219-max98357a: don\u0027t bind on Raven/Picasso boards\n ALSA: hda: Report a change when only the channel status bytes move\n ALSA: us122l: Prevent write upgrades for read mappings\n ALSA: hda/realtek: Add quirk for HP Elite Dragonfly Max G2 speaker\n ASoC: cs35l56: Fix race between kexec and snd_soc_register_component()\n ASoC: amd: yc: add quirk for Acer Nitro AN17-41 internal mic\n ASoC: mt6351: Publish the OF module alias\n ASoC: Intel: SST: Publish the PCI module aliases\n ASoC: bcm: bcm63xx: Publish the OF module aliases\n ALSA: usb-audio: Add quirk flags for Behringer UV1\n ALSA: usb-audio: Add boot quirk for Behringer CM1A\n ALSA: hda/realtek: Add quirk for HP Omen 16-wd0xxx mute LED\n ALSA: usbusx2y: validate URB actual_length in interrupt callback\n ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf\n ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough\n ALSA: usb: 6fire: Avoid embedded URBs\n ALSA: usb: hiface: Avoid embedded URBs\n ALSA: usb: ua101: Avoid embedded URBs\n ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev\n ...\n" }, { "commit": "d5d6c9d244c6d447c356df70d5c754b145dccd5c", "tree": "13cb9d05392a26f296b3a04dbe4e8753086880f7", "parents": [ "08df884136f1c1197bab2a27814404fd329d9aac", "37bef2170d4c88fc3d708eecf3ef0f4032bc1372" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 09:49:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 09:49:40 2026 -0700" }, "message": "Merge tag \u0027media/v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fixes from Mauro Carvalho Chehab:\n \"Core:\n - add bounded tile-count helpers for HEVC stateless decoders\n - validate AV1 tile counts fits in array size\n - validate HEVC tile counts fits in array size\n - fix memcmp() size in B1 reference list comparison\n\n mediatek:\n - bound AV1 tile-start copy to fit in array size\n\n rockchip:\n - reject AV1 frames exceeding the tile size\n - guard VPU981 AV1 divisor and tile buffer\n\n hantro and rkvdec:\n - bound G2 HEVC tile loops and PPS id to the buffer size\n\n rppx1:\n - read the raw pattern from the PRE2 acquisition module\n - describe the MAIN_POST white balance gains block\"\n\n* tag \u0027media/v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity\n media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity\n media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer\n media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity\n media: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n media: hevc: add bounded tile-count helpers\n media: v4l2-ctrls: validate AV1 tile counts\n media: v4l2-ctrls: validate HEVC tile counts\n media: v4l2-h264: Fix memcmp() size in B1 reference list comparison\n media: rppx1: bls: read the raw pattern from the PRE2 acquisition module\n media: rppx1: describe the MAIN_POST white balance gains block\n" }, { "commit": "b63c3c26726576e2a87baeee80bc202a5a43c9e5", "tree": "72cbbe2c310da35c855276a4ba8fc6725a7718c8", "parents": [ "80a4e3ad8daba66915a9bdf0fcae5831cc8dbd5f" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:53 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:22 2026 +0200" }, "message": "iommu/amd: Remove unused macro\n\nRemove unsed device range capability related macros.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "80a4e3ad8daba66915a9bdf0fcae5831cc8dbd5f", "tree": "eaeb8ff2b9618753e64686fe3bcbd6fcf7074de8", "parents": [ "5e1afd4ea1d6a9bbaecf3e28707dac9c8b56bd45" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:52 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:22 2026 +0200" }, "message": "iommu/amd: Remove redundant checks from interrupt handler path\n\nPPR and GAlog interrupt is enabled only if buffer is allocated.\n(See amd_iommu_enable_ppr_log() and iommu_ga_log_enable()).\n\nThe duplicate check in interrupt hanlder path is unnecessary\nand can be removed.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "5e1afd4ea1d6a9bbaecf3e28707dac9c8b56bd45", "tree": "8093ca8ebf3feaff5b72fe083c5beb95e55aa410", "parents": [ "798514a25544d6978d0bd7fe7071c9bdb5503076" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:51 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:21 2026 +0200" }, "message": "iommu/amd: Remove redundant check in irq_remapping_select()\n\nThe amd_iommu_irq_remap flag is already validated during irq remapping\ndomain creation (before calling amd_iommu_create_irq_domain()). The\nduplicate check in irq_remapping_select() is unnecessary and can be\nremoved.\n\nAdditionally, mark amd_iommu_irq_remap as static.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "798514a25544d6978d0bd7fe7071c9bdb5503076", "tree": "c44e6cf5be1fda3b58b730d335566e321edc5075", "parents": [ "adbd8a08208dc64bb1381f51b4f11ffdce1343fa" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:50 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:21 2026 +0200" }, "message": "iommu/amd: Make iommu_sva_set_dev_pasid as static\n\nIts used inside pasid.c only.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "7812d6dab0698001e50e8c2f901e17da3eb6f429", "tree": "43b6787f7851f817eed8eb643dc973e3ab721174", "parents": [ "462d0b066b613103f579793031429db2ca23abc0" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 00:15:34 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 23:06:10 2026 +0900" }, "message": "bootconfig: Fix integer overflow in initrd size check\n\nSashiko reported that in get_boot_config_from_initrd(), a crafted initrd\nwith a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer\narithmetic:\n\n data \u003d ((void *)hdr) - size;\n\nto wrap around on 32-bit systems (or when pointer subtraction overflows).\nBecause data wraps around, the subsequent bounds check:\n\n if ((unsigned long)data \u003c initrd_start)\n\nevaluates to false, bypassing the check. The kernel then calls\nxbc_calc_checksum(data, size), which attempts to read 4GB of memory,\nhitting unmapped pages and triggering a fatal kernel page fault during\nearly boot. Furthermore, on 64-bit systems with an initrd \u003e 4.29 GB, an\nunbounded 32-bit size can similarly bypass the initrd_start check.\n\nFix this by:\n1. Ensuring the initrd is at least large enough to contain the bootconfig\n footer and verifying hdr is within the initrd bounds.\n2. Checking that size does not exceed XBC_DATA_MAX and does not exceed\n the available space between initrd_start and hdr before performing\n pointer subtraction.\n\nLink: https://lore.kernel.org/all/178905333479.213925.1358412668943562406.stgit@devnote2/\n\nFixes: de462e5f1071 (\"bootconfig: Fix to remove bootconfig data from initrd while boot\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/\nAssisted-by: Antigravity:gemini-3.8-flash\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\n" }, { "commit": "462d0b066b613103f579793031429db2ca23abc0", "tree": "364d53a3c553debf6f2d66977af26dd0f12a173e", "parents": [ "df2908090cda368b01ff43709f51890076c56157" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 00:15:24 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 11 23:05:38 2026 +0900" }, "message": "tools/bootconfig: Fix integer overflow and truncation in size checks\n\nSashiko reported that on 32-bit systems, if an attacker crafts size in\nthe bootconfig footer such that adding BOOTCONFIG_FOOTER_SIZE wraps around\n(for instance, if size is 0xFFFFFFFF), the size check in\nload_xbc_from_initrd() can be bypassed:\n\n if (stat.st_size \u003c size + BOOTCONFIG_FOOTER_SIZE) {\n pr_err(\"bootconfig size is too big\\n\");\n return -E2BIG;\n }\n\nFurthermore, on 64-bit systems with an initrd \u003e 4.29 GB, comparing a\ncorrupted 32-bit size (e.g. 0xFFFFFFFF) against\nstat.st_size - BOOTCONFIG_FOOTER_SIZE can also bypass the check if\nsize is not bounded. Similarly, load_xbc_file() passes 64-bit stat.st_size\ndirectly into the 32-bit int size parameter of load_xbc_fd(), truncating\nlarge standalone files (\u003e\u003d 2GB).\n\nIn both cases, passing 0xFFFFFFFF to load_xbc_fd() truncates to -1,\nresulting in malloc(0), an integer overflow in read(), and an\nout-of-bounds null-byte write.\n\nFix this by:\n1. Rejecting size \u003e XBC_DATA_MAX or\n size \u003e stat.st_size - BOOTCONFIG_FOOTER_SIZE in load_xbc_from_initrd().\n2. Rejecting stat.st_size \u003e XBC_DATA_MAX in load_xbc_file() before passing\n it to load_xbc_fd().\n3. Checking size \u003c 0 || size \u003e XBC_DATA_MAX defensively in load_xbc_fd().\n\nLink: https://lore.kernel.org/all/178905332413.213925.3179977110281463499.stgit@devnote2/\n\nFixes: 950313ebf79c (\"tools: bootconfig: Add bootconfig command\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260909161113.16C691F00A3A@smtp.kernel.org/\nCloses: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/\nAssisted-by: Antigravity:gemini-3.8-flash\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\n" }, { "commit": "b1edd3a3e00369080012b2e4c665fc662b96ecbd", "tree": "21fb110c9aa269c3a73548021f25db520f580774", "parents": [ "e17b6f1307cabc1a5d142e6edaf92bae94472fda", "f3c6a8ae601abf2d8476d3f899283cc9a1001f7d" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 17:59:56 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 18:42:13 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namdgpu:\n- Freesync fix\n- GPUVM fix\n- Debugfs fixes\n- HDMI fixes\n- IPS fix\n- GPU reset fix\n- RGB quantization fixes\n- SMU 13.0.x fixes\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260910202516.825788-1-alexander.deucher@amd.com\n" }, { "commit": "c5dcb3aadc18d7b82ba64790721b005d18193d35", "tree": "b0807a6249a8db07a40730e773cea500eeee7b04", "parents": [ "113a9796effe3376d2ec5aabcca1fef4fef4cd62" ], "author": { "name": "Andrea Parri", "email": "parri.andrea@gmail.com", "time": "Thu Sep 10 16:34:42 2026 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Sep 11 10:15:42 2026 +0200" }, "message": "hrtimer: Use hard expiry when updating timers on the same base\n\nRearming a queued timer with nonzero slack can leave the timerqueue out\nof order. remove_and_enqueue_same_base() checks the new soft expiry\nagainst its neighbours\u0027 hard expiries, then stores the new hard expiry\nin the node without requeueing it.\n\nFor example, with A at 10 and B at 20, rearming A at 11 with slack 30\npasses the neighbour check but leaves A\u0027s hard expiry of 41 before B\u0027s\n20. The same function also caches the soft expiry in base-\u003eexpires_next\nwhen updating or inserting the first timer, giving next-event selection\nan earlier deadline than the queue head\u0027s hard expiry.\n\nSet the timer expiry before handling the queue. Use its stored hard\nexpiry for the in-place ordering check and both updates to\nbase-\u003eexpires_next.\n\nThe early update is safe because remove_and_enqueue_same_base() runs\nwith base-\u003ecpu_base-\u003elock held. The lock keeps the queue stable while\nhrtimer_can_update_in_place() checks the new expiry against both\nneighbours. If the check fails, timerqueue_linked_del() removes the node\nwithout comparing expiry values before it is reinserted.\n\nFixes: eddffab8282e3 (\"hrtimer: Keep track of first expiring timer per clock base\")\nFixes: 343f2f4dc5425 (\"hrtimer: Try to modify timers in place\")\nSigned-off-by: Andrea Parri \u003cparri.andrea@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nAssisted-by: LLM\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260910143442.2018-1-parri.andrea@gmail.com\n" }, { "commit": "e17b6f1307cabc1a5d142e6edaf92bae94472fda", "tree": "e2de54f793065ca7b2ec871102c17edfbfdf9824", "parents": [ "a202936da8436f627a48d3e7db249e5318a73237", "cbd3dafc2003db679ccd2f6c6a2551db79657049" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:45:19 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:45:19 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for v7.3-rc3:\n- Fix a memleak on perf config query error path\n- Fix UHBR SST SDP splitting when sink doesn\u0027t support it\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/27458ccc4d6be77a0d440f32279586711f3294f0@intel.com\n" }, { "commit": "ad4497a92caba4630f75c80d49cb947026213280", "tree": "e0396fc18d6fb0a2a3a75ba149973418d1ec933f", "parents": [ "69e10c2b4a51b4ff3c88a70e90f5180ad58c758f" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:06:08 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:45:11 2026 +0200" }, "message": "xfs: advance the findparent inode scan cursor while holding ILOCK\n\nLOLLM pointed out a race condition in xrep_findparent_scan -- the\ndirectory live update hook holds the directory ILOCK when it calls the\nxchk_iscan_want_live_update predicate to figure out if it needs to\nremember the live update, but xrep_findparent_scan drops the directory\nILOCK before advancing the cursor. Therefore, it\u0027s possible for a live\nupdate to check the scan cursor after the scan drops the ILOCK but\nbefore the scan updates its cursor. If this happens, we\u0027ll fail to\nrecord the live update. Fix this by moving the cursor update logic\ninside xrep_findparent_walk_directory.\n\nNote that for non-directories it\u0027s ok to advance the cursor without\nholding any ILOCK because the findparent scan only cares about directory\nparents, not the children.\n\nCc: stable@vger.kernel.org # v6.10\nFixes: a07b45576264e7 (\"xfs: scan the filesystem to repair a directory dotdot entry\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "a202936da8436f627a48d3e7db249e5318a73237", "tree": "97cca6db3f15d47dc04c16acdbe38b7352d080db", "parents": [ "2991f9f794c9a9be699b2221f757662213d17514", "f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:13:23 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:45:01 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nA runtime_pm guard for page-fault worker and a cache flush fix.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/aqLD4xjzFF6ROxBu@intel.com\n" }, { "commit": "69e10c2b4a51b4ff3c88a70e90f5180ad58c758f", "tree": "1c7d3f1f943e66449be0359f8d875dbb6460fea9", "parents": [ "e854f9a28b1fa08dfa5bf18ee4184fae90106180" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:52 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:44:48 2026 +0200" }, "message": "xfs: reset parent pointer args before each dir tree unlink repair\n\nLOLLM noticed that xfs_parent_removename only partially initializes the\npassed-in parent pointer arguments object. In the directory tree repair\ncode, we could decide to remove multiple links to a file, so we don\u0027t\nwant state from one call to bleed into the next one. Zero the whole\nthing explicitly.\n\nCc: stable@vger.kernel.org # v6.10\nFixes: 3f31406aef493b (\"xfs: fix corruptions in the directory tree\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "e854f9a28b1fa08dfa5bf18ee4184fae90106180", "tree": "b8ab8f3e5f3cf2389a2b9c6a2c0adcdb35ed8a68", "parents": [ "d3a6a35a220615c4f4578aedf3b1626b91d3acae" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:37 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:44:35 2026 +0200" }, "message": "xfs: fix replaying dirent removals into the temporary directory\n\nxrep_dir_replay_removename is the function that replays a directory\nentry removal from sc-\u003eip into the temporary directory so that when we\nswap the contents of sc-\u003etempip and sc-\u003eip, the directory is correct.\nLOLLM noticed that we were passing the wrong inode pointer into\nxrep_dir_init_args. It doesn\u0027t make sense to set rd-\u003eargs.dp to\nrd-\u003eargs.dp so let\u0027s fix this.\n\nCc: stable@vger.kernel.org # v6.10\nFixes: 8559b21a64d983 (\"xfs: implement live updates for directory repairs\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "d3a6a35a220615c4f4578aedf3b1626b91d3acae", "tree": "0cee039a966cc140bb5b211a2b34c47f280f2397", "parents": [ "3bdbf472a608aeb7e8e4dc70ee86738ad5256356" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:21 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:44:16 2026 +0200" }, "message": "xfs: fix termination logic in xchk_bmap\n\nxchk_should_terminate can turn its @error argument into -EINTR if the\nuser is sitting on ^C. Unfortunately, this code here turns that into a\n0 return, which isn\u0027t quite correct. LOLLM complains about this, though\nI think it\u0027s a very minor matter because the only way -EINTR happens is\nif there\u0027s a fatal signal.\n\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "3bdbf472a608aeb7e8e4dc70ee86738ad5256356", "tree": "eec6015576188a40ed438c3e8a43d546a0313097", "parents": [ "1ee2ce797c360785a3813fef62c90f427f3aed34" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:06 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:43:55 2026 +0200" }, "message": "xfs: fix rtrmap cross-referencing elision logic\n\nLOLLM points out that xchk_bmap_xref_rmap_cow skips the cross-reference\nif the data-section rmapbt cursor is not present. However, this is\nbroken for realtime file data fork scanning, because they will have an\nrtrmapbt cursor and not an rmapbt cursor. Fix the behavior by removing\nthe cursor checks because xchk_bmap_get_rmap already accounts for that.\n\nCc: stable@vger.kernel.org # v6.14\nFixes: 037a44d8277adf (\"xfs: cross-reference the realtime rmapbt\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "1ee2ce797c360785a3813fef62c90f427f3aed34", "tree": "fb48f2f49c7894d148dcae21cb29421700355cf9", "parents": [ "4d3c07591534517c633945c8d8e6526f10e3fabc" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:04:50 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:43:24 2026 +0200" }, "message": "xfs: actually check internal-rtdev fields in the superblock\n\nLOLLM points out that the superblock scrubber doesn\u0027t check the new\nfields that were added for internal realtime volumes when we added zoned\ndevice support.\n\nCc: stable@vger.kernel.org # v6.15\nFixes: 2167eaabe2fadd (\"xfs: define the zoned on-disk format\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "4d3c07591534517c633945c8d8e6526f10e3fabc", "tree": "4da5aab2c9dba7a265e0ad569f8f205f8b0ef1e9", "parents": [ "e240919ca727776f16a468d3d90686dc82cfe9cb" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Thu Sep 10 21:42:28 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:37:30 2026 +0200" }, "message": "xfs: fix under-reservation of blocks when repairing sf directories\n\nWhilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS\u003d\"-n\nsize\u003d8192\", I observed the following (trimmed) dmesg splat:\n\n XFS: Assertion failed: args-\u003etotal \u003e\u003d dp-\u003ei_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387\n WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511\n CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G W 7.3.0-rc2-djwx #rc2 PREEMPT(lazy) 6e418570b606a39783b0e7e7b30dc407b965f9e8\n Tainted: [W]\u003dWARN\n RIP: 0010:assfail+0x46/0x4a [xfs]\n RSP: 0018:ffffc900010d7890 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1\n RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38\n RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000\n R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940\n R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0\n FS: 00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0\n Call Trace:\n \u003cTASK\u003e\n xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n __x64_sys_ioctl+0x76/0xc0\n do_syscall_64+0x7a/0x3b0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThis is a consequence of commit 0fe77e57588b98, which added the\nfollowing assertion to xfs_da_grow_inode_int:\n\n ASSERT(args-\u003etotal \u003e\u003d dp-\u003ei_nblocks - nblks);\n\nTracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args\nobject that\u0027s passed to xfs_dir2_sf_to_block sets args-\u003etotal to 1.\nThis is incorrect because mkfs set the directory block size to 8k and\nthe filesystem block size to 4k. In other words, args-\u003etotal should be\n2 here, not 1.\n\nDave Chinner tripped over the same problem with the same branch through\na different channel -- his test setup set the fs block size to 1k, in\nwhich case the directory block size is still set to 4k. Here,\nargs-\u003etotal should be 4.\n\nChanging the assignment of args-\u003etotal to sc-\u003emp-\u003em_dir_geo-\u003efsbcount\nmakes the assertion go away, but that isn\u0027t a complete fix. In\nxrep_tempexch_estimate, we also incorrectly assume that a shortform\nconversion requires 1 fsblock when it should be m_dir_geo-\u003efsbcount.\nWithout that, we can under-reserve space in the transaction and cause a\nfilesystem shutdown.\n\nNote that the xfs_dabuf_nfsb helper will compute the correct value for\ndirectories and xattr, so we use that instead of open-coding the logic.\nAlso fix xrep_xattr_swap_prep to assign args-\u003etotal via xfs_dabuf_nfsb\nto avoid one logic bomb if we ever support multi-fsblock attrs.\n\nCc: stable@vger.kernel.org # v6.10\nCc: floss@jetm.me\nReported-by: dgc@kernel.org\nFixes: 629fdaf5f5b1b7 (\"xfs: use atomic extent swapping to fix user file fork data\")\nTripped-by: 0fe77e57588b98 (\"xfs: assert the reservation covers each da fork growth\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "2991f9f794c9a9be699b2221f757662213d17514", "tree": "bb4bd66190a2a43a94197da32f76a809ebdbc4ed", "parents": [ "df2908090cda368b01ff43709f51890076c56157", "4600b4d1a9ee730d03ddac5ce409cd2730ce8c0c" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 10:55:23 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:13:01 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA fair amount of fixes this week as well:\n\n- create blend mode property for more driver planes\n- Kconfig cleanups across the board\n- sched: null pointer dereference fix in kunit tests\n- ethosu misc fixes about error handling and corner cases handling\n- ivpu fixes about buffer and metadata validation\n- rockchip: fixes around buffer overflow and kconfig\n- tc358768: fix bus flags and error handling\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/aqJd5TPXpwqwsM0F@houat\n" }, { "commit": "135d84c66f85426299db01a09d93a79a87af18ba", "tree": "f9b58e1a1f6e75188b0aab7e8d9f04f000ce2fdf", "parents": [ "96bf9831fbf423b8104f7948cd8fe7007ecfb46c" ], "author": { "name": "Binglei Wang", "email": "l3b2w1@gmail.com", "time": "Fri Sep 11 12:11:33 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Fri Sep 11 12:16:20 2026 +0800" }, "message": "erofs: add missing buf-\u003eoff in erofs_bread()\n\nerofs_bread() locates the target folio with\n\n index \u003d (buf-\u003eoff + offset) \u003e\u003e PAGE_SHIFT;\n\nbut computes the in-folio offset without taking buf-\u003eoff into account:\n\n return buf-\u003ebase + (offset \u0026 ~PAGE_MASK);\n\nIf buf-\u003eoff is not page-aligned, the returned pointer misses the in-page\ncomponent of buf-\u003eoff, so callers end up fetching data from a wrong\noffset.\n\nbuf-\u003eoff is set to sbi-\u003edif0.fsoff in erofs_init_metabuf(), and fsoff can\nbe specified via the \"fsoffset\u003d\" mount option, which only requires\nblock-size alignment. Therefore, on an image with a sub-page block size\n(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,\nsince 512 is a multiple of the block size but not of PAGE_SIZE.\n\nIt can be reproduced by mounting an image that is placed at a\nnon-page-aligned offset:\n\n mkfs.erofs -b512 -zlz4hc sub.erofs src/\n # prepend 512 bytes of padding to the image\n mount -t erofs -o loop,fsoffset\u003d512 padded.erofs /mnt\n\nwhich fails with\n\n erofs (device loop0): cannot find valid erofs superblock\n\nbecause the on-disk superblock (at offset 1024 within the image, i.e.\n1536 within the padded file) is read from a wrong in-folio offset. With\nthis fixed, the very same image mounts successfully and its file contents\nmatch those read from the unpadded image.\n\nFix it by including buf-\u003eoff in the in-folio offset calculation, so that\nit is consistent with the folio index calculation.\n\nFixes: c36ec00d7f67 (\"erofs: add \u0027fsoffset\u0027 mount option to specify filesystem offset\")\nSigned-off-by: Binglei Wang \u003cl3b2w1@gmail.com\u003e\nReviewed-by: Gao Xiang \u003cxiang@kernel.org\u003e\nSigned-off-by: Gao Xiang \u003cxiang@kernel.org\u003e\n" } ], "next": "94b1a3ca9b8db3151f1416263704c159a9470da5" }