)]}' { "log": [ { "commit": "95e56f0f293ef797123eb032f78f5b5d56a035a6", "tree": "19372012f5dfbe2ef2aeb4c1a248ed34ff83b876", "parents": [ "2bfc56d9f5e82f6aada2a8d68093aab0b1f00f6a", "07a1a6562ce29e2e0c134a57882d6e52e8758492" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 08:56:31 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 08:56:31 2026 +0530" }, "message": "Merge tag \u0027kcsan-20260612-v7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux\n\nPull KCSAN update from Marco Elver:\n\n - Silence -Wmaybe-uninitialized when calling __kcsan_check_access()\n\n* tag \u0027kcsan-20260612-v7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux:\n kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()\n" }, { "commit": "2bfc56d9f5e82f6aada2a8d68093aab0b1f00f6a", "tree": "6441d1db6b098baa5ea17b856d39723952c6f437", "parents": [ "73f399414a84d715bb1794182aaea852b11d0962", "a174910917a8e93cb5334e9dce8bac32bff22c47" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 05:06:02 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 05:06:02 2026 +0530" }, "message": "Merge tag \u0027for-linus-7.2-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen updates from Juergen Gross:\n\n - Several small cleanups of various Xen related drivers\n (xen/platform-pci, xen-balloon, xenbus, xen/mcelog)\n\n - Cleanup for Xen PV-mode related code (includes dropping the Xen\n debugfs code)\n\n - Drop the additional lazy mmu mode tracking done by Xen specific code\n\n* tag \u0027for-linus-7.2-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen/xenbus: Replace strcpy() with memcpy()\n x86/xen: Replace generic lazy tracking with cpu specific one\n x86/xen: Get rid of last XEN_LAZY_MMU uses\n mm: Refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume()\n x86/xen: Change interface of xen_mc_issue()\n x86/xen: Drop lazy mode from trace entries\n x86/xen: Remove Xen debugfs support\n x86/xen: Cleanup Xen related trace points\n x86/xen: Guard PV-only stuff in xen-ops.h with CONFIG_XEN_PV\n xen: balloon: Replace sprintf() with sysfs_emit()\n xen/mcelog: mark g_physinfo, ncpus and xen_mce_chrdev_device as __ro_after_init\n xen: constify xsd_errors array\n xen/platform-pci: Simplify initialization of pci_device_id array\n" }, { "commit": "73f399414a84d715bb1794182aaea852b11d0962", "tree": "91a7d6656d3d93dfb77a40c7b5763048ce9c61c1", "parents": [ "de02909ae81aa4fda213d16915adb5e1b088a7db", "1a1e62a5a48494cdf33e3bfb82fb8f408da7c4cc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 05:01:15 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 05:01:15 2026 +0530" }, "message": "Merge tag \u0027kbuild-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild / Kconfig updates from Nathan Chancellor:\n \"Kbuild:\n\n - Remove broken module linking exclusion for BTF\n\n - Add documentation around how offset header files work\n\n - Include unstripped vDSO libraries in pacman packages\n\n - Bump minimum version of LLVM for building the kernel to 17.0.1 and\n clean up unnecessary workarounds\n\n - Use a context manager in run-clang-tools\n\n - Add dist macro value if present to release tag for RPM packages\n\n - Detect and report truncated buf_printf() output in modpost\n\n - Add __llvm_covfun and __llvm_covmap to section whitelist in modpost\n\n - Support Clang\u0027s distributed ThinLTO mode\n\n - Remove architecture specific configurations for AutoFDO and\n Propeller to ease individual architecture maintenance\n\n Kconfig:\n\n - Add kconfig-sym-check target to look for dangling Kconfig symbol\n references and invalid tristate literal values\n\n - Harden against potential NULL pointer dereference\n\n - Fix typo in Kconfig test comment\"\n\n* tag \u0027kbuild-7.2-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (31 commits)\n kconfig: tests: fix typo in comment\n kconfig: Remove the architecture specific config for Propeller\n kconfig: Remove the architecture specific config for AutoFDO\n modpost: Add __llvm_covfun and __llvm_covmap to section_white_list\n kconfig: add kconfig-sym-check static checker\n kbuild: Remove unnecessary \u0027T\u0027 modifier in cmd_ar_builtin_fixup\n kbuild: distributed build support for Clang ThinLTO\n kbuild: move vmlinux.a build rule to scripts/Makefile.vmlinux_a\n scripts: modpost: detect and report truncated buf_printf() output\n kbuild: rpm-pkg: append %{?dist} macro to Release tag\n run-clang-tools: run multiprocessing.Pool as context manager\n compiler-clang.h: Drop explicit version number from \"all\" diagnostic macro\n compiler-clang.h: Remove __cleanup -Wunused-variable workaround\n kbuild: Remove check for broken scoping with clang \u003c 17 in CC_HAS_ASM_GOTO_OUTPUT\n x86/entry/vdso32: Remove conditional omission of \u0027.cfi_offset eflags\u0027\n x86/module: Revert \"Deal with GOT based stack cookie load on Clang \u003c 17\"\n x86/build: Drop unnecessary \u0027-ffreestanding\u0027 addition to KBUILD_CFLAGS\n scripts/Makefile.warn: Drop -Wformat handling for clang \u003c 16\n riscv: Drop tautological condition from TOOLCHAIN_NEEDS_OLD_ISA_SPEC\n riscv: Remove tautological condition from selection of ARCH_SUPPORTS_CFI\n ...\n" }, { "commit": "de02909ae81aa4fda213d16915adb5e1b088a7db", "tree": "a49a44264dc37e943786d6e074105ad1b458f2b7", "parents": [ "8ab34af09f292ca9620dad8df253fec766729b29", "d53ac61b6120fa596d758ff6e22b5dcb6db21ce8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:28:20 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:28:20 2026 +0530" }, "message": "Merge tag \u0027pull-configfs-fixed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull configfs updates from Al Viro:\n \"A couple of fixes (UAF in configfs_lookup() and really old races\n introduced when lseek() on configfs directories stopped locking those\n directories; impact up to and including UAF).\n\n Fixes aside, the main result is that configfs is finally switched to\n tree-in-dcache machinery. It\u0027s *not* making use of recursive removal\n helpers yet, and it still does the bloody awful \"build subtree in full\n sight of userland, with possibility of failure halfway through and\n need to unroll\" that forces the locking model from hell; dealing with\n that is a separate patch series, once this one is out of the way.\n However, it is using DCACHE_PERSISTENT properly now. And apparmorfs is\n the sole remaining user of __simple_{unlink,rmdir}() at that point\"\n\n* tag \u0027pull-configfs-fixed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:\n create_default_group(): pass parent\u0027s dentry instead of config_group\n configfs_attach_group(): drop the unused parent_item argument\n configs_attach_item(): drop unused parent_item argument\n configfs_create(): lift parent timestamp updates into callers\n kill configfs_drop_dentry()\n configfs: mark pinned dentries persistent\n configfs: dentry refcount needs to be pinned only once\n switch configfs_detach_{group,item}() to passing dentry\n configfs_remove_dir(), detach_attrs(): switch to passing dentry\n populate_attrs(): move cleanup to the sole caller\n populate_group(): move cleanup on failure to the sole caller\n configfs_detach_rollback(): pass configfs_dirent instead of dentry\n configfs_do_depend_item(): pass configfs_dirent instead of dentry\n configfs_depend_prep(): pass configfs_dirent instead of dentry\n configfs_detach_prep(): pass configfs_dirent instead of dentry\n configfs_mkdir(): use take_dentry_name_snapshot()\n configfs: fix lockless traversals of -\u003es_children\n configfs_lookup(): don\u0027t leave -\u003es_dentry dangling on failure\n" }, { "commit": "8ab34af09f292ca9620dad8df253fec766729b29", "tree": "86e19444f0633efc34c2131ded68ed1db87d9bff", "parents": [ "e8a56d6fc828bb569fa2dd33c3e6eb16a165b097", "2555ac7a450bf11f8e461ce6cd0f62613734a796" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:21:00 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:21:00 2026 +0530" }, "message": "Merge tag \u0027pull-d_add\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull dentry d_add() cleanups from Al Viro:\n \"This converts a bunch of unidiomatic uses of d_add() in -\u003elookup()\n instances to equivalent uses of d_splice_alias(), which is the normal\n mechanism for -\u003elookup()\"\n\n* tag \u0027pull-d_add\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:\n gfs2: use d_splice_alias() for -\u003elookup() return value\n ntfs: use d_splice_alias() for -\u003elookup() return value\n simple_lookup(): use d_splice_alias() for -\u003elookup() return value\n ecryptfs: use d_splice_alias() for -\u003elookup() return value\n configfs_lookup(): switch to d_splice_alias()\n tracefs: use d_splice_alias() in -\u003elookup() instances\n" }, { "commit": "e8a56d6fc828bb569fa2dd33c3e6eb16a165b097", "tree": "1742623129141d47c68509271cf8183133e48849", "parents": [ "79169a1624253363fed3e9a447b77e50bb226206", "3df5153c5f123d6018c82a24341ccd99c79d64a0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:15:31 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:15:31 2026 +0530" }, "message": "Merge tag \u0027pull-dcache\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull dcache updates from Al Viro:\n\n - d_alloc_parallel() API change (Neil\u0027s with my changes)\n\n - NORCU fixes\n\n - Reorganization and simplification of dentry eviction logic\n\n - Simplifying rcu_read_lock() scopes in fs/dcache.c\n\n - Secondary roots work - getting rid of NFS fake root dentries and\n dealing with remaining shrink_dcache_for_umount() and\n shrink_dentry_list() races\n\n - making cursors NORCU (surprisingly easy)\n\n* tag \u0027pull-dcache\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (22 commits)\n make cursors NORCU\n nfs: get rid of fake root dentries\n wind -\u003es_roots via -\u003ed_sib instead of -\u003ed_hash\n shrink_dentry_tree(): unify the calls of shrink_dentry_list()\n shrinking rcu_read_lock() scope in d_alloc_parallel()\n d_walk(): shrink rcu_read_lock() scope\n document dentry_kill()\n adjust calling conventions of lock_for_kill(), fold __dentry_kill() into dentry_kill()\n Document rcu_read_lock() use in select_collect2()\n Shift rcu_read_{,un}lock() inside fast_dput()\n simplify safety for lock_for_kill() slowpath\n fold lock_for_kill() and __dentry_kill() into common helper\n fold lock_for_kill() into shrink_kill()\n shrink_dentry_list(): start with removing from shrink list\n d_prune_aliases(): make sure to skip NORCU aliases\n kill d_dispose_if_unused()\n make to_shrink_list() return whether it has moved dentry to list\n select_collect(): ignore dentries on shrink lists if they have positive refcounts\n find_acceptable_alias(): skip NORCU aliases with zero refcount\n fix a race between d_find_any_alias() and final dput() of NORCU dentries\n ...\n" }, { "commit": "79169a1624253363fed3e9a447b77e50bb226206", "tree": "e7c5853529da0bd435d04d2445e4d2bed9050021", "parents": [ "7e0e7bd60d4a812b694c477716597fcb038b00cb", "cf30ceccfaec3d2549ff60f7c915625f12dd3a93" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:07:58 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 04:07:58 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.procfs\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull procfs updates from Christian Brauner:\n\n - Revamp fs/filesystems.c\n\n The file was a mess with a hand-rolled linked list in desperate need\n of a cleanup. The filesystems list is now RCU-ified, /proc files can\n be marked permanent from outside fs/proc/, and the string emitted\n when reading /proc/filesystems is pre-generated and cached instead of\n pointer-chasing and printfing entry by entry on every read.\n\n The file is read frequently because libselinux reads it and is linked\n into numerous frequently used programs (even ones you would not\n suspect, like sed!). Scalability also improves since reference\n maintenance on open/close is bypassed.\n\n open+read+close cycle single-threaded (ops/s):\n before: 442732\n after: 1063462 (+140%)\n\n open+read+close cycle with 20 processes (ops/s):\n before: 606177\n after: 3300576 (+444%)\n\n A follow-up patch adds missing unlocks in some corner cases and\n tidies things up.\n\n - Relax the mount visibility check for subset\u003dpid mounts\n\n When procfs is mounted with subset\u003dpid, all static files become\n unavailable and only the dynamic pid information is accessible. In\n that case there is no point in imposing the full mount visibility\n restrictions on the mounter - everything that can be hidden in procfs\n is already inaccessible. These restrictions prevented procfs from\n being mounted inside rootless containers since almost all container\n implementations overmount parts of procfs to hide certain\n directories.\n\n As part of this /proc/self/net is only shown in subset\u003dpid mounts for\n CAP_NET_ADMIN, reconfiguring subset\u003dpid is rejected, the\n SB_I_USERNS_VISIBLE superblock flag is replaced with an\n FS_USERNS_MOUNT_RESTRICTED filesystem flag, fully visible mounts are\n recorded in a list, and the mount restrictions are finally\n documented.\n\n - Protect ptrace_may_access() with exec_update_lock in procfs\n\n Most uses of ptrace_may_access() in procfs should hold\n exec_update_lock to avoid TOCTOU issues with concurrent privileged\n execve() (like setuid binary execution).\n\n This fixes the easy cases - the owner and visibility checks and the\n FD link permission checks - with the gnarlier ones to follow later.\n\n* tag \u0027vfs-7.2-rc1.procfs\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n fs: fix ups and tidy ups to /proc/filesystems caching\n proc: protect ptrace_may_access() with exec_update_lock (FD links)\n proc: protect ptrace_may_access() with exec_update_lock (part 1)\n docs: proc: add documentation about mount restrictions\n proc: handle subset\u003dpid separately in userns visibility checks\n proc: prevent reconfiguring subset\u003dpid\n proc: subset\u003dpid: Show /proc/self/net only for CAP_NET_ADMIN\n fs: cache the string generated by reading /proc/filesystems\n sysfs: remove trivial sysfs_get_tree() wrapper\n fs: RCU-ify filesystems list\n fs: move SB_I_USERNS_VISIBLE to FS_USERNS_MOUNT_RESTRICTED\n proc: allow to mark /proc files permanent outside of fs/proc/\n namespace: record fully visible mounts in list\n" }, { "commit": "7e0e7bd60d4a812b694c477716597fcb038b00cb", "tree": "4ff61d47485803e7dacab1c8ddef0a4c11b512da", "parents": [ "ff8747aacaff8266dd751b8a8648fb728dcc3b21", "aa5c4fe3ba0cb2af90bbcfa7a8ef4fefcd5c2370" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:59:45 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:59:45 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull misc vfs updates from Christian Brauner:\n \"Features:\n\n - Reduce pipe-\u003emutex contention by pre-allocating pages outside the\n lock in anon_pipe_write().\n\n anon_pipe_write() called alloc_page() once per page while holding\n pipe-\u003emutex. The allocation can sleep doing direct reclaim and runs\n memcg charging, which extends the critical section and stalls any\n concurrent reader on the same mutex. Now up to 8 pages are\n pre-allocated before the mutex is taken, leftovers are recycled\n into the per-pipe tmp_page[] cache before unlock, and any remainder\n is released after unlock, keeping the allocator out of the critical\n section on both sides. On a writers x readers sweep with 64KB\n writes against a 1 MB pipe throughput improves 6-28% and average\n write latency drops 5-22%; under memory pressure - when the cost of\n holding the mutex across reclaim is highest - throughput improves\n 21-48% and latency drops 17-33%. The microbenchmark is added to\n selftests.\n\n - uaccess/sockptr: fix the ignored_trailing logic in\n copy_struct_to_user() to behave as documented and the usize check\n in copy_struct_from_sockptr() for user pointers, and add\n copy_struct_{from,to}_bounce_buffer() and copy_struct_to_sockptr()\n helpers for upcoming users (IPPROTO_SMBDIRECT, IPPROTO_QUIC).\n\n - bpf: add a sleepable bpf_real_inode() kfunc that resolves the real\n inode backing a dentry via d_real_inode(). On overlayfs the inode\n attached to the dentry doesn\u0027t carry the underlying device\n information; this is used by the filesystem restriction BPF program\n that was merged into systemd.\n\n - docs: add guidelines for submitting new filesystems, motivated by\n the maintenance burden abandoned and untestable filesystems impose\n on VFS developers, blocking infrastructure work like folio\n conversions and iomap migration.\n\n Fixes:\n\n - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()\n and drop the now-redundant assignments in callers. This began as a\n one-line dma-buf fix for a path_noexec() warning; a pseudo\n filesystem has no reason not to set SB_I_NOEXEC. All init_pseudo()\n callers were audited: the only visible effect is on dma-buf where\n SB_I_NOEXEC silences the warning.\n\n - Handle set_blocksize() failures in legacy filesystems (bfs, hpfs,\n qnx4, jfs, befs, affs, isofs, minix, ntfs3, omfs). Mounting a\n device with a sector size \u003e PAGE_SIZE crashed roughly half of them;\n the rest had the same missing error handling pattern. Plus a\n follow-up releasing the superblock buffer_head when setting the\n minix v3 block size fails.\n\n - mount: honour SB_NOUSER in the new mount API.\n\n - fs/fcntl: fix a SOFTIRQ-unsafe lock order in fasync signaling by\n switching the process-group paths of send_sigio() and send_sigurg()\n from read_lock(\u0026tasklist_lock) to RCU, matching the single-PID\n path.\n\n - vfs: add an FS_USERNS_DELEGATABLE flag and set it for NFS, fixing\n delegated NFS mounts (fsopen() in a container with the mount\n performed by a privileged daemon) that broke when non-init\n s_user_ns was tied to FS_USERNS_MOUNT.\n\n - selftests/namespaces: fix a hang in nsid_test where an unreaped\n grandchild kept the TAP pipe write-end open, a waitpid(-1) race in\n listns_efault_test, and a false FAIL on kernels without listns()\n where the tests should SKIP.\n\n - filelock: fix the break_lease() stub signature for\n CONFIG_FILE_LOCKING\u003dn.\n\n - init/initramfs_test: wait for the async initramfs unpacking before\n running; the test and do_populate_rootfs() share the parser state.\n\n - fs/coredump: reduce redundant log noise in\n validate_coredump_safety().\n\n - iomap: pass the correct length to fserror_report_io() in\n __iomap_write_begin().\n\n - backing-file: fix the backing_file_open() kerneldoc.\n\n Cleanups:\n\n - initramfs: refactor the cpio hex header parsing to use hex2bin()\n instead of the hand-rolled simple_strntoul() which is reverted, and\n extend the initramfs KUnit tests to cover header fields with 0x\n prefixes.\n\n - Replace __get_free_pages() and friends with kmalloc()/kzalloc()\n across quota, proc, ocfs2/dlm, nilfs2, nfs, nfsd, libfs, jfs, jbd2,\n isofs, fuse, select, namespace, configfs, binfmt_misc, bfs, and the\n do_mounts init code - part of the larger work of replacing page\n allocator calls with kmalloc().\n\n - Use clear_and_wake_up_bit() in unlock_buffer() and\n journal_end_buffer_io_sync() instead of open-coding the sequence.\n\n - Drop unused VFS exports: unexport drop_super_exclusive(), remove\n start_removing_user_path_at(), and fold __start_removing_path()\n into start_removing_path().\n\n - fs/read_write: narrow the __kernel_write() export with\n EXPORT_SYMBOL_FOR_MODULES().\n\n - vfs: uapi: retire octal and hex constants in favor of (1 \u003c\u003c n) for\n the O_ flags. Finding a free bit for a new flag across the\n architectures was needlessly hard with the mixed bases.\n\n - dcache: add extra sanity checks of dead dentries in dentry_free()\n via a new DENTRY_WARN_ONCE() that also prints d_flags.\n\n - iov_iter: use kmemdup_array() in dup_iter() to harden the\n allocation against multiplication overflow.\n\n - fs/pipe: write to -\u003epoll_usage only once.\n\n - vfs: remove an always-taken if-branch in find_next_fd().\n\n - dcache: use kmalloc_flex() for struct external_name in __d_alloc().\n\n - namei: use QSTR() instead of QSTR_INIT() in path_pts().\n\n - sync_file_range: delete dead S_ISLNK code.\n\n - Comment fixes: retire a stale comment in fget_task_next() and fix\n assorted spelling mistakes\"\n\n* tag \u0027vfs-7.2-rc1.misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (73 commits)\n backing-file: fix backing_file_open() kerneldoc parameter\n iomap: pass the correct len to fserror_report_io in __iomap_write_begin\n vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS\n filelock: fix break_lease() stub signature for CONFIG_FILE_LOCKING\u003dn\n vfs: uapi: retire octal and hex numbers in favor of (1 \u003c\u003c n) for O_ flags\n bpf: add bpf_real_inode() kfunc\n fs/read_write: Do not export __kernel_write() to the entire world\n libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers\n libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()\n mount: honour SB_NOUSER in the new mount API\n fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling\n selftests/pipe: add pipe_bench microbenchmark\n fs/pipe: pre-allocate pages outside pipe-\u003emutex in anon_pipe_write\n fs: retire stale comment in fget_task_next()\n fs: fix spelling mistakes in comment\n bfs: replace get_zeroed_page() with kzalloc()\n binfmt_misc: replace __get_free_page() with kmalloc()\n configfs: replace __get_free_pages() with kzalloc()\n fs/namespace: use __getname() to allocate mntpath buffer\n fs/select: replace __get_free_page() with kmalloc()\n ...\n" }, { "commit": "ff8747aacaff8266dd751b8a8648fb728dcc3b21", "tree": "2eb6f46a6c2f904de59b37d9edf5c2f1d2386010", "parents": [ "ec5d1ae94e99d8831427d00973da5620c7fb4368", "9722955b54307e9070994f2382ec06af3d7405e0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:54:54 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:54:54 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.xattr\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull simple_xattr updates from Christian Brauner:\n \"This reworks the simple xattr api to make it more efficient and easier\n to use for all consumers.\n\n The simple_xattr hash table moves from the inode into a per-superblock\n cache, removing the per-inode overhead for the common case of few or\n no xattrs. The interface now passes struct simple_xattrs ** so lazy\n allocation is handled internally instead of by every caller, kernfs\n xattr operations on kernfs nodes shared between multiple superblocks\n are properly serialized, and tmpfs constructs \"security.foo\" xattr\n names with kasprintf() instead of kmalloc() plus two memcpy()s.\n\n A follow-up fix links kernfs nodes to their parent before the LSM init\n hook runs: with the per-sb cache kernfs_xattr_set() computes the cache\n via kernfs_root(kn), which faulted on a freshly allocated node when\n selinux_kernfs_init_security() called into it - reproducible as a NULL\n pointer dereference on the first cgroup mkdir on SELinux-enabled\n systems.\n\n On top of this bpffs gains support for trusted.* and security.* xattrs\n so that user space and BPF LSM programs can attach metadata - for\n example a content hash or a security label - to pinned objects and\n directories and inspect it uniformly like on other filesystems. The\n store is in-memory and non-persistent, living only for the lifetime of\n the mount like everything else in bpffs\"\n\n* tag \u0027vfs-7.2-rc1.xattr\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n bpf: Add simple xattr support to bpffs\n kernfs: link kn to its parent before the LSM init hook\n simpe_xattr: use per-sb cache\n simple_xattr: change interface to pass struct simple_xattrs **\n tmpfs: simplify constructing \"security.foo\" xattr names\n kernfs: fix xattr race condition with multiple superblocks\n" }, { "commit": "ec5d1ae94e99d8831427d00973da5620c7fb4368", "tree": "9c2bd793eef39f6a56cd8c8c913818bb4dcc023c", "parents": [ "5b7c3f0fe36d8e867288f8e452ede82d178c757a", "b7bae6880e8de2a5f693c18d87ad5cc26f157eb2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:46:54 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:46:54 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.iomap\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull iomap updates from Christian Brauner:\n\n - Add the vfs infrastructure required to implement fs-verity support\n for XFS with a post-EOF merkle tree: fsverity generates and stores a\n zero-block hash, and iomap learns to verify data on buffered reads,\n to handle fsverity during writeback via the new IOMAP_F_FSVERITY\n flag, and to write fsverity metadata through iomap_fsverity_write().\n\n - Skip the memset of the iomap in iomap_iter() once the iteration is\n done. In high-IOPS scenarios (4k randread NVMe polling via io_uring)\n the pointless memset wasted memory write bandwidth; this improves\n IOPS by about 5% on ext4 and xfs.\n\n - Add balance_dirty_pages_ratelimited() to iomap_zero_iter(), aligning\n it with iomap_write_iter(). This prepares for the exFAT iomap\n conversion where zeroing beyond valid_size can trigger large-scale\n zeroing operations that caused memory pressure without throttling.\n\n - Remove the over-strict inline data boundary check. If a filesystem\n provides a valid inline_data pointer and length there is no reason to\n require that inline data must not cross a page boundary.\n\n - Don\u0027t make REQ_POLLED imply REQ_NOWAIT, matching the earlier\n equivalent block layer fix: there are valid cases to poll for I/O\n completion without REQ_NOWAIT, and REQ_NOWAIT for file system writes\n is currently not supported as writes aren\u0027t idempotent.\n\n - Introduce IOMAP_F_ZERO_TAIL for filesystems that maintain a separate\n valid data length (exFAT, NTFS). For a write starting at or beyond\n valid_size, __iomap_write_begin() now zeroes only the tail portion of\n the block while preserving valid data before it, instead of leaving\n stale data in the page cache. The flag is also added to the iomap\n trace event strings.\n\n* tag \u0027vfs-7.2-rc1.iomap\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n iomap: Add IOMAP_F_ZERO_TAIL flag to trace event strings\n iomap: introduce iomap_fsverity_write() for writing fsverity metadata\n iomap: teach iomap to read files with fsverity\n iomap: introduce IOMAP_F_FSVERITY and teach writeback to handle fsverity\n fsverity: generate and store zero-block hash\n iomap: introduce IOMAP_F_ZERO_TAIL flag\n iomap: don\u0027t make REQ_POLLED imply REQ_NOWAIT\n iomap: remove over-strict inline data boundary check\n iomap: add dirty page control to iomap_zero_iter\n iomap: avoid memset iomap when iter is done\n" }, { "commit": "5b7c3f0fe36d8e867288f8e452ede82d178c757a", "tree": "7fd007b26bd1d2220956471473997a8ad895b56a", "parents": [ "c8ed3a15a749246ddfedb84aab9cf0316c7b9b8a", "a1e9718b406bc4e6d0c63c7b999d06febbdc4091" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:40:54 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:40:54 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.eventpoll\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull eventpoll updates from Christian Brauner:\n\n - eventpoll clarity refactor\n\n The recent eventpoll UAF fixes (a6dc643c6931 and follow-ups) depended\n on invariants in fs/eventpoll.c that were nowhere documented and had\n to be reverse-engineered from the code: the lifetime relationships\n between struct eventpoll, struct epitem, and struct file, the three\n removal paths coordinating via epi_fget() pins and ep-\u003emtx, the\n ovflist sentinel-encoded scan state machine, the POLLFREE\n release/acquire handshake, and the loop / path check globals\n serialized by epnested_mutex. The fixes were correct but the next\n person to touch this code would hit the same learning curve.\n\n This series codifies those invariants in source and tightens the\n surrounding structure. No functional changes intended:\n\n - Documentation: a top-of-file overview with field-protection\n tables for struct eventpoll and struct epitem, a section\n gathering the loop-check / path-check globals next to their\n declarations, labelled comments on the two sides of the POLLFREE\n handshake, refreshed comments on epi_fget() and ep_remove_file(),\n and a docblock on ep_clear_and_put() that names its two-pass\n structure as load-bearing.\n\n - Mechanical renames: ep_refcount_dec_and_test() -\u003e ep_put() to\n pair with ep_get(), attach_epitem() -\u003e ep_attach_file() for\n ep_remove_file() symmetry, the unused depth argument dropped from\n epoll_mutex_lock(), and the CONFIG_KCMP block relocated next to\n CONFIG_COMPAT so the hot-path code is contiguous.\n\n - Helper extraction: ep_insert() splits into ep_alloc_epitem() and\n ep_register_epitem(), ep_clear_and_put()\u0027s two passes become\n ep_drain_pollwaits() and ep_drain_tree() so the ordering\n invariant is enforced by the call sequence rather than\n convention, the per-event delivery loop body becomes\n ep_deliver_event(), and the ep-\u003emtx + epnested_mutex acquisition\n dance lifts out of do_epoll_ctl() into ep_ctl_lock() /\n ep_ctl_unlock().\n\n - Sentinel and predicate cleanup: the EP_UNACTIVE_PTR overload is\n hidden behind named helpers (ep_is_scanning, epi_on_ovflist,\n ...), epi-\u003enext is renamed to epi-\u003eovflist_next, and the boolean\n predicates return bool.\n\n - The per-CTL_ADD scratch state (tfile_check_list, path_count[],\n inserting_into) moves from file-scope globals into a\n stack-allocated struct ep_ctl_ctx plumbed through the loop / path\n check chain.\n\n Two follow-up fixes are included: missing kernel-doc for the new @ctx\n parameters, and restoring the EP_UNACTIVE_PTR sentinel for\n ctx-\u003etfile_check_list - replacing it with NULL termination broke\n ep_remove_file()\u0027s \"never listed\" check for the list tail, causing a\n syzbot-reported use-after-free.\n\n - io_uring related epoll cleanups\n\n One of the nastier things about epoll is how it allows nesting\n contexts inside each other, leading to the necessity of loop\n detection and the issues that have come with that. There is no reason\n to support nesting on the io_uring side, so contain the damage and\n disallow nested contexts from there: eventpoll gains a file based\n control interface and struct epoll_filefd is renamed to epoll_key.\n The io_uring side proper goes on top of this through the block tree.\n\n - Fix epoll_wait() reporting false negatives\n\n ep_events_available() checks ep-\u003erdllist and ep_is_scanning() without\n a lock and can race with a concurrent scan such that neither check\n sees the events, causing epoll_wait() with a zero timeout to wrongly\n report no events even though events are available. A sequence lock\n closes the race and a reproducer is added to the eventpoll selftests.\n\n* tag \u0027vfs-7.2-rc1.eventpoll\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (25 commits)\n eventpoll: restore EP_UNACTIVE_PTR sentinel for ctx-\u003etfile_check_list\n eventpoll: Fix epoll_wait() report false negative\n selftests/eventpoll: Add test for multiple waiters\n eventpoll: add missing kernel-doc for @ctx function parameters\n eventpoll: rename struct epoll_filefd to epoll_key\n eventpoll: add file based control interface\n eventpoll: export is_file_epoll()\n eventpoll: pass struct epoll_filefd through ep_find() and ep_insert()\n eventpoll: hoist CTL_ADD scratch state into struct ep_ctl_ctx\n eventpoll: use bool for predicate helpers\n eventpoll: rename epi-\u003enext and txlist for clarity\n eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers\n eventpoll: extract lock dance from do_epoll_ctl() into ep_ctl_lock()\n eventpoll: extract ep_deliver_event() from ep_send_events()\n eventpoll: split ep_clear_and_put() into drain helpers\n eventpoll: split ep_insert() into alloc + register stages\n eventpoll: relocate KCMP helpers near compat syscalls\n eventpoll: rename attach_epitem() to ep_attach_file()\n eventpoll: drop unused depth argument from epoll_mutex_lock()\n eventpoll: rename ep_refcount_dec_and_test() to ep_put()\n ...\n" }, { "commit": "c8ed3a15a749246ddfedb84aab9cf0316c7b9b8a", "tree": "d4e216fa54148d4e0c34d500a7dc4dc386184258", "parents": [ "c17fdf62aeecbbaf2c2fd5c494e2089c02b0e75b", "f0d857543e4d37464759c338f46ad6c85a618a2e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:36:08 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:36:08 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.bh\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull buffer_head updates from Christian Brauner:\n \"This removes b_end_io from struct buffer_head.\n\n Instead of setting bio-\u003ebi_end_io to end_bio_bh_io_sync() which then\n calls bh-\u003eb_end_io(), the new bh_submit() and __bh_submit() interfaces\n set bio-\u003ebi_end_io to the appropriate completion handler directly,\n replacing two indirect function calls in the completion path with one.\n It is also one fewer function pointer in the middle of a writable data\n structure that can be corrupted, it shrinks struct buffer_head from\n 104 to 96 bytes allowing roughly 7% more buffer_heads to be cached in\n the same amount of memory, and it removes some atomic operations as\n the buffer refcount is no longer incremented before calling the end_io\n handler.\n\n All in-tree users (fs/buffer.c itself, ext4, jbd2, ocfs2, gfs2,\n nilfs2, and md-bitmap) are converted, and submit_bh(),\n mark_buffer_async_write(), and end_buffer_write_sync() are removed\"\n\n* tag \u0027vfs-7.2-rc1.bh\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (34 commits)\n buffer: Remove end_buffer_write_sync()\n buffer: Change calling convention for end_buffer_read_sync()\n buffer: Remove b_end_io\n buffer: Remove submit_bh()\n md-bitmap: Convert read_file_page and write_file_page to bh_submit()\n nilfs2: Convert nilfs_mdt_submit_block to bh_submit()\n nilfs2: Convert nilfs_gccache_submit_read_data to bh_submit()\n nilfs2: Convert nilfs_btnode_submit_block to bh_submit()\n buffer: Remove mark_buffer_async_write()\n gfs2: Convert gfs2_aspace_write_folio to bh_submit()\n gfs2: Remove use of b_end_io in gfs2_meta_read_endio()\n gfs2: Convert gfs2_dir_readahead to bh_submit()\n gfs2: Convert gfs2_metapath_ra to bh_submit()\n ocfs2: Convert ocfs2_write_super_or_backup to bh_submit()\n ocfs2: Convert ocfs2_read_blocks to bh_submit()\n ocfs2: Convert ocfs2_read_block to bh_submit()\n ocfs2: Convert ocfs2_write_block to bh_submit()\n jbd2: Convert jbd2_write_superblock() to bh_submit()\n jbd2: Convert journal commit to bh_submit()\n ext4: Convert ext4_commit_super() to bh_submit()\n ...\n" }, { "commit": "c17fdf62aeecbbaf2c2fd5c494e2089c02b0e75b", "tree": "2cb320b5bc6f1c97da837e8cb43352a72e789267", "parents": [ "0793d39ec8bab2b2255e3a288894c39e88ce5a75", "0275dc184aa007b260374af6d46fb15741c062a8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:30:45 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:30:45 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.writeback\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs writeback updates from Christian Brauner:\n\n - Fix a race between cgroup_writeback_umount() and inode_switch_wbs()\n\n When a container exits, a race between cgroup_writeback_umount() and\n inode_switch_wbs()/cleanup_offline_cgwb() can trigger \"VFS: Busy\n inodes after unmount\" followed by a use-after-free on percpu\n counters.\n\n There is a window between inode_prepare_wbs_switch() returning true\n (having passed the SB_ACTIVE check and grabbed the inode) and the\n subsequent wb_queue_isw() call: if cgroup_writeback_umount() observes\n the global isw_nr_in_flight counter as non-zero but flush_workqueue()\n finds nothing queued yet, it returns early - leaving a held inode\n reference that blocks evict_inodes() and a later iput() that hits\n freed percpu counters.\n\n The race is closed by covering the window from\n inode_prepare_wbs_switch() through wb_queue_isw() with an RCU\n read-side critical section and synchronizing in the umount path.\n\n On top of that the now-dead rcu_barrier() left over from the\n queue_rcu_work() era is removed, and the global\n synchronize_rcu()/flush_workqueue() pair is replaced with a per-sb\n in-flight counter plus pin/unpin/drain helpers so umount no longer\n serializes against switch activity on unrelated superblocks.\n\n Under cgroup writeback churn on a 16 vCPU guest this takes umount\n latency from ~92-138ms p50 down to ~5-8ms p50 and the cumulative cost\n of cgroup_writeback_umount() from ~62ms to ~4us per call.\n\n The initial race fix is kept separate and minimal so it backports\n cleanly to stable trees that still queue switches via\n queue_rcu_work().\n\n - Improve write performance with RWF_DONTCACHE\n\n Dirty DONTCACHE pages are now tracked per bdi_writeback so that the\n writeback flusher can be kicked in a targeted fashion for\n IOCB_DONTCACHE writes instead of relying on global writeback, and the\n PG_dropbehind flag is preserved when a folio is split.\n\n* tag \u0027vfs-7.2-rc1.writeback\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking\n mm: track DONTCACHE dirty pages per bdi_writeback\n mm: preserve PG_dropbehind flag during folio split\n writeback: use a per-sb counter to drain inode wb switches at umount\n writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()\n writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()\n" }, { "commit": "0793d39ec8bab2b2255e3a288894c39e88ce5a75", "tree": "7dfb1928b48c9a4081be709a410cde4bbc3a09a8", "parents": [ "50b900c564b0f0307c126de9f17c21d3a1ba039b", "2c6f0c248a6b49a6fc8c301c84d367860c56ccd8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:25:36 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:25:36 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.super\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs superblock updates from Christian Brauner:\n \"This retires sget().\n\n CIFS plus the two ext4 KUnit tests (extents-test, mballoc-test) were\n the last in-tree callers, and all three convert cleanly to sget_fc().\n\n That lets sget() and its prototype come out, taking ~60 lines that\n only existed to be kept in lockstep with sget_fc() on every\n publish-path change\"\n\n* tag \u0027vfs-7.2-rc1.super\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n fs: retire sget()\n smb: client: convert cifs_smb3_do_mount() to sget_fc()\n ext4: convert mballoc KUnit test to sget_fc()\n ext4: convert extents KUnit test to sget_fc()\n" }, { "commit": "50b900c564b0f0307c126de9f17c21d3a1ba039b", "tree": "59113f35198a8c9b1dede2fd17d0954d798db6e9", "parents": [ "37c405aeaa5c2cbe04c3c727e3989a16a2e9f30f", "318643721de396012da102723f337f35ba7ec1e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:11:05 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:11:05 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.openat2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull openat2 updates from Christian Brauner:\n \"Features:\n\n - Add O_EMPTYPATH to openat(2)/openat2(2). To get an operable file\n descriptor from an O_PATH file descriptor it is possible to use\n openat(fd, \".\", O_DIRECTORY) for directories, but other file types\n require going through open(\"/proc/\u003cpid\u003e/fd/\u003cnr\u003e\") and thus depend\n on a functioning procfs.\n\n With O_EMPTYPATH an empty path string is accepted and LOOKUP_EMPTY\n is set at path resolution time, allowing to reopen the file behind\n the file descriptor directly. Selftests are included.\n\n - Add an OPENAT2_REGULAR flag for openat2(2) which refuses to open\n anything but regular files with the new EFTYPE error code.\n\n This implements the \"ability to only open regular files\" feature\n requested by userspace via uapi-group.org and protects services\n from being redirected to fifos, device nodes, and friends.\n\n All atomic_open implementations were audited for OPENAT2_REGULAR\n handling. Explicit checks were added to ceph, gfs2, nfs (v4), and\n cifs/smb - these are the filesystems whose atomic_open can\n encounter an existing non-regular file and would otherwise call\n finish_open() on it or return a misleading error code.\n\n The remaining implementations (9p, fuse, vboxsf, nfs v2/v3) only\n call finish_open() on freshly created files and use\n finish_no_open() for lookup hits, letting the VFS catch non-regular\n files via the do_open() safety net.\n\n Cleanups:\n\n - Migrate the openat2 selftests to the kselftest harness and move\n them under selftests/filesystems/. The tests were written in the\n early days of selftests\u0027 TAP support and the modern kselftest\n harness is much easier to follow and maintain. The contents of the\n tests are unchanged and the new emptypath tests are ported on top.\n\n - Make the LAST_XXX last-type constants private to fs/namei.c. The\n only user outside of fs/namei.c was ksmbd which only needs to know\n whether the last component is a regular one, so\n vfs_path_parent_lookup() now performs the LAST_NORM check\n internally. The ints are replaced with a dedicated enum last_type\"\n\n* tag \u0027vfs-7.2-rc1.openat2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n vfs: replace ints with enum last_type for LAST_XXX\n vfs: make LAST_XXX private to fs/namei.c\n selftests: openat2: port emptypath_test to kselftest harness\n kselftest/openat2: test for OPENAT2_REGULAR flag\n openat2: new OPENAT2_REGULAR flag support\n openat2: introduce EFTYPE error code\n selftest: add tests for O_EMPTYPATH\n vfs: add O_EMPTYPATH to openat(2)/openat2(2)\n selftests: openat2: migrate to kselftest harness\n selftests: openat2: switch from custom ARRAY_LEN to ARRAY_SIZE\n selftests: openat2: move helpers to header\n selftests: move openat2 tests to selftests/filesystems/\n" }, { "commit": "37c405aeaa5c2cbe04c3c727e3989a16a2e9f30f", "tree": "88594b10c60e16fd03223136a230ed72e42fce62", "parents": [ "9c9e6bd4cca02f2d183eb260451fb6018f9ee67e", "ee8ab98f831226d69d43ccd93f53c50e6f19b389" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:05:50 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:05:50 2026 +0530" }, "message": "Merge tag \u0027kernel-7.2-rc1.misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull misc kernel updates from Christian Brauner:\n \"Fixes\n\n - rhashtable: give each instance its own lockdep class\n\n syzbot reported a circular locking dependency between ht-\u003emutex and\n fs_reclaim via the simple_xattrs rhashtable being torn down during\n inode eviction.\n\n The predicted deadlock cannot occur: rhashtable_free_and_destroy()\n cancels the deferred worker before taking ht-\u003emutex and\n acquisitions on distinct rhashtables are on distinct mutexes.\n\n Lockdep flags a cycle anyway because every ht-\u003emutex in the kernel\n shared the single static lockdep class from\n rhashtable_init_noprof().\n\n The lockdep key is lifted to a per-call-site static key so every\n rhashtable instance gets its own class.\n\n - selftests/clone3: fix misuse of the libcap library interface in the\n cap_checkpoint_restore test and remove unused variables\n\n - selftests/pid_namespace: compute the pid_max test limits\n dynamically instead of hardcoding values below the kernel-enforced\n minimum of PIDS_PER_CPU_MIN * num_possible_cpus() which made the\n tests fail on machines with many possible CPUs\n\n - selftests: fix the Makefile TARGETS entry for nsfs which wasn\u0027t\n adjusted when the tests moved under filesystems/\n\n Cleanups\n\n - ipc/sem.c: use unsigned int for nsops to match the declaration in\n syscalls.h\"\n\n* tag \u0027kernel-7.2-rc1.misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n selftests/clone3: remove unused variables\n selftests/clone3: fix libcap interface usage\n ipc/sem.c: use unsigned int for nsops\n selftests: Fix Makefile target for nsfs\n rhashtable: give each instance its own lockdep class\n selftests/pid_namespace: compute pid_max test limits dynamically\n" }, { "commit": "9c9e6bd4cca02f2d183eb260451fb6018f9ee67e", "tree": "5c351e1db3b13ffce9ce02c95173e58d35975d1f", "parents": [ "5d15ab717d503ff10b585a144870648b9a88c616", "38205ecbe6b6dc47968ad4e9c978e2117720969e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:00:58 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 03:00:58 2026 +0530" }, "message": "Merge tag \u0027kernel-7.2-rc1.task_exec_state\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull task_exec_state updates from Christian Brauner:\n \"This introduces a new per-task task_exec_state structure and relocates\n the dumpable mode and the user namespace captured at execve() from\n mm_struct onto it. It stays attached to the task for its full\n lifetime.\n\n __ptrace_may_access() and several /proc owner and visibility checks\n need to consult two pieces of state for any observable task, including\n zombies that have already gone through exit_mm(): the dumpable mode\n and the user namespace captured at execve(). Both live on mm_struct\n today, which exit_mm() clears from the task long before the task is\n reaped. A reader that races with do_exit() observes task-\u003emm \u003d\u003d NULL\n and either fails the check or falls back to init_user_ns - which\n denies legitimate access to non-dumpable zombies that were running in\n a nested user namespace.\n\n mm_struct loses -\u003euser_ns and the dumpability bits in -\u003eflags.\n MMF_DUMPABLE_BITS is reserved so the MMF_DUMP_FILTER_* layout exposed\n via /proc/\u003cpid\u003e/coredump_filter stays stable. task-\u003euser_dumpable and\n its exit_mm() snapshot are removed.\n\n task_exec_state is the privilege domain established by an execve().\n Within a thread group it is shared via refcount; across thread groups\n each task has its own:\n\n - CLONE_VM siblings (thread-group members, io_uring workers)\n refcount-share the parent\u0027s exec_state.\n\n - Non-CLONE_VM clones (fork(), vfork() without CLONE_VM) allocate a\n fresh exec_state inheriting the parent\u0027s dumpable mode and user_ns.\n\n - execve() in the child allocates a fresh instance and installs it\n under task_lock + exec_update_lock via task_exec_state_replace().\n\n - Credential changes (setresuid, capset, ...) and\n prctl(PR_SET_DUMPABLE) update dumpability on the current task\u0027s\n exec_state, i.e., on the thread group\u0027s shared instance.\n\n On top of this exec_mmap() no longer tears down the old mm while\n holding exec_update_lock for writing and cred_guard_mutex. Neither\n lock is needed for that: exec_update_lock only exists to make the mm\n swap atomic with the later commit_creds() and all its readers operate\n on the new mm; none looks at the detached old mm.\n\n The cost was real: __mmput() runs exit_mmap() over the entire old\n address space and can block in exit_aio() waiting for in-flight AIO,\n so execve() of a large process blocked ptrace_attach() and every\n exec_update_lock reader for the duration of the teardown.\n\n The old mm is now stashed in bprm-\u003eold_mm and released from\n setup_new_exec() after both locks are dropped, with a backstop in\n free_bprm() for the error paths\"\n\n* tag \u0027kernel-7.2-rc1.task_exec_state\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n exec: free the old mm outside the exec locks\n exec_state: relocate dumpable information\n ptrace: add ptracer_access_allowed()\n exec: introduce struct task_exec_state\n sched/coredump: introduce enum task_dumpable\n" }, { "commit": "5d15ab717d503ff10b585a144870648b9a88c616", "tree": "9051bc55df8fd4ecde5736e36a25b2a88518f9fd", "parents": [ "6b5b72ac2c6383e423144beb257f98359b966a3b", "ea3120fd5153c967efb20e6e3330caecbf9d8b0a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:55:34 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:55:34 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.casefold\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs casefolding updates from Christian Brauner:\n \"This exposes the case folding behavior of local filesystems so that\n file servers - nfsd, ksmbd, and user space file servers - can report\n the actual behavior to clients instead of guessing.\n\n Filesystems report case-insensitive and case-nonpreserving behavior\n via new file_kattr flags in their fileattr_get implementations. fat,\n exfat, ntfs3, hfs, hfsplus, xfs, cifs, nfs, vboxsf, and isofs are\n wired up. Local filesystems that are not explicitly handled default to\n the usual POSIX behavior of case-sensitive and case-preserving.\n\n nfsd uses this to report case folding via NFSv3 PATHCONF and to\n implement the NFSv4 FATTR4_CASE_INSENSITIVE and FATTR4_CASE_PRESERVING\n attributes - both have been part of the NFS protocols for decades to\n support clients on non-POSIX systems - and ksmbd reports it via\n FS_ATTRIBUTE_INFORMATION. Exposing the information through the\n fileattr uapi covers user space file servers.\n\n The immediate motivation is interoperability: Windows NFS clients\n hard-require servers to report case-insensitivity for Win32\n applications to work correctly, and a client that knows the server is\n case-insensitive can avoid issuing multiple LOOKUP/READDIR requests\n searching for case variants.\n\n The Linux NFS client already grew support for case-insensitive shares\n years ago in support of the Hammerspace NFS server - negative dentry\n caching must be disabled (a lookup for \"FILE.TXT\" failing must not\n cache a negative entry when \"file.txt\" exists) and directory change\n invalidation must drop cached case-folded name variants. Such servers\n often operate in multi-protocol environments where a single file\n service instance caters to both NFS and SMB clients, and nfsd needs to\n report case folding properly to participate as a first-class citizen\n there.\n\n A follow-up series brings fixes for the initial work: the nfsd\n case-info probe now uses kernel credentials, maps -ESTALE to\n NFS3ERR_STALE, and has its cost capped across READDIR entries; the nfs\n client avoids transiently zeroed case capability bits during the probe\n and skips the pathconf probe when neither field is consumed; the\n FS_CASEFOLD_FL semantics are clarified in the UAPI header; and the\n tools UAPI headers are synced\"\n\n* tag \u0027vfs-7.2-rc1.casefold\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (22 commits)\n nfsd: Cap case-folding probe cost across READDIR entries\n nfsd: Map -ESTALE from case probe to NFS3ERR_STALE\n nfsd: Use kernel credentials for case-info probe\n fs: Clarify FS_CASEFOLD_FL semantics in UAPI header\n nfs: Skip pathconf probe when neither field is consumed\n nfs: Avoid transient zeroed case capability bits during probe\n tools headers UAPI: Sync case-sensitivity flags from linux/fs.h\n ksmbd: Report filesystem case sensitivity via FS_ATTRIBUTE_INFORMATION\n nfsd: Implement NFSv4 FATTR4_CASE_INSENSITIVE and FATTR4_CASE_PRESERVING\n nfsd: Report export case-folding via NFSv3 PATHCONF\n isofs: Implement fileattr_get for case sensitivity\n vboxsf: Implement fileattr_get for case sensitivity\n nfs: Implement fileattr_get for case sensitivity\n cifs: Implement fileattr_get for case sensitivity\n xfs: Report case sensitivity in fileattr_get\n hfsplus: Report case sensitivity in fileattr_get\n hfs: Implement fileattr_get for case sensitivity\n ntfs3: Implement fileattr_get for case sensitivity\n exfat: Implement fileattr_get for case sensitivity\n fat: Implement fileattr_get for case sensitivity\n ...\n" }, { "commit": "6b5b72ac2c6383e423144beb257f98359b966a3b", "tree": "f9ae46d5db30eb2c3f6db50e08074fcc8258b113", "parents": [ "fac863c887a05d7c3091c5eccf30c89c2116ae11", "246bc86d0fd891273a8502314f158eab23af823c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:50:44 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:50:44 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.directory.delegations\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs directory delegations from Christian Brauner:\n \"This contains the VFS prerequisites for supporting directory\n delegations in nfsd via CB_NOTIFY callbacks.\n\n The filelock core gains support for ignoring delegation breaks for\n directory change events together with an inode_lease_ignore_mask()\n helper, and fsnotify gains fsnotify_modify_mark_mask() and a\n FSNOTIFY_EVENT_RENAME data type.\n\n With this in place nfsd can request delegations on directories and set\n up inotify watches to trigger sending CB_NOTIFY events to clients\n instead of having every directory change break the delegation.\n\n New tracepoints are added to fsnotify() and to the start of\n break_lease(), and trace_break_lease_block() is passed the currently\n blocking lease instead of the new one.\n\n A follow-up fix moves the LEASE_BREAK_* flags out of\n #ifdef CONFIG_FILE_LOCKING to fix the build for CONFIG_FILE_LOCKING\u003dn\n configurations\"\n\n* tag \u0027vfs-7.2-rc1.directory.delegations\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n filelock: move LEASE_BREAK_* flags out of #ifdef CONFIG_FILE_LOCKING\n fsnotify: add FSNOTIFY_EVENT_RENAME data type\n fsnotify: add fsnotify_modify_mark_mask()\n fsnotify: new tracepoint in fsnotify()\n filelock: add an inode_lease_ignore_mask helper\n filelock: add a tracepoint to start of break_lease()\n filelock: add support for ignoring deleg breaks for dir change events\n filelock: pass current blocking lease to trace_break_lease_block() rather than \"new_fl\"\n" }, { "commit": "fac863c887a05d7c3091c5eccf30c89c2116ae11", "tree": "484ba400219e0063b71009b35141d0f6150ba9f9", "parents": [ "4d23bdc4988efc22904c78ca36ebeef5deb950db", "5b451b76c85c8309d2e02caa467b38f5999c986f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:44:23 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:44:23 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.inode\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs inode updates from Christian Brauner:\n \"This extends the lockless -\u003ei_count handling.\n\n iput() could already decrement any value greater than one locklessly\n but acquiring a reference always required taking inode-\u003ei_lock. Now\n acquiring a reference is lockless as long as the count was already at\n least 1, i.e., only the 0-\u003e1 and 1-\u003e0 transitions take the lock.\n\n This avoids the lock for the common cases of nfs calling into the\n inode hash and btrfs using igrab(). Cleanup-wise icount_read_once() is\n added to line up with inode_state_read_once() and the open-coded\n -\u003ei_count loads across the tree are converted, and ihold() is\n relocated and tidied up.\n\n On top of that some stale lock ordering annotations are retired from\n the inode hash code: iunique() no longer takes the hash lock since the\n inode hash became RCU-searchable and s_inode_list_lock is no longer\n taken under the hash lock either\"\n\n* tag \u0027vfs-7.2-rc1.inode\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n fs: retire stale lock ordering annotations from inode hash\n fs: allow lockless -\u003ei_count bumps as long as it does not transition 0-\u003e1\n fs: relocate and tidy up ihold()\n fs: add icount_read_once() and stop open-coding -\u003ei_count loads\n" }, { "commit": "4d23bdc4988efc22904c78ca36ebeef5deb950db", "tree": "5ff6795a547f44257a989f3cb8f2b13172adf65c", "parents": [ "d2cb5e633c6e8f2fb9af57e72fb05899952b1e3c", "79e33ddc62c03cce6c29f0792454e1d618228acf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:38:54 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:38:54 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.exportfs\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull exportfs updates from Christian Brauner:\n \"This cleans up the exportfs support for block-style layouts that\n provide direct block device access: the operations for layout-based\n block device access are split out of struct export_operations into a\n separate header, -\u003ecommit_blocks() no longer takes a struct iattr\n argument, and the way support for layout-based block device access is\n detected is reworked.\n\n nfsd\u0027s blocklayout code also stops honoring loca_time_modify. This is\n preparation for supporting export of more than a single device per\n file system\"\n\n* tag \u0027vfs-7.2-rc1.exportfs\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n exportfs,nfsd: rework checking for layout-based block device access support\n exportfs: don\u0027t pass struct iattr to -\u003ecommit_blocks\n exportfs: split out the ops for layout-based block device access\n nfsd/blocklayout: always ignore loca_time_modify\n" }, { "commit": "d2cb5e633c6e8f2fb9af57e72fb05899952b1e3c", "tree": "26c291704709fd0ad60d6898c5a5052d9402dcdf", "parents": [ "8cd9520d35a6c38db6567e97dd93b1f11f185dc6", "07410646f6ff1d23222f105ccab778957d401bbe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:34:37 2026 +0530" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jun 15 02:34:37 2026 +0530" }, "message": "Merge tag \u0027vfs-7.2-rc1.kfunc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull bpf filesystem kfunc fix from Christian Brauner:\n \"The bpf_set_dentry_xattr() and bpf_remove_dentry_xattr() kfuncs locked\n the inode of the supplied dentry without checking whether the dentry\n is negative.\n\n Passing a negative dentry (e.g., from security_inode_create) caused a\n NULL pointer dereference. Negative dentries now fail with EINVAL. The\n WARN_ON(!inode) in the bpf xattr permission helpers is dropped as well\n since it could be triggered the same way, amounting to a denial of\n service on systems with panic_on_warn enabled\"\n\n* tag \u0027vfs-7.2-rc1.kfunc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries\n" }, { "commit": "8cd9520d35a6c38db6567e97dd93b1f11f185dc6", "tree": "96667ed2997d7b49f3e9a36c4297b1faca4d87e3", "parents": [ "424280953322cf66314f3ba5e2d1ef345f21c770" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:58:38 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:58:38 2026 +0100" }, "message": "Linux 7.1\n" }, { "commit": "424280953322cf66314f3ba5e2d1ef345f21c770", "tree": "b60272675976be52c6ae25c2eb688f4f24f49b9d", "parents": [ "e21ee273e6fa3879aec9a27251cfce98156e07c4", "009b6c6486b94a3aff566b017256b598dc96bf18" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:37:39 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:37:39 2026 +0100" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull ARM fixes from Russell King:\n\n - Avoid KASAN instrumentation of half-word IO\n\n - Use a byte load for KASAN shadow stack\n\n - Fix kexec and hibernation with PAN\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN\n ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow\n ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O\n" }, { "commit": "e21ee273e6fa3879aec9a27251cfce98156e07c4", "tree": "167899ca1a5d226e750e3d8e943ff9b103d17944", "parents": [ "2b07ea76fd28989bde5993532d7a943a6f90e246", "f29a24c94705496254dd9ce7ea8a31efb6eb4358" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 18:21:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 18:21:44 2026 -0700" }, "message": "Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fixes from Stephen Boyd:\n \"Fixes for the Qualcomm and Google GS101 clk drivers:\n\n - Skip parking clks on some Qualcomm platforms so that the recovery\n console keeps working\n\n - Fix Google GS101 resume by using the correct div register\"\n\n* tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: qcom: dispcc-sc8280xp: Don\u0027t park mdp_clk_src at registration time\n clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs\n clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked\n" }, { "commit": "2b07ea76fd28989bde5993532d7a943a6f90e246", "tree": "914251a4bffac169d2efa16b3bffa7d9e4671daa", "parents": [ "a5e98d1679809cbad0f88f1b6b60e92134d8ee13", "0d046ae106255cba5eb83b23f78ee93f3620247d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:23:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:23:36 2026 -0700" }, "message": "Merge tag \u0027core-urgent-2026-06-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull debugobjects fix from Ingo Molnar:\n\n - Fix potential debugobjects deadlock on PREEMPT_RT kernels (Waiman\n Long)\n\n* tag \u0027core-urgent-2026-06-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n debugobjects: Don\u0027t call fill_pool() in early boot hardirq context\n" }, { "commit": "a5e98d1679809cbad0f88f1b6b60e92134d8ee13", "tree": "8620070459b18bf31ce5627366e2f44b9fb3442e", "parents": [ "062871f1371b2e02a272ff5279c6479aff0a37ef", "35ebcfcc9ef29afcf258db854ccf25572c75baef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:14:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:14:17 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"The biggest news here is that this is my last pull request as I2C\n maintainer after 13.5 years. Starting with the 7.2 cycle, Andi Shyti\n is taking over who helped me greatly maintaining the host drivers for\n a while now. Thank you, Andi, and good luck with the subsystem. I\u0027ll\n be around for help, of course.\n\n Technically, there are two patches which might be a tad large for this\n late cycle, but most of them is explaining comments, so I think they\n are suitable.\n\n - MAINTAINERS:\n - hand over I2C maintainership to Andi\n - minor updates\n\n - rust: fix I2cAdapter refcount double increment\n\n - imx: keep clock and pinctrl states consistent in runtime PM\n\n - imx-lpi2c: fix DMA resource leaks on PIO fallback\n\n - qcom-cci: fix NULL pointer dereference on remove\n\n - riic: fix reset refcount leak on resume_noirq error path\n\n - stm32f7: account for analog filter in timing computation\n\n - tegra:\n - fix suspend/resume handling in NOIRQ phase\n - update Tegra410 I2C timings to match hardware specs\"\n\n* tag \u0027i2c-for-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n dt-bindings: i2c: mux-gpio: name correct maintainer\n MAINTAINERS: hand over I2C to Andi Shyti\n i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()\n MAINTAINERS: i2c: designware: Remove inactive reviewer\n i2c: tegra: Fix NOIRQ suspend/resume\n i2c: tegra: Update Tegra410 I2C timing parameters\n i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()\n i2c: stm32f7: fix timing computation ignoring i2c-analog-filter\n i2c: imx: fix clock and pinctrl state inconsistency in runtime PM\n i2c: riic: fix refcount leak in riic_i2c_resume_noirq()\n rust: i2c: fix I2cAdapter refcounts double increment\n" }, { "commit": "062871f1371b2e02a272ff5279c6479aff0a37ef", "tree": "e088c0636470795dbdb8563d01867a94a9e3c750", "parents": [ "4fa048ed72531d6c2a2147fa9b52b6a5451213a2", "3f786abd23951f3f600a62fef42469d9200d5f52" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 17:23:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 17:23:05 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Two fixes for the mcp23s08 driver.\n\n - Revert an earlier fix to the AMD pin controller that was all wrong. A\n proper fix is being developed.\n\n* tag \u0027pinctrl-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n Revert \"pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11\"\n pinctrl: mcp23s08: Read spi-present-mask as u8 not u32\n pinctrl: mcp23s08: Initialize mcp-\u003edev and mcp-\u003eaddr before regmap init\n" }, { "commit": "4fa048ed72531d6c2a2147fa9b52b6a5451213a2", "tree": "694b56bbd68008cda854051e488c787b7e9d616c", "parents": [ "2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0", "7c62657a10625e4e113de248d41f543d5a2f3a1a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 15:51:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 15:51:16 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-06-13\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Looks like it\u0027s settled down a bit more thankfully. Small changes\n across the board, amdgpu/xe leading with some colorop changes in the\n core/amd. Otherwise some misc driver fixes.\n\n colorop:\n - make lut interpolation mutable\n - track colorop updates correctly\n\n amdgpu:\n - UserQ fix\n - Userptr fix\n - MCCS freesync fix\n - track colorop changes correctly\n\n amdkfd:\n - Fix an event information leak\n - Events bounds check fix\n - Trap cleanup fix\n\n i915:\n - Check supported link rates DPCD read\n - Fix phys BO pread/pwrite with offset\n\n xe:\n - fix oops in suspend/shutdown without display\n - RAS fixes\n - Use HW_ERR prefix in log\n - include all registered queues in TLB invalidation\n - Fix refcount leak in xe_range_tree in error paths\n - fix job timeout recovery for unstarted jobs and kernel queues\n\n amdxdna:\n - fix possible leak of mm_struct\n\n ivpu:\n - fix integer truncation\n\n vc4:\n - fix leak in krealloc() error handling\n\n virtio:\n - fix dma_fence ref-count leak\"\n\n* tag \u0027drm-fixes-2026-06-13\u0027 of https://gitlab.freedesktop.org/drm/kernel: (24 commits)\n accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()\n drm/xe: fix job timeout recovery for unstarted jobs and kernel queues\n drm/xe: fix refcount leak in xe_range_fence_insert()\n drm/xe: include all registered queues in TLB invalidation\n drm/xe/hw_error: Use HW_ERR prefix in log\n drm/xe/drm_ras: Add per node cleanup action\n drm/xe/drm_ras: Make counter allocation drm managed\n drm/xe/display: fix oops in suspend/shutdown without display\n drm/amd/display: use plane color_mgmt_changed to track colorop changes\n drm/atomic: track individual colorop updates\n drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable\n drm/colorop: Remove read-only comments from interpolation fields\n drm/i915/gem: Fix phys BO pread/pwrite with offset\n drm/vc4: fix krealloc() memory leak\n drm/virtio: Fix driver removal with disabled KMS\n drm/i915/edp: Check supported link rates DPCD read\n accel/ivpu: Fix signed integer truncation in IPC receive\n drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()\n drm/amd/display: Consult MCCS FreeSync cap only if requested \u0026 supported\n drm/amdkfd: Unwind debug trap enable on copy_to_user failure\n ...\n" }, { "commit": "7c62657a10625e4e113de248d41f543d5a2f3a1a", "tree": "0489a36702999be344762419119adb9d6d92a25b", "parents": [ "6fe5552f678bdbb925388ecff30a257b382cb9f6", "2f41af638c92bac6f1f9275ea2d1901baef578f3" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 13 07:50:04 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 13 07:52:40 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-06-12\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namd:\n- track colorop changes correctly\n\namdxdna:\n- fix possible leak of mm_struct\n\ncolorop:\n- make lut interpolation mutable\n- track colorop updates correctly\n\nivpu:\n- fix integer truncation\n\nvc4:\n- fix leak in krealloc() error handling\n\nvirtio:\n- fix dma_fence ref-count leak\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260612081418.GA17001@2a02-2455-9062-2500-e496-5a17-62ba-545e.dyn6.pyur.net\n" }, { "commit": "2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0", "tree": "b9717d818a60b051be6af12f543c3c5ff8b5e792", "parents": [ "28608283615e5e7e92ea79c8ea13507f4b5e0cbe", "d898796a8e7ed8528c775f33da056e9978c4c248" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 13:49:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 13:49:45 2026 -0700" }, "message": "Merge tag \u0027pci-v7.1-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull pci fix from Bjorn Helgaas:\n\n - Add Frank Li as PCI endpoint reviewer (Frank Li)\n\n* tag \u0027pci-v7.1-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n MAINTAINERS: Add Frank Li as PCI endpoint reviewer\n" }, { "commit": "d898796a8e7ed8528c775f33da056e9978c4c248", "tree": "2c431a26832cac72b5054db0f8a903f92f42830c", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Frank Li", "email": "Frank.Li@nxp.com", "time": "Thu Jun 11 17:00:05 2026 -0400" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri Jun 12 15:15:38 2026 -0500" }, "message": "MAINTAINERS: Add Frank Li as PCI endpoint reviewer\n\nI have volunteered to review PCI endpoint-related changes. Add myself as a\nreviewer to be notified when related patches are posted.\n\nSigned-off-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nReviewed-by: Krzysztof Wilczyński \u003ckwilczynski@kernel.org\u003e\nLink: https://patch.msgid.link/20260611210007.529205-1-Frank.Li@oss.nxp.com\n" }, { "commit": "28608283615e5e7e92ea79c8ea13507f4b5e0cbe", "tree": "eea3e0785303e33f3bcba976cd211084b128add4", "parents": [ "880b719ca0da9d2470fd2652e8ed959ca5143280", "3c60184e39b57e5efe664fe8540cdbc1bc7ea899" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 11:06:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 11:06:16 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A couple of driver specific fixes: a small targeted fix for hardware\n error handling on DesignWare controllers and another for handling of\n custom chip select management on Qualcomm GENI controllers\"\n\n* tag \u0027spi-fix-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dw: fix race between IRQ handler and error handler on SMP\n spi: qcom-geni: Fix cs_change handling on the last transfer\n" }, { "commit": "880b719ca0da9d2470fd2652e8ed959ca5143280", "tree": "a40dde0f220d9195a4ef66306cce8279b62f62c8", "parents": [ "2e04e0961e9226d7e1fdd5bda3373289ba7a3f24", "29fe1bd01b99714f3136f922230a643c2742cda9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:49:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:49:59 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260611\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Tweak for an off-by-one in the CQ ring accounting for the min wait\n support.\n\n - Don\u0027t truncate end buffer length for a bundle, as the transfer might\n not happen. It\u0027s not required in the first place, as the completion\n side handles this condition already.\n\n* tag \u0027io_uring-7.1-20260611\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/wait: fix min_timeout behavior\n io_uring/kbuf: don\u0027t truncate end buffer for bundles\n" }, { "commit": "2e04e0961e9226d7e1fdd5bda3373289ba7a3f24", "tree": "7550e06f803c22c412a6997c40287512ee57240f", "parents": [ "c133f0433ad78ef51b5b4d3d26ed1940236d71a2", "e47832c73b83ec21e67026726a1c8124697792af" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:29:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:29:06 2026 -0700" }, "message": "Merge tag \u0027usb-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB / Thunderbolt fixes from Greg KH:\n \"Here are some small bugfixes for USB serial and Thunderbolt drivers\n for some reported and found issues. Included in here are:\n\n - usb serial overflow bugs fixed\n\n - new usb serial device id\n\n - thunderbolt validation fixes for reported issues\n\n All of these have been in linux-next this week with no reported\n issues\"\n\n* tag \u0027usb-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n USB: serial: kl5kusb105: fix bulk-out buffer overflow\n USB: serial: option: add usb-id for Dell Wireless DW5826e-m\n USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n USB: serial: io_ti: fix heap overflow in get_manuf_info()\n thunderbolt: Limit XDomain response copy to actual frame size\n thunderbolt: Validate XDomain request packet size before type cast\n thunderbolt: Clamp XDomain response data copy to allocation size\n thunderbolt: Bound root directory content to block size\n thunderbolt: Reject zero-length property entries in validator\n" }, { "commit": "c133f0433ad78ef51b5b4d3d26ed1940236d71a2", "tree": "6deb9241d5434b3d4f1a83fcca32c6868a562d0b", "parents": [ "9a837eff9032ca0e047b068ff101d2183eb0afa1", "88e994c57a79f62d5338231d8d37ee8dd98baffe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:10:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:10:12 2026 -0700" }, "message": "Merge tag \u0027staging-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are two small bugfixes for a staging driver to fix a\n much-reported issue.\n\n The fixes are for the rtl8723bs driver and it\u0027s something that many\n scanning tools keep tripping over in convoluted ways (and seems to be\n able to be triggered by network traffic)\n\n These fixes have been in linux-next for many weeks with no reported\n issues, sorry for the delay in getting them to you\"\n\n* tag \u0027staging-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction\n staging: rtl8723bs: fix buffer over-read in rtw_update_protection\n" }, { "commit": "9a837eff9032ca0e047b068ff101d2183eb0afa1", "tree": "9281b338a1335e104441b7dffc780efff0ac77bd", "parents": [ "1dadb7e7eb5a052a58fb2ec8d60c07186158efc4", "07ebe87915d8accdaba20c4f88c5ae430fe62fbb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 09:00:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 09:00:28 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc driver fixes from Greg KH:\n \"Here are some small driver fixes for 7.1-final to resolve some\n reported issues. Included in here are:\n\n - slimbus qcom driver bugfixes\n\n - nvmem driver bugfixes\n\n - fastrpc driver bugfixes\n\n - stratix10 firmware driver bugfixes\n\n All of these have been in linux-next for over a week with no\n reported issues\"\n\n* tag \u0027char-misc-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n misc: fastrpc: fix use-after-free race in fastrpc_map_create\n misc: fastrpc: Fix NULL pointer dereference in rpmsg callback\n misc: fastrpc: fix DMA address corruption due to find_vma misuse\n misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context\n slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock\n slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD\n slimbus: qcom-ngd-ctrl: Initialize controller resources in controller\n slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd\n slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership\n slimbus: qcom-ngd-ctrl: Fix probe error path ordering\n slimbus: qcom-ngd-ctrl: Fix up platform_driver registration\n slimbus: qcom-ngd-ctrl: fix OF node refcount\n nvmem: core: fix use-after-free bugs in error paths\n nvmem: layouts: onie-tlv: fix hang on unknown types\n firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe\n firmware: stratix10-svc: Don\u0027t fail probe when async ops unsupported\n firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported\n" }, { "commit": "1dadb7e7eb5a052a58fb2ec8d60c07186158efc4", "tree": "8dacc111044d2dcecf7c5fef2c9bf74eded2f574", "parents": [ "fd41dc46db5eecf21c9d53fe034a731a2767030a", "b0d1553d51c3d188baae6d77e6f3dfb415a7b623" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:52:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:52:10 2026 -0700" }, "message": "Merge tag \u0027sound-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A few small fixes for the last spurt. All changes are small, mostly\n consisting of driver-specific fixes, along with two UAF fixes for the\n ALSA timer core.\n\n Core:\n - Two UAF fixes in ALSA timer core\n\n ASoC:\n - SDCA: Fix NULL pointer dereference\n - amd / yc: Add DMI quirk for ASUS ExpertBook PM1403CDA\n - SOF amd: Fix garbage/spurious warnings\n - wm_adsp: Fix potential NULL dereference when removing firmware\n controls\n - loongson: Fix negative position calculation\n - spi-rzv2h-rspi: Fix SPDR read access width on 16-bit RX path\"\n\n* tag \u0027sound-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions\n ASoC: loongson: Fix invalid position error in ls_pcm_pointer\n spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX\n ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA\n ASoC: SOF: amd: set ipc flags to zero\n ASoC: SOF: amd: fix for ipc flags check\n ASoC: wm_adsp: Fix NULL dereference when removing firmware controls\n ALSA: timer: Fix UAF at snd_timer_user_params()\n ALSA: timer: Forcibly close timer instances at closing\n" }, { "commit": "fd41dc46db5eecf21c9d53fe034a731a2767030a", "tree": "7feafea0af1648abcbcd8844d5b5ed483be107c4", "parents": [ "f51cae6603c05b4b1fac65c773592e5bc8037251", "9c648f3554920721d8878807cd794fe2d7f989e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:44:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:44:56 2026 -0700" }, "message": "Merge tag \u0027soc-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"Two more small fixes came in, both addressing corner cases in platform\n specific code: the microchip mpfs system controller probe and the CPU\n power management on 32-bit rockchips SoCs\"\n\n* tag \u0027soc-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n ARM: rockchip: keep reset control around\n soc: microchip: mpfs-sys-controller: fix resource leak on probe error\n" }, { "commit": "35ebcfcc9ef29afcf258db854ccf25572c75baef", "tree": "fef851d3e7f8e223cf9c6f78172384a7e850b81a", "parents": [ "5cad752e1e73c326c9d784ceb34c9129285539c5", "9bffa2a61551da9ac32171f09d556974cb96d70a" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Jun 12 17:05:44 2026 +0200" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Jun 12 17:05:44 2026 +0200" }, "message": "Merge tag \u0027i2c-host-fixes-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-host-fixes for v7.1-rc8\n\n- imx: keep clock and pinctrl states consistent in runtime PM\n- imx-lpi2c: fix DMA resource leaks on PIO fallback\n- qcom-cci: fix NULL pointer dereference on remove\n- riic: fix reset refcount leak on resume_noirq error path\n- stm32f7: account for analog filter in timing computation\n- tegra: fix suspend/resume handling in NOIRQ phase\n- tegra: update Tegra410 I2C timings to match hardware specs\n- MAINTAINERS: hand over I2C maintainership to Andi\n" }, { "commit": "5cad752e1e73c326c9d784ceb34c9129285539c5", "tree": "99da4fd8ce62e4d051c0ed2fae69600b6b98c790", "parents": [ "498cc8f0a93b3e71d186e30d1b93b6f3eca96738" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Thu Jun 11 14:20:53 2026 +0200" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Jun 12 16:58:38 2026 +0200" }, "message": "dt-bindings: i2c: mux-gpio: name correct maintainer\n\nThe YAML conversion added me as maintainer but I can\u0027t recall being\nasked nor do I want to maintain it. Add Peter as maintainer for the\nbinding as he is maintainer of the driver.\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nAcked-by: Peter Korsgaard \u003cpeter.korsgaard@barco.com\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\n" }, { "commit": "cf30ceccfaec3d2549ff60f7c915625f12dd3a93", "tree": "5213a336e79d81c4f8e24006e5c2a4c1f58c5f43", "parents": [ "86e9d295084019f4df8ef8e477f39aa42d9a7ef8" ], "author": { "name": "Mateusz Guzik", "email": "mjguzik@gmail.com", "time": "Wed Jun 10 16:39:54 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Jun 12 14:26:27 2026 +0200" }, "message": "fs: fix ups and tidy ups to /proc/filesystems caching\n\n- add missing unlocks in some corner cases\n- whitespace touch ups\n- s/smp_store_release/rcu_assign_pointer/ [nop, the macro expands to the same thing]\n- mark file_systems_string as __read_mostly\n\nSigned-off-by: Mateusz Guzik \u003cmjguzik@gmail.com\u003e\nLink: https://patch.msgid.link/20260610143954.34185-1-mjguzik@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "9bffa2a61551da9ac32171f09d556974cb96d70a", "tree": "5a510a275dbf1012c1f2d6e8b34fa7aa16ead2b6", "parents": [ "695fcefd4a81466ef9c529790b4e96f1ea2ba051" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Tue Jun 09 11:16:14 2026 +0200" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Jun 12 11:11:58 2026 +0200" }, "message": "MAINTAINERS: hand over I2C to Andi Shyti\n\nAfter 13.5 years of maintaining I2C, it is finally time for me to move\nto other areas. So, I hereby transfer I2C maintainership to Andi Shyti.\nHe has been taking care of the I2C host drivers for a while now and\nkindly agreed to look after the whole subsystem. Thank you, Andi! I also\nwant to thank all contributors, reviewers, and fellow maintainers making\nall these years a mostly smooth ride. Happy hacking, everyone!\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260609091612.8228-4-wsa+renesas@sang-engineering.com\n" }, { "commit": "6fe5552f678bdbb925388ecff30a257b382cb9f6", "tree": "c63ead6390afc3bfdba9d3ee89e8c9946e15b71f", "parents": [ "c7be308858890007b4da9b6498a1c1f3e6647dee", "347ccc0453fca2c669e8dc8a72000e76ca4adf10" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:57:16 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:57:17 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-06-11\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nUAPI Changes:\n\nCross-subsystem Changes:\n\nCore Changes:\n\nDriver Changes:\n - fix oops in suspend/shutdown without display (Jani)\n - RAS fixes (Raag)\n - Use HW_ERR prefix in log (Raag)\n - include all registered queues in TLB invalidation (Tangudu)\n - Fix refcount leak in xe_range_tree in error paths (Wentao)\n - fix job timeout recovery for unstarted jobs and kernel queues (Rodrigo)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/aitt8ZkYmxIT9cdP@gsse-cloud1.jf.intel.com\n" }, { "commit": "c7be308858890007b4da9b6498a1c1f3e6647dee", "tree": "e31a5cd8d17179c0dab0056cacbdb83aee0d0b7e", "parents": [ "2aaaf5931b16938a017b7db51b8d9fadad857adc", "d21ad938398bca695a511307de38a65889e3b354" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:32:49 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:32:49 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-06-11\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Check supported link rates DPCD read [edp] (Nikita Zhandarovich)\n- Fix phys BO pread/pwrite with offset [gem] (Joonas Lahtinen)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/aipkcUDnTlzre-8F@linux\n" }, { "commit": "f51cae6603c05b4b1fac65c773592e5bc8037251", "tree": "d21144c1263676433eeceb4dbc25e8eb8789fe6e", "parents": [ "2b414a95b8f7307d42173ba9e580d6d3e2bcbfce", "6ec91df8aff77e2e8fe3179c1f3fc15b43a40ba3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 14:22:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 14:22:26 2026 -0700" }, "message": "Merge tag \u0027dma-mapping-7.1-2026-06-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fix from Marek Szyprowski:\n \"Three more fixes for the DMA-mapping code, related to PCI P2PDMA, DMA\n debug and DMA link ranges API (Li RongQing and Jason Gunthorpe)\"\n\n* tag \u0027dma-mapping-7.1-2026-06-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n iommu/dma: Do not try to iommu_map a 0 length region in swiotlb\n dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device\n dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments\n" }, { "commit": "b0d1553d51c3d188baae6d77e6f3dfb415a7b623", "tree": "76dd45e84f64a07e4a57bc6f8434055021d06850", "parents": [ "053a401b592be424fea9d57c789f66cd5d8cec11", "e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 11 21:29:47 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 11 21:29:47 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc7\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nA few more fixes for this release, some smaller driver specific ones\nplus a final quirk.\n" }, { "commit": "2b414a95b8f7307d42173ba9e580d6d3e2bcbfce", "tree": "e3349ab3ed37a969406d19f956d659503a006c92", "parents": [ "22e2036479cb77df6281ebbd376ae6c330774790", "1f57f68c4dd101e5e8ffc9ffa6428f45bcdd776a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:30:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:30:37 2026 -0700" }, "message": "Merge tag \u0027s390-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fix from Alexander Gordeev:\n\n - s390 selects GENERIC_LOCKBREAK when PREEMPT is enabled to tackle an\n old compile error that no longer exists. Since recently PREEMPT is\n always enabled, this LOCKBREAK config causes massive performance\n regressions.\n\n Remove GENERIC_LOCKBREAK from s390 Kconfig to fix the degradation.\n\n* tag \u0027s390-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390: Remove GENERIC_LOCKBREAK Kconfig option\n" }, { "commit": "22e2036479cb77df6281ebbd376ae6c330774790", "tree": "d872b0d89bf987fe6abf5897d6034baea0b5608f", "parents": [ "79f2670da86722d075633d20fa57418994ee6940", "7360b96099806396f4ce15233f6dddcb69248d34" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:17:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:17:49 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from IPsec and netfilter.\n\n This is relatively small, mostly because we are a bit behind our PW\n queue. I\u0027m not aware of any pending regression.\n\n Current release - regressions:\n\n - netfilter: nf_tables_offload: drop device refcount on error\n\n Previous releases - regressions:\n\n - core: add pskb_may_pull() to skb_gro_receive_list()\n\n - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n\n - ipv6: fix a potential NPD in cleanup_prefix_route()\n\n - ipv4: fix use-after-free caused by the fqdir_pre_exit() flush\n\n - eth:\n - bnxt_en: fix NULL pointer dereference\n - emac: fix use-after-free during device removal\n - octeontx2-af: fix memory leak in rvu_setup_hw_resources()\n - tun: zero the whole vnet header in tun_put_user()\n - sit: reload inner IPv6 header after GSO offloads\n\n Previous releases - always broken:\n\n - core: fix double-free in netdev_nl_bind_rx_doit()\n\n - netfilter: nf_log: validate MAC header was set before dumping it\n\n - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n\n - tcp: restrict SO_ATTACH_FILTER to priv users\n\n - mctp: usb: fix race between urb completion and rx_retry\n cancellation\n\n - eth:\n - mlx5: fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list\n - mvpp2: sync RX data at the hardware packet offset\"\n\n* tag \u0027net-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits)\n octeontx2-af: fix IP fragment flag corruption on custom KPU profile load\n ipv6: Fix a potential NPD in cleanup_prefix_route()\n net: txgbe: initialize PHY interface to 0\n net: txgbe: distinguish module types by checking identifier\n net: txgbe: initialize module info buffer\n net: mvpp2: build skb from XDP-adjusted data on XDP_PASS\n net: mvpp2: refill RX buffers before XDP or skb use\n net: mvpp2: limit XDP frame size to the RX buffer\n net: mvpp2: sync RX data at the hardware packet offset\n netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n netfilter: nf_log: validate MAC header was set before dumping it\n netfilter: x_tables: avoid leaking percpu counter pointers\n netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n netfilter: nf_tables_offload: drop device refcount on error\n netfilter: revalidate bridge ports\n rds: mark snapshot pages dirty in rds_info_getsockopt()\n ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n ptp: ocp: fix resource freeing order\n ...\n" }, { "commit": "79f2670da86722d075633d20fa57418994ee6940", "tree": "0d2f43a8115f545204ab0fb32e800718516f4bab", "parents": [ "6e9e0dfc7f2e34627a4280b8e168479018d95732", "fba0510cd62666951dcc0221527edc0c47ae6599" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:54:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:54:51 2026 -0700" }, "message": "Merge tag \u0027pmdomain-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - imx: Fix OF node refcount\n\n - ti: Fix wakeup configuration for parent devices of wakeup sources\n\n* tag \u0027pmdomain-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: imx: fix OF node refcount\n pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source\n" }, { "commit": "2f41af638c92bac6f1f9275ea2d1901baef578f3", "tree": "89ac96a1ae37f6f1c7755df1aa0c9bc5709bea21", "parents": [ "d79716401a954677a93c4dd51fec65beccb38296" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Wed Jun 10 08:11:27 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Thu Jun 11 09:50:07 2026 -0700" }, "message": "accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()\n\naie2_populate_range() jumps back to the again label without calling\nmmput(mm), leaking a reference to the mm_struct.\n\nAdd the missing mmput() before jumping to again.\n\nFixes: e486147c912f (\"accel/amdxdna: Add BO import and export\")\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com\n" }, { "commit": "6e9e0dfc7f2e34627a4280b8e168479018d95732", "tree": "ea9e9c32d46105105c8aff10deab06aa3f7cfda0", "parents": [ "9716c086c8e8b141d35aa61f2e96a2e83de212a7", "a23226b7c1f69eafd9ced4e037fb51c9758c0501" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:15:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:15:57 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix NULL pointer dereference in gpio-mvebu\n\n - fix runtime PM leak in remove path in gpio-zynq\n\n - reject invalid module params in gpio-mockup\n\n - fix generic IRQ chip leak in remove parh in gpio-rockchip\n\n - fix resource leaks in GPIO chip cleanup path on hog failure\n\n - fix a regression in how GPIO hogging code handles multiple GPIO chips\n reusing the same OF node\n\n* tag \u0027gpio-fixes-for-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpiolib: handle gpio-hogs only once\n gpio: fix cleanup path on hog failure\n gpio: rockchip: fix generic IRQ chip leak on remove\n gpio: mockup: reject invalid gpio_mockup_ranges widths\n gpio: zynq: fix runtime PM leak on remove\n gpio: mvebu: fix NULL pointer dereference in suspend/resume\n" }, { "commit": "e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd", "tree": "61b183bfed5b976e4620b489cec82301a20e41b6", "parents": [ "6ad3914e06a48a02e362d0df2b1073c7c567c93d" ], "author": { "name": "Kean Ren", "email": "rh_king@163.com", "time": "Thu Jun 11 10:37:57 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jun 11 15:55:23 2026 +0100" }, "message": "ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions\n\nsdca_dev_unregister_functions() iterates over all SDCA function\ndescriptors and calls sdca_dev_unregister() on each func_dev without\nchecking for NULL. When a function registration has failed partway\nthrough, or the device cleanup races with probe deferral, func_dev\nentries may be NULL, leading to a kernel oops:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000040\n RIP: 0010:device_del+0x1e/0x3e0\n Call Trace:\n sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca]\n release_nodes+0x35/0xb0\n devres_release_all+0x90/0x100\n device_unbind_cleanup+0xe/0x80\n device_release_driver_internal+0x1c1/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x161/0x3e0\n device_unregister+0x17/0x60\n sdw_delete_slave+0xb6/0xd0 [soundwire_bus]\n sdw_bus_master_delete+0x1e/0x50 [soundwire_bus]\n ...\n sof_probe_work+0x19/0x30 [snd_sof]\n\nThis was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake)\nwith the SOF audio driver probe failing due to missing Panther Lake\nfirmware, causing the subsequent cleanup of SoundWire devices to\ntrigger the crash.\n\nFix this with three changes:\n\n1) Add a NULL guard in sdca_dev_unregister() so that callers do not\n need to pre-validate the pointer (defense in depth).\n\n2) In sdca_dev_unregister_functions(), skip NULL func_dev entries\n and clear func_dev to NULL after unregistration, making the\n function idempotent and safe against double-invocation.\n\n3) In sdca_dev_register_functions(), roll back all previously\n registered functions when a later one fails, so the function\n array is never left in a partially-populated state.\n\nFixes: 4496d1c65bad (\"ASoC: SDCA: add function devices\")\nSigned-off-by: Kean Ren \u003crh_king@163.com\u003e\nReviewed-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260611023757.1553960-1-rh_king@163.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "009b6c6486b94a3aff566b017256b598dc96bf18", "tree": "5486704578b67ab5e9a49ca30a74f14bea60203a", "parents": [ "77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Mon May 25 17:38:17 2026 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Thu Jun 11 14:52:03 2026 +0100" }, "message": "ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN\n\nCommit 7af5b901e847 (\"ARM: 9358/2: Implement PAN for LPAE by TTBR0\npage table walks disablement\") implemented PAN for LPAE kernels by\nsetting TTBCR.EPD0 on every kernel entry, disabling TTBR0 page-table\nwalks while running in kernel mode. The commit correctly updated\ncpu_suspend() in arch/arm/kernel/suspend.c, but missed two other code\npaths that switch the CPU to the identity mapping before jumping to\nlow-PA (TTBR0-range) physical addresses:\n\n1. setup_mm_for_reboot() in arch/arm/mm/idmap.c, used by the kexec\n reboot path. With TTBCR.EPD0 still set, the subsequent branch to\n the identity-mapped cpu_v7_reset causes a PrefetchAbort because the\n TTBR0 page-table walk needed to resolve the identity-mapped address\n is disabled. This manifests as a hard hang or \"bad PC value\" panic\n on LPAE kernels booted on CPUs that strictly enforce EPD0 for\n instruction fetch (e.g. Cortex-A53 in AArch32 mode) while the same\n image may accidentally work on Cortex-A15 due to microarchitectural\n differences in EPD0 enforcement.\n\n2. arch_restore_image() in arch/arm/kernel/hibernate.c, which calls\n cpu_switch_mm(idmap_pgd, \u0026init_mm) directly without going through\n setup_mm_for_reboot(), leaving TTBCR.EPD0 set while the identity\n mapping is active.\n\nFix both sites by calling uaccess_save_and_enable() before switching\nto the identity mapping, mirroring what the original commit did for\ncpu_suspend().\n\nAssisted-by: Cursor:claude-sonnet-4.6\n\nFixes: 7af5b901e847 (\"ARM: 9358/2: Implement PAN for LPAE by TTBR0 page table walks disablement\")\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6", "tree": "3afa2c4dfe697591dd09fb424fb50d824585505c", "parents": [ "d59ed803715a71fb9582e139d648ece8d66dc743" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Sun May 24 06:52:35 2026 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Thu Jun 11 14:52:01 2026 +0100" }, "message": "ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow\n\nCommit 44e9a3bb76e5 (\"ARM: 9430/1: entry: Do a dummy read from\nVMAP shadow\") added a dummy read from the KASAN VMAP stack shadow in\n__switch_to(). The read uses ldr, but the KASAN shadow address is\nbyte-granular and is not guaranteed to be word aligned.\n\nARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and\nCONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to()\nwith an alignment exception before reaching init.\n\nUse ldrb for the dummy shadow access. The code only needs to fault in the\nshadow mapping if the stack shadow is missing, so a byte load is sufficient\nand matches the granularity of KASAN shadow memory.\n\nFixes: 44e9a3bb76e5 (\"ARM: 9430/1: entry: Do a dummy read from VMAP shadow\")\nCc: stable@vger.kernel.org # v6.13+\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "d59ed803715a71fb9582e139d648ece8d66dc743", "tree": "2459a5d66d333bcbe24441af8ca49f7c28f87784", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Sun May 24 06:52:36 2026 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Thu Jun 11 14:52:00 2026 +0100" }, "message": "ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O\n\nFor CPUs before ARMv6, __raw_readw() and __raw_writew() are implemented\nas C volatile halfword accesses so the compiler can generate an access\nsequence that is safe for those machines. With KASAN enabled, those C\naccesses are instrumented as normal memory accesses.\n\nThat is not valid for MMIO. On ARM926/VersatilePB with KASAN enabled,\nPL011 probing traps in __asan_store2() while registering the UART, because\nthe instrumented writew() tries to check KASAN shadow for an MMIO address.\n\nKeep the existing volatile halfword access, but move the ARMv5 definitions\ninto __no_kasan_or_inline functions so raw MMIO halfword accesses are not\ninstrumented by KASAN. The ARMv6-and-newer inline assembly path is\nunchanged.\n\nFixes: 421015713b30 (\"ARM: 9017/2: Enable KASan for ARM\")\nCc: stable@vger.kernel.org # v5.11+\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "347ccc0453fca2c669e8dc8a72000e76ca4adf10", "tree": "092779b1e82f7b088e379c4179af4bd7c7831156", "parents": [ "ba36786b21d19082e696eda85bfcd49e7071944a" ], "author": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Jun 10 11:25:49 2026 -0400" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Thu Jun 11 06:39:43 2026 -0700" }, "message": "drm/xe: fix job timeout recovery for unstarted jobs and kernel queues\n\nA job that GuC never scheduled (never started) indicates a GuC\nscheduling failure; previously such jobs were silently errored out\ninstead of triggering a GT reset to recover. Trigger a GT reset and\nresubmit them, but only when the queue was not already killed or banned:\nan unstarted job on an already banned queue is the ban working as\nintended and must neither clear the ban nor kick off a reset, otherwise\na banned userspace queue could be resurrected and spam GT resets.\n\nKernel queues are always recovered this way and wedge the device once\nrecovery attempts are exhausted, since kernel work must not silently\nfail. A started job that times out on a userspace VM bind queue stays\nbanned rather than being reset and retried.\n\nThe queue is banned early in the timeout handler to signal the G2H\nscheduling-done handler so it wakes the disable-scheduling waiter;\nwithout it the waiter sleeps the full 5s timeout. When a reset is\nwarranted the ban is cleared before rearming so that\nguc_exec_queue_start() can resubmit jobs after the GT reset - a\nstill-banned queue would block resubmission and cause an infinite TDR\nloop. The already-banned case is gated out before this point via\nskip_timeout_check, so it is unaffected.\n\nv2: (Himal) Do it for any queue type, not just kernel/migration\nv3: - (Sashiko and Sanjay): don\u0027t clear the ban / GT reset for already\n killed/banned queues on unstarted-job timeout\n - Update commit message\n - (Matt) Add Fixes tag\n\nFixes: fe05cee4d953 (\"drm/xe: Don\u0027t short circuit TDR on jobs not started\")\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nCc: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nAssisted-by: GitHub-Copilot:claude-sonnet-4.6\nAssisted-by: GitHub-Copilot:claude-opus-4.8\nTested-by: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nReviewed-by: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nLink: https://patch.msgid.link/20260610152548.404575-3-rodrigo.vivi@intel.com\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n(cherry picked from commit b1107d085e7e8ed15ba6f80c102528a9c8a6cb0e)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "ba36786b21d19082e696eda85bfcd49e7071944a", "tree": "4c7fb38d4903c3cc758fac88447962d09b14ecb2", "parents": [ "e4aaac46593733a06ec1a1f1a63128206d67fcaa" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Wed Jun 10 10:27:05 2026 -0700" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Thu Jun 11 06:39:40 2026 -0700" }, "message": "drm/xe: fix refcount leak in xe_range_fence_insert()\n\nxe_range_fence_insert() acquires a reference on fence via\ndma_fence_get() and stores it in rfence-\u003efence. It then calls\ndma_fence_add_callback() and handles two cases: when the callback\nis successfully registered (err \u003d\u003d 0) the fence is transferred to\nthe tree for later cleanup; when the fence is already signaled\n(err \u003d\u003d -ENOENT) it manually drops the extra reference with\ndma_fence_put(fence).\n\nHowever, dma_fence_add_callback() can fail with other errors\n(e.g. -EINVAL) and in that case the code falls through to the free:\nlabel without releasing the acquired reference, leaking it.\n\nFix the leak by adding an else branch that calls dma_fence_put()\nbefore jumping to free: for any error other than -ENOENT.\n\nFixes: 845f64bdbfc9 (\"drm/xe: Introduce a range-fence utility\")\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com\n(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "7360b96099806396f4ce15233f6dddcb69248d34", "tree": "0d26fe1f8292949f5da3727d3500f37b5f22046f", "parents": [ "64ced6c0882756db52cbedf50bc66338de4a4045" ], "author": { "name": "Kiran Kumar K", "email": "kirankumark@marvell.com", "time": "Mon Jun 08 15:24:55 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:59:34 2026 +0200" }, "message": "octeontx2-af: fix IP fragment flag corruption on custom KPU profile load\n\nnpc_cn20k_apply_custom_kpu() overwrites KPU profile entries with custom\nfirmware values and then calls npc_cn20k_update_action_entries_n_flags()\nover all entries. Since the same function already ran during default\nprofile initialisation, entries not overridden by the custom firmware\nget their flags translated twice, corrupting the CN20K-specific values.\n\nFix this by extracting the per-entry translation into a helper\nnpc_cn20k_translate_action_flags() and calling it as each custom entry\nis loaded, removing the redundant batch call at the end.\n\nFixes: ef992a0f12e8 (\"octeontx2-af: npc: cn20k: MKEX profile support\")\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nSigned-off-by: Kiran Kumar K \u003ckirankumark@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260608095455.1499203-1-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "64ced6c0882756db52cbedf50bc66338de4a4045", "tree": "e367659ac44fc0518a60896bec81e60840fa6755", "parents": [ "29899ec61ac6fcc9d46f5f8d0b72117d9a676c2e", "c7d573551f9286100a055ef696cde6af54549677" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:29:59 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:30:00 2026 +0200" }, "message": "Merge tag \u0027nf-26-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) Revalidate bridge ports, add missing NULL checks to fetch the bridge\n device by the port. From Florian Westphal.\n\n2) Fix netdevice refcount leak in the error path of nft_fwd hardware\n offload function, also from Florian.\n\n3) Unregister helper expectfn callback on conntrack helper module\n removal, otherwise dangling pointer remains in place,\n from Weiming Shi.\n\n4) Fix possible pointer infoleak in getsockopt() IPT_SO_GET_ENTRIES,\n From Kyle Zeng.\n\n5) Validate that device MAC header is present before nf_syslog\n accesses it. From Xiang Mei.\n\n6-8) Three patches to address a possible infoleak of stale stack\n data in three nf_tables expressions, due to mismatch in the\n _init() and _eval() function which is possible since 14fb07130c7d.\n From Davide Ornaghi and Florian Westphal.\n\nnetfilter pull request 26-06-10\n\n* tag \u0027nf-26-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n netfilter: nf_log: validate MAC header was set before dumping it\n netfilter: x_tables: avoid leaking percpu counter pointers\n netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n netfilter: nf_tables_offload: drop device refcount on error\n netfilter: revalidate bridge ports\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260610161629.214092-1-pablo@netfilter.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6ad3914e06a48a02e362d0df2b1073c7c567c93d", "tree": "b650bd7c92e779976173b5b0bf2b6c22e96cd0e1", "parents": [ "310628484ef06f95c5589374fade917a5689787b" ], "author": { "name": "Li Jun", "email": "lijun01@kylinos.cn", "time": "Thu Jun 11 09:00:45 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jun 11 11:21:24 2026 +0100" }, "message": "ASoC: loongson: Fix invalid position error in ls_pcm_pointer\n\nThe \"invalid position\" error occurred when the DMA position descriptor\nreturned an invalid address value (e.g., pos \u003d -1048838144). This happened\nbecause the `bytes_to_frames()` function returns a signed value, but when\n`addr \u003c runtime-\u003edma_addr`, the subtraction produces a negative result that\ngets interpreted as a large unsigned integer in comparisons.\nwhen the addr is abnormal, for example,the DMA controller is abnormal in\nhardware,x\u003d0 should not be a point(x \u003d\u003d runtime-\u003ebuffer_size),but a range,\nwhich includes the addr address being less than runtime -\u003edma1-adr, and\nthe addr exceeding the DMA address range.the value of pos should not better\na negative，return 0, maybe better.\n\n[ 32.834431][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.845019][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.855588][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.866145][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.995394][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 33.006025][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 33.016748][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n\nSigned-off-by: Li Jun \u003clijun01@kylinos.cn\u003e\n[Remove XRUN reporting I\u0027d mistakenly avised adding on prior review -- broonie]\nLink: https://patch.msgid.link/20260611010045.3668574-1-lijun01@kylinos.cn\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "29899ec61ac6fcc9d46f5f8d0b72117d9a676c2e", "tree": "ab82359e5c0d7089f7fceaa8a065b7736927e3b1", "parents": [ "b70c687b7cf267fb08586667a3946c8851cad672", "26aad08a928901296aabfbc7a33ecb951656bb98" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:00:49 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:00:49 2026 +0200" }, "message": "Merge tag \u0027ipsec-2026-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-06-10\n\n1) xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n Propagate SKBFL_SHARED_FRAG when paged fragments are moved between\n skbs so ESP can decide whether in-place crypto is safe.\n\n2) xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload\n Replace the unlocked read of xtfs-\u003era_newskb with a local flag so a\n concurrent reassembly can no longer free first_skb between\n spin_unlock and the post-loop check.\n\n3) xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n Prune the inexact bin under xfrm_policy_lock so a concurrent\n xfrm_hash_rebuild() can no longer free it before xfrm_policy_kill()\n dereferences it.\n\n4) xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n Move hrtimer_cancel() for the output and drop timers ahead of their\n spinlocks, breaking the softirq/lock cycle that could deadlock\n against the timer callbacks on SMP.\n\n5) xfrm: espintcp: do not reuse an in-progress partial send\n Fail a new send when espintcp_push_msgs() returns with emsg-\u003elen\n still set, so a blocking caller can no longer overwrite ctx-\u003epartial\n while a previous transfer still owns it.\n\n6) esp: fix page frag reference leak on skb_to_sgvec failure\n Add a flag to esp_ssg_unref() to unconditionally unref the source\n scatterlist, releasing the old page references that are otherwise\n leaked when the second skb_to_sgvec() in esp_output_tail() fails.\n\nPlease pull or let me know if there are problems.\n\nipsec-2026-06-10\n\n* tag \u0027ipsec-2026-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n esp: fix page frag reference leak on skb_to_sgvec failure\n xfrm: espintcp: do not reuse an in-progress partial send\n xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload\n xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260610140800.2562818-1-steffen.klassert@secunet.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b70c687b7cf267fb08586667a3946c8851cad672", "tree": "39c7bed2d853db117c8467e216891b644ea9ee62", "parents": [ "0068940907d33217ae01217f84910a5cde606c17" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Tue Jun 09 17:54:48 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 11:57:11 2026 +0200" }, "message": "ipv6: Fix a potential NPD in cleanup_prefix_route()\n\naddrconf_get_prefix_route() can return the fib6_null_entry sentinel\nentry which has a NULL fib6_table pointer. Therefore, before setting the\nroute\u0027s expiration time, check that we are not working with this entry,\nas otherwise a NPD will be triggered [1].\n\nNote that the other callers of addrconf_get_prefix_route() are not\nsusceptible to this bug:\n\n1. addrconf_prefix_rcv(): Requests a route with the \u0027RTF_ADDRCONF |\n RTF_PREFIX_RT\u0027 flags which are not set on fib6_null_entry.\n\n2. modify_prefix_route(): Fixed by commit a747e02430df (\"ipv6: avoid\n possible NULL deref in modify_prefix_route()\").\n\n3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for\n fib6_null_entry and returns an error.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[...]\nCall Trace:\n\u003cTASK\u003e\n__kasan_check_byte (mm/kasan/common.c:573)\nlock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1))\n_raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1))\ncleanup_prefix_route (net/ipv6/addrconf.c:1280)\nipv6_del_addr (net/ipv6/addrconf.c:1342)\ninet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119)\ninet6_rtm_deladdr (net/ipv6/addrconf.c:4812)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6997)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2555)\nnetlink_unicast (net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1899)\n__sock_sendmsg (net/socket.c:802 (discriminator 4))\n____sys_sendmsg (net/socket.c:2698)\n___sys_sendmsg (net/socket.c:2752)\n__sys_sendmsg (net/socket.c:2784)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nFixes: 5eb902b8e719 (\"net/ipv6: Remove expired routes with a separated list of routes.\")\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nReviewed-by: David Ahern \u003cdahern@nvidia.com\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260609145448.768318-1-idosch@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0068940907d33217ae01217f84910a5cde606c17", "tree": "aa2ce14e471e9d7d586d306e7e1cad4466719489", "parents": [ "b59873c9c40d0cbc16df86cf6cb5430330a0ac74", "47f848aac4e79bdb197f849fa86e71fff1ad36ef" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:15 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:16 2026 +0200" }, "message": "Merge branch \u0027net-txgbe-fix-module-identification\u0027\n\nJiawen Wu says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: txgbe: fix module identification\n\nFor AML devices, there are some issues where the wrong module\nindentified then configure PHY failed.\n\nThe module info buffers should be initialized to 0 before the firmware\nreturns information. And DECLARE_PHY_INTERFACE_MASK() does not guarantee\nzeroed contents, so explicitly clear the temporary interface masks before\nsetting supported interfaces.\n\nRework txgbe_identify_module() to validate module identifiers through\nexplicit type checks instead of relying on transceiver_type heuristics.\nWhen using the SFP module, transceiver_type could be a random value,\nbecause it was read from an invalid register.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260608070842.36504-1-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47f848aac4e79bdb197f849fa86e71fff1ad36ef", "tree": "aa2ce14e471e9d7d586d306e7e1cad4466719489", "parents": [ "f2df54ddbfb04a006ee326a5d8270434a414e0af" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Jun 08 15:08:42 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:14 2026 +0200" }, "message": "net: txgbe: initialize PHY interface to 0\n\nDECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents. Add a\nnew macro DECLARE_PHY_INTERFACE_MASK_ZERO(), make the stack variable to\nbe zeroed before setting supported interfaces.\n\nFixes: 57d39faed4c9 (\"net: txgbe: improve functions of AML 40G devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-4-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f2df54ddbfb04a006ee326a5d8270434a414e0af", "tree": "c324685962425d4260e8e82d6284466bf54d671f", "parents": [ "0487cfca46517ff6699c72dc1a8872b0af3c31a9" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Jun 08 15:08:41 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:14 2026 +0200" }, "message": "net: txgbe: distinguish module types by checking identifier\n\nRework txgbe_identify_module() to validate module identifiers through\nexplicit type checks instead of relying on transceiver_type heuristics.\nWhen using the SFP module, transceiver_type could be a random value,\nbecause it was read from an invalid register.\n\nFixes: 57d39faed4c9 (\"net: txgbe: improve functions of AML 40G devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-3-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0487cfca46517ff6699c72dc1a8872b0af3c31a9", "tree": "d6b994cf0f085cd66054d5fd0265b8c54bd4c7b5", "parents": [ "b59873c9c40d0cbc16df86cf6cb5430330a0ac74" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Jun 08 15:08:40 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:14 2026 +0200" }, "message": "net: txgbe: initialize module info buffer\n\nThe module info buffer should be initialized to 0 before the firmware\nreturns information. Otherwise, there is a risk that the buffer field\nnot filled by the firmware is random value.\n\nFixes: 343929799ace (\"net: txgbe: Support to handle GPIO IRQs for AML devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-2-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b59873c9c40d0cbc16df86cf6cb5430330a0ac74", "tree": "b0eb340983a1a9528d273b170e237255f038c236", "parents": [ "512db8267b73a220a64180d95ab5eebe7c4964a8", "77a6b90ce56bc982dcfa94229b8e28e6abb16e95" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:33 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:33 2026 +0200" }, "message": "Merge branch \u0027net-mvpp2-fix-xdp-rx-buffer-handling\u0027\n\nTil Kaiser says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mvpp2: fix XDP RX buffer handling\n\nThis is v5 of the earlier XDP_PASS fix. The XDP_PASS change is\nretained, and the series also fixes related RX/XDP buffer handling\nissues found during review.\n\nTested with tools/testing/selftests/drivers/net/xdp.py on mvpp2\nhardware.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260607134943.21996-1-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "77a6b90ce56bc982dcfa94229b8e28e6abb16e95", "tree": "b0eb340983a1a9528d273b170e237255f038c236", "parents": [ "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:43 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: build skb from XDP-adjusted data on XDP_PASS\n\nWhen an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail()\nand then returns XDP_PASS, mvpp2 still builds the skb from fixed offsets\nderived from the original RX descriptor. Packet geometry changes made by\nthe XDP program are therefore discarded before the skb reaches the stack.\n\nUpdate rx_offset and rx_bytes from xdp.data and xdp.data_end for\nXDP_PASS. This makes skb_reserve() and skb_put() reflect the packet seen\nby XDP, and makes RX byte accounting for XDP_PASS follow the length of the\nskb passed to the network stack.\n\nKeep a separate rx_sync_size for page-pool recycling on skb allocation\nfailure, which must stay tied to the received buffer range.\n\nNon-PASS verdicts continue to account the descriptor length because no skb\nis passed up in those cases.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-5-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6", "tree": "adb0381ccb32e0e21023ba87db46fa17078dfb79", "parents": [ "f3c6aa078927e6fe8121c9c591ddee8716c5305a" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:42 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: refill RX buffers before XDP or skb use\n\nThe RX error path returns the current descriptor buffer to the hardware\nBM pool. That is only valid while the driver still owns the buffer.\n\nmvpp2_rx_refill() can fail after the current buffer has been handed to\nXDP or attached to an skb. In those cases mvpp2_run_xdp() may have\nrecycled, redirected, or queued the page for XDP_TX, and an skb free also\nretires the data buffer. Returning such a buffer to BM lets hardware DMA\ninto memory that is no longer owned by the RX ring.\n\nRefill the BM pool before handing the current buffer to XDP or to the\nskb. If the allocation fails there, drop the packet and return the\nstill-owned current buffer to BM, preserving the pool depth. Once the\nrefill succeeds, later local drops retire/free the current buffer instead\nof returning it to BM.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nFixes: d6526926de73 (\"net: mvpp2: fix memory leak in mvpp2_rx\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-4-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f3c6aa078927e6fe8121c9c591ddee8716c5305a", "tree": "1c280e4029f2d969be34e95055b03c9791b4492e", "parents": [ "180235600934bef6add3be637c296d6cf3272e67" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:41 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: limit XDP frame size to the RX buffer\n\nmvpp2 has short and long BM pools, and short pool buffers can be smaller\nthan PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with\nPAGE_SIZE as frame size.\n\nXDP helpers use frame_sz to validate tail growth and to derive the hard\nend of the data area. Advertising PAGE_SIZE for short buffers can let\nbpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting\nmemory or later tripping skb tailroom checks.\n\nInitialize the XDP buffer with bm_pool-\u003efrag_size so XDP tailroom matches\nthe actual buffer backing the packet.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "180235600934bef6add3be637c296d6cf3272e67", "tree": "ecb9855b324d5a209827608ae91fc302d3d85901", "parents": [ "512db8267b73a220a64180d95ab5eebe7c4964a8" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:40 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: sync RX data at the hardware packet offset\n\nmvpp2 programs the RX queue packet offset, so hardware writes received\ndata at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at\ndma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the\nunused headroom and misses the same number of bytes at the packet tail.\n\nOn non-coherent DMA systems this can leave the CPU reading stale cache\ncontents for the end of the received frame.\n\nUse dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range\noffset so the sync covers the Marvell header and packet data actually\nwritten by hardware.\n\nFixes: e1921168bbd4 (\"mvpp2: sync only the received frame\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-2-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9716c086c8e8b141d35aa61f2e96a2e83de212a7", "tree": "918331b178b771fa02019c3fc60c8da519c22ddf", "parents": [ "767622308a1d8b111038fca0059b964da1f6d9c4", "6100a82e34cb75571feba920a9c18f60698d598a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 11:53:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 11:53:55 2026 -0700" }, "message": "Merge tag \u0027pm-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These address some remaining fallout after introducing dynamic EPP\n support in the amd-pstate driver during the current development cycle:\n\n - Restore allowing writing EPP of 0 when in performance mode in the\n amd-pstate driver which was unnecessarily disallowed by one of the\n recent updates (Mario Limonciello)\n\n - Remove stale documentation of the epp_cached field in struct\n amd_cpudata that has been dropped recently (Zhan Xusheng)\"\n\n* tag \u0027pm-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq/amd-pstate: Fix setting EPP in performance mode\n cpufreq/amd-pstate: drop stale @epp_cached kdoc\n" }, { "commit": "e4aaac46593733a06ec1a1f1a63128206d67fcaa", "tree": "8544b7271c0230c1b1008acd1ad26e0d925db736", "parents": [ "381b3576a87f4ed6e76adb78d7d9400428f8f4b7" ], "author": { "name": "Tangudu Tilak Tirumalesh", "email": "tilak.tirumalesh.tangudu@intel.com", "time": "Mon Jun 08 21:57:44 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:29 2026 -0700" }, "message": "drm/xe: include all registered queues in TLB invalidation\n\nContext-based TLB invalidation currently selects only scheduling-active\nexec queues via q-\u003eops-\u003eactive(). During rebind flows, queues may be\nsuspended (or transitioning through resume) while still owning valid\ntranslations, causing them to be skipped from invalidation and leading\nto missed TLB invalidations on LR rebinds.\n\nThe underlying issue is a TOCTOU: q-\u003eguc-\u003estate bits are flipped lock-free\nfrom enable_scheduling(), disable_scheduling{,_deregister}(), the\nsuspend/resume sched-msg handlers, handle_sched_done(), and\nguc_exec_queue_stop(); nothing in send_tlb_inval_ctx_ppgtt() serializes\nagainst them, so any state-based predicate can race.\n\nInclude all the registered queues so that TLB invalidations are not\nmissed. This is race-free because list membership on vm-\u003eexec_queues.list\nis stable under vm-\u003eexec_queues.lock held by the caller. The performance\nimpact is expected to be minimal and harmless. If it does turn out to be\na concern, we can come back with a race-safe solution to ignore certain\nqueues.\n\nFixes: 6cdaa5346d6f (\"drm/xe: Add context-based invalidation to GuC TLB invalidation backend\")\nAssisted-by: Claude:claude-opus-4.6\nSuggested-by: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nSigned-off-by: Tangudu Tilak Tirumalesh \u003ctilak.tirumalesh.tangudu@intel.com\u003e\nReviewed-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260608162745.338725-2-tilak.tirumalesh.tangudu@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit aa625e1e9f0710e424fe4f0e3f032807df81b5b0)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "381b3576a87f4ed6e76adb78d7d9400428f8f4b7", "tree": "6a6ef436b54ca5037ee139ecafd77e7fe2b119e5", "parents": [ "3e3f5b0c5ae6845b4d8d23f079e872635cd8b0ae" ], "author": { "name": "Raag Jadav", "email": "raag.jadav@intel.com", "time": "Tue Jun 02 10:18:44 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:25 2026 -0700" }, "message": "drm/xe/hw_error: Use HW_ERR prefix in log\n\nHardware errors should be logged with HW_ERR prefix. Make them\nconsistent with existing logs.\n\nFixes: 01aab7e1c9d4 (\"drm/xe/xe_hw_error: Add support for PVC SoC errors\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-5-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit ad60a618c49fef07d1860bfb1091140d29f5eddb)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "3e3f5b0c5ae6845b4d8d23f079e872635cd8b0ae", "tree": "16a72ad3985e16f0d23c9a636606bb86438be4c7", "parents": [ "4dcfcdc9fbb5efef21e149adf349d42d84c9da04" ], "author": { "name": "Raag Jadav", "email": "raag.jadav@intel.com", "time": "Tue Jun 02 10:18:43 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:22 2026 -0700" }, "message": "drm/xe/drm_ras: Add per node cleanup action\n\ncleanup_node_param() is not registered for previous node in case of counter\nallocation failure, which results in stale memory of previous node that\nisn\u0027t cleaned up on unwind. Add per node cleanup action which guarantees\ncleanup on unwind and also simplifies the cleanup logic.\n\nFixes: b40db12b542f (\"drm/xe/xe_drm_ras: Add support for XE DRM RAS\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-4-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 67fc5543d8274b2fcbef87734fad0469358f4478)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "4dcfcdc9fbb5efef21e149adf349d42d84c9da04", "tree": "d83dccc2072546a25d046b7d72c36321cadcdb66", "parents": [ "68938cc08e23a94fd881e845837ff918de005ce7" ], "author": { "name": "Raag Jadav", "email": "raag.jadav@intel.com", "time": "Tue Jun 02 10:18:42 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:18 2026 -0700" }, "message": "drm/xe/drm_ras: Make counter allocation drm managed\n\ncleanup_node_param() is not registered for previous node in case of counter\nallocation failure, which results in stale memory of previous node that\nisn\u0027t cleaned up on unwind. Fix this using drm managed allocation, which is\nguaranteed to be cleaned up on unwind.\n\nFixes: b40db12b542f (\"drm/xe/xe_drm_ras: Add support for XE DRM RAS\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-3-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 58d77c77ea0c5cb2b755ebe23e973c8272acd896)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "68938cc08e23a94fd881e845837ff918de005ce7", "tree": "333af8b83be098430cb8576342f728825a4be97e", "parents": [ "4549871118cf616eecdd2d939f78e3b9e1dddc48" ], "author": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Fri May 15 19:09:20 2026 +0300" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:09 2026 -0700" }, "message": "drm/xe/display: fix oops in suspend/shutdown without display\n\nThe xe driver keeps track of whether to probe display, and whether\ndisplay hardware is there, using xe-\u003einfo.probe_display. It gets set to\nfalse if there\u0027s no display after intel_display_device_probe(). However,\nthe display may also be disabled via fuses, detected at a later time in\nintel_display_device_info_runtime_init().\n\nIn this case, the xe driver does for_each_intel_crtc() on uninitialized\nmode config in xe_display_flush_cleanup_work(), leading to a NULL\npointer dereference, and generally calls display code with display info\ncleared.\n\nCheck for intel_display_device_present() after\nintel_display_device_info_runtime_init(), and reset\nxe-\u003einfo.probe_display as necessary. Also do unset_display_features()\nfor completeness, although display runtime init has already done\nthat. This will need to be unified across all cases later.\n\nMove intel_display_device_info_runtime_init() call slightly earlier,\nsimilar to i915, to avoid a bunch of unnecessary setup for no display\ncases.\n\nNote #1: The xe driver has no business doing low level display plumbing\nlike for_each_intel_crtc() to begin with. It all needs to happen in\ndisplay code.\n\nNote #2: The actual bug is present already in commit 44e694958b95\n(\"drm/xe/display: Implement display support\"), but the oops was likely\nintroduced later at commit ddf6492e0e50 (\"drm/xe/display: Make display\nsuspend/resume work on discrete\").\n\nFixes: 44e694958b95 (\"drm/xe/display: Implement display support\")\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7904\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/6150\nCc: stable@vger.kernel.org # v6.8+\nReviewed-by: Suraj Kandpal \u003csuraj.kandpal@intel.com\u003e\nLink: https://patch.msgid.link/20260515160920.1082842-1-jani.nikula@intel.com\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n(cherry picked from commit 7c3eb9f47533220888a67266448185fd0775d4da)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "c7d573551f9286100a055ef696cde6af54549677", "tree": "3b55982a657bd6eaadfa6632b3acc0ec7c1f8dc4", "parents": [ "ab185e0c4fb82dfba6fb86f8271e06f931d9c64c" ], "author": { "name": "Davide Ornaghi", "email": "d.ornaghi97@gmail.com", "time": "Wed Jun 10 12:39:13 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:32 2026 +0200" }, "message": "netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n\nNFT_META_BRI_IIFHWADDR declares its destination register with\nlen \u003d ETH_ALEN (6 bytes), which the register-init tracking rounds up to\ntwo 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does\nmemcpy(dest, br_dev-\u003edev_addr, ETH_ALEN), writing only 6 bytes and\nleaving the upper 2 bytes of the second register as uninitialised\nnft_do_chain() stack. A downstream load of that register span leaks\nthose stale bytes to userspace.\n\nZero the second register before the memcpy so the full declared span is\nwritten.\n\nFixes: cbd2257dc96e (\"netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Davide Ornaghi \u003cd.ornaghi97@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "ab185e0c4fb82dfba6fb86f8271e06f931d9c64c", "tree": "fe4753675107e422020c0706b4ef3453286bef14", "parents": [ "772cecf198da732faebb5dcfc46d66a505be8495" ], "author": { "name": "Davide Ornaghi", "email": "d.ornaghi97@gmail.com", "time": "Wed Jun 10 12:39:12 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:19 2026 +0200" }, "message": "netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n\nFor NFT_FIB_RESULT_OIFNAME the destination register is declared with\nlen \u003d IFNAMSIZ (four 32-bit registers), but on the lookup-fail,\nRTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one\nregister via \"*dest \u003d 0\". The remaining three registers are left as\nwhatever was on the stack in nft_do_chain()\u0027s struct nft_regs, and a\ndownstream expression that loads the register span can leak that\nuninitialised kernel stack to userspace.\n\nThe NFTA_FIB_F_PRESENT existence check has the same shape: it is only\nmeaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type\nwhile the eval stores a single byte via nft_reg_store8(), leaving the rest\nof the declared span stale.\n\nFix both:\n\n - replace the bare \"*dest \u003d 0\" in the eval with nft_fib_store_result(),\n which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already\n used on the other early-return path), and\n\n - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its\n destination as a single u8, so the marked span matches the one byte\n the eval writes.\n\nFixes: f6d0cbcf09c5 (\"netfilter: nf_tables: add fib expression\")\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Davide Ornaghi \u003cd.ornaghi97@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "772cecf198da732faebb5dcfc46d66a505be8495", "tree": "477ccc145bc5973aa7d806445cd8e4f6b38a0b4c", "parents": [ "a84b6fedbc97078788be78dbdd7517d143ad1a77" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Jun 09 21:28:09 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:12 2026 +0200" }, "message": "netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n\nnft_exthdr_init() passes user-controlled priv-\u003elen to\nnft_parse_register_store(), which marks that many bytes in the\nregister bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT\nis set, the eval paths write only 1 byte (nft_reg_store8) or\n4 bytes (*dest \u003d 0 on TCP/DCCP error path). When len \u003e 4,\nregisters beyond the first are never written, retaining\nuninitialized stack data from nft_regs.\n\nBail out if userspace requests too much data when F_PRESENT is set.\n\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nFixes: c078ca3b0c5b (\"netfilter: nft_exthdr: Add support for existence check\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "a84b6fedbc97078788be78dbdd7517d143ad1a77", "tree": "b949480e102f10fa258f524b96b607699c7151c6", "parents": [ "f7f2fbb0e893a0238dc464f8d8c0f5609bec584f" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Tue Jun 09 15:55:02 2026 -0700" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:01 2026 +0200" }, "message": "netfilter: nf_log: validate MAC header was set before dumping it\n\nThe fallback path of dump_mac_header() guards the MAC header access\nonly with \"skb-\u003emac_header !\u003d skb-\u003enetwork_header\", without checking\nskb_mac_header_was_set(). When the MAC header is unset, mac_header is\n0xffff, so the test passes and skb_mac_header(skb) returns\nskb-\u003ehead + 0xffff, ~64 KiB past the buffer; the loop then reads\ndev-\u003ehard_header_len bytes out of bounds into the kernel log.\n\nThis is reachable via the netdev logger: nf_log_unknown_packet() calls\ndump_mac_header() unconditionally, and an skb sent through AF_PACKET\nwith PACKET_QDISC_BYPASS reaches the egress hook with mac_header still\nunset (__dev_queue_xmit(), which would reset it, is bypassed).\n\nAdd the skb_mac_header_was_set() check the ARPHRD_ETHER path already\nuses, and replace the open-coded MAC header length test with\nskb_mac_header_len(). Only skbs with an unset MAC header are affected;\nvalid ones are dumped as before.\n\n BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831)\n Read of size 1 at addr ffff88800ea49d3f by task exploit/148\n Call Trace:\n kasan_report (mm/kasan/report.c:595)\n dump_mac_header (net/netfilter/nf_log_syslog.c:831)\n nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963)\n nf_log_packet (net/netfilter/nf_log.c:260)\n nft_log_eval (net/netfilter/nft_log.c:60)\n nft_do_chain (net/netfilter/nf_tables_core.c:285)\n nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307)\n nf_hook_slow (net/netfilter/core.c:619)\n nf_hook_direct_egress (net/packet/af_packet.c:257)\n packet_xmit (net/packet/af_packet.c:280)\n packet_sendmsg (net/packet/af_packet.c:3114)\n __sys_sendto (net/socket.c:2265)\n\nFixes: 7eb9282cd0ef (\"netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "f7f2fbb0e893a0238dc464f8d8c0f5609bec584f", "tree": "e2886b33a6821900694c7e4fc017a6a89c360de1", "parents": [ "c3009418f9fa1dcb3eb86f4d8c92583537b5faa3" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Sat Jun 06 01:10:31 2026 -0700" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:59:01 2026 +0200" }, "message": "netfilter: x_tables: avoid leaking percpu counter pointers\n\nThe native and compat get-entries paths copy the fixed rule entry header\nfrom the kernelized rule blob to userspace before overwriting the entry\u0027s\ncounter fields with a sanitized counter snapshot.\n\nOn SMP kernels, entry-\u003ecounters.pcnt contains the percpu allocation\naddress used by x_tables rule counters. A caller can provide a userspace\nbuffer that faults during the initial fixed-header copy after pcnt has\nbeen copied but before the later sanitized counter copy runs. The syscall\nthen returns -EFAULT while leaving the raw percpu pointer in userspace.\n\nCopy only the fixed entry prefix before counters from the kernelized rule\nblob, then copy the sanitized counter snapshot into the counter field.\nApply this ordering to the IPv4, IPv6, and ARP native and compat\nget-entries implementations so a fault cannot expose the internal percpu\ncounter pointer.\n\nFixes: 71ae0dff02d7 (\"netfilter: xtables: use percpu rule counters\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "c3009418f9fa1dcb3eb86f4d8c92583537b5faa3", "tree": "8ab258ae3560c0e20835e1745b54c9a9aa886bf3", "parents": [ "efc542561729a2859397dad51bda1fe41262beb1" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Wed Jun 03 00:38:17 2026 -0700" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:58:39 2026 +0200" }, "message": "netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp-\u003eexpectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp-\u003eexpectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp-\u003eexpectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n nf_hook_slow (net/netfilter/core.c:619)\n __ip_local_out (net/ipv4/ip_output.c:120)\n __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n tcp_connect (net/ipv4/tcp_output.c:4374)\n tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose -\u003eexpectfn matches the descriptor being torn\ndown. Call it from each NAT helper\u0027s exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops.\n\nFixes: f587de0e2feb (\"[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "efc542561729a2859397dad51bda1fe41262beb1", "tree": "2bb16a7ee4276bb9c7d2905291e42b5cee73b3c6", "parents": [ "ccb9fd4b87538ccf19ccff78ee26700526d94867" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Jun 05 13:47:12 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:58:29 2026 +0200" }, "message": "netfilter: nf_tables_offload: drop device refcount on error\n\nReported by sashiko:\nIf nft_flow_action_entry_next() returns NULL, dev reference leaks.\n\nFixes: c6f85577584b (\"netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it\")\nReported-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "ccb9fd4b87538ccf19ccff78ee26700526d94867", "tree": "85002bc68f328b5d7c414d4157689881fa3d000f", "parents": [ "4aacf509e537a711fa71bca9f234e5eb6968850e" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Jun 02 17:04:25 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:58:20 2026 +0200" }, "message": "netfilter: revalidate bridge ports\n\nebt_redirect_tg() dereferences br_port_get_rcu() return without a\nNULL check, causing a kernel panic when the bridge port has been\nremoved between the original hook invocation and an NFQUEUE\nreinject.\n\nA mere NULL check isn\u0027t sufficient, however. As sashiko review\npoints out userspace can not only remove the port from the bridge,\nit could also place the device in a different virtual device, e.g.\nmacvlan.\n\nIf this happens, we must drop the packet, there is no way for us to\nreinject it into the bridge path.\n\nSwitch to _upper API, we don\u0027t need the bridge port structure.\nAlso, this fix keeps another bug intact:\n\nBoth nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER\ntoo aggressive, which prevents certain logging features when queueing\nin bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old\nCONFIG_BRIDGE_NETFILTER cruft is off.\n\nFixes tag is a common ancestor, this was always broken.\n\nFixes: f350a0a87374 (\"bridge: use rx_handler_data pointer to store net_bridge_port pointer\")\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nAssisted-by: Claude:claude-sonnet-4-6\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "310628484ef06f95c5589374fade917a5689787b", "tree": "b7c193be0159a3845cb02809e8b359cd0a337cb2", "parents": [ "0e152e4126fa14e697d8514cdd1567b18c679f08" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Wed Jun 10 20:08:17 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Jun 10 16:39:13 2026 +0100" }, "message": "spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX\n\nThe RZ/V2H hardware manual (section 7.5.2.2.1) specifies that read access\nsize for the SPI Data Register (SPDR) are fixed at 32 bits. The\nRZV2H_RSPI_RX macro for the 16-bit data path used readw(), violating\nthis requirement.\n\nSwitch to readl() for the 16-bit RX path to conform to the hardware\nspecification.\n\nFixes: 8b61c8919dff (\"spi: Add driver for the RZ/V2H(P) RSPI IP\")\nSuggested-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nReviewed-by: Fabrizio Castro \u003cfabrizio.castro.jz@renesas.com\u003e\nLink: https://patch.msgid.link/20260610-rzv2h-rspi-v2-1-40c80b4a2c90@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "512db8267b73a220a64180d95ab5eebe7c4964a8", "tree": "3b8a0b6a7ed0b5cf632cf6eef72cf7ff1924f0e3", "parents": [ "a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Jun 08 02:32:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 10 08:18:16 2026 -0700" }, "message": "rds: mark snapshot pages dirty in rds_info_getsockopt()\n\nrds_info_getsockopt() pins the destination user pages with FOLL_WRITE and\nthe RDS_INFO_* producers memcpy the snapshot into them through\nkmap_atomic(). Because that copy goes through the kernel direct map, the\ndirty bit on the user PTE is never set, so unpin_user_pages() releases the\npages without marking them dirty. A file-backed destination page can then\nbe reclaimed without writeback, silently discarding the copied data.\n\nUse unpin_user_pages_dirty_lock() with make_dirty\u003dtrue so the modified\npages are marked dirty before they are unpinned.\n\nFixes: a8c879a7ee98 (\"RDS: Info and stats\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260608-rds_fix-v1-1-006c88543408@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9", "tree": "df7e012789b2152c7b475522d48e3d05cc4fe710", "parents": [ "627366c51145a07f675b1800fb5ea2ec960bd900" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Jun 08 16:46:13 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 10 08:16:07 2026 -0700" }, "message": "ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n\nIn vti6_tnl_lookup(), when an exact match for a tunnel fails,\nthe code falls back to searching for wildcard tunnels:\n\n- Tunnels matching the packet\u0027s local address, with any remote address\n wildcard remote).\n\n- Tunnels matching the packet\u0027s remote address, with any local address\n (wildcard local).\n\nHowever, vti6 stores all these different types of tunnels in the same\nhash table (ip6n-\u003etnls_r_l) prone to hash collisions.\n\nThe bug is that the fallback search loops in vti6_tnl_lookup() were\nmissing checks to ensure that the candidate tunnel actually has\na wildcard address.\n\nFixes: fbe68ee87522 (\"vti6: Add a lookup method for tunnels with wildcard endpoints.\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20260608164613.933023-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "767622308a1d8b111038fca0059b964da1f6d9c4", "tree": "567c86cdc36bf13a566c93f28a0d38f5e0a87a4f", "parents": [ "805d5a2b792819171be100c50c9ddafa0f8c2231", "15b4155138505669d3d43d7692459ee8ea2a86e7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 07:18:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 07:18:32 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linux-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n\n - Fix the implementation of the CFI branch landing pad control prctl()s\n to return -EINVAL if unknown control bits are set, rather than\n silently ignoring the request; and add a kselftest for this case\n\n - Fix unaligned access performance testing to happen earlier in boot,\n which fixes a performance regression in the lib/checksum code\n\n - Fix a binfmt_elf warning when dumping core (due to missing\n .core_note_name for CFI registers)\n\n* tag \u0027riscv-for-linux-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: cfi: reject unknown flags in PR_SET_CFI\n riscv: Fix fast_unaligned_access_speed_key not getting initialized\n riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI\n" }, { "commit": "805d5a2b792819171be100c50c9ddafa0f8c2231", "tree": "cd654c208c02a858c590003e3e05039c430facf3", "parents": [ "acb7500801e98639f6d8c2d796ed9f64cba83d3a" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Jun 05 22:27:33 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 07:09:20 2026 -0700" }, "message": "namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories\n\nopen_tree(..., OPEN_TREE_NAMESPACE) and\nfsmount(..., FSMOUNT_NAMESPACE, ...) currently work on non-directories,\nlike regular files. That\u0027s bad for two reasons:\n\n - It ends up mounting a regular file over the inherited namespace root,\n which is a directory; mounting a non-directory over a directory is\n normally explicitly forbidden, see for example do_move_mount()\n\n - It causes setns() on the new namespace to set the cwd to a regular\n file, which the rest of VFS does not expect\n\nFix it by restricting create_new_namespace() (which is used by both of\nthese flags) to directories.\n\nLeave the behavior for OPEN_TREE_CLONE as-is, that seems unproblematic.\n\nFixes: 9b8a0ba68246 (\"mount: add OPEN_TREE_NAMESPACE\")\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: stable@kernel.org\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e47832c73b83ec21e67026726a1c8124697792af", "tree": "4754bd2d9943abebe43080690e90c53e5cee525c", "parents": [ "4316acc7ddaaa4572da1a55a2bc561d341c9c2a4", "96d47e40bf9db4a9efd5c8fb53287a508d165f14" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jun 10 12:25:33 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jun 10 12:25:33 2026 +0200" }, "message": "Merge tag \u0027usb-serial-7.1-rc8\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus\n\nJohan writes:\n\nUSB serial fixes for 7.1-rc8\n\nHere is one more buffer overflow fix.\n\nThis one has been in linux-next overnight with no reported issues.\n\n* tag \u0027usb-serial-7.1-rc8\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:\n USB: serial: kl5kusb105: fix bulk-out buffer overflow\n" }, { "commit": "d79716401a954677a93c4dd51fec65beccb38296", "tree": "afffed2d3f386137b5e8dfbdb6dec0a111edcf91", "parents": [ "2e235e2a2784b12b735321e5b42240ca51c49b0f" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Tue Jun 09 12:20:21 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:37 2026 -0300" }, "message": "drm/amd/display: use plane color_mgmt_changed to track colorop changes\n\nEnsure the driver tracks changes in any colorop property of a plane\ncolor pipeline by using the same mechanism of CRTC color management and\nupdate plane color blocks when any colorop property changes. It fixes an\nissue observed on gamescope settings for night mode which is done via\nshaper/3D-LUT updates.\n\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com\n" }, { "commit": "2e235e2a2784b12b735321e5b42240ca51c49b0f", "tree": "676ea24469c0131f742531df9b198f4b76c7c0ec", "parents": [ "94ff735296d371045fce163451a3d65e44ac4729" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Tue Jun 09 12:20:20 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:36 2026 -0300" }, "message": "drm/atomic: track individual colorop updates\n\nAs we do for CRTC color mgmt properties, use color_mgmt_changed flag to\ntrack any value changes in the color pipeline of a given plane, so that\ndrivers can update color blocks as soon as plane color pipeline or\nindividual colorop values change. Since we\u0027re here, only announce and\ntrack changes to plane COLOR_PIPELINE prop if its value is actually\nchanging.\n\nFixes: 8c5ea1745f4c (\"drm/colorop: Add BYPASS property\")\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: 41651f9d42eb (\"drm/colorop: Add 1D Curve subtype\")\nFixes: 3410108037d5 (\"drm/colorop: Add multiplier type\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nFixes: e5719e7f1900 (\"drm/colorop: Add 3x4 CTM type\")\nFixes: 99a4e4f08abe (\"drm/colorop: Add 1D Curve Custom LUT type\")\nFixes: 2afc3184f3b3 (\"drm/plane: Add COLOR PIPELINE property\")\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e #v1\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com\n" }, { "commit": "94ff735296d371045fce163451a3d65e44ac4729", "tree": "4d7280de41157b84aaf9fa34cc45102b5f29697c", "parents": [ "e480228cf65583040c894bb9cc02e1d5b328cee0" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Tue Jun 09 12:20:19 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:35 2026 -0300" }, "message": "drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable\n\nAs interpolation props are actually mutable props, any changes should be\nhandled by drm_colorop_state. Move their enum and make it correctly\nbehaves as mutable.\n\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com\n" }, { "commit": "e480228cf65583040c894bb9cc02e1d5b328cee0", "tree": "896f108a6f7f47426d32ec12eff1c461d7570781", "parents": [ "5d563a5da8717629ae72f9eadf1e0e340bd1658b" ], "author": { "name": "Alex Hung", "email": "alex.hung@amd.com", "time": "Tue Jun 09 12:20:18 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:34 2026 -0300" }, "message": "drm/colorop: Remove read-only comments from interpolation fields\n\nThe lut1d_interpolation and lut3d_interpolation fields and their\nassociated properties were marked as read-only, but userspace\ncan set them via drm_atomic_colorop_set_property().\n\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com\n" }, { "commit": "d21ad938398bca695a511307de38a65889e3b354", "tree": "7a7842d24c2dc98a5822194a4a1f624b5b612cae", "parents": [ "2673cefa99ca918e7ac5b0388ff578a83656c896" ], "author": { "name": "Joonas Lahtinen", "email": "joonas.lahtinen@linux.intel.com", "time": "Wed Jun 10 09:03:14 2026 +0300" }, "committer": { "name": "Tvrtko Ursulin", "email": "tursulin@ursulin.net", "time": "Wed Jun 10 09:23:22 2026 +0100" }, "message": "drm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\nReported-by: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nFixes: c6790dc22312 (\"drm/i915: Wean off drm_pci_alloc/drm_pci_free\")\nCc: \u003cstable@vger.kernel.org\u003e # v4.5+\nCc: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\nCc: Simona Vetter \u003csimona@ffwll.ch\u003e\nCc: Jani Nikula \u003cjani.nikula@linux.intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nSigned-off-by: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\nLink: https://patch.msgid.link/20260610060314.26111-1-joonas.lahtinen@linux.intel.com\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)\nSigned-off-by: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\n" }, { "commit": "a23226b7c1f69eafd9ced4e037fb51c9758c0501", "tree": "bdb1249e86f117d266f43007e12e8a20d577d87f", "parents": [ "64911f5aac534191e6b9a52ca1d50ba870a12d86" ], "author": { "name": "Daniel Drake", "email": "dan@reactivated.net", "time": "Mon Jun 08 22:01:08 2026 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Jun 10 10:12:57 2026 +0200" }, "message": "gpiolib: handle gpio-hogs only once\n\nCommit d1d564ec49929 (\"gpio: move hogs into GPIO core\") introduced a\nbehaviour change that breaks boot on Raspberry Pi 5 when using the\nfirmware-supplied device tree:\n\n gpiochip_add_data_with_key: GPIOs 544..575\n (/soc@107c000000/gpio@7d517c00) failed to register, -22\n brcmstb-gpio 107d517c00.gpio: Could not add gpiochip for bank 1\n brcmstb-gpio 107d517c00.gpio: probe with driver brcmstb-gpio failed\n with error -22\n\ngpio-brcmstb registers two gpio_chips against the device tree\nnode gpio@7d517c00, one for each bank. The firmware-supplied DT includes\na gpio-hog on RP1 RUN, and this gpio-hog is attempted to be applied to\n*both* gpio_chips. This succeeds against bank 0 (which hosts the GPIO)\nand fails for bank 1 (which does not).\n\nIn the previous implementation, failures to apply gpio-hogs were\nquietly ignored. In the new code, the error code propagates and causes\nprobe to fail.\n\nClosely approximate the previous behaviour by using the OF_POPULATED flag\nto ensure that each gpio-hog is processed only once. The flag was\npreviously being set before the gpio-hogs were processed, so as part\nof this change, the flag now gets set only after the gpio-hog is actioned.\nThe handling of gpio-hogs on a DT node with multiple gpio_chips remains a\nbit incomplete/unclear, but this at least retains the ability to apply\nhogs to the first gpio_chip per node.\n\nFixes: d1d564ec49929 (\"gpio: move hogs into GPIO core\")\nSigned-off-by: Daniel Drake \u003cdan@reactivated.net\u003e\nLink: https://patch.msgid.link/20260608210108.36248-1-dan@reactivated.net\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "aa5c4fe3ba0cb2af90bbcfa7a8ef4fefcd5c2370", "tree": "4106f6fdf663028fff46b3f281f0c424ce14b3c1", "parents": [ "de654d66ff30e75d9308fd4d4f1627addef7923e" ], "author": { "name": "Li Wang", "email": "liwang@kylinos.cn", "time": "Thu May 28 18:42:08 2026 +0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Jun 10 09:49:25 2026 +0200" }, "message": "backing-file: fix backing_file_open() kerneldoc parameter\n\nThe kerneldoc for backing_file_open() documented a @user_path argument,\nbut the function takes const struct file *user_file. The user\npath is derived as \u0026user_file-\u003ef_path.\n\nUpdate the @-tag to @user_file and adjust the description accordingly.\nAlso fix the \"reuqested\" typo to \u0027requested\u0027 in the old comment.\n\nSigned-off-by: Li Wang \u003cliwang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260528104208.395757-1-liwang@kylinos.cn\nReviewed-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "64911f5aac534191e6b9a52ca1d50ba870a12d86", "tree": "0c1f69b8aac45264830b5a5b0d898425842077fe", "parents": [ "1c1e0fc88d6ef65bf15d517853251f75ab9d18c3" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Tue Jun 09 14:17:50 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Jun 10 09:29:19 2026 +0200" }, "message": "gpio: fix cleanup path on hog failure\n\nIf gpiochip_hog_lines() successfully processes some hogs but fails on\na later one, the error handling path in gpiochip_add_data_with_key()\njumps directly to err_remove_of_chip. This leaks resources allocated\nearlier for ACPI, interrupts and hogs that were successfully processed.\nUse the right label in error path.\n\nCloses: https://sashiko.dev/#/patchset/20260608210108.36248-1-dan%40reactivated.net\nFixes: d1d564ec4992 (\"gpio: move hogs into GPIO core\")\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260609-gpio-hogs-fixes-v1-2-b4064f8070e7@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" } ], "next": "de654d66ff30e75d9308fd4d4f1627addef7923e" }