)]}' { "log": [ { "commit": "6628e7d4c6b25c8d18f1345e3a20d21829aae7e4", "tree": "7edfdd0dec052f7d7336ba6b65a1a9cc78df95ca", "parents": [ "46fec1c3029b552ec63b2d01af9d43a386f043ea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 13:26:31 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 13:26:31 2026 -0800" }, "message": "Linux 7.4-rc1\n" }, { "commit": "46fec1c3029b552ec63b2d01af9d43a386f043ea", "tree": "2f46152aaae331460fb9eae7ad650800cb52678c", "parents": [ "7a3d2740d1b1b5ed8d22e1e5430de3b5046cf6a9", "b327e63683a2b894b500027375342c25222b58ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:52:32 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:52:32 2026 -0800" }, "message": "Merge tag \u0027sched-urgent-2026-11-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n\n - Fix a false positive cputime related warning in kcpustat_dyntick_stop()\n that can trigger sporadically after a clocksource switch (Stian Halseth)\n\n* tag \u0027sched-urgent-2026-11-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/cputime: Don\u0027t warn when the tick period starts after idle exit\n" }, { "commit": "7a3d2740d1b1b5ed8d22e1e5430de3b5046cf6a9", "tree": "b89e0f0948c6f2c24a8e5cd71f6aa0c76e6881f1", "parents": [ "65cac1217004da03c3d2418bd7a7fda038117809", "f322d7f7ae56bce728ba03a387e35380bc4ad939" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:19:12 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:19:12 2026 -0800" }, "message": "Merge tag \u0027timers-urgent-2026-11-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fixes from Ingo Molnar:\n\n - Fix on-stack hrtimer cleanup in play_idle_precise(), and\n add the hrtimer_on_stack cleanup class to facilitate the fix\n (Hui Su)\n\n - Fix clock_getres() system call\u0027s handling of NULL output\n pointer in the !CONFIG_POSIX_TIMERS case (Hungyu Lin)\n\n - Fix get_cpu_itimer() to return TICK_NSEC when the sampled CPU time\n is exactly equal to the nonzero expiry (Hungyu Lin)\n\n - Fix do_timens_ktime_to_host() time offset subtraction underflow\n check (Hungyu Lin)\n\n - Report zero remaining time for disarmed SIGEV_NONE posix timers,\n and add a self-test to detect this bug in the future (Hung-Jui Lin)\n\n - Fix NOHZ \u0027full kick\u0027 handling bug that can cause missed\n tick updates (Peng Wang)\n\n - Fix field access bug in the vdso/gettimeofday code that works\n only by accident (Thomas Weißschuh)\n\n - Fix \u0026 prevent immediate clocksource watchdog rerun after a delay\n (Karl Mehltretter)\n\n* tag \u0027timers-urgent-2026-11-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n clocksource: Prevent immediate watchdog rerun after a delay\n vdso/gettimeofday: Correct the read of tz_minuteswest and tz_dsttime\n tick/nohz: Reevaluate the tick for kicks flushed outside hardirq\n selftests: timers: Add a test for disarmed SIGEV_NONE timers\n posix-timers: Report zero remaining time for disarmed SIGEV_NONE timers\n time/namespace: Fix overflow when converting absolute deadlines\n timers/itimer: Keep a nonzero value at CPU timer expiry\n posix-timers: Accept NULL clock_getres() output in stubs\n sched/idle: Use hrtimer cleanup class in play_idle_precise()\n hrtimer: Add cleanup class for on-stack timers\n" }, { "commit": "65cac1217004da03c3d2418bd7a7fda038117809", "tree": "cbdf7facb18260805101abdb1e669c19ce874c4b", "parents": [ "cbaa26615075e26ab54e0e8afaa10860867f75fe", "1c16bc2b1122f78f9d51c5785f7a78b36d44972b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:16:37 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:16:37 2026 -0800" }, "message": "Merge tag \u0027irq-urgent-2026-11-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc irqchip fixes from Ingo Molnar:\n\n - Fix the hardware IRQ-retrigger logic on the riscv-imsic\n irqchip driver (Avi Weiss)\n\n - Fix MSI descriptor leak in the irq-msi-lib irqchip driver\n (Avi Weiss)\n\n* tag \u0027irq-urgent-2026-11-01\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/irq-msi-lib: Free wired MSI descriptors\n irqchip/riscv-imsic: Report successful hardware retrigger\n" }, { "commit": "cbaa26615075e26ab54e0e8afaa10860867f75fe", "tree": "3c9e440c53d3306eb2d386532dc85543b6712a8e", "parents": [ "9b6f2eabc8371dea951c244f4aa9e013f36de9f8", "278b2abf660a3e0991eb9f16f11bd9e9514a286d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:00:06 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 09:00:06 2026 -0800" }, "message": "Merge tag \u0027bootconfig-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull bootconfig fix from Masami Hiramatsu:\n\n - init/bootconfig: Pass init arguments in documented order\n\n Parse extra_init_args before command-line init arguments in\n start_kernel(). This ensures command-line options take precedence\n over bootconfig, matching the documented order and saved command\n line.\n\n* tag \u0027bootconfig-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n init/bootconfig: pass init arguments in documented order\n" }, { "commit": "9b6f2eabc8371dea951c244f4aa9e013f36de9f8", "tree": "85a8160bc4febe644d61dde3ea50235570a75eee", "parents": [ "cbbddb6b08cc9900a87cccaa9b22bbe06aa4f50a", "7485659ecb81d5fce3a3edf2cae9fcb29c17b1cd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 08:41:03 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 01 08:41:03 2026 -0800" }, "message": "Merge tag \u0027rtc-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull RTC updates from Alexandre Belloni:\n \"This introduces a way to lift the hctosys limit for 32-bit systems to\n ensure systems relying on it can pass Y2038. Add a driver for the\n Raspberry Pi 5 RTC and add support for the Abracon abx81x, Ricoh\n R2223x, Renesas R-Car X5H and Allwinner B288 RTCs to existing drivers:\n\n Subsystem:\n - the hctosys limit for 32bit platforms is now configurable\n - introduce lock guard for for rtc_device.ops_lock\n - use sysfs_emit() instead of sprintf() were possible\n - selftest fixes\n\n New driver:\n - Raspberry Pi 5 RTC\n\n Drivers:\n - abx80x: add support for ABX81X\n - bd70528: properly enable wakeup\n - cmos: Fix ACPI RTC alarm handling\n - ds1685: power-off fixes\n - mt6397: add nvmem support\n - pcf85063: add HW UIE support\n - rs5c372: Ricoh R2223x support\n - rzn1: add R-Car X5H support\n - s35390a: allow use of output pin for interrupt signal 1 for wakealarm to\n support synology devices\n - sun6i: add Allwinner B288 support\"\n\n* tag \u0027rtc-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (89 commits)\n rtc: rs5c372: use sysfs_emit() instead of sprintf()\n rtc: ds1307: use sysfs_emit() instead of sprintf()\n rtc: isl1208: use sysfs_emit() instead of sprintf()\n rtc: ds1685: use sysfs_emit() instead of sprintf()\n rtc: ds1343: use sysfs_emit() instead of sprintf()\n rtc: rx8025: use sysfs_emit() instead of sprintf()\n rtc: x1205: use sysfs_emit() instead of sprintf()\n rtc: bq32k: use sysfs_emit() instead of sprintf()\n rtc: ep93xx: use sysfs_emit() instead of sprintf()\n rtc: pcf2127: use sysfs_emit() instead of sprintf()\n rtc: rv3029: use sysfs_emit() instead of sprintf()\n rtc: ds1685: keep setting PAB until power is removed\n rtc: ds1685: do not sleep in the power-off handler\n rtc: ds1685: arm the wake-up alarm at power-off only if an alarm is set\n rtc: rv3028: use sysfs_emit() instead of sprintf()\n rtc: pcf85063: add 1 Hz update interrupt (UIE) support\n rtc: pcf85063: preserve the alarm flag in clkout register updates\n rtc: pcf85063: do not clear AIE in the interrupt handler\n rtc: pcf85063: use devm_of_clk_add_hw_provider() for clkout\n rtc: s35390a: Add synology quirk\n ...\n" }, { "commit": "b327e63683a2b894b500027375342c25222b58ef", "tree": "76d2833e913cc15df4b96d3263c97707c9bcb358", "parents": [ "cbbddb6b08cc9900a87cccaa9b22bbe06aa4f50a" ], "author": { "name": "Stian Halseth", "email": "stian@itx.no", "time": "Sat Oct 31 09:14:07 2026 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sun Nov 01 07:32:38 2026 +0100" }, "message": "sched/cputime: Don\u0027t warn when the tick period starts after idle exit\n\nkcpustat_dyntick_stop() warns if idle ends before the tick period\nthat the next tick will account has started. That happens on x86 in\na CPU\u0027s first idle period with the tick stopped, right after the\nswitch from the jiffies clocksource to tsc-early.\n\nOn the jiffies clocksource ktime only moves at the tick. When the\nclocksource switches some time d after a tick, that d is lost: ktime\ncontinues from the value of the last tick. The next tick comes\nTICK_NSEC after the last one, but ktime has only moved TICK_NSEC - d,\nwhile tick_periodic() still adds a full TICK_NSEC to tick_next_period,\nwhich is now d ahead of ktime. When NOHZ starts,\ntick_init_jiffy_update() rounds it up to a multiple of TICK_NSEC and\nthe sched timer is armed there, up to nearly two ticks after now. A\ntick stop saves that as ts-\u003elast_tick, and an idle exit before now\nreaches ts-\u003elast_tick - TICK_NSEC sees the tick period in the future.\n\nNothing is accounted twice then. The first tick covers a period that\nstarts after the idle exit, and the code already handles it. Drop the\nwarning.\n\nFixes: 96a494c9cfd8 (\"sched/cputime: Don\u0027t account idle time twice after dyntick-idle\")\nReported-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nReported-by: Breno Leitao \u003cleitao@debian.org\u003e\nReported-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nReviewed-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Stian Halseth \u003cstian@itx.no\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://lore.kernel.org/all/auTCQauaU733PY5z@gmail.com/\nLink: https://lore.kernel.org/all/CAHk-\u003dwinC2u2D1FAX5grfq9F\u003dbxmARxhuiQ4MvHAiJFu3iF6gw@mail.gmail.com/\nLink: https://patch.msgid.link/20261031081408.3378884-1-stian@itx.no\nCloses: https://lore.kernel.org/all/bfe9b14a-6e65-41c5-b638-26f6e033788b@molgen.mpg.de/\n--\n kernel/sched/cputime.c | 7 ++++++-\n 1 file changed, 6 insertions(+), 1 deletion(-)\n" }, { "commit": "cbbddb6b08cc9900a87cccaa9b22bbe06aa4f50a", "tree": "64187d199649cb3a6f8daf9c6f8304d4f71fc7f0", "parents": [ "e9954f3fbddd25e1a01b7e5a0b72fb8b564204e0", "8969e647d0322939512041b9685cc5f27753dd8c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 31 15:05:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 31 15:05:17 2026 -0700" }, "message": "Merge tag \u0027power-utilities-2026.10.31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux\n\nPull x86 power utilities updates from Len Brown:\n \"Turbostat:\n - Fix --cpu option to work more than once\n - Fix --Joules option to work with --show power\n - Remove hard-coded 8192-CPU limit\n - Decode Uncore Frequency Agent Types\n - Dump RDT (Resource Director Technology) config\n - Dump RP (Resource Priority) config\n - Recognize Rugged Panther Lake\n - Fix PMT mmap size, bounds check, and mask computation\n - Misc cleanups and minor fixes\n\n x86_energy_perf_policy:\n - Harden input parsing and bounds checks\n - Fix optarg keyword matching\n - Rewrite MSR device path discovery\n - Misc cleanups and minor fixes\"\n\n* tag \u0027power-utilities-2026.10.31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: (42 commits)\n tools/power x86_energy_perf_policy: Version 2026.10.31\n tools/power turbostat: Version 2026.10.31\n tools/power turbostat: Fix PMT mmap size and bounds check\n tools/power turbostat: Fix undefined behavior in pmt_gen_value_mask()\n tools/power turbostat: Fix --Joules when used with --show power\n MAINTAINERS: Add x86_energy_perf_policy\n x86_energy_perf_policy: Simplify write_sysfs() return type\n x86_energy_perf_policy: Use calloc to initialize string buffer\n x86_energy_perf_policy: Cleanup: Constify read only parameters\n x86_energy_perf_policy: Cleanup: Drop unused signal.h\n x86_energy_perf_policy: Document MSRHEADER\n x86_energy_perf_policy: Cleanup: Check fseek() in VM path\n x86_energy_perf_policy: Cleanup: Define BCLK_MHZ\n x86_energy_perf_policy: Cleanup: Define HWP_WINDOW_MAX_USEC\n x86_energy_perf_policy: Bound package iteration\n x86_energy_perf_policy: Harden against potential ratio overflow\n x86_energy_perf_policy: Fix optarg keyword matching\n x86_energy_perf_policy: Cleanup: Use snprintf() for platform-profile\n x86_energy_perf_policy: Harden with strtol()\n x86_energy_perf_policy: Harden update_cpufreq_scaling_freq()\n ...\n" }, { "commit": "e9954f3fbddd25e1a01b7e5a0b72fb8b564204e0", "tree": "6932c388b83c3c2366a340117adb4a515f7572cf", "parents": [ "ca62fc8c6b1841039aee6de1ef03c9863751ec04", "74f6055d0c5997b13e6a5253fdc2263f3af90408" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 31 12:30:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 31 12:30:31 2026 -0700" }, "message": "Merge tag \u0027sound-fix-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of fixes across the sound subsystem. Nothing particularly\n stands out, mostly driver- and device-specific fixes along with a few\n race / UAF fixes and cleanups. Here are some highlights:\n\n ALSA core:\n - Fix potential race in PCM proc handling at disconnection\n - Fix potential race in UMP sequencer callback at releasing\n\n HD-audio:\n - Reject codec reset/reconfig on ASoC buses to prevent deadlock\n - Force MSI for Hygon H34M51A board\n - Usual Realtek quirks for ASUS and HP laptops/AiO\n\n USB-audio:\n - Bound packet copies by PCM buffer size in generic and ua101 drivers\n - Rate-limit URB submission errors at stream start\n - Skip redundant probe-time interface setup on MSI ALC4080\n - Device quirks for Novation UltraNova, MOTU MicroBook II, and RYDZ\n Headphone\n\n ASoC:\n - Fixes for runtime PM and IRQ handling in hdac_hda and SDCA\n - SOF: Fix potential UAF at release, fix for Kconfig dependency\n - Qualcomm: Fixes for sm8250 and q6apm/q6afe\n - NXP / i.MX: Fix for pending work in hw_free\n - Xilinx: Fix read-modify-write of AUD_CTRL in formatter_pcm\n - Intel: Arrow Lake SoundWire match table additions (RT712, RT713 +\n dual RT1320)\n - AMD: DMI quirk for HP Laptop 14-em0xxx and memory leak fix in Raven\n DMA close\n - Various codec fixes for midas_wm1811, wm8994, cs35l56, cs42l56,\n WSA881x/883x/884x, es8326/es8375/es9356, rt721/rt722, and\n tlv320aic32x4\n\n Misc:\n - OPL3: Fix races in timer initialization, shutdown, and voice\n cleanup\n - Bounds checks and string helpers for AC97 and emu10k1\n - Fix spu_memset() stride in legacy SH AICA driver\n - Parameter handling fixes in pcmtest virtual driver\"\n\n* tag \u0027sound-fix-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (71 commits)\n ASoC: SOF: Intel: hda: Stop the controller before freeing its DMA buffers\n ASoC: imx-pcm-rpmsg: Flush pending work in hw_free\n ASoC: xilinx: formatter_pcm: Fix read-modify-write of AUD_CTRL in hw_params\n ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe\n ASoC: rt721: Remove invalid register defaults\n ASoC: hdac_hda: Balance the runtime PM disable in codec remove\n ASoC: hdac_hda: Restore the codec device type on unbind\n ASoC: hdac_hda: Allocate the private data at codec driver bind\n ASoC: qcom: sm8250: Limit RX digital gain to 0 dB\n ALSA: hda: Reject codec reset on ASoC (ext_ops) buses\n ALSA: usb-audio: add quirk for Novation UltraNova (1235:0011)\n ALSA: usb-audio: Add correct datainterval in the quirks-table for Microbook II\n ALSA: usb-audio: Skip probe-time interface setup for MSI MAG X570S ALC4080\n ALSA: hda/realtek: Extend quirk for HP Pavilion All-in-One 27-ca1xxx\n ALSA: pcmtest: Honor the enable parameter\n ALSA: ua101: Bound packet copies by the PCM buffer size\n ALSA: usb-audio: Bound packet copies by the PCM buffer size\n ASoC: SDCA: re-enable IRQ on pm_runtime_force_suspend failure\n ASoC: SDCA: drop pm_runtime reference on probe failure path\n ASoC: SDCA: propagate sdw_slave_read_prop() failure in class_read_prop\n ...\n" }, { "commit": "ca62fc8c6b1841039aee6de1ef03c9863751ec04", "tree": "9965cf6b4b6d7a5a69359480fa7a563505e2b099", "parents": [ "36aad21d50d1af3f6954bb0c988257a908202477", "1d27da7de3f74405b1de85ad26c5ea90f826114b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 31 11:35:53 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 31 11:35:53 2026 -0700" }, "message": "Merge tag \u0027ovl-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs\n\nPull overlayfs fixes from Amir Goldstein:\n\n - Fixes for bugs found by Chris Mason\u0027s AI review, several of them\n reachable by unprivileged users: an info leak, use-after-free and\n NULL deref bugs, an RCU walk stall with remote layers and data loss\n with nfs_export\n\n - Fix copy up of files with an empty security.capability xattr, which\n any user could set to block copy up\n\n - Fix a regression from v6.16 with the override_creds mount option\n\n - Two casefold fixes\n\n* tag \u0027ovl-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:\n ovl: check the casefold flag of directories only\n ovl: reserve space for the casefolded name terminator\n ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN\n selftests/ovl: fix detached layer mountinfo expectations\n ovl: set the revalidate flags after d_instantiate()\n ovl: always encode the origin fh when index is enabled\n ovl: read the nlink xattr of every indexed non-dir\n ovl: skip copy up of empty security.capability\n ovl: fix a torn path in ovl_get_redirect()\n ovl: do not copy up a dentry that was removed\n ovl: hold a reference on the parent in readdir\n ovl: use the pinned upper dir in ovl_fix_origin()\n ovl: do not take a name snapshot in RCU walk\n vfs: add try_take_dentry_name_snapshot()\n ovl: take a snapshot of the name for copy up\n ovl: check that the parents of volatile/dirty are dirs\n ovl: add assertions in dir cache code\n ovl: set OVL_WHITEOUTS before publishing the upper dir\n ovl: fortify ovl_copy_xattr() against underlying layer modifications\n ovl: do not copy up an xattr value that was never read\n" }, { "commit": "8969e647d0322939512041b9685cc5f27753dd8c", "tree": "03abe140c938f5bcb9b8767456df65eb6ea9ee87", "parents": [ "a8d65a89a31fd5a04709f002feaf847602904950", "ed9324befbded16f66840327f981e508091eab3e" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 14:29:22 2026 -0300" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 14:29:22 2026 -0300" }, "message": "Merge branches \u0027turbostat\u0027 and \u0027x86_energy_perf_policy\u0027 into utilities\n" }, { "commit": "ed9324befbded16f66840327f981e508091eab3e", "tree": "54fbab29a5c2daf18752f582e52d2431683ae9be", "parents": [ "5917748d81cfa3bf4e2160c431c2996bffc148ad" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 14:00:43 2026 -0300" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 14:23:24 2026 -0300" }, "message": "tools/power x86_energy_perf_policy: Version 2026.10.31\n\nSince 2026.04.25:\n\nHarden input parsing and bounds checks.\nFix optarg keyword matching.\nRewrite MSR device path discovery.\nMisc cleanups and minor fixes.\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "a8d65a89a31fd5a04709f002feaf847602904950", "tree": "baf7de888d0cbd7f75f47ed9fc004a8f8ddd7166", "parents": [ "cfdb43387f3e6144bc374165ebf6deecb0324470" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 13:47:21 2026 -0300" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 14:21:38 2026 -0300" }, "message": "tools/power turbostat: Version 2026.10.31\n\nSince version 2026.09.28:\n\nFix --cpu option to work more than once.\nFix --Joules option to work with --show power.\nRemove hard-coded 8192-CPU limit.\nDecode Uncore Frequency Agent Types.\nDump RDT (Resource Director Technology) config.\nDump RP (Resource Priority) config.\nRecognize Rugged Panther Lake.\nFix PMT mmap size, bounds check, and mask computation.\nMisc cleanups and minor fixes.\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "cfdb43387f3e6144bc374165ebf6deecb0324470", "tree": "cb76281b8204f046c8b023dc37a648838accca33", "parents": [ "3d6fc92be1feb6436932979e4652174467e7a42a" ], "author": { "name": "Kaushlendra Kumar", "email": "kaushlendra.kumar@intel.com", "time": "Thu Oct 29 20:02:00 2026 +0530" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 13:46:33 2026 -0300" }, "message": "tools/power turbostat: Fix PMT mmap size and bounds check\n\nRemove assert(offset \u003d\u003d 0), to allow non-zero PMT offsets.\n\nFix the pmt_mmio_open() mapping to round-up (offset + size).\n\nFix the offset bounds check to disallow running past the end of the region.\n\n[lenb: commit message re-write]\nSigned-off-by: Kaushlendra Kumar \u003ckaushlendra.kumar@intel.com\u003e\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "3d6fc92be1feb6436932979e4652174467e7a42a", "tree": "6c2cf835fd830dcd7713c5957aa8af4891b53878", "parents": [ "ab6e94fb4a25278ab84ccc390f37719d13ad86f8" ], "author": { "name": "Kaushlendra Kumar", "email": "kaushlendra.kumar@intel.com", "time": "Thu Oct 29 14:14:29 2026 +0530" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 13:46:33 2026 -0300" }, "message": "tools/power turbostat: Fix undefined behavior in pmt_gen_value_mask()\n\nThe function uses plain int literal \u00271\u0027 for bit shifting, which causes\nundefined behavior when msb \u003e\u003d 31. This is because shifting a 32-bit int\nby 32 or more bits is undefined behavior in C. Fix by using 1ULL\n(unsigned long long) instead of 1 to ensure 64-bit arithmetic on all\nplatforms.\n\nSigned-off-by: Kaushlendra Kumar \u003ckaushlendra.kumar@intel.com\u003e\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "ab6e94fb4a25278ab84ccc390f37719d13ad86f8", "tree": "0fc5b5f361eca9bd16eadea91a346007d8a3df13", "parents": [ "00eae75a3baa8a551b6c86a63bd0eed5b0bd4f7c" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Fri Oct 16 17:28:36 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Oct 31 13:46:06 2026 -0300" }, "message": "tools/power turbostat: Fix --Joules when used with --show power\n\nThe \"--Joules\" option displays energy in Joules,\nreplacing the same metrics displayed as power in Watts.\n\nBut when used with --show power, it deletes the power\nmetrics without replacing them with their energy counterparts:\n\n$ sudo ./turbostat -q --list --show power --Joules\nCoreTmp,PkgTmp,RAM_J,PKG_%,RAM_%\n\nFix it thus:\n\n$ sudo ./turbostat -q --list --show power --Joules\nCoreTmp,PkgTmp,Pkg_J,Cor_J,GFX_J,RAM_J,PKG_%,RAM_%,Sys_J\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "74f6055d0c5997b13e6a5253fdc2263f3af90408", "tree": "e121434ac2025ce47840f7a79096503a6c6ea3e3", "parents": [ "a4311e9447bbb219044db38897f95be112f46a8a", "11ae63bd9030349a0136fb2edd1622a4a029edc8" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Sat Oct 31 16:31:50 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Sat Oct 31 16:31:50 2026 +0100" }, "message": "Merge tag \u0027asoc-fix-v7.4-merge-window\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.4\n\nA moderately large collection of fixes and quirks that have come in\nduring the merge window, everything here is driver specific and none of\nit unusually severe.\n" }, { "commit": "278b2abf660a3e0991eb9f16f11bd9e9514a286d", "tree": "02f30837a1d678aab1a07296df6551ba4d144a60", "parents": [ "c03c1a14507dfaf8b856c2608f9ac216021fc222" ], "author": { "name": "Avi Weiss", "email": "thnkslprpt@gmail.com", "time": "Tue Oct 27 09:37:20 2026 +0200" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Sat Oct 31 22:26:20 2026 +0900" }, "message": "init/bootconfig: pass init arguments in documented order\n\nstart_kernel() appends command-line init arguments before\nbootconfig init arguments, while setup_command_line()\nplaces them in the opposite order. As a result, the\narguments passed to init do not match the saved command\nline, reversing the intended precedence of options.\n\nParse extra_init_args before after_dashes so command-line\ninit arguments are passed last.\n\nLink: https://lore.kernel.org/all/20261027073719.4010659-2-thnkslprpt@gmail.com/\n\nFixes: b66fbbe8d482 (\"init/bootconfig: Reorder init parameter from bootconfig and cmdline\")\nSigned-off-by: Avi Weiss \u003cthnkslprpt@gmail.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "36aad21d50d1af3f6954bb0c988257a908202477", "tree": "abc632251b0a4e7943c862df4644a75aea54da62", "parents": [ "dd384658c738d15783a786d3af2851e02490f171", "206fc30f71b005156085fd8523ccc84a2c67791b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 22:01:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 22:01:54 2026 -0700" }, "message": "Merge tag \u0027ksmbd-for-7.4-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server fixes from Namjae Jeon:\n\n - Fix compound CREATE response buffer sizing and reserve space for\n final response padding to prevent buffer overflows and out-of-bounds\n reads\n\n - Allocate sufficient space for UTF-16 directory-name conversion,\n including the terminating NUL\n\n - Fix an RDMA transfer length underflow that can cause out-of-bounds\n reads or writes when processing multiple remote buffer descriptors\n\n - Fix use-after-free bugs during failed durable reconnect cleanup and\n AppInstanceId supersede racing with session teardown\n\n - Keep retry timeout clamp bounds constant to fix a MIPS build failure\n with CONFIG_HZ\u003d1024\n\n - Fix a session reference leak in compounded SESSION_SETUP and reject\n compounded session binding to avoid mixing session and tree state\n after a failed binding\n\n - Serialize operations on each named pipe and preserve unread RPC reply\n data for subsequent READ requests when the client\u0027s output buffer is\n too small\n\n - Return complete, eight-byte-aligned stream information entries and\n report insufficient output space correctly\n\n - Use the resolved share root path so shares rooted at mount points\n list their contents correctly with crossmnt disabled\n\n - Ignore network-device events outside the initial network namespace,\n preventing container interfaces from affecting ksmbd listeners\n\n* tag \u0027ksmbd-for-7.4-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:\n ksmbd: return complete and aligned stream information\n ksmbd: fix session reference leak on compounded SESSION_SETUP\n ksmbd: fix named-pipe reply loss with small output buffers\n ksmbd: avoid races between named-pipe operations\n ksmbd: fix use-after-free after a failed durable reconnect\n ksmbd: fix out-of-bounds read when padding the final compound response\n ksmbd: fix SMB2 CREATE response buffer overflow in compound requests\n ksmbd: use the resolved share path for the share root\n ksmbd: keep retry timeout clamp bounds constant\n smb: server: size directory name conversion buffer correctly\n ksmbd: prevent session binding in compound requests\n ksmbd: ignore network devices of other namespaces\n ksmbd: fix app-instance non-durable supersede session UAF\n smb: smbdirect: fix buffer length underflow in RDMA transfers\n" }, { "commit": "dd384658c738d15783a786d3af2851e02490f171", "tree": "63b96f8ba0e7b33ddc8d44506dce5ac39fed77aa", "parents": [ "60aba79a50127e92d8c4a663d35b855e52a9da01", "4626d370ae89b8af4d46a45372b269f926ec662d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 21:54:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 21:54:38 2026 -0700" }, "message": "Merge tag \u0027perf-tools-for-v7.4-1-2026-10-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next\n\nPull perf tool updates from Arnaldo Carvalho de Melo:\n\n - Support instruction tracking on arm64 for data type profiling,\n resolving stack, global, per-CPU and \u0027current\u0027 variable accesses, so\n that \u0027perf annotate --data-type\u0027 resolves types on arm64 the way it\n does on x86.\n\n - Port the Python scripts to the perf module and standalone execution,\n and improve the module: lazy sample callchains and event copies, GIL\n handling, better session/thread lookup, new treport, flamegraph and\n sqlite/postgres exporters.\n\n - Reenable and fix the attribute expectation test suite: per-PMU bit\n masks, other core PMUs\u0027 events, dummy tracking events, group checks\n and spelled out skip reasons.\n\n - perf trace: filter the target\u0027s tasks in BPF, open the BPF output\n event on every CPU, add an option to disable syscall augmentation and\n raise TRACE_AUG_MAX_BUF.\n\n - perf jitdump: harden record parsing, validating unwinding sizes and\n symbol names, byte-swapping debug entries via safe accessors and\n fixing frees on error paths.\n\n - perf annotate-data fixes: bound the member nesting recursion, resolve\n type DIEs in the debug file they came from, adjust the offset for\n flex-arrays and show the sample count in the data-type browser.\n\n - perf symbol and debug info: try linked debug files for DSOs, avoid\n repeated failing searches, set binary/symtab types for split\n kallsyms, JIT maps and the build-id cache, fix libbfd symbol loading.\n\n - perf config: serialize config file access with a mutex, add the\n DEFINE_MUTEX() and DO_ONCE() primitives and a robust process shared\n mutex, add the core.hybrid-merge option.\n\n - perf report: add --progress and --no-progress options.\n\n - perf mem: add a false sharing workload to \u0027perf test\u0027, request\n PERF_SAMPLE_CPU by default, use the IBS swfilt filter when available\n and decode L0 in the memory level.\n\n - perf test: take turns using the perf mlock budget in the mmaping\n tests, add the \u0027needs_mlock\u0027 suite flag, scope the probe based tests\n to their PID and make more tests non-exclusive.\n\n - perf vendor events intel: update events and metrics to TMA 5.2,\n refresh the event tables and fix umask encodings.\n\n - perf build: run shellcheck, mypy and pylint in parallel, make pylint\n opt-out with NO_PYLINT\u003d1, fix clean and install dependencies.\n\n - Add a script and a \u0027make sync-headers\u0027 target to sync the tools/\n copies of kernel headers with the kernel sources, plus the resulting\n syncs of the cpufeatures, KVM, fs, mount, fcntl, socket, rtnetlink,\n if_addr and sound headers.\n\n - Fix cs-etm HW_ID mapping synthesis for raw trace, queue teardown\n leaks and duplicate v0 global mappings.\n\n - Add a \u0027perf bench atomic\u0027 benchmark for atomic operations.\n\n - Filter events before creating lock_stat in \u0027perf lock contention\u0027.\n\n - Add a \u0027perf test\u0027 case for events re-armed with\n PERF_EVENT_IOC_REFRESH.\n\n - Fix memory leaks on \u0027perf c2c\u0027 output fields and add function view\n stdio coverage to its test.\n\n - Fix a NULL dereference resolving callchains in \u0027perf machine\u0027.\n\n - Optimize the libdw fallback when DWARF is missing and try the symbol\n file first when checking for debuginfo.\n\n - Don\u0027t call eprintf() in pr_debugN() when not verbose.\n\n - Don\u0027t delete cumulative caller entries before the stat_acc decays in\n \u0027perf report\u0027.\n\n - Fix ring buffer cursor handling: keep the consumed cursor in forward\n mode and use the head selected by read_init.\n\n - Fix \u0027perf test mmap-basic\u0027 user rdpmc detection and only test\n userspace reading on supported platforms.\n\n - Build fixes: include sys/types.h for ssize_t, errno.h before kernel\n headers and fix jevents.py type annotations for mypy 2.x.\n\n* tag \u0027perf-tools-for-v7.4-1-2026-10-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next: (425 commits)\n perf machine: Fix NULL deref in thread__resolve_callchain_sample()\n perf pmu-events: Fix jevents.py type annotations for mypy 2.x\n perf parse-events: Include errno.h before kernel headers\n perf print_insn: Include sys/types.h for ssize_t\n perf tests mmap-basic: Fix user rdpmc detection logic\n perf tests mmap-basic: Only test userspace reading on supported platforms\n perf mmap: Preserve the consumed cursor in forward mode\n perf mmap: Use the head selected by read_init\n perf hist: Do not delete cumulative caller entries before stat_acc decays\n perf debug: Avoid calling eprintf() in pr_debugN() when verbose \u003c n\n perf libdw: Optimize fallback logic for missing DWARF\n tools headers: Sync KVM headers with the kernel sources\n tools headers: Sync UAPI sound/asound.h with the kernel sources\n tools headers: Sync UAPI linux/mount.h with the kernel sources\n tools headers: Sync UAPI linux/fs.h with the kernel sources\n tools headers: Sync UAPI linux/fcntl.h with the kernel sources\n tools headers: Sync linux/socket.h with the kernel sources\n tools arch x86: Sync the cpufeatures.h copy with the kernel sources\n tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources\n tools headers UAPI: Sync linux/if_addr.h with the kernel sources\n ...\n" }, { "commit": "60aba79a50127e92d8c4a663d35b855e52a9da01", "tree": "2224ab02a04ab210ed25eb794425ffa7a34bd218", "parents": [ "2a500a04d6f969318c05f46aedb6e73fc1963a00", "ed35bbe7d06e6505401eff3f3c7a36bd1f167a17" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 21:50:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 21:50:13 2026 -0700" }, "message": "Merge tag \u0027apparmor-pr-2026-10-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor\n\nPull AppArmor fixes from John Johansen:\n \"Leaks:\n - fix a leak on a rejected string table entry\n - fix refcount leak in aa_get_newest_profile()\n - fix profile leak when a policy load fails\n - remove fs entries created by a failed policy load\n - on failed load ensure profile files are removed before parent\n - Fix namespace reference leak in __aa_find_or_create_ns()\n\n Use after free/double free:\n - fix a use-after-free in aa_lookupn_ns()\n - avoid potential double free when remapping DFA tables\n\n Bounds checking by-passes:\n - fix table_size() integer overflow on 32 bit\n - check accept index + 1 is in bounds\n\n Mediation fixes:\n - Fix AF_UNSPEC mediation\n - check address length before reading AF_UNSPEC bind address\n - mediate AF_UNSPEC socket disconnects\n - Fix sctp connect/bind by-passess\n - advertise that sctp is being mediated\n - fix check SCTP bind, and connect permission checks\n - check connect permission for SCTP\n - incorrect state machine traversal\n - convert duplicated dfa transitions to match_char()\n - locking issues\n - don\u0027t revalidate inherited files under files-\u003efile_lock\n - fix uninitialized variable warning in aa_inherit_files\n - Bad dereferences\n - fix NULL ctx-\u003epeer derefs in unix socket ctx updates\n\n Unnecessary warnings:\n - remove unconfined_profile() check in inet socket mediation\n\n Kernel Doc:\n - Fix the return value in split_token_from_name() kernel-doc\n\n Misc:\n - fix query_data() output overlapping the lookup key\n - report a label allocation failure as -ENOMEM\"\n\n* tag \u0027apparmor-pr-2026-10-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (23 commits)\n apparmor: fix uninitialized variable warning in aa_inherit_files\n apparmor: fix profile leak when a policy load fails\n apparmor: on failed load ensure profile files are removed before parent\n apparmor: remove fs entries created by a failed policy load\n apparmor: fix query_data() output overlapping the lookup key\n apparmor: advertise that sctp is being mediated\n apparmor: fix check SCTP bind, and connect permission checks\n apparmor: check connect permission for SCTP\n apparmor: fix a use-after-free in aa_lookupn_ns()\n apparmor: Fix namespace reference leak in __aa_find_or_create_ns()\n apparmor: check accept index + 1 is in bounds\n apparmor: Fix the return value in split_token_from_name() kernel-doc\n apparmor: convert duplicated dfa transitions to match_char()\n apparmor: fix table_size() integer overflow on 32 bit\n apparmor: avoid potential double free when remapping DFA tables\n apparmor: report a label allocation failure as -ENOMEM\n apparmor: fix a leak on a rejected string table entry\n apparmor: remove unconfined_profile() check in inet socket mediation\n apparmor: fix refcount leak in aa_get_newest_profile()\n apparmor: check address length before reading AF_UNSPEC bind address\n ...\n" }, { "commit": "2a500a04d6f969318c05f46aedb6e73fc1963a00", "tree": "4585da0c22128adf3e1fbb9e9a963b52ff17ed7c", "parents": [ "ac1bf565f140154ee27db56c80f29c9eeb9a77c3", "a287f97d4256b5f5527f5b5a54f8ada55e1482c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:38:34 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:38:34 2026 -1000" }, "message": "Merge tag \u0027driver-core-7.4-rc1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull more driver core fixes from Danilo Krummrich:\n\n - Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind\n operations associated with misleading fuzzing reports. It also taints\n established workflows, including VFIO device passthrough; a more\n targeted approach will be revisited after 7.4.\n\n - Rate limit synthetic uevent failure messages to prevent log flooding\n from repeated invalid writes to sysfs uevent files\n\n* tag \u0027driver-core-7.4-rc1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n Revert \"driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers\"\n driver core: Limit the messages on a refused uevent\n" }, { "commit": "ac1bf565f140154ee27db56c80f29c9eeb9a77c3", "tree": "b18b0700308c6766836c075299bc4b7bc280922c", "parents": [ "e823910506ff3a34fb2966a9ecccc4019b2154dd", "aba9df180668b4c0b1e021980f3bff9ad502d26c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:23:04 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:23:04 2026 -1000" }, "message": "Merge branch \u0027fixes-from-sasha\u0027\n\nMisc fixes for this merge window from Sasha Levin that were posted for\nissues found in linux-next but not picked up by maintainers.\n\nIn an almost certainly futile attempt to clean up the disaster area that\nis my inbox, I\u0027m merging them directly rather than leaving them pending\nand wait for them to come in through the proper channels.\n\n* fixes-from-sasha:\n selftests/fuse: add the missing symlink caching test\n fuse: fix link error with CONFIG_FUSE_PASSTHROUGH\u003dn\n xprtrdma: fix up the nfs/nfs-anna merge of the Write chunk head trim\n" }, { "commit": "aba9df180668b4c0b1e021980f3bff9ad502d26c", "tree": "b18b0700308c6766836c075299bc4b7bc280922c", "parents": [ "1ea806165ec5fb8bca5d9990392fdb4f53a97977" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Mon Oct 26 15:40:08 2026 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:22:37 2026 -1000" }, "message": "selftests/fuse: add the missing symlink caching test\n\nCommit 3e14f079d7a0 (\"selftests/fuse: add fuse symlink caching test\")\nregistered fuse_symlink_cache_test in the fuse selftest Makefile and\n.gitignore, but the test source was not part of the applied commit, so\nbuilding the fuse selftests fails:\n\n make[1]: *** No rule to make target \u0027fuse_symlink_cache_test.c\u0027, needed by \u0027.../fuse_symlink_cache_test\u0027.\n\nAdd fuse_symlink_cache_test.c as posted in Luis Henriques\u0027s v5\nsubmission. The test serves a file and a symlink to it from a libfuse\nlow-level filesystem, resolves the symlink 100 times, and counts the\nreadlink requests that reach the server: one when FUSE_CAP_CACHE_SYMLINKS\nis set during FUSE_INIT, and all 100 when it is not.\n\nFixes: 3e14f079d7a0 (\"selftests/fuse: add fuse symlink caching test\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/r/202610170822.oEJ1Autq-lkp@intel.com/\nLink: https://lore.kernel.org/r/20261001164916.15311-8-luis@igalia.com\nOriginally-by: Luis Henriques \u003cluis@igalia.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nReviewed-by: Luis Henriques \u003cluis@igalia.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1ea806165ec5fb8bca5d9990392fdb4f53a97977", "tree": "d21ac8a42bd7b28b5624aade8989bd316508aa72", "parents": [ "960994f5d1883b6a293f66a886cf2e42be7b8669" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Mon Oct 26 11:26:50 2026 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:22:37 2026 -1000" }, "message": "fuse: fix link error with CONFIG_FUSE_PASSTHROUGH\u003dn\n\nCommit 2f19d54c055d (\"fuse: support 64 bit, server allocated backing ID\")\nmoved the CONFIG_FUSE_PASSTHROUGH check out of the backing ioctl handlers\nand into fuse_get_conn_for_passthrough(). The calls from the handlers\ninto backing.c, which is only built with CONFIG_FUSE_PASSTHROUGH, are now\nonly removed if the compiler inlines that helper. It does not have to,\nand with gcc 11 and CONFIG_CC_OPTIMIZE_FOR_SIZE it doesn\u0027t:\n\n dev.c:(.text+0x355c): undefined reference to `fuse_backing_open\u0027\n nios2-linux-ld: dev.c:(.text+0x3594): undefined reference to `fuse_backing_open_64\u0027\n nios2-linux-ld: dev.c:(.text+0x35d0): undefined reference to `fuse_backing_close\u0027\n\nCheck CONFIG_FUSE_PASSTHROUGH in each handler again, as\nfuse_notify_backing_remove() does. The check still comes after the\nfuse_get_dev() and -ENOTCONN checks, so the errors userspace sees do not\nchange.\n\nFixes: 2f19d54c055d (\"fuse: support 64 bit, server allocated backing ID\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202610171310.uqRzJkIx-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202610260719.sj08mXBr-lkp@intel.com/\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "960994f5d1883b6a293f66a886cf2e42be7b8669", "tree": "1efa318d0084ff80e58eec3556aefb0999c04553", "parents": [ "e823910506ff3a34fb2966a9ecccc4019b2154dd" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Tue Oct 20 12:13:46 2026 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:22:36 2026 -1000" }, "message": "xprtrdma: fix up the nfs/nfs-anna merge of the Write chunk head trim\n\nTwo fixes for the same Write chunk payload corruption meet in\nlinux-next. In the nfs tree, commit a0db57fee35e (\"xprtrdma: Fix Write\nchunk payload corruption on a short reply header\") trims\nhead[0].iov_len in rpcrdma_decode_msg(). In the nfs-anna tree,\ncommit 9ee534a75912 (\"xprtrdma: trim head iovec when the payload\narrives via a Write chunk\") trims it in rpcrdma_inline_fixup() and\nreduces buflen by the same amount.\n\nThe merge resolution keeps the caller-side trim. By the time\nrpcrdma_inline_fixup() runs, head[0].iov_len already equals copy_len,\nso the block added by the nfs-anna commit never runs and its buflen\nreduction in rq_rcv_buf and rq_private_buf is lost. The helper is also\nstill passed xdr_pad_size(writelist), while its kernel-doc now\ndescribes @writelist as the number of bytes conveyed by the Write\nchunk.\n\nDrop the caller-side trim and pass the full Write chunk length, so\nthat rpcrdma_inline_fixup() is the only place that trims head[0] and\nreduces buflen. Compute the pad with xdr_pad_size() in the helper, so\nthe padding from the nfs commit stays correct for lengths that are not\na multiple of four. Its rpclen calculation and empty reply check stay\nin rpcrdma_decode_msg().\n\nFixes: 53ab189bdc14 (\"Merge branch \u0027linux-next\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs.git\")\nLink: https://lore.kernel.org/all/as4aacUf2Q78FMvY@sirena.org.uk/\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nTested-by: Tim Menninger \u003ctmenninger@everpuredata.com\u003e\nReviewed-by: Tim Menninger \u003ctmenninger@everpuredata.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e823910506ff3a34fb2966a9ecccc4019b2154dd", "tree": "33de8e146b29204475466f65e976ef1d680cf89a", "parents": [ "453ebbefe2e504057cdcd0e422ba39ed8b99434f", "e58096244338308dde3fa76982c8042981ddda52" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:11:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:11:27 2026 -1000" }, "message": "Merge tag \u0027kbuild-fixes-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nathan Chancellor:\n\n - Move probing of \u0027-mfentry\u0027 back into Makefile instead of Kconfig\n because it does not interact well with toolchains that support\n multiple bit widths\n\n - Add a big comment in scripts/Kconfig.toolchain of two pitfalls when\n moving cc-option checks from Kbuild to Kconfig\n\n* tag \u0027kbuild-fixes-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild\n kbuild: Move testing of \u0027-mfentry\u0027 back to Makefile from Kconfig\n" }, { "commit": "453ebbefe2e504057cdcd0e422ba39ed8b99434f", "tree": "e6a1617e65a3ba6b3656116617649ab644780e01", "parents": [ "b92f6e90cf056ec80bafb858d5749829a55ac75e", "5b598ba5f3bf367944956cee59c6d078c53ca694" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:09:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 14:09:26 2026 -1000" }, "message": "Merge tag \u0027ktest-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest\n\nPull ktest updates from Steven Rostedt:\n\n - Sort configs before writing config file\n\n Currently the .config file is created from the perl hash array from\n reading the applied min-configs. The order is determined by how perl\n hashes the values. This causes the .config file to be created in\n different orders for each run, and the order may determine the final\n value of the .config file after it goes through a make oldconfig.\n\n Sort the values when creating the .config so that the result is the\n same for every run.\n\n - Add total test time to run output\n\n Have ktest display the total test time of running all the tests. This\n is useful to find issues in the build, install, boot or test run\n where things are hanging for longer than expected.\n\n - Update reading of the git output during bisect\n\n The ktest bisect is an automated way to run git bisect. Since there\n currently no easy way to know if the bisect found the bad commit (I\u0027m\n talking with the git maintainers to fix this[1]), it parses the\n output for the line \"is first bad commit\". But a recent update to git\n has the output state \"is the first \u0027bad\u0027 commit\" which breaks ktest\n bisect.\n\n Have ktest handle both output strings.\n\n [1] https://lore.kernel.org/all/20261020141011.0015d172@gandalf.local.home/\n\n* tag \u0027ktest-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest:\n ktest: Accept quoted bad term in git bisect output\n ktest.pl: Add total test run time to output\n ktest: Sort config keys before writing config files\n" }, { "commit": "b92f6e90cf056ec80bafb858d5749829a55ac75e", "tree": "8323bbba29b8ea88affcf1be7a3c67f91f0542ad", "parents": [ "51b4bf5fe7c90ebf08599b9a3c7620b4a3fd4b22", "f94ed3d7cba3c83eef50b1a96d630d63cf54f69c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:48:47 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:48:47 2026 -1000" }, "message": "Merge tag \u0027drm-next-2026-10-31\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"The final set of merge window fixes, from AMD mostly. with one set of\n panthor mmu fixes.\n\n amdgpu:\n - UALink fixes\n - Runtime PM fixes\n - GPUVM fixes\n - Mac fixes\n - HDMI fixes\n - DP MST fix\n - Userptr fix\n - SMU fixes\n - DSC fix\n - VCE/UVD sched teardown fix\n - Display runpm reference fix\n - Display TD-LUT fix\n - SMU 13.x fixes\n - SMU 14.x fixes\n - Gang submit fix\n - Passive DVI sink fix\n - USB4 tunnel fix\n - Freesync fix\n\n amdkfd:\n - SVM fixes\n - Fix doorbell allocation race\n - GC 12.1 fix\n - GPU reset fix\n - Buffer accounting fixes\n - Bounds checking fixes\n - Hotplug fixes\n - SVM fixes\n - CRIU fixes\n - GFX12 fix\n\n panthor:\n - Fix bugs in MMU handling\"\n\n* tag \u0027drm-next-2026-10-31\u0027 of https://gitlab.freedesktop.org/drm/kernel: (52 commits)\n drm/amd/display: refresh cached HDMI FreeSync state\n drm/amd/display: Cap DSC bpp for USB4 DP tunnels\n drm/amd/display: Poll passive DVI sinks for EDID readiness\n drm/amdgpu: re-enable GFXOFF for compute on GFX12\n drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO\n drm/amdgpu: drop the gang leader reference when freeing gang jobs\n drm/amdkfd: send SMI process and VM fault events only to allowed clients\n drm/amdkfd: validate SRAT subtables before parsing\n drm/amd/pm: preserve committed OD features for SMU 14.0.2\n drm/amd/pm: add zero fan stop temperature support on smu 14.0.2\n drm/amd/pm: preserve committed OD features for SMU 13.0.0/13.0.7\n drm/amd/display: Initialize missing TD-LUT programming inputs\n drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping\n drm/amdgpu: reject CS chunks too large for kvmalloc()\n drm/amd/display: take a runtime PM reference only when a CRTC turns on\n drm/amdgpu: guard VCE/UVD sched entity teardown on failed probe\n drm/amdkfd: stop restore retries on device unplug\n drm/amdkfd: tear down KFD processes before early fini_sw on disconnect\n drm/amdkfd: Validate the control stack of a restored queue\n drm/amdkfd: correct vram_available calculation\n ...\n" }, { "commit": "51b4bf5fe7c90ebf08599b9a3c7620b4a3fd4b22", "tree": "38aee3d3c4404c68b53bbe5368fa799cb60d3f13", "parents": [ "69eac8481741b1474eac7c459768c94bb94430e1", "ddc7a7e1eeb116ccaf010a6f1fb6ab927f3f888d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:40:03 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:40:03 2026 -1000" }, "message": "Merge tag \u0027cifs-fixes-7.4-rc1\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - Validate the offsets and lengths a server puts in its responses\n before using them, so that a malicious or broken server can no longer\n make the client read past the received data:\n - POSIX lock data (which leaked kernel bytes through F_GETLK)\n - NT transaction responses and SMB1 EA lists (both wrapping their\n pointer checks on 32-bit)\n - short SESSION_SETUP responses (which sent stale buffer content\n back to the server in the NTLMv2 AUTHENTICATE message)\n - SMB2 READ data areas\n - empty truncated fiemap responses\n\n - Fix a heap overflow in SMB2_tcon() with UNC paths longer than\n MAX_SHARENAME_LENGTH\n\n - Fix a slab-out-of-bounds write when chmod() rewrites a security\n descriptor that needs more room than was reserved\n\n - Fix a use-after-free of the server info between the cifsd thread and\n the release of the last session reference (reported by syzbot)\n\n - Fix a use-after-free in the demultiplex thread when a receive error\n reconnects and frees the read request still being processed\n\n - Fix a double teardown of a tcon that the cached directory laundromat\n took a reference on while it was being freed\n\n - Fix a NULL pointer dereference when /proc/fs/cifs/DebugData is read\n while the module is still initializing\n\n* tag \u0027cifs-fixes-7.4-rc1\u0027 of https://git.manguebit.org/linux:\n smb: client: validate SMB1 EA list bounds before parsing\n smb: client: stop processing a read response after a receive error\n smb: client: don\u0027t resurrect an exiting tcon from cached dir workers\n smb: client: fix early procfs exposure race\n smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()\n smb: client: hold server info until cifsd exits\n smb: client: fix fiemap wild read on empty truncated response\n smb: client: validate the data area in SMB2_read()\n smb: client: reject short SESSION_SETUP responses\n smb: client: fix buffer overflow in SMB2_tcon()\n smb: client: validate NT transaction response layout and offsets\n smb: client: bound POSIX lock data area by response length\n" }, { "commit": "69eac8481741b1474eac7c459768c94bb94430e1", "tree": "dd0ac7ac8967ffa3ceb8ab3ad1811f24e265fd8f", "parents": [ "a9547379cb381e2a036e3261a6becc17973ac470", "c349b233d6ab0fc3517401a1e2d36f5f90eb8c9b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:38:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:38:02 2026 -1000" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity fixes from Eric Biggers:\n \"Fixes for several bugs found by LLMs:\n\n - Fix bypass of IPE\u0027s fsverity support, and a use-after-free in\n certain cases, when FS_IOC_ENABLE_VERITY fails when almost done\n\n - Fix FS_IOC_MEASURE_VERITY and FS_IOC_READ_VERITY_METADATA to no\n longer bypass Landlock and AppArmor\u0027s read permission checks\n\n - Be robust against the filesystem returning different values for a\n file\u0027s verity descriptor length in two successive queries\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n fsverity: Set S_VERITY only after rollback is no longer possible\n fsverity: Tell LSMs about signature only after verity is enabled\n fsverity: Be more careful with return value of -\u003eget_verity_descriptor()\n fsverity: Explicitly require FMODE_READ to retrieve hashes\n" }, { "commit": "a9547379cb381e2a036e3261a6becc17973ac470", "tree": "b1281904d60282880afdd58ed10f73704bc28d89", "parents": [ "7306ea08c00efaf6406281bd113f7d657be2e6c8", "4358090906b01806ee483229e8d7163b806bd116" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:28:58 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:28:58 2026 -1000" }, "message": "Merge tag \u0027thermal-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control fixes from Rafael Wysocki:\n \"These fix three issues related to thermal control:\n\n - Fix CPU mask truncation in power limit trace event used by the\n power allocator thermal governor (Hungyu Lin)\n\n - Fix code indentation in create_s32_tzp_attr() and rearrange it to\n use early return when applicable (Thorsten Blum)\n\n - Allow cross builds of the Intel thermal tests (Sasha Levin)\"\n\n* tag \u0027thermal-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n thermal: sysfs: Fix indentation in create_s32_tzp_attr()\n thermal: Fix CPU mask truncation in power limit trace event\n selftests/thermal: allow cross builds of the Intel tests\n" }, { "commit": "7306ea08c00efaf6406281bd113f7d657be2e6c8", "tree": "c2a2a24ed420f2e380ae542628fbfba185eca543", "parents": [ "e3e15872e77f3feecd831eccfb753b9af916f387", "018f42c9ac5fa9701fc09514ed0739ab72708331" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:22:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:22:02 2026 -1000" }, "message": "Merge tag \u0027pm-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These address assorted issues in the power management code and update\n documentation:\n\n - Fix potential out-of-bounds access in deferred reset in the cpufreq\n statistics code (Zhongqiu Han)\n\n - Cancel HWP notify work in the intel_pstate driver cleanup to\n prevent possible use-after-free from occurring (Tristan Madani)\n\n - Adjust state names and descriptions for ACPI _LPI idle states in\n the intel_idle driver to make them follow the driver\u0027s idle state\n naming convention (Rafael Wysocki)\n\n - Document the new pm_runtime_use_autosuspend() undo mechanism that\n triggers automatically on driver exit (Joshua Crofts)\n\n - Do not call suspend_ops-\u003ebegin()/end() for suspend-to-idle to avoid\n driver confusion (Ovidiu Panait)\n\n - Make the energy model management code allocate the cpumask for\n non-CPU perf domains to prevent out-of-bounds reads from occurring\n in the EM netlink interface (Karl Mehltretter)\"\n\n* tag \u0027pm-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n PM: runtime: clarify pm_runtime_use_autosuspend() undo mechanism\n cpufreq: stats: Fix potential out-of-bounds access in deferred reset\n PM: suspend: Do not call suspend_ops-\u003ebegin()/end() for s2idle\n intel_idle: Adjust state names and descriptions for _LPI states\n PM: EM: allocate the cpumask for every perf domain\n cpufreq: intel_pstate: cancel HWP notify work in driver cleanup\n" }, { "commit": "e3e15872e77f3feecd831eccfb753b9af916f387", "tree": "31fede01214b37fcc15994046772c554b8c357e8", "parents": [ "17fa96334e15c6b38e8d9dd3627f3a6c5ca034f8", "3f971ee94fb57377f0a9d5a8d190d1d465ac6b80" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:10:30 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 13:10:30 2026 -1000" }, "message": "Merge tag \u0027acpi-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n \"These address assorted issues in ACPI support code and work around\n concurrency-related issues in AML on some platforms:\n\n - Separate handler locking from sysfs lifetime in the ACPI platform\n profile driver to avoid possible deadlocks due to sysfs accesses\n during driver removal (Daniel Lezcano)\n\n - Introduce additional locking around the evaluation of selected ACPI\n control methods in a few places to work around issues related to\n concurrency in AML on some platforms (Ali Ahmet Memiş)\n\n - Address two issues reported by Sashiko in the ACPI table data sysfs\n interface (Jamie Nguyen)\n\n - Initialize parser_state.aml_end in acpi_install_method() properly\n to avoid out-of-bounds accesses during control method installation\n (Ivan Hu)\"\n\n* tag \u0027acpi-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: sysfs: Finish sysfs init when creating a table file fails\n ACPI: sysfs: Map only the requested range in acpi_data_show()\n ACPICA: Initialize parser_state.aml_end in acpi_install_method()\n ACPI: platform_profile: Separate handler locking from sysfs lifetime\n platform/x86: ideapad-laptop: Evaluate ACPI methods exclusively\n thermal: intel: int340x: Evaluate _TMP exclusively\n ACPI: battery: Evaluate battery methods exclusively\n ACPI: utils: Add exclusive AML evaluation helpers\n" }, { "commit": "7485659ecb81d5fce3a3edf2cae9fcb29c17b1cd", "tree": "557b8e0ca608d376cdf7c6ffd554ec5951d6e3d1", "parents": [ "42602b834325ef7b78c27f45d4cfd91bfe1b7d5f" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:35 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:23:31 2026 +0100" }, "message": "rtc: rs5c372: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in sysfs show callbacks\n(rs5c372_sysfs_show_trim and rs5c372_sysfs_show_osc) to conform to the\nrecommended sysfs attribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-12-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "42602b834325ef7b78c27f45d4cfd91bfe1b7d5f", "tree": "7aef7c808c7dd3b62403de188bcff4ed1133d056", "parents": [ "26e2f34b862c6f8cbaab6023ccc58021bb3ac4ee" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:34 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:23:31 2026 +0100" }, "message": "rtc: ds1307: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in the sysfs show callback\n(ds3231_hwmon_show_temp) to conform to the recommended sysfs attribute\nformatting guidelines in Documentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-11-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "26e2f34b862c6f8cbaab6023ccc58021bb3ac4ee", "tree": "7282c8c134ff795832b1b4703bd3c6d4387666f8", "parents": [ "edd541b0fff4e38f019f92939d97e5a604f80a23" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:33 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:23:31 2026 +0100" }, "message": "rtc: isl1208: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in sysfs show callbacks\n(timestamp0_show, isl1208_sysfs_show_atrim, isl1208_sysfs_show_dtrim\nand isl1208_sysfs_show_usr) to conform to the recommended sysfs\nattribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-10-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "edd541b0fff4e38f019f92939d97e5a604f80a23", "tree": "03b5e6a37c885289636a468c0110b1aa79ba4df3", "parents": [ "67b3eadfb80dee4dfd56ca624f33e2ac7ed5987a" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:32 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:23:31 2026 +0100" }, "message": "rtc: ds1685: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in sysfs show callbacks\n(ds1685_rtc_sysfs_battery_show, ds1685_rtc_sysfs_auxbatt_show and\nds1685_rtc_sysfs_serial_show) to conform to the recommended sysfs\nattribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nAcked-by: Joshua Kinard \u003clinux@kumba.dev\u003e\nLink: https://patch.msgid.link/20261029132339.925021-9-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "67b3eadfb80dee4dfd56ca624f33e2ac7ed5987a", "tree": "dafade2500542679b307e84135ab42e4743f273a", "parents": [ "c0b38531ddc5e5a361d8e5e8315588e856bb2924" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:31 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:23:31 2026 +0100" }, "message": "rtc: ds1343: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in sysfs show callbacks\n(ds1343_show_glitchfilter and ds1343_show_tricklecharger) to conform\nto the recommended sysfs attribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-8-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "c0b38531ddc5e5a361d8e5e8315588e856bb2924", "tree": "389526d9a48ca773eadd999edb8a50491e2c7a57", "parents": [ "0f3bc1c937276458786dc85aaa47142555fe6725" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:30 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:23:31 2026 +0100" }, "message": "rtc: rx8025: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in the sysfs show callback\n(rx8025_sysfs_show_clock_adjust) to conform to the recommended sysfs\nattribute formatting guidelines in Documentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-7-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "0f3bc1c937276458786dc85aaa47142555fe6725", "tree": "67f9f5fba783753a8b015765b8ab86d48cceb422", "parents": [ "187c4ed20a5636105ae88b28351fc4b730506bc0" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:28 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:22:57 2026 +0100" }, "message": "rtc: x1205: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in sysfs show callbacks\n(x1205_sysfs_show_atrim and x1205_sysfs_show_dtrim) to conform to the\nrecommended sysfs attribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-5-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "187c4ed20a5636105ae88b28351fc4b730506bc0", "tree": "2dddbaead662b6551eb0def6f1b83252dbbad4be", "parents": [ "946584fe01b840625ce26a5a9b91875cad009fae" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:27 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:22:57 2026 +0100" }, "message": "rtc: bq32k: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in the sysfs show callback\n(bq32k_sysfs_show_tricklecharge_bypass) to conform to the recommended\nsysfs attribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-4-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "946584fe01b840625ce26a5a9b91875cad009fae", "tree": "df8088afc45f4ff5271d02a29aedac5556c644b8", "parents": [ "8d2735de39daebb862542b8f340481bf2f506e9e" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:26 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:22:57 2026 +0100" }, "message": "rtc: ep93xx: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in sysfs show callbacks\n(comp_preload_show and comp_delete_show) to conform to the\nrecommended sysfs attribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-3-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "8d2735de39daebb862542b8f340481bf2f506e9e", "tree": "b701312852bb8d033dabffa7468e717f0fe86578", "parents": [ "bc9a04e1e1d8931bc5bf9d96937477b8c6259f6b" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:25 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:22:56 2026 +0100" }, "message": "rtc: pcf2127: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in the sysfs show callback\n(timestamp_show) to conform to the recommended sysfs attribute\nformatting guidelines in Documentation/filesystems/sysfs.rst.\n\nReviewed-by: Bruno Thomsen \u003cbruno.thomsen@gmail.com\u003e\nLink: https://patch.msgid.link/20261029132339.925021-2-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "bc9a04e1e1d8931bc5bf9d96937477b8c6259f6b", "tree": "7ea48799865d66eab4bdb438d533f73962cb9349", "parents": [ "3b6cdc36553b1fe627f782a7f5efe5ffc806faa1" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Oct 29 14:23:24 2026 +0100" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 23:22:56 2026 +0100" }, "message": "rtc: rv3029: use sysfs_emit() instead of sprintf()\n\nUse sysfs_emit() instead of sprintf() in sysfs show callbacks\n(rv3029_hwmon_show_temp and rv3029_hwmon_show_update_interval) to\nconform to the recommended sysfs attribute formatting guidelines in\nDocumentation/filesystems/sysfs.rst.\n\nLink: https://patch.msgid.link/20261029132339.925021-1-alexandre.belloni@bootlin.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "3b6cdc36553b1fe627f782a7f5efe5ffc806faa1", "tree": "e182a34ea15c1513538a5699be1a6d12be133f11", "parents": [ "21a829af60a7f5c7456f1f0ff9b6b0eff0ceb738" ], "author": { "name": "Imre Kaloz", "email": "kaloz@kernel.org", "time": "Tue Oct 13 14:02:08 2026 +0200" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 21:38:05 2026 +0100" }, "message": "rtc: ds1685: keep setting PAB until power is removed\n\nA kickstart or wake-up flag set while its interrupt is enabled (KF with\nKSE, WF with WIE) clears PAB, and the system stays powered. Clear the\nevent flags together with setting PAB, and repeat the write until power\nis gone.\n\nSigned-off-by: Imre Kaloz \u003ckaloz@kernel.org\u003e\nAcked-by: Joshua Kinard \u003clinux@kumba.dev\u003e\nLink: https://patch.msgid.link/20261013120208.11268-4-kaloz@kernel.org\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "21a829af60a7f5c7456f1f0ff9b6b0eff0ceb738", "tree": "a81cfc56ebbb7df06c96073a503516717cc8bf42", "parents": [ "c2373bcd50d9654b76eac585c7c98105665b3321" ], "author": { "name": "Imre Kaloz", "email": "kaloz@kernel.org", "time": "Tue Oct 13 14:02:07 2026 +0200" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 21:38:05 2026 +0100" }, "message": "rtc: ds1685: do not sleep in the power-off handler\n\nPower-off handlers run from an atomic notifier chain and must not\nsleep. Use mdelay() for the delay before setting PAB.\n\nFixes: aaaf5fbf56f1 (\"rtc: add driver for DS1685 family of real time clocks\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/sashiko-outbox-169477@kernel.org/\nSigned-off-by: Imre Kaloz \u003ckaloz@kernel.org\u003e\nAcked-by: Joshua Kinard \u003clinux@kumba.dev\u003e\nLink: https://patch.msgid.link/20261013120208.11268-3-kaloz@kernel.org\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "c2373bcd50d9654b76eac585c7c98105665b3321", "tree": "2fe3f7ff6b0bb5ee024e9fc333d6239a1fe85d0c", "parents": [ "55bb5877494d6c99898b959aa593663ce4676f4e" ], "author": { "name": "Imre Kaloz", "email": "kaloz@kernel.org", "time": "Tue Oct 13 14:02:06 2026 +0200" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Oct 30 21:38:05 2026 +0100" }, "message": "rtc: ds1685: arm the wake-up alarm at power-off only if an alarm is set\n\nds1685_rtc_poweroff() always sets WIE. The wake-up alarm then compares\nthe time-of-day and date alarm registers, which hold whatever was last\nwritten to them, and a match powers the machine straight back on.\n\nSet WIE only when AIE is set in Control B, and clear it otherwise.\n\nFixes: aaaf5fbf56f1 (\"rtc: add driver for DS1685 family of real time clocks\")\nSigned-off-by: Imre Kaloz \u003ckaloz@kernel.org\u003e\nAcked-by: Joshua Kinard \u003clinux@kumba.dev\u003e\nLink: https://patch.msgid.link/20261013120208.11268-2-kaloz@kernel.org\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "4358090906b01806ee483229e8d7163b806bd116", "tree": "79868774c636945a21bf6d244cdb2dc9eaae5598", "parents": [ "361da59d7909a63b978fa1cd19cde65c34c86ffd", "ff4194e54f840b4df4eb2489c63ee88283895efc" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Oct 30 20:59:25 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Oct 30 20:59:25 2026 +0100" }, "message": "Merge branch \u0027thermal-intel\u0027\n\nMerge a fix for Intel thermal tests for 7.4-rc1:\n\n - Allow cross builds of the Intel thermal tests (Sasha Levin)\n\n* thermal-intel:\n selftests/thermal: allow cross builds of the Intel tests\n" }, { "commit": "17fa96334e15c6b38e8d9dd3627f3a6c5ca034f8", "tree": "5260bdaf3379444d54901567005349f77e5935e6", "parents": [ "6e07889d8fedf729282ed14ff202e06dbb67444b", "1689c80fca308978ea1c9f03d15a500f4e44e2e1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:48:45 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:48:45 2026 -1000" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull more KVM updates from Paolo Bonzini:\n \"ARM64:\n\n - Fix a couple of embarrassing merge mistakes in kvmarm-7.4\n\n - Cleanup the HCR_EL2 bit fields to exclusively use the generated\n definitions, fixings a nasty regression introduced in 6.16, where\n barriers were not upgraded from NSH to ISH anymore\n\n - Fix publication of state when a vcpu is forced out of the guest\n\n - Let vcpu pausing nest correctly\n\n - Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the\n architecture\n\n - Don\u0027t warn on SMCCC filter reserved range allocation failure\n\n - Prevent GICv5 and TLBI hypercalls to be used from the host when\n pKVM is active\n\n - Enforce that only GICv3 guests are supported for pKVM\n\n - Don\u0027t try to access GICv5 EL2 sysregs from EL1\n\n - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E\n by checking the feature dependencies\n\n - Require matching VGIC and ITS model\n\n - Cleanup TRACE_REMOTE dependencies\n\n - Fix random comments\n\n ARM64 selftests:\n\n - selftests: Skip unwritable ID fields in the failed-run test\n\n - Move pkvm_selftests() after all CPUs have initialized EL2\n\n RISC-V:\n\n - Allow Zicclsm, Ziccamoa, Ziccif, Za64rs for KVM guest\n\n - Implement KVM_PRE_FAULT_MEMORY ioctl()\n\n - Replace imsic switch-case macros with range checks\n\n RISC-V fixes:\n\n - Avoid redundant interrupt check for pending timers\n\n - Reject vCPU creation after AIA initialization\n\n - Fix build with vector support disabled\n\n - Fix IPI delivery for out-of-order vcpu_id\n\n - Use a raw lock for IMSIC wakeup state\n\n - Reject vCPU creation after AIA initialization\n\n RISC-V selftests:\n\n - Lazy V-extension enablement for KVM selftests\n\n - Show sepc/scause/stval CSRs in KVM selftests vcpu dump\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (42 commits)\n KVM: selftests: Reject GICv3 ITS with a GICv5 VGIC\n KVM: arm64: vgic: Require matching VGIC and ITS models\n KVM: arm64: gic-v5: Drop unused addr variable\n KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E\n KVM: arm64: selftests: Skip unwritable ID fields in the failed-run test\n tracing/remotes: Fix TRACE_REMOTE build when TRACING\u003dn\n KVM: arm64: Move pkvm_selftests() after all CPUs have initialized EL2\n KVM: arm64: Get rid of compatibility HCR_EL2 aliases\n KVM: arm64: Convert HCR_xyz to HCR_EL2_xyz\n KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests\n KVM: arm64: Fix stale VGICv3 comments in the nVHE world switch\n KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1\n KVM: arm64: Validate the host-provided vgic model in pKVM\n KVM: arm64: Reject the stage-2 flush hypercalls under pKVM\n KVM: arm64: Return on kvm_gmem_get_pfn() failure in gmem_abort()\n KVM: riscv: selftest: add Zicclsm, Ziccamoa, Ziccif, Za64rs\n RISC-V: KVM: Allow Zicclsm, Ziccamoa, Ziccif, Za64rs in guest\n MAINTAINERS: name the kvm-riscv/linux riscv_kvm_next branch\n RISC-V: KVM: Don\u0027t write MMIO load result to x0\n RISC-V: KVM: Use a raw lock for IMSIC wakeup state\n ...\n" }, { "commit": "6e07889d8fedf729282ed14ff202e06dbb67444b", "tree": "24fe8a9ae9157959829d30592dcdda7445c9a3a9", "parents": [ "780cb2a5fd64901444878cf5a40c0f2ec54837ce", "f46be4da2cbb17574b5369517a9a1e1b414063b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:46:29 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:46:29 2026 -1000" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n \"Three fixes that turned up during the merging window: shadow stack not\n freed during a failed fork or it is unmapped from parent when a worker\n thread exits (same commit covers both); PTE_CONT set on PROT_NONE\n entries but subsequently ignored by the unfolding code since\n pte_valid() is false (pte_present() is true); an MPAM lock not\n released on the error path.\n\n Summary:\n\n - Release the GCS on a failed fork.\n\n copy_thread() can allocate a GCS for CLONE_VM threads but a later\n copy_process() failure left the VMA in the parent\u0027s mm. Implement\n exit_thread() to free it and stop kernel threads and user workers\n inheriting the parent\u0027s GCS base/size. Add a kselftest for the\n clone3() failure case\n\n - Do not set PTE_CONT on invalid PTEs in contpte_set_ptes().\n\n Batched set_ptes() of present-invalid entries (e.g. PROT_NONE)\n created contpte groups that the single-PTE helpers did not unfold,\n corrupting a neighbouring guard marker via\n test_and_clear_young_ptes()\n\n - Release the MPAM mon_sel lock on the mpam_save_mbwu_state() error\n paths\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n selftests/arm64: GCS must not leak on a failed clone3\n arm64/gcs: release GCS on failed fork\n arm64/mm: restrict transparent contpte mappings to valid PTEs\n arm_mpam: Release the mon_sel lock on mpam_save_mbwu_state() errors\n" }, { "commit": "780cb2a5fd64901444878cf5a40c0f2ec54837ce", "tree": "6e73864dd8b389f706607440fe2ae20629fff686", "parents": [ "8fe8e62f432f0a7a0292a328a73c6912b9a2b73b", "6f8d12bb1a1231dbba579932772701880745a21d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:44:29 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:44:29 2026 -1000" }, "message": "Merge tag \u0027loongarch-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch updates from Huacai Chen:\n\n - Add LoongArch-specific ACPI initialization\n\n - Set NX compat flag in PE/COFF efi header\n\n - Use pa_to_nid()/nid_to_addrbase() rather than hard-code\n\n - Detect and expose LAMCAS/DIV32 feature existence\n\n - Fix and improve perf hardware breakpoints\n\n - Fix and improve BPF JIT (trampoline and 32-bit operations)\n\n - Add arch_crash_save_vmcoreinfo() support\n\n - Some bug fixes and other small changes\n\n* tag \u0027loongarch-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (24 commits)\n soc: loongson: loongson2_guts: Use of_root instead of own reference\n soc: loongson: loongson2_pm: Fix build warnings for 32BIT\n LoongArch: dts: loongson-2k0500: Drop unsupported bus_id in DWMAC\n LoongArch: BPF: Optimize 32-bit operations using native instructions\n LoongArch: BPF: Clean up and decouple is32 parameter from move_imm()\n LoongArch: BPF: Fix stack arguments for indirect trampolines\n LoongArch: Add arch_crash_save_vmcoreinfo() support\n LoongArch: Fix one-shot limitation for perf hardware breakpoints\n LoongArch: Fix perf hardware breakpoint failure via installation\n LoongArch: Only send SIGTRAP signal if necessary in do_watch()\n LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP\n LoongArch: Fix bitmask corruption in update_bp_registers()\n LoongArch: Remove redundant call in update_bp_registers()\n LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic()\n LoongArch: Detect and expose DIV32 feature existence\n LoongArch: Detect and expose LAMCAS feature existence\n LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code\n LoongArch: Don\u0027t init \u0026 online empty nodes\n LoongArch: Call cpu_final_simd() with pure_initcall()\n LoongArch: Use assign_bit() API where applicable\n ...\n" }, { "commit": "018f42c9ac5fa9701fc09514ed0739ab72708331", "tree": "c132ee806455665b2569f9534a148feeaf37cdc3", "parents": [ "6c7a7007c5b7566fba4fbee1d40011fb8f833dc3", "8a702989677216489e471a6f27599da53f753567", "4035247966859152a6523bc041f81cb9905695a5", "1faca2d1ed7d28f4156690cda43a9814e22b4460", "4785d5faa935a828a04743c5a7d279baf454c723" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Oct 30 20:43:06 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Oct 30 20:43:06 2026 +0100" }, "message": "Merge branches \u0027pm-cpufreq\u0027, \u0027pm-cpuidle\u0027, \u0027pm-runtime\u0027 and \u0027pm-sleep\u0027\n\nMerge assorted power management fixes for 7.4-rc1:\n\n - Fix potential out-of-bounds access in deferred reset in the cpufreq\n statistics code (Zhongqiu Han)\n\n - Cancel HWP notify work in the intel_pstate driver cleanup to prevent\n possible use-after-free from occurring (Tristan Madani)\n\n - Adjust state names and descriptions for ACPI _LPI idle states in the\n intel_idle driver to make them follow the driver\u0027s idle state naming\n convention (Rafael Wysocki)\n\n - Document the new pm_runtime_use_autosuspend() undo mechanism that\n triggers automatically on driver exit (Joshua Crofts)\n\n - Do not call suspend_ops-\u003ebegin()/end() for suspend-to-idle to avoid\n driver confusion (Ovidiu Panait)\n\n* pm-cpufreq:\n cpufreq: stats: Fix potential out-of-bounds access in deferred reset\n cpufreq: intel_pstate: cancel HWP notify work in driver cleanup\n\n* pm-cpuidle:\n intel_idle: Adjust state names and descriptions for _LPI states\n\n* pm-runtime:\n PM: runtime: clarify pm_runtime_use_autosuspend() undo mechanism\n\n* pm-sleep:\n PM: suspend: Do not call suspend_ops-\u003ebegin()/end() for s2idle\n" }, { "commit": "8fe8e62f432f0a7a0292a328a73c6912b9a2b73b", "tree": "cf25fe382ecb05c523b6e139ff7ad81d43f5e27f", "parents": [ "0c8bf38058e5ac0e42246acb13f623b7962a3922", "823d21c78453fcdf58dbd8ecefbb41f4f3eb6540" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:42:10 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:42:10 2026 -1000" }, "message": "Merge tag \u0027ceph-for-7.4-rc1\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph updates from Ilya Dryomov:\n \"The two things of note here are the disablement of inline data support\n and a new lazyio mount option to enable LAZYIO behavior globally\n (instead of via an ioctl on a per-file basis), both from Xiubo.\n\n Despite being over a decade old, the inline data feature never lost\n its experimental status -- it has always been off by default and\n required passing --yes-i-really-mean-it flag to be turned on. It was\n officially deprecated in 2020 and is now in the process of being\n removed on the MDS side. For now it\u0027s still possible to re-enable it\n in Kconfig, but the code will eventually be dropped from the kernel\n client entirely.\n\n Outside of that we have a number of bug fixes, a series from Tal to\n help phase out older page APIs, some cleanups from Max and a large\n pile of LLM-based hardening patches.\n\n Xiubo is also back in a maintainer role, replacing Slava\"\n\n* tag \u0027ceph-for-7.4-rc1\u0027 of https://github.com/ceph/ceph-client: (66 commits)\n ceph: fix uninitialized err in ceph_netfs_issue_read()\n MAINTAINERS: update ceph and libceph maintainers\n ceph: validate encoded xattr name lengths\n ceph: validate MDS reply fragtree split array length\n ceph: bound name skips in ceph_mdsmap_decode() by the message end\n ceph: validate fscrypt auth blob length\n ceph: check the caps of a closed file after caps_wanted_delay_min\n ceph: don\u0027t fail write_begin with -EAGAIN after flushing old snapc\n ceph: fail readdir when the MDS reply carries no dirfrag\n ceph: clamp MDS reply result code to the errno range\n libceph: initialize CRUSH choose argument weights\n libceph: fix out-of-bounds reads from repeated CRUSH bucket entries\n ceph: fix 32-bit overflow in readdir reply count check\n libceph: reject bad connect_seq in msgr1 READY reply\n ceph: Fix mds session leak in __open_export_target_session()\n ceph: Fix xattr buffer leak in __send_cap()\n ceph: fix integer overflow in the snap trace bounds check\n libceph: bound mon_command ack decode to front len\n ceph: use alloc_page() in fill_fscrypt_truncate()\n libceph: use alloc_page() in ceph_alloc_page_vector()\n ...\n" }, { "commit": "3f971ee94fb57377f0a9d5a8d190d1d465ac6b80", "tree": "c9541f9c21f977ee9f2589eb8eb15fcbea66fcd1", "parents": [ "ec696f34774db985841bac9a2df179c0040ef073", "b66621ad2a8fb553c4cb75b9d69fead4f0532933", "f54ec8af333761e3bf6c2d347e1053d9fca8db6e" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Oct 30 20:25:24 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Oct 30 20:25:24 2026 +0100" }, "message": "Merge branches \u0027acpi-driver\u0027 and \u0027acpi-sysfs\u0027\n\nMerge additional updates related to ACPI support in device drivers and\nACPI sysfs interface fixes for 7.4-rc1:\n\n - Separate handler locking from sysfs lifetime in the ACPI platform\n profile driver (Daniel Lezcano)\n\n - Introduce additional locking around the evaluation of selected ACPI\n control methods in a few places to work around issues related to\n concurrency in AML on some platforms (Ali Ahmet Memiş)\n\n - Address two issues reported by Sashiko in the ACPI table data sysfs\n interface (Jamie Nguyen)\n\n* acpi-driver:\n ACPI: platform_profile: Separate handler locking from sysfs lifetime\n platform/x86: ideapad-laptop: Evaluate ACPI methods exclusively\n thermal: intel: int340x: Evaluate _TMP exclusively\n ACPI: battery: Evaluate battery methods exclusively\n ACPI: utils: Add exclusive AML evaluation helpers\n\n* acpi-sysfs:\n ACPI: sysfs: Finish sysfs init when creating a table file fails\n ACPI: sysfs: Map only the requested range in acpi_data_show()\n" }, { "commit": "0c8bf38058e5ac0e42246acb13f623b7962a3922", "tree": "044e1a04a596588cd8efae045969cb2f84002447", "parents": [ "abf8c33470f78e2226ee3dcdc69004660020ab47", "a522dd871024a0f065bfa7638afdb929607f58fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:25:01 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 09:25:01 2026 -1000" }, "message": "Merge tag \u0027vfs-7.4-rc1.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - writeback:\n\n - Update dirtied_when instead of dirtied_time_when when a wb switch\n puts an inode at the newest end of the target b_dirty list. The\n list was left out of order so move_expired_inodes() could stop\n before older inodes, and the lazytime expiration timestamp was\n reset\n\n - Clear the old wb\u0027s dirty-I/O state and bandwidth contribution when\n a batch of inode switches leaves its dirty lists empty. An empty\n wb stayed scheduled for periodic writeback and inflated\n bdi-\u003etot_write_bandwidth\n\n - Take wb_switch_rwsem across the inode scan of\n cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned\n inodes let a scan racing a sync()\u0027s queue_io() move lazytime\n inodes past the sync\u0027s cutoff, so sync() returned without\n persisting their timestamps\n\n - Don\u0027t kick writeback for an IOCB_DONTCACHE write on an inode that\n has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE\n write to a block device dereferenced NULL\n\n - statmount/listmount/listns:\n\n - Refuse statmount() string requests with a buffer that isn\u0027t larger\n than struct statmount\n\n - Don\u0027t wrap around with a U64_MAX cursor in listmount() and\n listns()\n\n - Don\u0027t end listns() at an inactive namespace\n\n - Only add init_ipc_ns and init_net to the namespace trees if\n CONFIG_IPC_NS and CONFIG_NET_NS are enabled\n\n - iomap:\n\n - Only mark blocks uptodate in __iomap_write_begin() after reading\n them and let __iomap_write_end() mark the zeroed blocks uptodate\n once the copy from userspace succeeded\n\n - Check a chunk against max_integrity_io_size() on its own before\n the bio size check\n\n - Only enforce block alignment for direct I/O into holes and\n unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set\n\n - backing-file:\n\n - Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE\n passthrough opens the backing file with vfs_open() which skips\n may_open(), so anyone who may open the FUSE file for writing could\n overwrite an append-only backing file anywhere or write to an\n immutable one. Open, mmap and writes now check the backing inode\n the way may_open() and do_mmap() do\n\n - Always call kiocb_end_write() for a queued write\n\n - Let backing files inherit FMODE_NONOTIFY from the user file. The\n event fds fanotify creates for permission events on a stacked\n filesystem raised FS_OPEN_PERM on the real path from inside the\n listener\u0027s read() and deadlocked listeners with marks on both\n layers\n\n - pidfs:\n\n - Look the task up before checking for exit information in\n PIDFD_GET_INFO and start over if the task no longer owns the pid\n once all fields have been read. A caller racing release_task() got\n neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the\n exit information was available, and a caller racing a sub-thread\u0027s\n exec reported that thread\u0027s tid as the pid\n\n - Clear the mask bits of fields that lie beyond the struct size the\n caller passed. The uapi header promises that the mask names no\n such field but a caller passing PIDFD_INFO_SIZE_VER0 got the\n coredump and supported mask bits set for fields that were never\n written\n\n - aio:\n\n - Give the aio ring a -\u003eread_folio that fails with EIO so a fault on\n a ring whose file was truncated gets SIGBUS instead of jumping to\n NULL\n\n - Check nr_events against the ring size before doubling it in\n ioctx_alloc()\n\n - splice:\n\n - Only write back an implicit file position in do_splice() when the\n splice helper succeeded. splice doesn\u0027t take f_pos_lock so a\n failed splice restored a stale snapshot over a position that a\n concurrent getdents() had moved. On ext2 the next readdir then\n trusted an offset inside a directory entry\n\n - Retry tee() when the input pipe was emptied or the output pipe\n filled between the prep steps and link_pipe() instead of returning\n 0 while the input pipe still has writers, as splice_pipe_to_pipe()\n does\n\n - ucount:\n\n - Take the reference that pins a ucounts level on the 0 -\u003e 1\n transition before checking the rlimit\n\n - Read the parent ucounts before dropping the rlimit count in\n do_dec_rlimit_put_ucounts()\n\n - inode:\n\n - Rotate inodes whose page cache couldn\u0027t be dropped to the tail of\n the LRU\n\n - Skip inodes that another LRU walker is isolating\n\n - setns:\n\n - Set nsset-\u003eflags before anything in prepare_nsset() can fail so\n the error path drops the cred prepared for CLONE_NEWUSER. A\n failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it\n together with its user namespace\n\n - Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct\n again when more namespaces are requested\n\n - minix:\n\n - Restore uptodate on the pinned bitmap buffers before redirtying\n them after a failed writeback instead of tripping the warning in\n mark_buffer_dirty(), as ext2 and ext4 do for their superblock\n buffers\n\n - Reject rmdir() of a directory with a corrupted link count with\n EFSCORRUPTED instead of hitting the drop_nlink() warning\n\n - userns: Keep the exec securebits and their locks when creating or\n joining a user namespace. set_cred_user_ns() reset all securebits to\n SECUREBITS_DEFAULT so anyone who may create a user namespace could\n shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with\n a single unshare(CLONE_NEWUSER)\n\n - fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),\n pwrite64(), preadv() and pwritev() wrappers\n\n - proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the\n last vread_iter() copy instead of the running total\n\n - eventpoll: Return the error when the wakeup source for EPOLLWAKEUP\n can\u0027t be created in EPOLL_CTL_MOD instead of reporting success\n without suspend protection\n\n - coredump: Mark do_coredump() noinline_for_stack\n\n - nsfs: Check the trailing bytes of a namespace file handle in bytes\n instead of words\n\n - netfs: Restore the per-level and per-point decoding of the debug mask\n\n - exportfs: Release the directory file get_name() opened with\n __fput_sync(). From nfsd\u0027s kernel threads the deferred fputs arrived\n faster than delayed_fput retired them and each pinned the directory\u0027s\n readdir state, growing unreclaimable slab by about 90 MB per second\n under a parallel tree walk\n\n - fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be\n unmounted as of v7.0 its struct ramfs_fs_info was leaked\n\n - signal: Check the blocked mask for every entry\n dequeue_synchronous_signal() looks at. The scan could select a\n blocked synchronous signal and deliver it while blocked\n\n - super: Convert the superblock device table from an rhltable to a\n plain hashtable under a spinlock. This fixes a bug from v7.3 where\n fs_bdev_freeze() froze a btrfs filesystem through a stale member that\n open_ctree() had already released while the freeze was waiting for\n SB_BORN\n\n - fork: Leave rcu_users at zero until copy_process() can\u0027t fail\n anymore. bpf_task_acquire() handed out trusted references to the new\n task from the task_alloc LSM hook and sched_ext\u0027s ops.init_task() and\n a failing fork freed the task behind them\n\n - xattr: Always run cap_convert_nscap() for a security.capability\n write. A zero-length setxattr() skipped it and let an unprivileged\n caller without CAP_SETFCAP or write permission on the file plant an\n empty security.capability xattr that made every execve() of the\n binary fail with EINVAL\n\n - namei: Skip the S_ISDIR assertion in\n\n - proc: Refuse to mount on entries below /proc/\u003cpid\u003e/net like fd/,\n fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the\n first lookup by anyone with search permission ran d_invalidate() on\n the dentry and detached every mount on it, locked mounts included\n\n - libfs: Hold one mount reference for all pins instead of one per pin.\n The pin count is what keeps the mount alive, so the per-pin reference\n only cost a mntget() and a mntput() through\n mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or\n configfs file that comes and goes\n\n - iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of\n any type\n\n - watch_queue: Give info_id its own storage instead of overlaying it\n with rcu_head\n\n - filelock: Take an active superblock reference while waiting for a\n delegation break. After a lazy umount closing the delegation holder\n could shut down the superblock under the waiter whose final iput()\n then ran shmem_evict_inode() on freed state\n\n - fs: Skip the copy_file_range() write limit checks when there is no\n data to copy\n\n - bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since\n close_range() became synchronous this cycle close(), close_range()\n and the closes on exec and exit no longer go through filp_close().\n fexit stays rejected since the file may be gone by then\n\n - fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A\n spuriously woken waiter kept its on-stack entry queued, took that as\n proof that the pin was alive and used the freed acct structure when\n umount() of the accounting file raced acct(2)\n\n - dcache: Don\u0027t fail __d_obtain_alias() for an inode without links and\n aliases. The ESTALE check added this cycle broke open_by_handle_at()\n and nfsd file handle decoding on NFS and FUSE where i_nlink is just\n what the server last reported and the handle may well still be valid\n\n - selftests/ovl: Fix the mountinfo expectations of the detached layer\n test which has failed since it was added\n\n* tag \u0027vfs-7.4-rc1.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)\n fs: don\u0027t fail __d_obtain_alias() for unlinked inodes\n ns: don\u0027t add init_ipc_ns and init_net without namespace support\n aio: avoid request count overflow in ioctx_alloc()\n selftests/ovl: fix detached layer mountinfo expectations\n bpf: Allow bpf_d_path() from filp_close_sync()\n fs: skip copy_file_range write limits when there is no data\n minix: reject rmdir of a directory with a corrupted link count\n fs_pin: do not trust the pin after a spurious wakeup in pin_kill()\n ucount: read the parent ucounts before dropping the rlimit count\n splice: retry tee() instead of returning 0 when it races\n selftests/pidfd: test that fields beyond the struct size are not reported\n pidfs: do not report fields that do not fit into the caller\u0027s struct\n fs: let backing files inherit FMODE_NONOTIFY from the user file\n splice: avoid stale f_pos writeback on error\n backing-file: always end a queued write\n filelock: keep superblock active through delegation wait\n watch_queue: keep info_id separate from rcu_head\n iomap: only follow dio alignment requirement if specified\n iov_iter: fix NULL deref in iov_iter_alignment()\n backing-file: enforce append-only and immutable backing inodes\n ...\n" }, { "commit": "abf8c33470f78e2226ee3dcdc69004660020ab47", "tree": "6c8ed8f99294a6911a29c3fe48d6a94f46af86fe", "parents": [ "2228d64da8a66b319a847c1fe0e66527b643e2c1", "7da2aca123754c0e06092bbe179d58078b58d8d4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 08:27:10 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 08:27:10 2026 -1000" }, "message": "Merge tag \u0027spi-fix-v7.4-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"Two patches here, one a straightforward device quirk and the other a\n fix for a potentially nasty data corruption bug in the zynq-qspi\n driver\"\n\n* tag \u0027spi-fix-v7.4-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: cs42l43: Add speaker ID quirk for Dell XPS 13 DX13260 SKU 0E54\n spi: zynq-qspi: fix address buffer corruption and support 4-byte address\n" }, { "commit": "2228d64da8a66b319a847c1fe0e66527b643e2c1", "tree": "920a15b7605a12d86b1ae5cc1580133ac704202e", "parents": [ "a4395d81eca6a94026276fe70cfb20f5a0191f1f", "8a6d73e316f95e398a1de1d1f58314b6d3e7f641" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 08:24:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 08:24:02 2026 -1000" }, "message": "Merge tag \u0027regulator-fix-v7.4-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"One fix here, we had an issue with deferred hardware disables where\n if we were deferring while suspend was happening we would let the\n workqueue run which could result in us trying to access hardware after\n it or the buses used to access it were suspended.\n\n We fix this by completing any work as we suspend the individual\n regulators\"\n\n* tag \u0027regulator-fix-v7.4-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: irq: freeze deferred hardware access during suspend\n" }, { "commit": "a4395d81eca6a94026276fe70cfb20f5a0191f1f", "tree": "55212b642a4c80ba2c7819366871c180e9eda4d0", "parents": [ "bd5c762ac0519a8c62141751c893cd25a1ad8940", "1ea2927c1bc3c66d2ff69f131268e6be4d38a87c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 08:20:58 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 08:20:58 2026 -1000" }, "message": "Merge tag \u0027regmap-fix-v7.4-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fix from Mark Brown:\n \"One fix for a real issue that fortunately doesn\u0027t affect any in tree\n configurations\"\n\n* tag \u0027regmap-fix-v7.4-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: irq: fix incorrect index calculation for read_sub_irq_data()\n" }, { "commit": "bd5c762ac0519a8c62141751c893cd25a1ad8940", "tree": "36e69e90a68142a9911f8fcb3d7c3f31d283b9f4", "parents": [ "8ebbaf8835c62d7541a6226672a6c2e8e6a5428a", "3650bb41391b51d9dcf87b0480ecafeb1526252f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 07:45:41 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 07:45:41 2026 -1000" }, "message": "Merge tag \u0027scsi-misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull more SCSI updates from James Bottomley:\n \"A couple of late arriving driver updates (lpfc, ufs) with the main\n addition being the lock context analysis update where clang static\n analysis coupled with annotations are used to verify driver guarantees\n about locks and warn on compile if they\u0027re inconsistent. This is\n mostly annotations with only a few code changes (except in scsi_debug\n which needed a fairly big rework to validate with locking context\n analysis)\"\n\n* tag \u0027scsi-misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (103 commits)\n scsi: ufs: core: Do not release a reserved request in ufshcd_abort()\n scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()\n scsi: ufs: core: Fix double release in ufshcd_eh_timed_out()\n scsi: ufs: core: Fix double completion in ufshcd_clear_lu_cmds()\n scsi: ufs: core: Add a helper for clearing hba-\u003eoutstanding_reqs\n scsi: ufs: core: Remove an always-false WARN_ONCE()\n scsi: fnic: Update module authors\n scsi: ufs: qcom: Power down UFS during system suspend on Milos\n scsi: MAINTAINERS: Update Marvell Ethernet storage maintainers\n scsi: handle out-of-range SG_SET_TIMEOUT values\n scsi: core: Update cdrom.h coments\n scsi: st: MAINTAINERS: Add Laurence Oberman and John Meneghini\n scsi: sd: Mark the disk dead if runtime resume fails in sd_remove()\n scsi: libiscsi_tcp: Prevent R2T range check overflow\n scsi: ufs: core: Fix stale comment in ufshcd_mcq_config_nr_queues()\n scsi: fnic: Annotate fnic_nvme functions with __must_hold()\n scsi: ufs: core: Fix a deadlock between clock scaling and device commands\n scsi: ufs: core: Clear stale UIC result byte before peer DME retries\n scsi: ufs: bsg: Reject UIC commands with a non-zero result byte\n scsi: ufs: bsg: Validate request_len before accessing request\n ...\n" }, { "commit": "8ebbaf8835c62d7541a6226672a6c2e8e6a5428a", "tree": "d1fb6d6b2a3919794b27da22bdaba7b03eabdd52", "parents": [ "9ed11143be5ed8d9ffa36907f24f4aca889d185e", "c8c53d669d4e45b3a804013251a34387d7e11bfb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:33:23 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:33:23 2026 -1000" }, "message": "Merge tag \u0027block-7.4-20261029\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull more block updates from Jens Axboe:\n \"Bigger than usual for an end-of-merge-window pull request, main reason\n being that the MD side I had missed a pull on, and both NVMe and block\n got a good pile of LLM driven fixes where some of them may as well\n just go in now rather than wait a full cycle. This contains:\n\n - NVMe fixes via Keith:\n - nvme-tcp fallout from the parallel queue allocation: initialize\n pf_cache_lock and the header digest before requests are set up,\n and don\u0027t dereference a NULL queue-\u003ectrl on reconnect\n - nvme-fabrics queue mapping fixes: reset io_queues on reconnect,\n limit each queue type to the online CPUs, and clear a poll map\n with no poll queues\n - nvme-tcp io_work priority inversion with send_mutex held\n (Seiji), error recovery on read_sock failure and skipping TLS\n control records while waiting for the ICResp (Martin B), TLS\n handshake timeout validation, and an address attribute race\n - nvme-rdma NULL metadata_sgl dereference with T10-PI\n - nvme-pci early boot hang with the quirks parameter\n - nvme-multipath ANA log bounds underflow, and an nvme-fc\n discovery reference leak\n - nvmet hardening: rdma inline SGL out-of-bounds write and short\n connect requests, fc use-after-free in LS create connection and\n teardown on admin queue failure, pci-epf transport error\n reporting and SGL length checks, zns NUMD wrap, fc stale read\n data, auth state and status fixes, ports list and qid_max\n locking, rdma double puts and irq-safe locking, and a double\n free on metadata SGL allocation failure\n - nvmet fixes from Josef: big discard length truncation, NULL\n derefs for PCI endpoint targets and debugfs host_traddr, stop\n listening when a tcp port is removed, and don\u0027t BUG() in\n nvme-loop when a scan runs beside a reset\n\n - MD fixes via Yu Kuai:\n - raid5 validation: reject too few disks, invalid reshape disks, a\n per-device size below one chunk, and an inconsistent reshape\n state from the superblock instead of BUG(), plus journal payload\n size checks\n - raid5 error path and lifetime fixes: extra_page leak and NULL\n derefs in free_conf/setup_conf, draining released_stripes before\n destroying the cache, RCU for the big_stripe_tree lookup, and\n per-array io_unit slab names\n - md core: reject v0.90 arrays with too many devices, validate\n bblog_size, take reconfig_mutex when enabling PPL, fix the\n mddev-\u003eprivate NULL deref when stopping an array under IO, and\n don\u0027t hand out the array before mddev-\u003ekobj is added\n - raid10 missing barrier wakeup, raid0 device count validation, a\n bogus mddev_unlock() in lbs_store(), and shared helpers\n\n - blk-mq fixes from Josef:\n - don\u0027t trust the bio cookie in blk_mq_poll()\n - keep tag sharing fair after a queue update\n - don\u0027t bring back flags of a completed request from the timeout\n handler\n - honor a restarted timer\n - initialize the dma state for P2P\n - quiesce a queue joining a quiesced tag set\n - set up and exit hctxs under tag_list_lock\n - free the tag bitmaps in the SRCU callback\n\n - blk-cgroup and friends from Josef:\n - keep the old blkg while reassociating a bio\n - free struct ioc after a grace period\n - don\u0027t truncate v1 iops limits\n - fix root io.stat on 32-bit\n - don\u0027t free a blkg with its punt work queued\n - flush iolatency enable_work after going offline\n - pass dead group I/O counts on and make reset_stats reset them\n - don\u0027t enter reclaim under rq_qos_mutex\n\n - Other core fixes from Josef:\n - a disk use-after-free in sync_bdevs()\n - don\u0027t losing the status of a failed flush request\n - 64-bit sector math for mac partitions\n - apply the segment size to the integrity buffer\n\n - blk-iocost: abort a weight transfer on invalid donation weights,\n and publish hweights as one atomic value\n\n - Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),\n reachable via dm-inlinecrypt\n\n - Fix recursive i_rwsem locking in blkdev_write_iter(), from two\n fixes for the same race landing in the window\n\n - Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing\n an infinite loop in blk_rq_map_user_iov()\n\n - Check the open mode for LOOP_SET_STATUS in the compat ioctl\n\n - rnbd-srv use-after-free and kobject fixes\n\n - drbd timer and req_lock fixes\n\n - zloop cleanups and error path fixes\n\n - cdrom header and kernel-doc cleanups\"\n\n* tag \u0027block-7.4-20261029\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)\n blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()\n zloop: check that the zone backing file support -\u003e{read,write}_iter\n zloop: fput file after failed zone init\n zloop: share more code for opening a zone backing file\n zloop: remove a duplicate call to zloop_get_block_size\n block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c\n blk-iocost: publish hweights as one atomic value\n blk-iocost: abort weight transfer on invalid donation weights\n rnbd-srv: publish the sess_dev at the end of OPEN\n rnbd-srv: fix use-after-free on two CLOSE messages\n block/rnbd-srv: drop the sess_dev kobject unlocked\n block/rnbd-srv: don\u0027t free the device on a sysfs error\n drbd: take req_lock to skip the initial sync as peer\n drbd: stop the start_resync timer of a dying device\n block: apply the segment size to the integrity buffer\n blk-mq: free the bitmaps of tags in the SRCU callback\n block: partitions/mac: compute the sectors in 64 bits\n blk-mq: set up a queue under tag_list_lock\n blk-mq: exit the hctxs of a queue under tag_list_lock\n blk-mq: quiesce a queue that joins a quiesced tag set\n ...\n" }, { "commit": "9ed11143be5ed8d9ffa36907f24f4aca889d185e", "tree": "9f3c283a864d87928df3c30c925189517a34931e", "parents": [ "67f1f9b38c15b54d257a1efc544873b53905737f", "22d9db9fd64a493525d692b32c556875b7254665" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:29:43 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:29:43 2026 -1000" }, "message": "Merge tag \u0027io_uring-7.4-20261029\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - A batch of fixes from Chris:\n - Charge registered buffer arrays, rsrc nodes, tctx nodes and\n personalities to memcg, and free the XArray nodes a failed store\n leaves behind.\n - Clear bpf_ctx while submitting SQEs from a bpf-ops program, as the\n socket code otherwise skips both the capability check and\n lock_sock() for a setsockopt from the SQ.\n - Free the task context after an RCU grace period, closing a UAF\n when a foreign task frees the last request.\n - Stop io_ring_exit_work() from waiting on an SQPOLL thread held in\n get_signal(), and drop sqd-\u003elock while the thread waits for\n in-flight requests, as either one could pin every iou_exit slot\n\n - io-wq fixes:\n - Don\u0027t create new workers once the exit has begun, which could\n leave an exiting worker in the thread group under exec\n - save the worker type before dropping its reference (KASAN UAF)\n - Defer io-wq enqueues from a foreign task to task_work, as an\n IOPOLL reap by another task could race io_wq_put_and_exit()\n\n - Keep the drain active when the deferred request being started is\n itself a drain request, and don\u0027t attach a new ring to an SQPOLL\n thread that is already canceling\n\n - Fix the multishot recv length limit accounting, and count cancelled\n timeouts in cq_timeouts so an armed off timeout doesn\u0027t fire early\n\n - Advance the buffer ring head when a pickup empties it, and keep the\n recvmsg buffer select length within MAX_RW_COUNT\n\n - Mask the socket type in the bpf filter population so SOCK_CLOEXEC or\n SOCK_NONBLOCK can\u0027t bypass a type filter, and enforce the per-task\n register restrictions for blind registration\n\n - Complete a non-blocking connect() that fails with -EAGAIN rather than\n retrying it through poll and io-wq, matching connect(2)\n\n - napi list traversal cleanup, and remove a useless min_not_zero()\n\n* tag \u0027io_uring-7.4-20261029\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (21 commits)\n io_uring/sqpoll: don\u0027t attach to a thread that is canceling\n io_uring/net: fix multishot recv length limit accounting\n io_uring/timeout: count cancelled timeouts in cq_timeouts\n io_uring/napi: clean up list traversal with list_for_each_entry_safe()\n io_uring: defer foreign io-wq enqueues to task_work\n io_uring/io-wq: save worker type before dropping its reference\n io_uring/cancel: drop sqd-\u003elock while SQPOLL waits\n io_uring/sqpoll: don\u0027t wait for the thread to exit\n io_uring: free the task context after a grace period\n io_uring/bpf-ops: clear bpf_ctx while submitting SQEs\n io_uring: free XArray nodes left by a failed store\n io_uring: charge tctx nodes and personalities\n io_uring/rsrc: charge buffer arrays and nodes to memcg\n io_uring/io-wq: no new workers once the exit has begun\n io_uring: keep the drain active when a deferred drain request is started\n io_uring/net: don\u0027t retry a non-blocking connect() that fails with -EAGAIN\n io_uring/register: enforce per-task restrictions in io_uring_register_blind()\n io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()\n io_uring/net: Remove useless min_not_zero() usage\n io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT\n ...\n" }, { "commit": "67f1f9b38c15b54d257a1efc544873b53905737f", "tree": "a4528fcb1c2f6b8e8ce79870b024836ec3d74b89", "parents": [ "4517b5a6c8745f244d89971dc34ec69f5a9eb3d5", "01d1204582f16e8b7bfce29648e5cf77a585d962" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:27:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:27:35 2026 -1000" }, "message": "Merge tag \u0027fbdev-for-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev\n\nPull more fbdev updates from Helge Deller:\n\n - atmel_lcdfb: avoid issues due to empty modelist in probe\n\n - simplify the console-blanking interface\n\n* tag \u0027fbdev-for-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:\n fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe\n vt: Remove old-style con_blank\n vgacon: Implement struct consw.con_unblank\n sticon: Implement struct consw.con_unblank\n newport_con: Implement struct consw.con_unblank\n fbcon: Implement struct consw.con_unblank\n dummycon: Implement struct consw.con_unblank\n vt: Add con_unblank callback to struct consw\n" }, { "commit": "4517b5a6c8745f244d89971dc34ec69f5a9eb3d5", "tree": "b2fb15a433115d3b1de979c67a7756f28291bf77", "parents": [ "d89e1d186ec9271bf78e62771779e9fc03bf0fc3", "0d9678b125d8315d62de1261bee67c7e6f21457e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:18:43 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 30 06:18:43 2026 -1000" }, "message": "Merge tag \u0027clk-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk updates from Stephen Boyd:\n \"Here\u0027s the clk changes for the merge window which is dominated in the\n diffstat by Qualcomm churning out new SoCs that need clk drivers.\n\n Looking beyond the sheer amount of lines of mostly data there we have\n a clk nexus DT binding change in the core clk framework and a driver\n core patch to add a subsys driver macro.\n\n The clock nexus support is useful for devices that map clks internally\n or for connectors on a board that route clock signals to another\n board. I suspect the use of this will expand in the future, so we have\n unit tests to make sure it doesn\u0027t break.\n\n The driver core change adds subsys_driver() and\n subsys_platform_driver() so we can register early drivers without\n open-coding that all (module_platform_driver() is at device initcall\n level so it isn\u0027t be used).\n\n Beyond the core framework bits we have lots of changes all over the\n tree to initialize \u0027struct clk_init_data\u0027. The potential risk here is\n that someone forgets to initialize all the members of that structure\n and either the clk flags cause weird behavior later on or the parents\n are pointing at junk and the clk is orphaned forever. The patches just\n initialize the thing with zeroes to be safe. Longer term we should\n probably move this struct out of \u0027struct clk_hw\u0027 and pass it during\n clk registration time. That\u0027s a much bigger change and would require\n restructuring entire drivers that rely on the pointer being there.\n\n Finally, we have the usual fixes like calculation updates for\n dividers, handling error paths during clk registration, or fixing clk\n data now that drivers are using them. Those patches are dwarfed by the\n amount of new SoC support and only affect those SoCs and the consumers\n of those clks. Overall I\u0027m more concerned the clk_init_data patches\n are going to expose some latent bugs that we didn\u0027t notice before\n because something was relying on clks being orphaned and now they\u0027re\n not.\n\n Core:\n - subsys_driver() / subsys_platform_driver() macros\n - Clock nexus DT binding support (with KUnit tests)\n - Spread-spectrum configuration validation\n - Fully initialize struct clk_init_data across many drivers\n\n New Drivers:\n - Anlogic DR1V90 CRU\n - ZTE zx297520v3 top, matrix, and LSP clocks\n - Samsung Exynos5515 and ACPM driver extended to Exynos850.\n - Qualcomm Eliza camera, camera-BIST, GPU, and video clks\n - Qualcomm Hawi / Maili camera and GPU controllers\n - Qualcomm Kuno global, RPMh\n - Qualcomm MSM8952 global, RPM\n - Qualcomm Nord camera/video clocks, EMAC interconnect, PHY resets\n - Qualcomm IPQ5210 / IPQ9650 network clocks\n - i.MX93 350 MHz fractional-N GP-PLL for display\n - i.MX pll14xx spread-spectrum clock generation\n - Amlogic A9 SCMI clock controller\n - Allwinner single-divider \"update bit\" support\n - EN7523 Serdes port selection\"\n\n* tag \u0027clk-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (316 commits)\n clk: imx: pll14xx: support spread spectrum clock generation\n clk: cdce925: Size the PLL child name buffer for any int\n clk: stm32: fix clock array size for STM32MP21\n dt-bindings: clock: Convert HiSilicon clocks to DT schema\n clk: lmk04832: Handle reset GPIO lookup errors\n dt-bindings: clock: anlogic,dr1v90-cru: make external clocks optional\n clk: tegra: bpmp: remove kcalloc\n clk: mmp2-audio: add missing PM_CLK dependency\n clk: zte: Introduce a driver for zx297520v3 LSP clocks\n clk: zte: Introduce a driver for zx297520v3 matrix clocks\n clk: zte: Introduce a driver for zx297520v3 top clocks\n clk: zte: Add zx PLL support infrastructure\n clk: zte: Add regmap-based clocks\n clk: zte: Add Clock registration infrastructure\n dt-bindings: clk: zte: Add zx297520v3 LSP clock and reset controller\n dt-bindings: clk: zte: Add zx297520v3 matrix clock and reset controller\n dt-bindings: clk: zte: Add zx297520v3 top clock and reset controller\n clk: nuvoton: ma35d1: Add missing WDT/WWDT parent clocks\n dt-bindings: clock: ma35d1: Add missing WDT/WWDT parent clocks\n dt-bindings: clock: ma35d1: Drop CLK_MAX_IDX define\n ...\n" }, { "commit": "a522dd871024a0f065bfa7638afdb929607f58fc", "tree": "259f5d5eeb7bc6c2a4411aecdd9fe7e6643558a9", "parents": [ "82f1c815aaef1905c5c6c386c8a0d74f6ff70a54" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Fri Oct 30 16:55:52 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 17:18:39 2026 +0100" }, "message": "fs: don\u0027t fail __d_obtain_alias() for unlinked inodes\n\nCommit 669bb5af15d4 (\"fs: make sure to call fsnotify_inoderemove() only\nonce when inode is dead\") did two things. It made dentry_unlink_inode()\ncall fsnotify_inoderemove() only once the inode has neither links nor\naliases left. And it made __d_obtain_alias() fail with -ESTALE for an\ninode in that state so that open_by_handle_at() can\u0027t create a new alias\nafter FS_DELETE_SELF has been reported and the inode marks are gone.\n\nThe second part is wrong for network filesystems. __d_obtain_alias()\nbacks d_obtain_alias() and d_obtain_root(). Those are what the\n-\u003efh_to_dentry() and -\u003eget_parent() methods use to turn the inode they\nlooked up into a dentry for exportfs_decode_fh_raw(), i.e., for\nopen_by_handle_at() and for nfsd file handle decoding.\n\nFor a local filesystem an in-core inode without links and aliases is an\norphan that goes away on the final iput(). For a network filesystem\nthat\u0027s not true. i_nlink is just the link count the server last\nreported and whether the object is still reachable through its file\nhandle is up to the server. If a file is unlinked while it is still\nopen elsewhere, e.g., by another NFSv4 client or by a process on the\nserver, the server keeps the object alive and its file handle stays\nvalid. nfs_fh_to_dentry() fetches the attributes for such a handle,\nnfs_fhget() sets i_nlink to 0 from them, the new inode has no aliases\nyet and so __d_obtain_alias() now fails with -ESTALE. The same applies\nto fuse_get_dentry() which takes i_nlink from the fuse server.\nFilesystems that care about unlinked inodes already make that decision\nthemselves in -\u003efh_to_dentry(), e.g., ceph\u0027s __fh_to_dentry() fetches\nthe link count with CEPH_CAP_LINK_SHARED and only refuses an unlinked\ninode if it isn\u0027t open.\n\nNote that on a network filesystem i_nlink drops to zero through\nattribute updates when another client unlinks the file. So the inode\nmight never have gone through dentry_unlink_inode() with i_nlink \u003d\u003d 0,\ni.e., fsnotify_inoderemove() might never have been called for it and\nthere\u0027s nothing for the -ESTALE to protect.\n\nSo drop the two checks from __d_obtain_alias() again and go back to the\nunconditional alias lookup. While at it, update the comment above\ninode_notify_dead() since it no longer blocks new aliases.\n\nAmir sent this as v3 to replace 669bb5af15d4 but that commit was already\nin mainline by then. So do it as a fix on top. The resulting code is\nidentical to v3.\n\nThis means open_by_handle_at() can again create a new alias for an\nunlinked inode after FS_DELETE_SELF has been reported. Closing that file\nreports a second FS_DELETE_SELF and the file has none of the inode marks\nthat were torn down. That\u0027s what Daehyeon\u0027s open_by_handle_at() LTP test\nchecks so it is expected to fail again. This needs to be handled\nseparately. A mark that is added through such a file while\nfsnotify_destroy_marks() is still running is rejected with -ENOENT since\n36ebddca56b9 (\"fsnotify: prevent mark additions during connector\nteardown\") so it can\u0027t end up on a detached connector.\n\nChristian Brauner \u003cbrauner@kernel.org\u003e says:\n\nAmir\u0027s v3 replaced 669bb5af15d4 as a whole. I turned it into an\nincremental fix on top of mainline and wrote a new commit message.\nJan\u0027s Reviewed-by was given on v3 and the resulting code is identical.\n\nFixes: 669bb5af15d4 (\"fs: make sure to call fsnotify_inoderemove() only once when inode is dead\")\nCc: stable@vger.kernel.org\nReported-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nLink: https://patch.msgid.link/CAOQ4uxg7Qt436SiKhKEJKOjtCjeB_XyTjazYF7HMyQAGGcgx2A@mail.gmail.com\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20261030-work-dcache-obtain_alias-v1-1-a1f7e44536d2@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "82f1c815aaef1905c5c6c386c8a0d74f6ff70a54", "tree": "738fe9ea4efe34f53da73d383eb771a7de5db691", "parents": [ "b44341e39d856e4cc6ad8ed94ebffd440f39846c" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:50:07 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 17:17:55 2026 +0100" }, "message": "ns: don\u0027t add init_ipc_ns and init_net without namespace support\n\nWhen CONFIG_IPC_NS or CONFIG_NET_NS are turned off we still add the\ninitial ipc and network namespace to the namespace trees. ipc_ns_init()\ncalls ns_tree_add(\u0026init_ipc_ns) whenever CONFIG_SYSVIPC is set and\nsetup_net() calls ns_tree_add_raw() on init_net whenever CONFIG_NET is\nset.\n\nBut without CONFIG_IPC_NS and CONFIG_NET_NS these aren\u0027t namespaces\nuserspace can do anything with. They don\u0027t have proc_ns_operations so\nthere\u0027s no /proc/\u003cpid\u003e/ns/{ipc,net} for them, nsfs_fh_to_dentry()\nrefuses them with -EOPNOTSUPP, and since ns-\u003eops is NULL\n__ns_tree_add_raw() doesn\u0027t add them to the owner list of init_user_ns\neither. So they end up half registered. That\u0027s also not how we treat\nany of the other namespace types. Without CONFIG_UTS_NS, CONFIG_PID_NS,\nCONFIG_TIME_NS or CONFIG_USER_NS the initial namespace is never added\nto the tree.\n\nlistns() walks the unified tree and calls is_current_namespace() for\nevery namespace it finds via may_list_ns(). But is_current_namespace()\nonly knows about CLONE_NEWIPC and CLONE_NEWNET if CONFIG_IPC_NS and\nCONFIG_NET_NS are set. Otherwise we end up in the default case and its\nVFS_WARN_ON_ONCE(). Any unprivileged caller can trigger that with a\nplain listns() call:\n\n WARNING: CPU: 0 PID: 526 at fs/nsfs.c:508 is_current_namespace+0x12f/0x440\n Call Trace:\n legitimize_ns+0x25f/0x4c0\n do_listns+0x185/0x5c0\n __do_sys_listns+0x13b/0x300\n\nInstead of teaching is_current_namespace() about namespaces that can\u0027t\nbe opened, only add the initial namespaces to the tree if their\nnamespace type is enabled. Move the registration of init_ipc_ns into\nipc/namespace.c which is only built with CONFIG_IPC_NS. That also fixes\nCONFIG_SYSVIPC\u003dn, CONFIG_POSIX_MQUEUE\u003dy, CONFIG_IPC_NS\u003dy where\nipc/shm.c isn\u0027t built and init_ipc_ns was never added at all. For the\nnetwork namespace only call ns_tree_add_raw() if CONFIG_NET_NS is set.\nWithout CONFIG_NET_NS cleanup_net() isn\u0027t built and init_net is never\nremoved so there\u0027s nothing to balance.\n\nFixes: 74b24a582e1f (\"ipc: support ns lookup\")\nFixes: 195f7422298d (\"net: support ns lookup\")\nReported-by: kernel test robot \u003cyi1.lai@intel.com\u003e\nCloses: https://lore.kernel.org/oe-lkp/202610260917.6248e316-lkp@intel.com\nCc: stable@vger.kernel.org # v6.18+\nLink: https://patch.msgid.link/20261030-work-nsfs-init_ns_tree-v1-1-7ec0adb47c54@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "b44341e39d856e4cc6ad8ed94ebffd440f39846c", "tree": "2aae81a868c9f0585c7872a0e1f104ecfe2c5033", "parents": [ "8457ca071faba9dec2dde99f78da9c5af289e955" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Oct 22 13:25:35 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:12:43 2026 +0100" }, "message": "aio: avoid request count overflow in ioctx_alloc()\n\nioctx_alloc() saves the 32-bit nr_events in max_reqs, then doubles\nnr_events before checking the ring-size bound. For\nnr_events\u003d0x80000001, the doubled value wraps to 2, so the ring check\npasses and aio_setup_ring() builds a one-page/127-slot ring. The\noriginal 0x80000001 is still stored in ctx-\u003emax_reqs and charged to the\nglobal aio_nr quota.\n\nIf an administrator has raised fs.aio-max-nr to at least 0x80000001,\nan unprivileged process can create that context and make later normal\nio_setup() calls fail with -EAGAIN until the wrapped context is\ndestroyed.\n\nCheck for too large number of requests before multiplying.\n\nLink: https://lore.kernel.org/all/20261022091748.3653127-1-teel4res@gmail.com\nReported-by: Cheng Yongkang \u003cteel4res@gmail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20261022112534.3513745-2-jack@suse.cz\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "8457ca071faba9dec2dde99f78da9c5af289e955", "tree": "86d32e4eaa08934cc35c015b0aaa31ab2d11ec8f", "parents": [ "3a00ecc89069ea5222f6b02916e9783c6817c7c7" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Sat Oct 17 18:51:03 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:11:46 2026 +0100" }, "message": "selftests/ovl: fix detached layer mountinfo expectations\n\nset_layers_via_detached_mount_fds was copied from the attached-fd test\nand still looks for /tmp paths. Detached open_tree() layers are recorded\nby d_path() as upperdir\u003d/upper, workdir\u003d/work, and lowerdir+\u003d/ and\ndatadir+\u003d/ for each cloned directory. The test has failed since it was\nadded.\n\nReported-by: Disha Goel \u003cdisgoel@linux.ibm.com\u003e\nLink: https://lore.kernel.org/linux-unionfs/20260924112858.51392-2-disgoel@linux.ibm.com\nFixes: ccc829b15d48a (\"selftests: add tests for using detached mount with overlayfs\")\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nLink: https://patch.msgid.link/20261017165103.2450042-1-amir73il@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "3a00ecc89069ea5222f6b02916e9783c6817c7c7", "tree": "fd3dac2d758bd2493785b16b08b2f38bc17c5b31", "parents": [ "81dfa035891f0502674332ee97db348a16486de0" ], "author": { "name": "Ihor Solodrai", "email": "ihor.solodrai@linux.dev", "time": "Wed Oct 21 13:13:59 2026 -0700" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:10:05 2026 +0100" }, "message": "bpf: Allow bpf_d_path() from filp_close_sync()\n\nThe d_path selftest closes its descriptors with close_range() so that\nits fentry program on filp_close() runs.\n\nCommit 056069eb2b66 (\"fs: make close_range() synchronous\") switched\nclose_range() to filp_close_sync(), so the program still attaches but\nis never called:\n\n test_d_path_basic:FAIL:close trampoline for filp_close was not called\n\nWith that series, close(), close_range() and the closes on exec and\nexit all go through filp_close_sync(). Few paths still reach\nfilp_close(), dup2() being one of them, so a program on filp_close()\nno longer sees most file closes.\n\nAllow bpf_d_path() from filp_close_sync(), but only from fentry.\nfilp_close_sync() drops the last file reference inline, so by the time\nan fexit program runs, file-\u003ef_path may already be freed, with no RCU\ndelay for NORCU dentries such as pipes and sockets.\n\nAttach the selftest program to filp_close_sync() and keep triggering\nit with close_range().\n\nAdd a test rejecting bpf_d_path() from fexit/filp_close_sync.\n\nFixes: 056069eb2b66 (\"fs: make close_range() synchronous\")\nSigned-off-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nLink: https://patch.msgid.link/20261021201400.5409-1-ihor.solodrai@linux.dev\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "81dfa035891f0502674332ee97db348a16486de0", "tree": "cc6c5b414a10611d224d33cc463221c30cf43e16", "parents": [ "fc9577079df8a44ccbf39d2f06634017d286e4f0" ], "author": { "name": "Hungyu Lin", "email": "dennylin0707@gmail.com", "time": "Mon Oct 26 01:57:38 2026 +0000" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:06:00 2026 +0100" }, "message": "fs: skip copy_file_range write limits when there is no data\n\ngeneric_copy_file_checks() reduces count to zero for a source offset at\nor beyond EOF, but still checks the destination write limits. If pos_out\nis at RLIMIT_FSIZE, this sends SIGXFSZ and returns -EFBIG even though\nthere is no data to write.\n\nFor example, GNU cat copying a 1024-byte regular file to another regular\nfile with RLIMIT_FSIZE\u003d1024 copies all bytes and is then killed by its\nnext copy_file_range() call at EOF. A zero-length request can fail in\nthe same way.\n\nCheck write limits only when count is nonzero, as the ordinary write\nchecks already do. Keep the other copy validation in place.\n\nFixes: 96e6e8f4a68d (\"vfs: add missing checks to copy_file_range\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hungyu Lin \u003cdennylin0707@gmail.com\u003e\nLink: https://patch.msgid.link/20261026015738.46230-1-dennylin0707@gmail.com\nReviewed-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "fc9577079df8a44ccbf39d2f06634017d286e4f0", "tree": "b4a4b50935d1b8602fa82ab057126b8207c48e95", "parents": [ "f3a6dae67c9ca3d913cbb42fe324c9b47c8d9e53" ], "author": { "name": "Nguyen Ngoc Thang", "email": "ngocthang2710.1999@gmail.com", "time": "Fri Oct 16 18:58:51 2026 +0700" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:05:28 2026 +0100" }, "message": "minix: reject rmdir of a directory with a corrupted link count\n\nminix_rmdir() calls minix_unlink(), which drops the victim\u0027s link\ncount once, and then drops it a second time for the \".\" entry. An\nimage where an empty directory has i_nlink \u003c 2 makes the second drop\nhit drop_nlink() with i_nlink \u003d\u003d 0:\n\n WARNING: fs/inode.c:408 at drop_nlink\n minix_rmdir+0xe9/0x150\n vfs_rmdir\n filename_rmdir\n __do_sys_unlinkat\n\nThe parent\u0027s link count is already validated; do the same for the\ndirectory being removed and fail with -EFSCORRUPTED.\n\nReported-by: syzbot+8420e667af06b1709c00@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d8420e667af06b1709c00\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Nguyen Ngoc Thang \u003cngocthang2710.1999@gmail.com\u003e\nLink: https://patch.msgid.link/20261016115851.14276-1-ngocthang2710.1999@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "f3a6dae67c9ca3d913cbb42fe324c9b47c8d9e53", "tree": "46cb148a601d9a0f26c64790d194137a6b93b8d9", "parents": [ "38bf603d1ea5d5a65a9cb277df75327ffec01ff1" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Mon Oct 26 21:58:13 2026 -0400" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:03:49 2026 +0100" }, "message": "fs_pin: do not trust the pin after a spurious wakeup in pin_kill()\n\nA task waiting in pin_kill() for another task\u0027s -\u003ekill() can take\np-\u003ewait.lock after the pin has been freed, and can return with its\non-stack wait entry still on p-\u003ewait. With BSD process accounting this\nis a use-after-free of the acct structure when umount() of the mount\nholding the accounting file races with acct(2).\n\npin_kill() takes a still-queued entry as proof that pin_remove() has not\nrun, so p is alive. But autoremove_wake_function() dequeues only when\ntry_to_wake_up() succeeds: if the waiter was already woken spuriously,\npin_remove() leaves the entry queued, acct_pin_kill() frees the acct\nwith kfree_rcu(), and the grace period can end while the waiter sits\nbetween schedule() and rcu_read_lock().\n\nDequeue the entry unconditionally in a private wake function;\npin_remove() is the only waker and sets p-\u003edone first.\n\nReproduced under QEMU with KASAN and test-only delays: a\nslab-use-after-free in pin_kill() before the patch, no report after.\n\nFixes: 59eda0e07f43 (\"new fs_pin killing logics\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nLink: https://patch.msgid.link/20261027015813.841821-1-nickolai@csail.mit.edu\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "38bf603d1ea5d5a65a9cb277df75327ffec01ff1", "tree": "641f0b7681333882b774d5722c17db29b5fcdecc", "parents": [ "b2aa970a0a03c117306f48d75a4c3125a8cc9957" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Fri Oct 23 21:55:13 2026 -0400" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:02:40 2026 +0100" }, "message": "ucount: read the parent ucounts before dropping the rlimit count\n\ndo_dec_rlimit_put_ucounts() drops its share of iter-\u003erlimit[type] and\nonly then loads iter-\u003ens-\u003eucounts. If the decrement leaves the count\nnon-zero, a concurrent caller can take it to zero and put the last\nreference, which frees the ucounts and possibly its user namespace with\nkfree_rcu(). An exiting task frees its pending signals without siglock\nor any RCU read-side section, so when it is preempted between the\ndecrement and the load for a grace period it reads freed memory and\nthen decrements a counter through the pointer it found there.\n\nA pending signal holds no reference on its ucounts: the reference is\ntaken by whoever moves the count from 0 to 1 and dropped by whoever\nmoves it back to 0, so the caller\u0027s share of the count is all that\nkeeps iter alive, and only until it is dropped.\n\nLoad the parent first; it stays pinned by the caller\u0027s share of its\nown count.\n\nFixes: 15bc01effefe (\"ucounts: Fix signal ucount refcounting\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nLink: https://patch.msgid.link/20261024015513.830312-1-nickolai@csail.mit.edu\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "b2aa970a0a03c117306f48d75a4c3125a8cc9957", "tree": "a02d8a556aa36adf92740e1ded4620075604dbe7", "parents": [ "23584035ade3c4b9d5c7ddb2e82a1d159221c5c9" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Sat Oct 17 22:55:41 2026 -0400" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:01:24 2026 +0100" }, "message": "splice: retry tee() instead of returning 0 when it races\n\ntee() can return 0 while the input pipe still has writers, when\nanother task reads the input pipe or fills the output pipe at the same\ntime. tee(2) documents 0 as \"no data was copied\" because the input pipe\nhas no writers, and loops built on it (the man page example breaks out\non 0) stop early. In a test with one thread writing 1 byte at a time\nto the input pipe, one reading it and one draining the output pipe,\nabout one tee() call in 150 returned 0.\n\ndo_tee() runs ipipe_prep() and opipe_prep() to wait for data and room,\neach under its own pipe lock, and only then takes both locks in\nlink_pipe(). If the input pipe was emptied or the output pipe filled in\nbetween, link_pipe() finds nothing to do and returns 0.\nsplice_pipe_to_pipe(), which was modelled on tee(), handles the same\nrace by dropping both locks and going back to the prep steps (\"A zero\nreturn value means EOF, so retry instead\"), and returns -EAGAIN for\nSPLICE_F_NONBLOCK.\n\nDo the same in link_pipe(): move the prep steps into it and retry when\nnothing was linked although the input pipe still has writers.\n\nTested under QEMU (x86_64) with the program in the notes: 154 of 22698\ntee() calls returned 0 before the change, none of 34429 after it.\n\nFixes: aadd06e5c56b (\"[PATCH] splice: fix problems with sys_tee()\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nLink: https://patch.msgid.link/20261018025541.799135-1-nickolai@csail.mit.edu\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "23584035ade3c4b9d5c7ddb2e82a1d159221c5c9", "tree": "76198f8341f7380aee32a74e90eefda54dad1cd3", "parents": [ "c3d355f427cea70fbe31b49e21f1915dbf37f2e6", "28767d4934f04492c8179ec470e967829b1dc895" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:00:28 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:00:28 2026 +0100" }, "message": "Merge patch series \"pidfs: do not report fields that do not fit into the caller\u0027s struct\"\n\nNickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e says:\n\nPIDFD_GET_INFO sets the mask bits of fields that lie beyond the struct\nsize the caller passed, although the uapi header promises that the mask\nnames no such field and tells userspace to rely on the mask. Patch 1\nclears those bits before the copy. Patch 2 adds a selftest for it.\n\nTested in a QEMU x86_64 guest: the new test fails without patch 1 and\npasses with it, and the other pidfd selftests give the same results with\nand without patch 1. Built with W\u003d1 for x86_64.\n\nThe bug was found and fixed with the assistance of an AI agent.\n\n* patches from https://patch.msgid.link/20261024041334.831273-1-nickolai@csail.mit.edu:\n selftests/pidfd: test that fields beyond the struct size are not reported\n pidfs: do not report fields that do not fit into the caller\u0027s struct\n\nLink: https://patch.msgid.link/20261024041334.831273-1-nickolai@csail.mit.edu\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "28767d4934f04492c8179ec470e967829b1dc895", "tree": "76198f8341f7380aee32a74e90eefda54dad1cd3", "parents": [ "1534c37167488f2b85c74de048e1d6a4ba3848de" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Sat Oct 24 00:13:34 2026 -0400" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:00:18 2026 +0100" }, "message": "selftests/pidfd: test that fields beyond the struct size are not reported\n\nPIDFD_GET_INFO must not set the mask bit of a field that lies beyond\nthe struct size encoded in the ioctl command. Add a test that requests\nthe coredump fields and the supported mask with PIDFD_INFO_SIZE_VER0\nover a full-size, poisoned struct, and checks that the mask names none\nof those fields and that the poison behind the first 64 bytes is\nintact.\n\nAdd fallback definitions of PIDFD_INFO_SIZE_VER0 to VER3 to pidfd.h,\nlike the other uapi constants there.\n\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nLink: https://patch.msgid.link/20261024041334.831273-3-nickolai@csail.mit.edu\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "1534c37167488f2b85c74de048e1d6a4ba3848de", "tree": "b426aa99f505bfe6624e0d2aca39b204ca43fe11", "parents": [ "c3d355f427cea70fbe31b49e21f1915dbf37f2e6" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Sat Oct 24 00:13:33 2026 -0400" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 16:00:18 2026 +0100" }, "message": "pidfs: do not report fields that do not fit into the caller\u0027s struct\n\nThe documentation of struct pidfd_info promises that \"If the structure\nsize is too small to contain a field (requested or not), to avoid\nconfusion the mask will not contain a bit for that field\", and asks\nuserspace to trust the returned mask when deciding which fields hold\nvalid data.\n\npidfd_info() does not keep that promise. It builds kinfo.mask without\nlooking at the size encoded in the ioctl command, and\ncopy_struct_to_user() then truncates the copy to that size. A caller\nthat passes a 64-byte struct (PIDFD_INFO_SIZE_VER0) and requests\nPIDFD_INFO_COREDUMP or PIDFD_INFO_SUPPORTED_MASK gets a mask with\nPIDFD_INFO_COREDUMP, PIDFD_INFO_COREDUMP_SIGNAL, PIDFD_INFO_COREDUMP_CODE\nand PIDFD_INFO_SUPPORTED_MASK set, while the coredump_* and\nsupported_mask fields behind the 64 bytes were never written. Trusting\nthe mask as documented, userspace then reads whatever its own buffer\nheld at those offsets. The same happens for a 72- or 80-byte struct\nand the fields added after it.\n\nClear the bits of the fields that lie beyond the caller\u0027s size before\nthe copy, in the one place that knows both the final mask and the size.\nA request for a field that cannot be returned is thereby answered the\nway the header describes: the field is simply absent from the mask.\n\nFixes: 1d8db6fd698d (\"pidfs, coredump: add PIDFD_INFO_COREDUMP\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nLink: https://patch.msgid.link/20261024041334.831273-2-nickolai@csail.mit.edu\nAcked-by: Luca Boccassi \u003cluca.boccassi@gmail.com\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "c3d355f427cea70fbe31b49e21f1915dbf37f2e6", "tree": "4124fa4b77cf2b7fe571d6f3c3e9ed28cf075299", "parents": [ "79b496ebe382866e3a05090b7dc9ae95e85e65b2" ], "author": { "name": "Edvard Conrad", "email": "edvard@tuta.io", "time": "Thu Oct 29 22:18:40 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 15:57:59 2026 +0100" }, "message": "fs: let backing files inherit FMODE_NONOTIFY from the user file\n\nWhen fanotify reports a permission event, copy_event_to_user() creates\nthe event fd with dentry_open_nonotify(), so that the listener\u0027s use of\nthat fd does not generate further events. If the event\u0027s path is on a\nstacked filesystem, the stacked filesystem\u0027s -\u003eopen() opens the real\nfile with backing_file_open(). Since commit ebe559609d78 (\"fs: get rid\nof __FMODE_NONOTIFY kludge\"), FMODE_NONOTIFY lives in f_mode only and\nthe backing file does not inherit it: it is allocated with the default\nfsnotify mode, and fsnotify_open_perm_and_set_mode() raises FS_OPEN_PERM\non the real path if the backing filesystem has permission event\nwatchers.\n\nBefore that commit __FMODE_NONOTIFY travelled in f_flags, and overlayfs\ncopies the user file\u0027s f_flags into the backing open\n(ovl_open_realfile()), so the backing file was exempt implicitly. Commit\nbc2473c90fca (\"ovl: enable fsnotify events on underlying real files\")\nrelied on that when it dropped FMODE_NONOTIFY from OVL_OPEN_FLAGS.\n\nThe nested event is queued to the same group, from inside the\nlistener\u0027s read(2), and can only be answered by another reader thread\nof that group. A listener holding filesystem marks on both the stacked\nand the backing filesystem therefore deadlocks as soon as all of its\nreader threads are inside such a read(2) at the same time, and every\nother task that touches a marked filesystem queues up behind it.\n\nObserved with a commercial anti-malware agent (16 reader threads) on an\nostree/composefs host: / is an overlayfs whose data layer is the ostree\nobject store on the same btrfs that holds /etc and /home, and a\nsystemd-sysext overlay sits on /usr. Every on-demand scan of /usr wedged\nthe whole machine until the group was killed. Stack of a blocked reader\nthread on 7.2.7:\n\n fanotify_get_response\n fanotify_handle_event\n send_to_group\n fsnotify\n __fsnotify_parent\n do_dentry_open\n vfs_open\n backing_file_open\n ovl_open_realfile [overlay]\n ovl_open [overlay]\n do_dentry_open\n vfs_open\n backing_file_open\n ovl_open_realfile [overlay]\n ovl_open [overlay]\n do_dentry_open\n vfs_open\n dentry_open_nonotify\n copy_event_to_user\n fanotify_read\n vfs_read\n ksys_read\n\nUserspace cannot avoid this: the backing open happens while the kernel\nbuilds the fd, before the event is reported, and fid reporting is not\navailable for permission event classes.\n\nMake a backing file inherit FMODE_NONOTIFY when the user file it is\nopened for must not generate events. This restores the pre-6.14\nbehaviour for the fds that fanotify creates (and for any other\nFMODE_NONOTIFY file), while ordinary opens through a stacked filesystem\nkeep generating events on the real path, as intended by bc2473c90fca.\n\nVerified with a self-contained reproducer (private tmpfs lower layers, an\noverlayfs over them, FAN_OPEN_PERM filesystem marks on the overlay and on\none lower layer, a child opening a file through the overlay) in a qemu\nVM on this tree built with defconfig plus OVERLAY_FS, FANOTIFY and\nFANOTIFY_ACCESS_PERMISSIONS: without this patch the listener\u0027s read(2)\nnever returns and the child\u0027s open is released only by the listener\u0027s\ndeath; with it read(2) returns, the event is answered and the open\ncompletes.\n\nbacking_tmpfile_open() is left alone: its only caller is\novl_create_tmpfile(), whose user file is a regular overlayfs file.\n\nFixes: ebe559609d78 (\"fs: get rid of __FMODE_NONOTIFY kludge\")\nCc: stable@vger.kernel.org\nReviewed-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Edvard Conrad \u003cedvard@tuta.io\u003e\nLink: https://patch.msgid.link/P58Wrer--F-9@tuta.io\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "79b496ebe382866e3a05090b7dc9ae95e85e65b2", "tree": "8b37602f7a47d8a6a37f3e880749a37cc6a74df8", "parents": [ "627cdcbc2a2eceb0452078a0c14370f9f1f17a91" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Sun Oct 18 14:17:08 2026 +0900" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 15:56:02 2026 +0100" }, "message": "splice: avoid stale f_pos writeback on error\n\ndo_splice() snapshots an implicit file position before calling the splice\nhelper. Since splice does not take f_pos_lock, another operation on the\nsame open file description can update f_pos while the helper is blocked.\nIf the helper then fails, the unconditional writeback restores the stale\nsnapshot.\n\nFor a directory without -\u003esplice_read, a file-to-pipe splice fails with\n-EINVAL. A concurrent directory mutation and getdents() call can advance\nf_pos and refresh the filesystem\u0027s revalidation cookie before that failure\nrestores only the old position. The next ext2 readdir can then trust an\noffset inside a directory entry and copy data from the adjacent page to\nuserspace.\n\nOnly update an implicit file position when splice returns a non-negative\nresult, matching read and write. Keep explicit offset updates unchanged.\n\nFixes: 7995bd287134 (\"splice: don\u0027t pass the address of -\u003ef_pos to methods\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/20261018051708.2422394-1-4ncienth@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "627cdcbc2a2eceb0452078a0c14370f9f1f17a91", "tree": "1a7b7df2320df4d87b638afae5e4e8fb89423b3e", "parents": [ "c206cdfee6c037b829178bb7e17e6e37ddc9aa35" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Thu Oct 29 19:03:19 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 15:54:59 2026 +0100" }, "message": "backing-file: always end a queued write\n\nWrites to a loop device with direct I/O on an overlay file make the\nnext freeze of the upper filesystem hang for ever.\n\nEvery kiocb_start_write() needs a kiocb_end_write(). For a write that\nis queued, vfs_iocb_iter_write() leaves the end to the completion, and\nbacking_aio_rw_complete() only calls kiocb_end_write() when IOCB_WRITE\nis set in the flags copied from the submitter. In-kernel submitters\nsuch as loop do not set that flag, so each queued write keeps the\nfreeze protection of the backing filesystem.\n\nDirect writes to a loop device with direct I/O backed by an overlay\nfile left fsfreeze of the ext4 upper filesystem, and a later touch\nthere, blocked in D state. It takes write access to the node of the\nloop device, which root has by default, to attach the file and to write.\n\nThe fix used here is to mark a write in struct backing_aio and to call\nkiocb_end_write() on completion of every marked write.\n\nReproduced under qemu without KVM, on v7.3-rc6-21-g602042bf29f6 with\nearlier fixes of this series applied, with and without this change,\nonce each. The kernel was not changed for the run. With this change\nfsfreeze finished in about a second. Not run: the nvmet and LIO file\nbackends, which do not set IOCB_WRITE either, FUSE passthrough, and an\nxfs upper filesystem.\n\nFixes: 2406a307ac7d (\"ovl: implement async IO routines\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\n[amir: use aio-\u003eis_write to explicitly mark a write aio]\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nLink: https://patch.msgid.link/20261029180319.2852090-1-amir73il@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "c206cdfee6c037b829178bb7e17e6e37ddc9aa35", "tree": "d4b8116ca1388c096655be72cd497233c943998d", "parents": [ "53d72818f9e2aeb03a6053544ee6efa4eb2a3988" ], "author": { "name": "Zhao Gongyi", "email": "zhaogongyi@bytedance.com", "time": "Fri Oct 23 19:12:50 2026 +0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 15:54:20 2026 +0100" }, "message": "filelock: keep superblock active through delegation wait\n\nA caller may drop its path after try_break_deleg() returns a delegated\ninode but before break_deleg_wait() finishes. The extra inode reference\nheld in struct delegated_inode does not keep the superblock active.\n\nAfter a lazy unmount, closing the delegation holder can release the last\nmount reference and shut down the superblock while another task waits for\nthe delegation break. The waiter\u0027s final iput() can then enter the\nfilesystem\u0027s eviction code after its superblock-private state was freed.\nThis has been observed as a KASAN use-after-free in shmem_evict_inode().\n\nWhen try_break_deleg() saves a delegated inode, take an active reference\nto its superblock while the caller still pins the mount. Keep that\nreference through break_deleg_wait() and the final iput(), then release\nit with deactivate_super(). This protects every caller of the helpers,\nincluding the mknod, mkdir, symlink and rmdir paths that drop their path\nbefore waiting.\n\nFixes: e12d203b8c88 (\"vfs: allow mkdir to wait for delegation break on parent\")\nFixes: 4fa76319cd0c (\"vfs: allow rmdir to wait for delegation break on parent\")\nFixes: c826229c6a82 (\"vfs: make vfs_create break delegations on parent directory\")\nFixes: e8960c1b2ee9 (\"vfs: make vfs_mknod break delegations on parent directory\")\nFixes: 92bf53577f01 (\"vfs: make vfs_symlink break delegations on parent dir\")\nLink: https://lore.kernel.org/r/20261016093421.90725-1-zhaogongyi@bytedance.com\nCc: stable@vger.kernel.org\nSigned-off-by: Zhao Gongyi \u003czhaogongyi@bytedance.com\u003e\nLink: https://patch.msgid.link/20261023111250.17696-1-zhaogongyi@bytedance.com\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "53d72818f9e2aeb03a6053544ee6efa4eb2a3988", "tree": "d1ed0a7f2b4b33ec05aea5b06f194c15cff55a6a", "parents": [ "87d02f3e98a86abf70441b0a0418e01cb1d64b44" ], "author": { "name": "Zhiyu Zhang", "email": "zhiyuzhang999@gmail.com", "time": "Thu Oct 29 01:41:36 2026 -0400" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 15:53:44 2026 +0100" }, "message": "watch_queue: keep info_id separate from rcu_head\n\nstruct watch overlays info_id with rcu_head. A notification poster reads\ninfo_id under rcu_read_lock(), but a concurrent final put can enqueue the\nwatch with call_rcu(). Enqueueing the callback writes rcu_head before the\ngrace period has elapsed, so it can corrupt info_id while the object\nremains legally visible to the reader.\n\n__post_watch_notification() then merges that value into the notification\ninfo word without masking it. Pointer bits can corrupt WATCH_INFO_LENGTH\nand make post_one_notification() copy beyond the posting task\u0027s stack\nrecord.\n\nGive info_id storage separate from rcu_head so RCU enqueueing cannot modify\nit. Place it after the kref, which uses existing tail padding on x86-64.\nMask info_id with WATCH_INFO_ID at the point of use as an additional\ninvariant check.\n\nAn unprivileged shell and keyctl reproducer was run for 30 seconds in QEMU.\nThe vulnerable baseline produced malformed notification lengths, while this\nchange completed with 288631 key notifications and no malformed record.\n\nFixes: c73be61cede5 (\"pipe: Add general notification queue support\")\nReported-by: Tong Liu \u003clyutoon@gmail.com\u003e\nReported-by: Qi Tang \u003ctpluszz77@gmail.com\u003e\nReported-by: Zhiyu Zhang \u003czhiyuzhang999@gmail.com\u003e\nCloses: https://lore.kernel.org/lkml/CALf2hKveij_sHgANY9Aktm1dPa4wfKjKNkHyp9yPbjORWFXagA@mail.gmail.com/\nLink: https://lore.kernel.org/netdev/CALf2hKvp0NPVLwr\u003da3+jUHtPohxbra8gox+aYAfWathJnn-J+Q@mail.gmail.com/\nSigned-off-by: Zhiyu Zhang \u003czhiyuzhang999@gmail.com\u003e\nLink: https://patch.msgid.link/20261029054136.1174216-1-zhiyuzhang999@gmail.com\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "87d02f3e98a86abf70441b0a0418e01cb1d64b44", "tree": "e1e3824cdd59018b8e0dba7418da8f7fc1d21eab", "parents": [ "99f7d39384d6f1967f3dddf27aca47280f63d8d7" ], "author": { "name": "Qu Wenruo", "email": "wqu@suse.com", "time": "Fri Oct 30 07:21:23 2026 +1030" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 15:53:01 2026 +0100" }, "message": "iomap: only follow dio alignment requirement if specified\n\nAfter commit 4025185cf953 (\"iomap: follow the alignment requirement for\niomap_dio_hole_iter()\"), generic/091 fails on both xfs and ext4.\n\nThe reason is that ext4 and xfs (except COW write) do not require full\nblock alignment for direct IO. They are totally fine reading a sub-block\nrange.\n\nThat commit fails any direct read of sub-block holes/prealloc, even those\nfilesystems can handle it without any problem.\n\nFix the regression by only follow the block alignment if the\nIOMAP_DIO_FSBLOCK_ALIGNED flag is set.\n\nFixes: 4025185cf953 (\"iomap: follow the alignment requirement for iomap_dio_hole_iter()\")\nReviewed-by: Pankaj Raghav(Samsung) \u003cpankaj.raghav@linux.dev\u003e\nSigned-off-by: Qu Wenruo \u003cwqu@suse.com\u003e\nLink: https://patch.msgid.link/0e89c49b6f7804081f4041007b81ac620a153830.1793307063.git.wqu@suse.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "22d9db9fd64a493525d692b32c556875b7254665", "tree": "71905afa6a3df24ce3ae870c5c915c9172073947", "parents": [ "3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 30 07:27:28 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 30 07:33:00 2026 -0600" }, "message": "io_uring/sqpoll: don\u0027t attach to a thread that is canceling\n\nio_sq_offload_create() refuses to attach a ring to an SQPOLL thread\nthat has already gone, by checking sqd-\u003ethread under sqd-\u003elock. Since\nthe thread drops the lock while io_uring_cancel_generic() waits for its\nrequests, that check can run while the thread is on its way out and\nstill see it. The new ring is then added to ctx_list, io_uring_setup()\nsucceeds, the thread finishes canceling and exits without ever having\nlooked at the ring, and io_uring_enter() fails with -EOWNERDEAD.\n\nOnly a thread that exits on a fatal signal can be caught like this, as\nthe stop bit is set once the last ring has let go of the sqd, when no fd\nis left to attach through. A fatal signal is group wide and attaching\nneeds the same thread group, so the attacher is on its way out as well.\nStill, make the check see it: set the stop bit before canceling,\nwhatever the reason for the exit, and test it when attaching.\n\nReported-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nFixes: cb0306c52ffa (\"io_uring/cancel: drop sqd-\u003elock while SQPOLL waits\")\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "99f7d39384d6f1967f3dddf27aca47280f63d8d7", "tree": "b4abc877d09db63f52991fdf0f478e558ab312ed", "parents": [ "172658cf600904ff6121e240f69a0ccb36e65d6b", "a290a9e5cf5fbba05d6c59b94b36d00f4fc15ef2" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 13:40:47 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 13:40:47 2026 +0100" }, "message": "Merge patch series \"fs: fixes for aio rings, backing files and iov_iter_alignment()\"\n\nChristian Brauner \u003cbrauner@kernel.org\u003e says:\n\nThe aio bug fixed here is the third way this year to fault on an aio\nring after its file was truncated. The ring file has no -\u003eread_folio\nbecause all of its folios are supposed to be in the page cache so we\njump to NULL. This time vm_munmap() gets interrupted by a fatal signal\nin io_destroy() and leaves the ring mapped. I didn\u0027t want to plug yet\nanother route so the ring now gets a -\u003eread_folio that fails and the\nfault gets SIGBUS. Making the munmap unkillable would only cover this\none route.\n\nI rewrote the backing-file one. FUSE passthrough opens the backing file\nwith the flags of the user\u0027s open but never runs the may_open() checks\nagainst the backing inode. So a passthrough file backed by an\nappend-only file can be overwritten anywhere and one backed by an\nimmutable file can be written to. Chris\u0027 version only checked the write\npaths. That left shared mappings and S_IMMUTABLE open and it failed\nwrites on file descriptors opened before chattr +a which can keep\nwriting on any other filesystem. So the checks are now done at open and\nmmap time like may_open() and do_mmap() do and writes only fail if\nappend mode was taken away from the user file.\n\nFUSE reports EIO instead of EPERM for a refused open because it turns\nevery error from opening the backing file into EIO. I left that alone.\nMiklos, if you\u0027d rather pass the error through I can do that on top.\nAmir, for overlayfs this only changes something if the upper inode is\nchanged behind its back.\n\nThe iov_iter one is a NULL deref that any user can trigger on btrfs with\na single zero-length IORING_OP_READ_FIXED on an O_DIRECT file.\nio_import_fixed() hands out an empty bvec iterator without an array for\nthat and iov_iter_alignment() looks at the first segment before it\nchecks the count. Other places build such iterators as well so I fixed\niov_iter_alignment() instead of io_uring.\n\nAll three are tested in a KASAN VM. Without the patches the aio and\niov_iter reproducers oops and the backing-file one overwrites both an\nappend-only and an immutable file through FUSE passthrough. With them\nnone of that happens.\n\n* patches from https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-0-88f22792f6f7@kernel.org:\n iov_iter: fix NULL deref in iov_iter_alignment()\n backing-file: enforce append-only and immutable backing inodes\n aio: fix NULL deref when a fault races ring truncation\n\nLink: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-0-88f22792f6f7@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "a290a9e5cf5fbba05d6c59b94b36d00f4fc15ef2", "tree": "b4abc877d09db63f52991fdf0f478e558ab312ed", "parents": [ "19b18e01d0361ce495be153ecce80b581086ab3f" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Thu Oct 29 15:00:22 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 13:40:41 2026 +0100" }, "message": "iov_iter: fix NULL deref in iov_iter_alignment()\n\nSince commit 111a12b422a8 (\"io_uring/rsrc: reject zero-length fixed\nbuffer import\") io_import_fixed() hands out an empty ITER_BVEC for a\nzero-length request. Its count is 0 and its bvec array is NULL.\n\niov_iter_alignment() only checks the count for ITER_UBUF. For ITER_BVEC\nit calls iov_iter_alignment_bvec() and the do-while loop in there reads\nbvec-\u003ebv_len before it looks at the count. So it dereferences NULL.\n\nbtrfs checks the alignment of a direct read with iov_iter_alignment()\nbefore it looks at the count and f2fs does the same. So any user that\ncan open a file on btrfs can oops the kernel with a single zero-length\nIORING_OP_READ_FIXED on an O_DIRECT file descriptor. With IOSQE_ASYNC\nthe oops happens in an io-wq worker. The dead worker stays on the worker\nlist and when the task that submitted the request exits io-wq writes to\nthe freed task_struct of the worker. That\u0027s just fallout from the oops\nthough.\n\nEmpty iterators with a NULL array aren\u0027t unusual. afs, tls and tipc\ncreate them as well. So leave io_uring alone and make\niov_iter_alignment() return 0 for an empty iterator of any type.\n\nFixes: 111a12b422a8 (\"io_uring/rsrc: reject zero-length fixed buffer import\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nLink: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-3-88f22792f6f7@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "19b18e01d0361ce495be153ecce80b581086ab3f", "tree": "b2c1302813dc680d48ce930337f18a14f15bdea9", "parents": [ "d53b5aa5cfae27e4d236fc0ab9581085d27f7d33" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Oct 29 15:00:21 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 13:40:41 2026 +0100" }, "message": "backing-file: enforce append-only and immutable backing inodes\n\nFUSE passthrough opens the backing file anew whenever the FUSE file is\nopened. fuse_passthrough_open() passes the flags of that open to\nbacking_file_open() which opens the backing file with vfs_open() and the\ncredentials of the server. But vfs_open() doesn\u0027t go through may_open().\nSo the backing inode is never checked for S_APPEND and S_IMMUTABLE. The\nchecks that did run were done on the FUSE inode and that one never has\neither flag.\n\nSo anyone who may open the FUSE file for writing can overwrite an\nappend-only backing file anywhere or write to an immutable one. The\nserver only has to register the file and a read-only or even an O_PATH\nfile descriptor is enough for that. Registering requires CAP_SYS_ADMIN\nbut the writer can be any user that the server lets open the file.\n\nThe FUSE inode is checked instead of the backing inode in a few more\nplaces:\n\n- do_mmap() refuses a shared mapping of an append-only file that was\n opened for writing. A FUSE file opened with O_RDWR | O_APPEND passes\n the open check and can then be mapped shared and written to at any\n offset.\n\n- fcntl(F_SETFL) and RWF_NOAPPEND refuse to take append mode away from a\n file on an append-only inode. On the FUSE file both succeed. A\n synchronous write still appends because the backing file was opened\n with O_APPEND. But an asynchronous write is submitted with the flags\n of the user\u0027s kiocb and lands at the given offset.\n\nDo the checks on the backing inode. backing_file_open() refuses to open\nan immutable inode for writing and an append-only inode for writing\nwithout O_APPEND, just like may_open(). backing_file_mmap() refuses a\nshared mapping of an append-only inode, just like do_mmap(). And writes\nand splices to a backing file in append mode fail if append mode was\ntaken away from the user file.\n\nA FUSE file that was opened before the backing file became append-only\ncan still write anywhere. That\u0027s what happens on the native filesystem\nas well and the backing file of such a file isn\u0027t in append mode. Two\ndifferences remain. F_SETFL succeeds and the next write fails. And FUSE\nreports EIO for a refused open because it turns every error from opening\nthe backing file into EIO.\n\noverlayfs uses the same helpers but it mirrors S_APPEND and S_IMMUTABLE\nin its own inode and a chattr through the overlay never sets them on the\nupper inode. So for overlayfs this only changes something if the upper\ninode is changed behind the overlay\u0027s back.\n\nFixes: 4a90451bbc7f (\"fuse: implement open in passthrough mode\")\nReported-by: Chris Mason \u003cmason@kernel.org\u003e\nCc: stable@vger.kernel.org # v6.9+\nLink: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-2-88f22792f6f7@kernel.org\nReviewed-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "d53b5aa5cfae27e4d236fc0ab9581085d27f7d33", "tree": "63f3b56af0edc7c0bc4426fcf51a5f71801a6133", "parents": [ "172658cf600904ff6121e240f69a0ccb36e65d6b" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Thu Oct 29 15:00:20 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Oct 30 13:40:40 2026 +0100" }, "message": "aio: fix NULL deref when a fault races ring truncation\n\nThe aio ring lives in a file on the aio pseudo filesystem and the ring\nVMA uses filemap_fault(). aio_ctx_aops doesn\u0027t have a -\u003eread_folio\nbecause aio_setup_ring() puts all folios of the ring into the page\ncache. So a fault on the ring only works as long as it finds its folio\nin the page cache. If it doesn\u0027t, filemap_fault() calls -\u003eread_folio\nwithout checking and we jump to NULL.\n\nWe already fixed this twice this year. A forked child could inherit the\nring mapping, fixed by commit c03ce4173c7b (\"fs: aio: set\nVMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error\"). And a\npartial mremap() could leave part of the ring mapped, fixed by\ncommit 3adf7ae18bf4 (\"fs: aio: reject partial mremap to avoid\nNull-pointer-dereference error\"). Both times a VMA outlived the ring and\nthe ring file was truncated under it.\n\nThere\u0027s a third way to get there. kill_ioctx() and the error path of\nioctx_alloc() unmap the ring with vm_munmap() and ignore the return\nvalue. If vm_munmap() has to wait for mmap_lock and a fatal signal is\npending it returns -EINTR and the VMA stays. free_ioctx() then calls\nput_aio_ring_file() which truncates the ring file to zero. A fault that\npassed the i_size check in filemap_fault() before that doesn\u0027t find its\nfolio anymore, allocates a new one and calls -\u003eread_folio:\n\n fault on the ring io_destroy() with SIGKILL pending\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n vm_munmap() returns -EINTR\n filemap_fault()\n i_size check passes\n free_ioctx()\n put_aio_ring_file()\n truncate_setsize(inode, 0)\n no folio, allocate a new one\n filemap_read_folio()\n -\u003eread_folio \u003d\u003d NULL\n\nAll that\u0027s needed is a second process that shares the mm. If a CLONE_VM\nchild calls io_destroy() and gets SIGKILLed while it waits for mmap_lock\nthe ring stays mapped for the threads of the parent. Any user can do\nthat.\n\nInstead of plugging the routes one by one give the ring a -\u003eread_folio\nthat unlocks the folio and returns -EIO. All folios of a live ring are\nin the page cache so a fault can only end up there if the ring was\ntruncated. The fault now gets SIGBUS. Nothing else reads the ring file\nand the aio filesystem uses noop_backing_dev_info so there\u0027s no\nreadahead either.\n\nMaking vm_munmap() unkillable in those two places would only close this\none route and bring back what commit ae7987835643 (\"mm: make vm_munmap\nkillable\") fixed.\n\nFixes: 36bc08cc0170 (\"fs/aio: Add support to aio ring pages migration\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nLink: https://patch.msgid.link/20261029-work-fs-ai-fixes-v1-1-88f22792f6f7@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "ed35bbe7d06e6505401eff3f3c7a36bd1f167a17", "tree": "7cec0908c18c0cab79ee160f5013aeebef60535f", "parents": [ "ce94927fa4173fcc1eca27bdc65a140064c8f1e6" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Thu Oct 29 16:53:12 2026 -0700" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Thu Oct 29 17:02:50 2026 -0700" }, "message": "apparmor: fix uninitialized variable warning in aa_inherit_files\n\nFix the following warning\n\nAll warnings (new ones prefixed by \u003e\u003e):\n\n\u003e\u003e security/apparmor/file.c:737:53: warning: variable \u0027file\u0027 is uninitialized when used here [-Wuninitialized]\n 737 | int error \u003d aa_file_perm(OP_INHERIT, cred, label, file,\n | ^~~~\n security/apparmor/file.c:724:36: note: initialize the variable \u0027file\u0027 to silence this warning\n 724 | struct file *devnull \u003d NULL, *file;\n | ^\n | \u003d NULL\n 1 warning generated.\n\nvim +/file +737 security/apparmor/file.c\n\n 719\n 720\t/* based on selinux\u0027s flush_unauthorized_files */\n 721\tvoid aa_inherit_files(const struct cred *cred, struct files_struct *files)\n 722\t{\n 723\t\tstruct aa_label *label \u003d aa_get_newest_cred_label(cred);\n 724\t\tstruct file *devnull \u003d NULL, *file;\n 725\t\tbool devnull_tried \u003d false;\n 726\t\tunsigned int n \u003d 0;\n 727\n 728\t\trevalidate_tty(cred, label);\n 729\n 730\t\t/*\n 731\t\t * Revalidate access to inherited open files. Each file is\n 732\t\t * revalidated holding only a reference to it, with no locks\n 733\t\t * held, as revalidation may sleep (e.g. unix socket mediation\n 734\t\t * dropping path refs, or allocating path buffers).\n 735\t\t */\n 736\t\twhile ((n \u003d iterate_fd(files, n, get_next_file, \u0026file)) !\u003d 0) {\n \u003e 737\t\t\tint error \u003d aa_file_perm(OP_INHERIT, cred, label, file,\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202610292346.ehqNujiE-lkp@intel.com/\nFixes: a913281f60015 (\"apparmor: don\u0027t revalidate inherited files under files-\u003efile_lock\")\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "d89e1d186ec9271bf78e62771779e9fc03bf0fc3", "tree": "0c40997edac11ec31e84c61c0f291df109f7288f", "parents": [ "0ff8f40110872ecd3a9918e56ddd0ff1b46fb10e", "a5e894bc87b76fd980075892ba77e6bdeeb5e4d0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 14:00:23 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 14:00:23 2026 -1000" }, "message": "Merge tag \u0027fscrypt-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fscrypt/linux\n\nPull fscrypt fixes from Eric Biggers:\n\n - Add more checks to prevent encryption on \"large block size\" ext4\n filesystems (s_blocksize \u003e PAGE_SIZE), which isn\u0027t supported yet.\n There was already a mount-time check, but it wasn\u0027t enough.\n\n - Add missing memory barrier to fscrypt_find_mode_key()\n\n - Add missing zeroization in an error path\n\n* tag \u0027fscrypt-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fscrypt/linux:\n ext4: reject encrypted inodes when block size \u003e page size\n ext4: refuse encryption when block size \u003e page size\n fscrypt: Fix missing barrier in fscrypt_find_mode_key()\n fscrypt: Explicitly zeroize sw_secret in error path\n" }, { "commit": "0ff8f40110872ecd3a9918e56ddd0ff1b46fb10e", "tree": "fe365ddb9b3988fc583f7cb17c969e488a6fff78", "parents": [ "5fade975d5632280855d03699edd22c0689e3a3f", "ee1cb3443cff5a800948b662756f75b17ca63fe2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 13:31:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 13:31:48 2026 -1000" }, "message": "Merge tag \u0027ntfs3_for_7.4\u0027 of https://github.com/Paragon-Software-Group/linux-ntfs3\n\nPull ntfs3 updates from Konstantin Komarov:\n \"The bulk of this cycle is hardening against corrupted or maliciously\n crafted volumes. Most of these fixes come from fuzzing and KASAN\n reports. The main areas are:\n\n - $LogFile replay, where several unchecked on-disk sizes could make\n mount write past the MFT record buffer\n - MFT record and index parsing\n - extended attributes, where a bad $EA entry could leak up to 64K of\n kernel heap to userspace through getxattr()\n\n Reading a damaged compressed file could also return uninitialized page\n cache contents to userspace; that is fixed too.\n\n A few fixes affect healthy volumes as well: a heap overflow in\n fallocate(INSERT_RANGE) on small files, a use-after-free when a\n WOF-compressed file is opened for writing during a concurrent read, a\n lock-order deadlock in readdir, and stale disk data showing up in\n newly allocated clusters of compressed files.\n\n On the feature side there are new tracepoints covering mount, log\n replay, lookup, directory index, allocation, iomap and file I/O. There\n is also a new \u0027ugm\u0027 mount option (on by default): with ugm\u003d0, newly\n created files don\u0027t get the WSL uid/gid/mode extended attributes,\n which Windows doesn\u0027t use.\n\n The rest is smaller correctness fixes and cleanups\"\n\n* tag \u0027ntfs3_for_7.4\u0027 of https://github.com/Paragon-Software-Group/linux-ntfs3: (52 commits)\n ntfs3: add file I/O tracepoints\n ntfs3: add iomap tracepoints\n ntfs3: add allocation tracepoints\n ntfs3: add directory index tracepoints\n ntfs3: add create inode tracepoint\n ntfs3: add namei tracepoints\n ntfs3: add mount and log replay tracepoints\n fs/ntfs3: validate the EA value length in ntfs_read_ea()\n fs/ntfs3: handle partial allocation in attr_data_get_block_locked()\n ntfs3: fix mapping pairs bounds check for alignment\n fs/ntfs3: bound DeleteAttribute asize against rec-\u003eused in do_action\n ntfs3: release ni_lock before dir_emit in ntfs_readdir to fix deadlocks\n fs/ntfs3: bound CreateAttribute asize against record_size in do_action\n fs/ntfs3: do not mark frame pages uptodate on read error\n fs/ntfs3: prevent positive E_NTFS_NONRESIDENT from reaching writeback error handling\n fs/ntfs3: fix ntfs_fnd leak when compare function is missing\n fs/ntfs3: fix stale attr_b in attr_allocate_frame()\n fs/ntfs3: reject unaligned hole punching on compressed files\n fs/ntfs3: take ni_lock() once in ntfs_readdir()\n fs/ntfs3: reserve a compression unit in maxbytes_sparse\n ...\n" }, { "commit": "5fade975d5632280855d03699edd22c0689e3a3f", "tree": "53d5071d92a69c18bf577829fa30f79a5cd46e0e", "parents": [ "9c7e3d59107e2daf204bf6bf87b6c448ca89defe", "9ca9e8c857b55a081d5a1f8039b27cbb4d646b49" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 13:24:49 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 13:24:49 2026 -1000" }, "message": "Merge tag \u0027kgdb-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux\n\nPull kgdb updates from Daniel Thompson:\n \"Varied updates this cycle.\n\n Naveen Kumar Chaudhary fixed a memory leak when the environment is\n already full, eliminated to weird historical cruft (CMD_BUFLEN having\n different values in different files) and removed some dead code.\n\n Fang Xieyan tackled a family of related buffer overflows in the gdb\n remote protocol parsing (great fixes from a defensive coding point of\n view but not security relavent; gdb can already do anything it wants\n to)\"\n\n* tag \u0027kgdb-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux:\n kgdb: Fix buffer overflow in the qRcmd packet handler\n kgdb: Fix buffer overflow in the \u0027M\u0027 and \u0027X\u0027 packet handlers\n kgdb: Fix buffer overflow in the \u0027m\u0027 packet handler\n kgdb: remove unreachable return in kgdb_reenter_check()\n kdb: unify CMD_BUFLEN definition into kdb_private.h\n kdb: fix memory leak in kdb_setenv() when environment is full\n" }, { "commit": "9c7e3d59107e2daf204bf6bf87b6c448ca89defe", "tree": "59e0a03cba2d5dc957b578b0afbb5e95a39fe0ee", "parents": [ "1b8b67503725fa6deb3a4f00ea61f982bd00c152", "33b28f3b313353f11fc939e9a268605e66290d0b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 12:39:45 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 12:39:45 2026 -1000" }, "message": "Merge tag \u0027hyperv-next-signed-20261028\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux\n\nPull hyperv updates from Wei Liu:\n\n - Update to documents and code comments (Michael Kelley)\n\n - Harden Vmbus (Kameron Carr)\n\n - Rework MSHV driver page deposit logic (Mukesh Rathor)\n\n - Vmbus kexec bug fix (Shradha Gupta)\n\n - Miscellaneous bug fixes (Daehyeon Ko, Jiale Yao, Sasha Levin)\n\n* tag \u0027hyperv-next-signed-20261028\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:\n Drivers: hv: Remove leftover support for old Hyper-V versions\n mshv: Remove unused *_old memory deposit functions\n mshv: Redesign hypervisor memory deposit logic\n mshv: Rename memory deposit memory functions to _old\n mshv_vtl: reject poll files with multiple waitqueues\n mshv_vtl: detach poll waiter on POLLFREE\n mshv_vtl: initialize poll file mutex before device registration\n Documentation: hyperv: Update information on guest CPU offlining\n Documentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2\n Drivers: hv: Run VMBus kexec cleanup from syscore shutdown\n kexec: Add helper to report an active kexec reboot\n tools: hv: remove unused rte_smp_mb()\n Documentation: hyperv: Update documentation for sending VMBus packets\n Drivers: hv: vmbus: Check ACPI companion before use\n Documentation: hyperv: Describe validation of the ring buffer indices\n Drivers: hv: vmbus: Keep the ring byte counts sane for a bad index\n Drivers: hv: vmbus: Compute ring byte counts from a caller-held snapshot\n Drivers: hv: vmbus: Use *_ONCE() to access shared ring buffer indices\n Drivers: hv: vmbus: Bounds check the shared ring buffer indices\n" }, { "commit": "1b8b67503725fa6deb3a4f00ea61f982bd00c152", "tree": "6e8a9630acc926a8bf23765382e03056d1d2d188", "parents": [ "fb7bd3a2aad70a76232a7168a505386d0a1396af", "a5ae1bf65cee84bcc121d659e7e22a767853f5f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 12:33:25 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 12:33:25 2026 -1000" }, "message": "Merge tag \u0027riscv-for-linus-7.4-mw1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V updates from Paul Walmsley:\n\n - Add support for crash hotplug\n\n - Improve user copy performance on cores with fast misaligned accesses\n\n - Optimize code paths involving pgtable_l{4,5}_enabled() by patching in\n the return values during early boot (since these don\u0027t change during\n runtime), or by specifying the return values directly in Kconfig\n files (for purpose-built kernels)\n\n - Change the PCIe bus reassignment behavior to depend on the\n PCI_REASSIGN_ALL_BUS PCI flag (as ARM64 does)\n\n - Avoid an unnecessary sstatus CSR read during context switch\n\n - Make the sbi_ecall() macro variadic, improving code clarity\n\n - Refactor __switch_to_vector() to prepare for upcoming vector context\n switch optimizations\n\n - Add a kselftest for vectorized user copy\n\n - Add bounds checking on the shadow stack restore token address to\n avoid it being used as an attack vector\n\n - Fix the shadow stack and indirect branch landing pad control\n functions to only update the CPU\u0027s envcfg CSR when operating on the\n current task\n\n - For MIPS RISC-V systems, add support for early boot-applied errata;\n and for P8700 RISC-V systems, avoid WFI usage in the kernel (since it\n is buggy)\n\n - Add the \"B\" RISC-V ISA extension to hwcap and hwprobe reporting\n\n - Add support for specifying and reporting the \"Zic64b\" RISC-V ISA\n extension, and add it to the SpacemiT K1, K3, and Sophgo SG2044 DT\n files\n\n - Require the block size of cache management operations to be specified\n in DT schema validation for the RISC-V ISA extensions Zicbom, Zicbop,\n and Zicboz\n\n - Some miscellaneous fixes: fix an incorrect bitfield width in the\n RVG_SYSTEM_CSR_MASK bitmask macro; make RISCV_ALTERNATIVE mandatory,\n now that XIP kernel support has been removed; and remove some\n unnecessary includes in kernel/smp.c\n\n* tag \u0027riscv-for-linus-7.4-mw1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (28 commits)\n riscv: mm: unexport _pgtable_l4_enabled and _pgtable_l5_enabled\n riscv: introduce RISCV_ISA_SV48 and RISCV_ISA_SV57\n riscv: support early isa ext and use it to optimize pgtable_l4|l5_enabled\n riscv: convert pgtable_l4|l5_enabled to inline function\n riscv: remove RISCV_ALTERNATIVE Kconfig option\n riscv: Add a getter for user PMLEN support\n riscv: dts: sophgo: sg2044: Add Zic64b ISA extension\n riscv: dts: spacemit: k1: Add Zic64b ISA extension\n riscv: dts: spacemit: k3: Add Zic64b ISA extension\n riscv: Add Zic64b to cpufeature and hwprobe\n dt-bindings: riscv: Add Zic64b extension description\n dt-bindings: riscv: Require block-size for Zicbom, Zicbop, and Zicboz\n riscv: Add B to hwcap and hwprobe\n riscv: remove unused profile.h includes\n riscv: cfi: Only write envcfg CSR when task is current\n riscv: cfi: Bounds check restore token before swap\n riscv: Add ERRATA_MIPS_P8700_WFI to replace WFI with mips.pause\n selftest: riscv: test vectorized user copy\n riscv: vector: refactor context switch for kernel-mode vector\n riscv: do not read csr in vector context switch\n ...\n" }, { "commit": "f46be4da2cbb17574b5369517a9a1e1b414063b4", "tree": "d53cc5b50cd34630904f9f5398639a2097752ec9", "parents": [ "078e122f3bf000dd45965997b66deac10ee580fa" ], "author": { "name": "Iván Ezequiel Rodriguez", "email": "ivanrwcm25@gmail.com", "time": "Wed Oct 28 12:43:14 2026 -0300" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu Oct 29 20:42:23 2026 +0000" }, "message": "selftests/arm64: GCS must not leak on a failed clone3\n\nKTAP coverage for clone3(CLONE_VM|CLONE_PIDFD) with a bad pidfd\npointer: sixteen failures must not grow the parent\u0027s GCS VMA count.\n\nAssisted-by: LLM\nSigned-off-by: Iván Ezequiel Rodriguez \u003civanrwcm25@gmail.com\u003e\nReviewed-by: Mark Brown \u003cbroonie@kernel.org\u003e\nTested-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "078e122f3bf000dd45965997b66deac10ee580fa", "tree": "42344f0ea9c5594fd3a8ca1811a496f1af566f95", "parents": [ "486d396b19e93f6e56e0a0ba96c14a9ccc1a5977" ], "author": { "name": "Iván Ezequiel Rodriguez", "email": "ivanrwcm25@gmail.com", "time": "Wed Oct 28 12:43:12 2026 -0300" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu Oct 29 20:42:22 2026 +0000" }, "message": "arm64/gcs: release GCS on failed fork\n\ncopy_thread() can map a CLONE_VM GCS and still return 0. A later\ncopy_process() failure calls exit_thread(), but arm64 did not\nimplement it, so the VMA stayed in the parent\u0027s mm. Wire\nHAVE_EXIT_THREAD to gcs_free().\n\nKernel threads created with CLONE_VM (io_uring and vhost workers)\ninherit the parent\u0027s gcs_base/gcs_size from arch_dup_task_struct()\nwithout allocating their own GCS. When such a thread exits,\nexit_mm() -\u003e mm_release() -\u003e deactivate_mm() -\u003e gcs_free() unmaps the\nparent\u0027s GCS. With the new exit_thread(), a failed copy_process() for\none of these threads would do the same. Clear these fields in\ncopy_thread().\n\nFixes: 506496bcbb42 (\"arm64/gcs: Ensure that new threads have a GCS\")\nCc: stable@vger.kernel.org\nCc: Mark Brown \u003cbroonie@kernel.org\u003e\nAssisted-by: LLM\nSigned-off-by: Iván Ezequiel Rodriguez \u003civanrwcm25@gmail.com\u003e\nReviewed-by: Mark Brown \u003cbroonie@kernel.org\u003e\nTested-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "a287f97d4256b5f5527f5b5a54f8ada55e1482c7", "tree": "5e05c53003ecf24ae22fa1a1032962ec7640a5a3", "parents": [ "a01c8e5b1dff1ce489e6b339139e744db36b8bb3" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 28 14:42:15 2026 +0100" }, "committer": { "name": "Danilo Krummrich", "email": "dakr@kernel.org", "time": "Thu Oct 29 21:01:16 2026 +0100" }, "message": "Revert \"driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers\"\n\nThis reverts commit fcbfaffee51a452cc8efcbaa3b88ec4595678424.\n\nTurns out that vfio is a crazy beast and people have been \"relying\" on\nthe bind/unbind debugging feature as a way to handle passing through\ndevices to guest instances. Because of this (https://xkcd.com/1172/),\nlet\u0027s revert the feature for now until we can figure out a more agreeable\nway to handle this such that normal workflows do not taint the kernel.\n\nOdds are something like what Uwe proposes at:\n\thttps://lore.kernel.org/lkml/cover.1790612298.git.u.kleine-koenig@baylibre.com/\nwill be the best way forward and will be revisited after for after 7.4.\n\nThe feature was originally intended to stem the flow of unnecessary\nfuzzing reports of \"broken\" drivers where random devices were being\nbound to random drivers and of course things were going wrong. The main\nsyzbot tool is now not doing this anymore, and hopefully no one else\nstarts it up again (but in this madness of LLMs these days, you can\u0027t be\nsure.)\n\nThanks to everyone for telling me just how wrong I was to implement\nthis, I appreciated the feedback :)\n\nLink: https://lore.kernel.org/all/DLIL9H50MALI.3JROXYEEUM3KU@kernel.org/\nTo: Jonathan Corbet \u003ccorbet@lwn.net\u003e\nTo: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nTo: Randy Dunlap \u003crdunlap@infradead.org\u003e\nTo: \"Rafael J. Wysocki\" \u003crafael@kernel.org\u003e\nTo: Danilo Krummrich \u003cdakr@kernel.org\u003e\nTo: Johan Hovold \u003cjohan@kernel.org\u003e\nTo: Steven Rostedt \u003crostedt@goodmis.org\u003e\nTo: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nTo: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nReported-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nReported-by: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nReported-by: Michal Pecio \u003cmichal.pecio@gmail.com\u003e\nReported-by: \"Uwe Kleine-König\" \u003cu.kleine-koenig@baylibre.com\u003e\nLink: https://patch.msgid.link/20261028-bind_taint-revert-v1-1-7c6b9cef30c9@linuxfoundation.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n[ Revert the change in Documentation/admin-guide/tainted-kernels.rst.\n - Danilo ]\nSigned-off-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\n" }, { "commit": "fb7bd3a2aad70a76232a7168a505386d0a1396af", "tree": "c2421d62d0df43ea79324a81eb69d875d6d8032b", "parents": [ "4dd16e31135ea8437a720222df34e8745f385d6d", "7d109178cd644268326cd31702ed46c7ac8bb300" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 09:40:12 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 09:40:12 2026 -1000" }, "message": "Merge tag \u0027rust-fixes-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull Rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Fix \u0027objtool\u0027 warnings for the upcoming Rust 1.101.0 (expected\n 2026-12-24) by adding one more \u0027noreturn\u0027 function\n\n \u0027kernel\u0027 crate:\n\n - Fix KCFI failures on every call from C to Rust IRQ handlers and\n \u0027hrtimer\u0027 callbacks by giving the C enum bindings the correct\n \u0027cfi_encoding\u0027. Also prevent the same issue for DMA callbacks\n taking \u0027dma_data_direction\u0027\n\n - \u0027workqueue\u0027 module: fix a runtime warning when queueing work on the\n deprecated \u0027system_wq\u0027 by switching to \u0027system_{percpu,dfl}_wq\u0027\"\n\n* tag \u0027rust-fixes-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: dma: declare cfi_encoding for dma_data_direction\n rust: hrtimer: declare cfi_encoding for hrtimer_restart\n rust: irq: declare cfi_encoding for irqreturn\n objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0\n rust: workqueue: replace deprecated system_wq with system_{percpu,dfl}_wq\n" }, { "commit": "4dd16e31135ea8437a720222df34e8745f385d6d", "tree": "004c93006bf6fdd3618249deedab3fbbdc8bee30", "parents": [ "46806af187f448b0d5481f284e7c900a57ee6a6d", "8f44631ba02afe9fff2f0a0fb66560ab19df87fd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:17:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:17:05 2026 -1000" }, "message": "Merge tag \u0027net-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Current release - new code bugs:\n\n - mctp: usblib: fix assertion breaking esoteric builds\n\n Previous releases - regressions:\n\n - Revert advertising the TCP MSS from the configured MTU\n\n - netlink: check sk_rcvbuf before charging the dump skb\n\n - eth:\n - ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl\n - mlx4: always create the eth and ib auxiliary devices\n - tg3: invert restart quirk logic to restrict SNP power-down bypass\n - bnxt: recycle agg buffers when Rx head buffer allocation fails\n\n Previous releases - always broken:\n\n - net: fix frag_list leak in skb_segment_list() error path\n\n - sctp: reject forged cookie peer_addr with unknown address family\n\n - vxlan: keep reserved_bits across changelink\n\n - net: limit priority VLAN untag depth\n\n - inet: frags: prevent acceptance of partially authenticated reassembly\n\n - gro: do not GRO GSO packets with inconsistent payload\n\n - tcp: avoid double destroy in tcp_abort() of an unaccepted child\"\n\n* tag \u0027net-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (137 commits)\n tun: drop batched packets while the device is down\n selftests: net: netlink-dumps: start a dump with a notification queued\n netlink: check sk_rcvbuf before charging the dump skb\n net/sched: act_ife: do not consume the inner header on egress\n openvswitch: use eth_type_trans_careful() in internal_dev_recv()\n net: use eth_type_trans_careful() in __dev_forward_skb2()\n loopback: use eth_type_trans_careful()\n net: add eth_type_trans_careful()\n tcp: initialize mapped children before route lookup\n tcp: fix reordering addition overflow in MTU probing\n tcp: avoid double destroy in tcp_abort() of an unaccepted child\n net: bgmac: fix TX DMA unmapping and slot cleanup\n gro: do not GRO GSO packets with inconsistent payload\n net/packet: check TX_RING fragments before memory accounting\n eth: bnxt: hand XDP frags over to the copybreak skb\n eth: bnxt: free XDP frags when xdp_do_redirect() fails\n eth: bnxt: don\u0027t leak buffers when XDP agg buffer allocation fails\n eth: bnxt: resize Rx head buffers when rx-copybreak changes\n eth: bnxt: recycle agg buffers when Rx head buffer allocation fails\n netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts\n ...\n" }, { "commit": "46806af187f448b0d5481f284e7c900a57ee6a6d", "tree": "4a664c1e3f24c91ad6df8b5c5e3bf2fd10b4ee1d", "parents": [ "d011f648a708b231f7ef28c18ff30c815b07fe56", "c8a8a68d3ab4a06c8f5a13a8c00275351c8239b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:10:23 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:10:23 2026 -1000" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that\n were added for rust-bpf in this merge window. We found a cleaner\n approach that does it on compiler side instead of kernel/libbpf. No\n released kernel has them (Alexei Starovoitov)\n\n - Fix bpf_send_signal_task() returning -EPERM when it is called from a\n kernel thread (Aditya Sharma)\n\n - Various fixes (Alexei Starovoitov):\n - Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix\n objtool warning during the build\n - Fix scalar evolution: clear delta of a widened register, don\u0027t\n widen a pointer to a buffer, don\u0027t clamp a register whose type\n changed in the loop, and reset the range of a clamped packet\n pointer\n - Finish the insn in the state that maybe_fork_scalars() splits\n off, so that pruning doesn\u0027t drop it at the head of a counted\n loop\n - Preserve the registers that carry stack arguments across\n arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64\n - Don\u0027t re-sort subprog_info[] for every new subprogram\n - Fix flaky map_kptr and rcu_reentry selftests\n\n - Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative()\n and bpf_xdp_load_bytes(), since the destination can be a slice of the\n same packet (Ayushman Rout)\n\n - Fixes and follow-ups for scalar evolution: reject pointer operands in\n 32-bit recurrences and latches, don\u0027t intersect with the current\n register range on clamp to avoid a false \u0027verifier bug\u0027, avoid false\n infinite loop reports, and recognize a 32-bit copy of the induction\n variable (Eduard Zingerman)\n\n - Fix out-of-bounds write to btf-\u003etypes[] for split BTF and propagate\n btf_add_type() errors in btf_check_all_metas() (Feng Yang)\n\n - Fix use-after-free in bpf_timer callback that fires after its inner\n map was freed (Mani Tofigh)\n\n - Fix x86 JIT stopping before jumps converge: size backward jumps by\n the insns they jump over (Mykyta Yatsenko)\n\n - Fix use-after-free of struct_ops trampoline: dissociate struct_ops\n progs before the grace period of the map (Qiliang Yuan)\n\n - Validate stack argument reads against the caller state to fix\n out-of-bounds read in the verifier, and reject callbacks with stack\n arguments (Weiming Shi)\n\n - Tie borrowed iterator results and pointers loaded from trusted fields\n to the lifetime of their source, so that iterator next, destroy and\n reference release invalidate them (Xu Yunxiang)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits)\n bpf: Don\u0027t re-sort subprog_info[] for every new subprogram\n bpf: Fix out-of-bounds btf-\u003etypes write for split BTF\n selftests/bpf: Test stack arguments across may_goto\n bpf: Keep stack arguments in arch_bpf_timed_may_goto()\n selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop\n bpf: Finish the insn in the state that maybe_fork_scalars() splits off\n selftests/bpf: Test the clamp of pointers in scalar evolution\n bpf: Reset the range of a packet pointer that scalar evolution clamps\n bpf: Don\u0027t clamp a register whose type changed in the loop\n selftests/bpf: Test a loop that moves a pointer to a buffer\n bpf: Don\u0027t widen a pointer to a buffer in scalar evolution\n selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed\n selftests/bpf: Wait for the last maps of map_kptr to be freed\n selftests/bpf: Test that a widened register is not linked\n bpf: Clear delta of a register that scalar evolution widens\n bpf, x86: Remove r0_on_stack from fetching atomics in arena\n bpf: Remove BPF_F_ARENA_SCALAR\n selftests/bpf: Remove tests for arena access through numbers\n libbpf: Keep format strings of bpf_printk() in .rodata\n libbpf: Remove .arena.data\n ...\n" } ], "next": "d011f648a708b231f7ef28c18ff30c815b07fe56" }