)]}' { "log": [ { "commit": "8e16f8bbf1bd528975fd6f4081eaf00513c1d83e", "tree": "f521a64a2285b719be85885f77cd6bca7f0213b2", "parents": [ "15811dfa39a7a4bafb11902165617b2f6fd05349" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Oct 24 19:48:45 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:38:58 2026 -0800" }, "message": "Input: synaptics-rmi4 - use 4-argument i2c_smbus_read_block_data()\n\nPass the transfer length to i2c_smbus_read_block_data() in\nsmb_block_read().\n\nLink: https://patch.msgid.link/20261024-i2c-smbus-read-block-data-v1-5-19bb97467982@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "15811dfa39a7a4bafb11902165617b2f6fd05349", "tree": "bbec22903fcbfbcde25cdf2475e1921e721e8086", "parents": [ "a088436b8be4f3b4016d7b9c7fef735df2892194" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Oct 24 19:48:44 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:38:52 2026 -0800" }, "message": "Input: elan_i2c - use 4-argument i2c_smbus_read_block_data()\n\nConvert callers of i2c_smbus_read_block_data() to the 4-argument\nvariant, specifying the buffer size to avoid buffer overruns.\n\nLink: https://patch.msgid.link/20261024-i2c-smbus-read-block-data-v1-4-19bb97467982@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "a088436b8be4f3b4016d7b9c7fef735df2892194", "tree": "36c37c989fa5d8db564dbb1fc62c925bbd0d0f56", "parents": [ "20b1aea46009b5540d79c9cdfd080fe94e8b8305" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Oct 24 19:48:43 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:38:46 2026 -0800" }, "message": "Input: cyapa - use 4-argument i2c_smbus_read_block_data()\n\nPass the transfer length to i2c_smbus_read_block_data() in\ncyapa_smbus_read_block(), accounting for the final chunk size.\n\nLink: https://patch.msgid.link/20261024-i2c-smbus-read-block-data-v1-3-19bb97467982@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "20b1aea46009b5540d79c9cdfd080fe94e8b8305", "tree": "ee283fbe438b178f00367ce207f542574adacaa0", "parents": [ "d5412d46212a93f1611c39d9a351c378c5b5942c" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Nov 03 14:58:43 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:28:09 2026 -0800" }, "message": "Input: stmfts - use touchscreen_report_pos() for coordinates\n\nDuring driver initialization, stmfts_probe() invokes\ntouchscreen_parse_properties() to parse axis inversion and swapping\nproperties into sdata-\u003eprop.\n\nHowever, stmfts_report_contact_event(), stmfts5_report_contact_event(),\nand stmfts_report_hover_event() continue to report coordinates directly\nusing input_report_abs(), ignoring any configured axis inversion or\nswapping settings in sdata-\u003eprop.\n\nUpdate coordinate reporting across all three functions to use\ntouchscreen_report_pos() with \u0026sdata-\u003eprop so that axis inversion and\nswapping transformations are properly applied.\n\nLink: https://patch.msgid.link/20261103225923.3892612-4-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "d5412d46212a93f1611c39d9a351c378c5b5942c", "tree": "161a90cdcebd59c8d15d09112049a5e290786939", "parents": [ "88ed9e44c25fcea40f6607b00b2c4194407b8028" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Nov 03 14:58:42 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:28:09 2026 -0800" }, "message": "Input: stmfts - validate slot ID in touch events\n\nBoth FTS4 and FTS5 contact and release reporting functions extract a\n4-bit slot/touch ID (values 0 to 15) from the event payload. However,\nthe driver initializes only STMFTS_MAX_FINGERS (10) multi-touch slots.\n\nPassing a slot ID greater than or equal to STMFTS_MAX_FINGERS to\ninput_mt_slot() is silently rejected by the input core without updating\nmt-\u003eslot, which causes subsequent slot state, coordinate, or release\nreports to corrupt or release the previously active slot.\n\nValidate that the slot ID is strictly less than STMFTS_MAX_FINGERS in\nstmfts_report_contact_event(), stmfts_report_contact_release(),\nstmfts5_report_contact_event(), and stmfts5_report_contact_release(),\nlogging a warning and returning early when an invalid slot ID is\nencountered.\n\nLink: https://patch.msgid.link/20261103225923.3892612-3-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "88ed9e44c25fcea40f6607b00b2c4194407b8028", "tree": "632e4e461fdee288354f9d158017d953799af03c", "parents": [ "68b2277b866ad856ebfcaa25c42a2241a6ebf29e" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Nov 03 14:58:41 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:28:09 2026 -0800" }, "message": "Input: stmfts - do not abort event parsing on non-touch events\n\nWhen processing hardware interrupts, stmfts_read_events() reads a batch\nof up to 32 events from the controller FIFO into the buffer. Only\nSTMFTS_EV_NO_EVENT (0x00) marks the end of valid events in this buffer.\n\nCurrently, both stmfts_parse_events() and stmfts5_parse_events() abort\nthe event parsing loop early upon encountering non-touch events such as\ncontroller-ready, status, user-report, or debug events. This causes any\nsubsequent touch events that were already read from the FIFO in the same\nbatch to be discarded.\n\nUpdate both event parsing loops so only STMFTS_EV_NO_EVENT terminates\nprocessing, while non-touch events complete cmd_done when applicable and\ncontinue processing the remaining entries in the FIFO buffer.\n\nLink: https://patch.msgid.link/20261103225923.3892612-2-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "68b2277b866ad856ebfcaa25c42a2241a6ebf29e", "tree": "cb5ae74095b87a124817bc3c7e326a8a7ea5bbc1", "parents": [ "911812b3a007c5f26e2c67d0977878474d5ba6de" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 02 20:47:07 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:27:25 2026 -0800" }, "message": "Input: apple_z2 - set default resolution before parsing properties\n\napple_z2_probe() currently sets the default 100 units/mm resolution on\nABS_MT_POSITION_X and ABS_MT_POSITION_Y after calling\ntouchscreen_parse_properties(). This unconditionally overwrites any axis\nresolution calculated by touchscreen_parse_properties() from\ntouchscreen-x-mm and touchscreen-y-mm device properties.\n\nSet the default resolution before calling touchscreen_parse_properties()\nso the default resolution remains in place when physical dimensions are\nomitted, while allowing touchscreen-x-mm and touchscreen-y-mm to\noverride it when present.\n\nLink: https://patch.msgid.link/20261103044708.2461481-5-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "911812b3a007c5f26e2c67d0977878474d5ba6de", "tree": "001b6880aa5658b5e5f02e0c36b39a15a94101d8", "parents": [ "ef88fc7be68a3890c76a67fcf361d934a84ceacb" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 02 20:47:06 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:27:25 2026 -0800" }, "message": "Input: goodix-berlin - set default resolution before parsing properties\n\ngoodix_berlin_input_dev_config() currently configures the default\n10 units/mm resolution on ABS_MT_POSITION_X and ABS_MT_POSITION_Y after\ncalling touchscreen_parse_properties(). This unconditionally overwrites\nany axis resolution calculated by touchscreen_parse_properties() from\ntouchscreen-x-mm and touchscreen-y-mm device properties.\n\nSet the default resolution before calling touchscreen_parse_properties()\nso the default resolution remains in place when physical dimensions are\nnot specified, while allowing touchscreen-x-mm and touchscreen-y-mm to\noverride it when present.\n\nReviewed-by: Neil Armstrong \u003cneil.armstrong@linaro.org\u003e\nLink: https://patch.msgid.link/20261103044708.2461481-4-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "ef88fc7be68a3890c76a67fcf361d934a84ceacb", "tree": "32351032e7b8863aac53ad01f9c041490bab0dd8", "parents": [ "d818ff483497f4fd2a5fad95c712e5b27baa1187" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 02 20:47:05 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:27:25 2026 -0800" }, "message": "Input: wacom_w9000 - rely on touchscreen_parse_properties() for resolution\n\nThe input core\u0027s touchscreen_parse_properties() helper now parses the\ntouchscreen-x-mm and touchscreen-y-mm properties and calculates axis\nresolution in units per millimeter automatically, including handling\naxis swapping.\n\nRely on touchscreen_parse_properties() to configure axis resolutions and\nremove the manual property parsing and resolution assignment block in\nwacom_w9000_probe(), along with the now-unused local variable.\n\nLink: https://patch.msgid.link/20261103044708.2461481-3-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "d818ff483497f4fd2a5fad95c712e5b27baa1187", "tree": "3873f1d121e6d081ee3692271d10b1a5b6b8e000", "parents": [ "751d4ead161b738dcf7ec5f67355c19be99bc912" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 02 20:47:04 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:27:25 2026 -0800" }, "message": "Input: touchscreen - parse touchscreen-x-mm and touchscreen-y-mm\n\nThe touchscreen device tree bindings define common touchscreen-x-mm and\ntouchscreen-y-mm properties specifying the physical dimensions of the\ntouchscreen in millimeters. However, touchscreen_parse_properties() does\nnot parse these properties, forcing individual drivers to parse them\nmanually or fall back to arbitrary resolution values.\n\nParse touchscreen-x-mm and touchscreen-y-mm in\ntouchscreen_parse_properties() and calculate axis resolution in units\nper millimeter as the coordinate count (maximum - minimum + 1) divided\nby the physical dimension, rounded to the nearest integer. Guard against\nzero physical size or invalid axis ranges, and preserve pre-existing\nresolution settings when the properties are omitted. Apply resolution\nbefore early exit so callers passing a NULL properties pointer still\nget axes configured and so coordinate inversion and axis swapping\ncontinue to work seamlessly. Also add KUnit test coverage for resolution\ncalculation.\n\nLink: https://patch.msgid.link/20261103044708.2461481-2-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "751d4ead161b738dcf7ec5f67355c19be99bc912", "tree": "614410eb2bbbbbee2e52c73a1918d07eb2971abd", "parents": [ "2c52e8d3faefb4d472f7b84dbe51d37908ad4b66" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Nov 08 23:29:50 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:19:12 2026 -0800" }, "message": "Input: lm8333 - remove driver\n\nThe LM8333 keypad driver relies exclusively on legacy platform data,\nhas no Device Tree or generic device property support, and has no\nusers in mainline. The BSP board file it was originally written for\nwas never upstreamed, and the original author Wolfram Sang confirmed\nin the mailing list discussion that it will likely never be converted\nto Device Tree and agreed to dropping it.\n\nRemove the driver and its platform data header.\n\nLink: https://lore.kernel.org/r/Zr6I9RB5mibU_12N@google.com\nLink: https://lore.kernel.org/r/Zr6PnlsdoyLoX261@shikoro\nAcked-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nReviewed-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20261109072950.3474308-3-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "2c52e8d3faefb4d472f7b84dbe51d37908ad4b66", "tree": "92ef93c48ea71b7c7a905964445d5eb6b5a55e1e", "parents": [ "3359accece98cf1193e338294a6d7f9ff2988bca" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Nov 08 23:29:49 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:18:34 2026 -0800" }, "message": "Input: lm8323 - remove driver\n\nThe LM8323 keypad driver relies exclusively on legacy platform data,\nhas no Device Tree or generic device property support, and has no users\nin mainline (including the Nokia N810 DTS, which never added support\nfor it). Its PWM/LED handling and unbind lifetime are broken, and after\nhardware-tested IRQ fixes in 2011 the driver has for over a decade only\nreceived mechanical API conversions and static-analysis cleanups\nwithout hardware testing.\n\nAn inquiry on the mailing list asking whether anyone still uses or\nwishes to keep the driver received no objections. Remove the driver\nand its platform data header.\n\nLink: https://lore.kernel.org/r/Zr6I9RB5mibU_12N@google.com\nReviewed-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20261109072950.3474308-2-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "3359accece98cf1193e338294a6d7f9ff2988bca", "tree": "6c0ec84f00a230751d2de6280fc126db6083142d", "parents": [ "67865a5f30d7ac453e3fecd2894f189c4aec025c" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Oct 17 23:12:10 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 18:11:00 2026 -0800" }, "message": "Input: da9055_onkey - switch to using managed resources\n\nSwitch the driver to use devm_input_allocate_device(),\ndevm_delayed_work_autocancel(), and devm_request_threaded_irq() to\nsimplify error handling in probe and drop the remove() callback (which\nalso had a leftover broken regmap_irq_get_virq() call on an already\nmapped virtual IRQ). Also use input_set_capability() to advertise\nKEY_POWER support and drop unneeded error messages.\n\nReported-by: Myeonghun Pak \u003cmhun512@gmail.com\u003e\nLink: https://patch.msgid.link/atRjCWI0PXs840rl@google.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "67865a5f30d7ac453e3fecd2894f189c4aec025c", "tree": "1a8c24d4fe7e9736268893f4cfdbef240f3a5e92", "parents": [ "0619ca4a13e35a3f8b84cb79ea689e3dd8862ac9", "7475ea8b58616b33c04afb976cf0fbaad9dd63fb" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 17:42:58 2026 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 17:42:58 2026 -0800" }, "message": "Merge tag \u0027v7.4-rc2\u0027 into next\n\nSync up with mainline to being in I2C API changes and other updates.\n" }, { "commit": "0619ca4a13e35a3f8b84cb79ea689e3dd8862ac9", "tree": "6091a67eb16d6ab9de76a759f3e18058c70d34c4", "parents": [ "857894b1a89345c6d99b197ff00d34be1556bc3c" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:07:44 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 17:25:48 2026 -0800" }, "message": "Input: wacom_w8001 - use ACQUIRE() for interruptible mutex in w8001_open()\n\nSwitch from scoped_guard(mutex_intr, ...) with an error fallback of\n-EINTR to ACQUIRE(mutex_intr, lock) and ACQUIRE_ERR(mutex_intr, \u0026lock).\nThis flattens the function logic and propagates the exact return value\nfrom mutex_lock_interruptible().\n\nAssisted-by: LLM\nReviewed-by: Jason Gerecke \u003cjason.gerecke@wacom.com\u003e\nLink: https://patch.msgid.link/20261009190746.803607-3-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "857894b1a89345c6d99b197ff00d34be1556bc3c", "tree": "f0a46c29ce125a12b00505f4dcc63df5f6887f27", "parents": [ "9692577eccf565f48450711df8b15c0354c1d537" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:07:43 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 17:25:48 2026 -0800" }, "message": "Input: wacom_w8001 - assign distinct phys paths to pen and touch devices\n\nPreviously, both pen and touch input devices used the same phys path\n\"%s/input0\", which made it impossible for userspace or udev rules to\ndistinguish the devices by physical topology.\n\nAssign distinct phys paths by introducing separate buffers pen_phys\n(\"%s/input0\") and touch_phys (\"%s/input1\") in struct w8001. Pass the\ncorresponding phys path to w8001_allocate_device() during pen and touch\nsetup, and drop the shared phys buffer from struct w8001.\n\nFixes: e0361b70175f (\"Input: wacom_w8001 - split the touch and pen devices into two devices\")\nAssisted-by: LLM\nLink: https://patch.msgid.link/20261009190746.803607-2-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "9692577eccf565f48450711df8b15c0354c1d537", "tree": "13fba9a378a6092452628bab92b09f483d5564ea", "parents": [ "13555bf4a31f3246131eebf2bdb6a8dc39786fb8" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:07:42 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 17:25:48 2026 -0800" }, "message": "Input: wacom_w8001 - fix teardown order and device lifetime\n\nIn w8001_disconnect(), serio_close() was called before unregistering\nthe input devices. When input_unregister_device() calls w8001_close()\nto shut down the hardware, w8001_command() fails because the serio\nport is already closed, preventing W8001_CMD_STOP from reaching the\ncontroller.\n\nAdditionally, w8001_connect() pre-allocated both pen_dev and touch_dev\nupfront before serio_open() so w8001_interrupt() could dereference\nthem unconditionally, and then freed unused input devices mid-probe\nwithout synchronizing with w8001_interrupt() when pen or touch was\nabsent. That created a race and use-after-free hazard with\nw8001_interrupt(), as well as a double-free on the fail4 error path.\n\nFix these issues by guarding event reporting in w8001_interrupt()\nagainst NULL device pointers, allocating and registering input devices\non demand after querying capabilities, synchronizing device pointer\npublication and teardown with serio_pause_rx, and unregistering input\ndevices before closing the serio port in both disconnect and probe\nerror unwind paths.\n\nFixes: 66fd9385ee9c (\"Input: wacom_w8001 - simplify w8001_remove\")\nFixes: e0361b70175f (\"Input: wacom_w8001 - split the touch and pen devices into two devices\")\nReported-by: sashiko-bot@kernel.org\nAssisted-by: LLM\nLink: https://patch.msgid.link/20261009190746.803607-1-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "13555bf4a31f3246131eebf2bdb6a8dc39786fb8", "tree": "2aebd9bf9ce254dca63cdfeb4ef304e854ea9d7a", "parents": [ "7cd4263215f93911b2a932702a2b59703b768278" ], "author": { "name": "Tristan Madani", "email": "tristan@talencesecurity.com", "time": "Thu Oct 29 00:22:27 2026 +0000" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 00:25:34 2026 -0800" }, "message": "Input: applespi - validate ACPI property buffer length\n\napplespi_get_spi_settings() reads three ACPI _DSD properties\n(spiCSDelay, resetA2RUsec, resetRecUsec) as u64 values from their\nbuffer pointers without verifying that the buffer is at least 8\nbytes long. If a firmware implementation provides a shorter buffer,\nthe u64 dereference reads beyond the allocated object.\n\nAdd buffer length checks before each u64 dereference.\n\nFixes: 038b1a05eae6 (\"Input: add Apple SPI keyboard and trackpad driver\")\nSigned-off-by: Tristan Madani \u003ctristan@talencesecurity.com\u003e\nLink: https://patch.msgid.link/20261029002227.2002174-1-tristmd@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "7cd4263215f93911b2a932702a2b59703b768278", "tree": "c3b7d89c17113b360b037ab822387be5ebacd07d", "parents": [ "50243f01061072369d5af457da5a0ae8a3051560" ], "author": { "name": "Guanglei Zhu", "email": "zhugl3@xiaopeng.com", "time": "Wed Nov 04 11:07:08 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 00:18:45 2026 -0800" }, "message": "Input: joydev - avoid an undefined shift in the legacy 0x read\n\nThe legacy 0.x read path shifts the axis values by the calibration\nconstants that JS_SET_CAL installs:\n\n data.x \u003d (joydev-\u003eabs[0] / 256 + 128) \u003e\u003e joydev-\u003eglue.JS_CORR.x;\n data.y \u003d (joydev-\u003eabs[1] / 256 + 128) \u003e\u003e joydev-\u003eglue.JS_CORR.y;\n\nJS_CORR is copied straight from userspace as three s32 values and\nnever validated, so the shift count can be negative or wider than\nthe type, which is undefined behavior: the shift compiles to\nwhatever the architecture does with an out-of-range count, and the\ncompiler is free to assume it cannot happen.\n\nClamp the shift count to the width of the shifted value.\n\nSigned-off-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261104030708.791730-1-zhugl3@xiaopeng.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "50243f01061072369d5af457da5a0ae8a3051560", "tree": "aae904e38dad17b0353c60a64089eaf476d3b641", "parents": [ "6c67a1f896608e6650e13fb273c02695b5e49c98" ], "author": { "name": "Guanglei Zhu", "email": "zhugl3@xiaopeng.com", "time": "Thu Nov 05 10:13:03 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 00:11:55 2026 -0800" }, "message": "Input: tegra-kbc - check the pin numbers from the device tree\n\nThe row and column pin lists are read straight from the device tree\nand used to index the pin configuration array:\n\n\tfor (i \u003d 0; i \u003c num_rows; i++) {\n\t\tkbc-\u003epin_cfg[rows_cfg[i]].type \u003d PIN_CFG_ROW;\n\t\tkbc-\u003epin_cfg[rows_cfg[i]].num \u003d i;\n\t}\n\nThe helper only limits how many entries it reads, not what they\ncontain. Not all Tegra variants have KBC_MAX_GPIO pins - Tegra114,\nfor example, has 11 rows + 8 columns \u003d 19 - and the setup loop only\ninitializes pin_cfg[] up to kbc-\u003enum_rows_and_columns, so a device\ntree that names a pin the variant does not have makes the row and\ncolumn stores write over pin_cfg entries that were never touched,\nand the later check_pin_cfg() walk reads that stale data back as\nvalid configuration.\n\nReject pin numbers the variant does not have.\n\nFixes: 88390243a993 (\"Input: tegra-kbc - add support for rows/columns configuration from dt\")\nSigned-off-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261105021303.4206-1-zhugl3@xiaopeng.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "6c67a1f896608e6650e13fb273c02695b5e49c98", "tree": "aa4d7b27854d7cc816b004f2aa040aa3fd94a77b", "parents": [ "e87fe056ed791df86d4975c297496519c110678e" ], "author": { "name": "Guanglei Zhu", "email": "zhugl3@xiaopeng.com", "time": "Fri Nov 06 09:49:28 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Nov 09 00:06:31 2026 -0800" }, "message": "Input: lpc32xx-keys - reject matrices bigger than the hardware has\n\nThe scanner state array holds the last state of eight matrix\ncolumns, and the interrupt handler walks the matrix size that the\ndevice tree declared:\n\n\tu8 lastkeystates[8];\n\t...\n\tfor (i \u003d 0; i \u003c kscandat-\u003ematrix_sz; i++)\n\t\tlpc32xx_mod_states(kscandat, i);\n\nThe probe path only checks that rows and columns match; the\nhardware supports square matrices from 1x1 up to 8x8, but nothing\nstops a device tree from declaring more, which makes the state\narray index run past the field into the rest of the driver data -\nincluding the keymap pointer the same code dereferences.\n\nReject matrices larger than the hardware supports.\n\nFixes: 69690bec400e (\"Input: add support for key scan interface of the LPC32xx SoC\")\nSigned-off-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261106014928.328020-1-zhugl3@xiaopeng.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "e87fe056ed791df86d4975c297496519c110678e", "tree": "0e8dc77832548ef1a5199185a62d74a0d6311a65", "parents": [ "d4deebff919d9e08eafca58dc9225ad0449fc1fc" ], "author": { "name": "Andreas Kemnade", "email": "andreas@kemnade.info", "time": "Sat Nov 07 11:48:07 2026 +0100" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Nov 08 23:03:58 2026 -0800" }, "message": "Input: gpio-keys - do not BUG() on requested wakeirqs\n\nHaving the IRQ handler called when enabled IRQs arrive should be considered\nas a feature not as a bug. So do not BUG() there when this happens.\nAlso BUG() is too harsh here.\n\nFixes: 3717194f24922 (\"Input: gpio-keys - add system suspend support for dedicated wakeirqs\")\nSigned-off-by: Andreas Kemnade \u003candreas@kemnade.info\u003e\nLink: https://patch.msgid.link/20261107104807.54410-1-andreas@kemnade.info\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "7475ea8b58616b33c04afb976cf0fbaad9dd63fb", "tree": "cccce5fea5fe43ed1a45832ff28f5d74468369dc", "parents": [ "e0d8e8de8bcb1ef7b749033b5af5518ba8df7bec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 16:22:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 16:22:20 2026 -0800" }, "message": "Linux 7.4-rc2\n" }, { "commit": "e0d8e8de8bcb1ef7b749033b5af5518ba8df7bec", "tree": "28b34217252fea6ee2d86bbbc3b7b6002d69ed76", "parents": [ "8a65162514fbad21a2c58ffed65f42b27e92b163", "4dd10fbbeb9c33709edc89916e19c03c780a0751" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 14:55:54 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 14:55:54 2026 -0800" }, "message": "Merge tag \u0027devm_kmalloc_obj-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull devm_kmalloc_obj conversion from Kees Cook:\n\n - treewide refresh of kmalloc_obj() conversions\n\n - devm_kmalloc_obj conversion rules added to Coccinelle scripting\n\n - treewide conversion of devm_kmalloc() family to devm_kmalloc_obj()\n\n* tag \u0027devm_kmalloc_obj-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family\n coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules\n treewide: refresh kmalloc_obj() conversions\n" }, { "commit": "8a65162514fbad21a2c58ffed65f42b27e92b163", "tree": "fa9166d182d4082ba801d3e4a80b68240fa313d4", "parents": [ "e6f836ef7865fb454641febe080cf88a3c677186", "a42ae51fe3c36cef82dc687ea594ca232a785fd4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 12:14:14 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 12:14:14 2026 -0800" }, "message": "Merge tag \u0027driver-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Fix an unused-function warning in the Rust I/O code that breaks\n builds with CONFIG_PCI disabled and CONFIG_WERROR enabled\n\n - Fix kernfs sparse warnings on SMP Alpha when inheriting a parent\n node\u0027s group ID\n\n - Add Johan Hovold as an auxiliary bus maintainer\n\n* tag \u0027driver-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n MAINTAINERS: update auxiliary bus entry\n kernfs: avoid READ_ONCE() on a kgid_t in kernfs_new_node()\n rust: io: fix unused Flags::from_raw warning without CONFIG_PCI\n" }, { "commit": "e6f836ef7865fb454641febe080cf88a3c677186", "tree": "3cf764e0f059fff6c509534478df4935725b8329", "parents": [ "25fccf436e6e978954bb2774170d1094889c3fc7", "a4845f077415ef32fe672c841e2fc58ae9e28273" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:59:25 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:59:25 2026 -0800" }, "message": "Merge tag \u0027ata-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Allow re-enabling NCQ, after EH disabled it, by writing the current\n queue depth to the queue_depth sysfs attribute (Igor)\n\n - Retry failed non-NCQ commands when their sense data asks for a\n retry, as is already done for NCQ commands. Previously, such\n non-NCQ commands were never retried (me)\n\n - Only check the power mode of ATA and ZAC devices before putting\n them in standby mode (on suspend, shutdown or device removal).\n libata never puts other devices, such as ATAPI devices, in standby\n mode, and some ATAPI devices reject the CHECK POWER MODE command\n (Giuseppe)\n\n - Fix several bugs in the MODE SELECT translation.\n\n Reject parameter lists with data after the mode page before the\n mode page is handled. Previously, a rejected command could leave\n the CDL enabled state tracked by libata out of sync with the\n device, and data after the control mode page was silently ignored.\n\n Reject mode pages with SUBPAGE CODE FFh, and mode pages with the\n SPF bit set but SUBPAGE CODE 00h, which were incorrectly accepted.\n\n The commit that passes the whole mode page to the MODE SELECT\n handlers might look like a cleanup, but it is a fix, and thus has\n a Fixes tag: the FIELD POINTER pointed 2 bytes (page_0 format) or\n 4 bytes (sub_page format) before the invalid byte in the mode page\n (me, Shao)\n\n - Disable the enclosure management (SEMB) port of the Marvell\n 88SM9705 port multiplier. The port never answers SRST, and the\n resulting EH retries delayed disk discovery by minutes (Marco)\n\n - Reject data-in commands, e.g. INQUIRY, submitted via SG_IO with a\n data-out buffer, whose pages may be pinned without write access.\n Writing a reply to such a buffer could oops the kernel (Zhao)\n\n* tag \u0027ata-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-scsi: reject data-in commands with a data-out buffer\n ata: libata-pmp: disable the SEMB port on Marvell 88SM9705\n ata: libata-scsi: set the field pointer when rejecting CDL\n ata: libata-scsi: pass the whole mode page to the MODE SELECT handlers\n ata: libata-scsi: fix MODE SELECT field pointer for block descriptor length\n ata: libata-scsi: fix MODE SELECT field pointer for unsupported subpages\n ata: libata-scsi: reject MODE SELECT mode pages with a wrong SPF bit\n ata: libata-scsi: do not accept subpage code FFh in MODE SELECT\n ata: libata-scsi: fix MODE SELECT handling of data after the mode page\n ata: libata-core: Check device support before querying power state\n ata: libata-eh: Retry non-NCQ commands when their sense data asks for it\n ata: libata-sata: allow re-enabling NCQ with the same queue_depth\n" }, { "commit": "25fccf436e6e978954bb2774170d1094889c3fc7", "tree": "5812f716ff395b99a7de2a7de803a1e61f2a4248", "parents": [ "2651f6deb3326129a052897df193052dc28ea94f", "4acd5f806bf5569bfa3a45ea6a525936197df10c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:54:44 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:54:44 2026 -0800" }, "message": "Merge tag \u0027firewire-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394\n\nPull firewire fix from Takashi Sakamoto:\n \"Fix a race in the 1394 OHCI driver, introduced in v7.4-rc1\n\n Queueing an AT local request in interrupt context can race with\n dequeueing requests in a workqueue without disabling interrupts,\n potentially leading to a deadlock\"\n\n* tag \u0027firewire-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:\n firewire: ohci: avoid potential deadlock when queueing AT local requests\n" }, { "commit": "2651f6deb3326129a052897df193052dc28ea94f", "tree": "151cf554fd60fb513c3cc9de634bca9fdb2dbbb7", "parents": [ "11b6438b9e9f30e2eead2f232a58ef3f71a206be", "456c965ca46c59a4a241c755e6565fd883a522f4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:36:45 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:36:45 2026 -0800" }, "message": "Merge tag \u0027mips-fixes_7.4_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux\n\nPull MIPS fixes from Thomas Bogendoerfer:\n \"Alchemy:\n - Fix /proc/interrups\n - Preserve ethernet address from PROM\n\n SGI:\n - IP27: Fix NMI dump\n - IP30: make defconfig more useful\n - IP32: added workarounds for crime revision 1.1\n\n Others:\n - Fix compressed kernel linked with ld.lld\n - Fix IDE ports on Cobalt devices\n - Reject wrong affinity settings on SB1250 platforms\"\n\n* tag \u0027mips-fixes_7.4_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:\n MIPS: SB1250: Validate and update IRQ affinity\n MIPS: Cobalt: Include legacy IDE ports in the PCI I/O window\n MIPS: sgi-ip32: Report the real CRIME revision\n MIPS: sgi-ip32: Leave MACE PCI control alone in config accesses\n MIPS: sgi-ip32: Mask MACE PCI interrupts in CRIME only\n MIPS: mm: Fix the cache error vector jump for XKPHYS kernels\n MIPS: Alchemy: Save the Ethernet address before reusing PROM memory\n MIPS: Alchemy: Register interrupt chips with the IRQ core\n MIPS: SGI-IP30: fix the defconfig defaults for the Bridge PROM and RTC\n MIPS: boot: compressed: fix the vmlinuz link with ld.lld\n MIPS: boot: compressed: place .rodata.* and discard .MIPS.abiflags\n MIPS: Avoid dead code/data elimination when using recordmcount\n MIPS: SGI-IP27: print the NMI dump on an nbcon console\n" }, { "commit": "11b6438b9e9f30e2eead2f232a58ef3f71a206be", "tree": "1b02298ca39941ae69468b300e884fe10637a598", "parents": [ "2ebb9de23bbd942b1a2431384e4a62908c31bb2a", "5cdc3746fa163fb4e8d05fa3cabf46bc6aa7df75" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 10:29:22 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 10:29:22 2026 -0800" }, "message": "Merge tag \u0027x86-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Select the BHI mitigation based on the attack vector properly\n (Breno Leitao)\n\n - Fix i386-gcov build bug in csum_ipv6_magic() due to overly\n strict asm constraints that cannot be met in that build mode\n (Rosen Penev)\n\n - Fix Vmware-guest i386 high-bandwidth hypercall arguments\n under UNWINDER_GUESS \u0026 disabled frame-pointers (Zack Rusin)\n\n - Fix resctrl AMD ABMC counter ID field width (Babu Moger)\n\n - Fix restctrl pqos tool ABI breakage by reverting the\n mbm_assign_mode to default mode at boot (Babu Moger)\n\n - Initialize wall clock in get_rtc_noop() (Naman Jain)\n\n - Fix ptrace historic ABI quirk regression (Thomas Gleixner)\n\n - Add Drew Fustini as resctrl reviewer and Ben Horgan\n as fs/resctrl reviewer\n\n - Clear SEV RMPOPT when segmented RMP is disabled by firmware but\n is advertised as available (Ashish Kalra)\n\n - Set up SEV RMPOPT only on an active SNP host (Ashish Kalra)\n\n - Don\u0027t emit KCFI_REFERENCE() in modules (Ridge Lomont)\n\n - Ignore negative NMI handler durations (Breno Leitao)\n\n - Fix off-by-one error in boot-time sme_clear_pgd() (Thorsten Blum)\n\n - Fix ASID allocation bug (Chris Mason)\n\n* tag \u0027x86-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mm: Fix global ASID handed out to two processes\n x86/boot: Fix off-by-one error in sme_clear_pgd()\n MAINTAINERS: Add Ben Horgan as fs/resctrl reviewer\n x86/nmi: Ignore negative NMI handler durations\n x86/kcfi: Don\u0027t emit KCFI_REFERENCE() in modules\n x86/sev: Set up RMPOPT only on an active SNP host\n x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware\n MAINTAINERS: resctrl: Add myself as reviewer\n x86/entry: Fix ptrace regression\n x86/init: Initialize wall clock in get_rtc_noop()\n x86,fs/resctrl: Keep mbm_assign_mode in default mode at boot\n x86/resctrl: Correct ABMC counter ID field width\n x86/vmware: Fix i386 high-bandwidth hypercall arguments\n x86/csum: Relax the len and proto constraints in 32-bit csum_ipv6_magic()\n x86/bugs: Select the BHI mitigation based on the attack vector properly\n" }, { "commit": "2ebb9de23bbd942b1a2431384e4a62908c31bb2a", "tree": "800945c1c5fe53e94828ccfa72af1c9bbfb15b8e", "parents": [ "40f3717a64edff0b91686e22208312114f7e2061", "006991aa89974378ee579416dba87adc22cd60fd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 09:01:08 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 09:01:08 2026 -0800" }, "message": "Merge tag \u0027sched-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix this_bw on class change of a dying SCHED_DEADLINE task\n (Nickolai Zeldovich)\n\n - Account I/O waits independently of delayed dequeue\n (Christian Loehle)\n\n - Clear throttle state when leaving the fair class (Daehyeon Ko)\n\n - Fix u32 truncation of the PELT period count (Hui Su)\n\n - Fix imbalanced cluster static-key updates that can mistakenly\n disable cluster-aware scheduling (Hui Su)\n\n - Fix active load balancing logic to ignore non-fair current\n in alb_break_llc() (Kayra Cizmeci)\n\n* tag \u0027sched-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/cache: Ignore non-fair current in alb_break_llc()\n sched/topology: Balance cluster static-key updates\n sched/pelt: Fix u32 truncation of the PELT period count\n sched/fair: Clear throttle state when leaving the fair class\n sched/core: Account I/O waits independently of delayed dequeue\n sched/deadline: Fix this_bw on class change of a dying task\n" }, { "commit": "40f3717a64edff0b91686e22208312114f7e2061", "tree": "481335b0b41a185ee1b7ede583e9d09d4f090662", "parents": [ "d1829ebf4ad888f1b73afee0f1d6e41734ca328a", "6f083fbccd5f06889bc08e1182bd02c0383b9121" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:54:01 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:54:01 2026 -0800" }, "message": "Merge tag \u0027perf-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix sideband event output when only requesting attr.defer_output\n (Ian Rogers)\n\n - Clamp deferred callchain entry count to fit u16 header.size\n (Ian Rogers)\n\n - Various AMD IBS fixes (Ravi Bangoria):\n - Reset CPU0 IBS state on syscore resume\n - Fix kernel address leak via REGS_USER and REGS_INTR\n - Simplify/fix event state handling with IBS_CAPS_DIS\n\n - Revert AUX page allocation order default to be continuous (Leo Yan)\n\n - Don\u0027t send SIGTRAP after exec removed the event (Danish Khateeb)\n\n* tag \u0027perf-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Don\u0027t send SIGTRAP after exec removed the event\n Revert \"perf/aux: Allocate non-contiguous AUX pages by default\"\n perf/amd/ibs: Simplify event state handling with IBS_CAPS_DIS\n perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR\n perf/amd/ibs: Reset CPU0 IBS state on syscore resume\n perf/core: Clamp deferred callchain entry count to fit u16 header.size\n perf/core: Include perf_event_attr::defer_output in is_sb_event() check\n" }, { "commit": "d1829ebf4ad888f1b73afee0f1d6e41734ca328a", "tree": "dd009a1b110f5caf7df0b7c6aff0ade7191bafa5", "parents": [ "bef911b8064db38d32ccfed7f05ac639978180d6", "408b129aac48b574c0c9d11137a89eefba825d5d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:52:09 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:52:09 2026 -0800" }, "message": "Merge tag \u0027locking-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Fix lockdep message output (Zhuangzhuang Wang)\n\n - Fix OSQ memory ordering bugs, one of which can cause\n unlink queue corruption (Peter Zijlstra)\n\n* tag \u0027locking-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/osq: Fix unlink queue corruption\n locking/osq: Switch osq_wait_next()/atomic_cmpxchg() ordering\n locking/lockdep: Fix inverted \"on\"/\"last\" CPU label in lockdep_print_held_locks()\n" }, { "commit": "bef911b8064db38d32ccfed7f05ac639978180d6", "tree": "43a83efed692a1e9f8d2763950bd1b995b1c17ec", "parents": [ "fa4ad798f6f681031775266044ba1b0cf3c670bd", "57d916a3eb765ee0577d269bb2ac1bdf3a7a7f40" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:49:58 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:49:58 2026 -0800" }, "message": "Merge tag \u0027rust-fixes-7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull Rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Fix build error with bindgen 0.73 in certain configs such as\n allmodconfig by deriving \u0027Zeroable\u0027 for opaque array wrappers.\n\n \u0027kernel\u0027 crate:\n\n - \u0027cpufreq\u0027 module: clean \u0027undocumented_unsafe_blocks\u0027 Clippy warning\n for Rust \u003c\u003d 1.86\"\n\n* tag \u0027rust-fixes-7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: bindings: derive Zeroable for bindgen\u0027s opaque array wrappers\n rust: cpufreq: fix `undocumented_unsafe_blocks` in `PolicyCpu::from_cpu()`\n" }, { "commit": "d4deebff919d9e08eafca58dc9225ad0449fc1fc", "tree": "f6b521e443cbc2f49229c9b2ba0647b36fdbad94", "parents": [ "3eff68f5da5eebed23c91a8e829c901863a65a3c" ], "author": { "name": "Thorsten Blum", "email": "blum@kernel.org", "time": "Sun Nov 08 01:49:52 2026 +0100" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Nov 07 20:25:23 2026 -0800" }, "message": "Input: amijoy - fix memory region leak on registration failure\n\nIf input_register_device() fails in amijoy_init(), release the memory\nregion for the current port before cleaning up the previously registered\nports.\n\nConsolidate the error paths while at it.\n\nFixes: 127278ce2254 (\"Input: joysticks - handle errors when registering input devices\")\nSigned-off-by: Thorsten Blum \u003cblum@kernel.org\u003e\nLink: https://patch.msgid.link/20261108004952.394691-3-blum@kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "3eff68f5da5eebed23c91a8e829c901863a65a3c", "tree": "09c412124f764f2698f33420cb9f893904e45ca1", "parents": [ "fc90c18c4bb6f57a6cb90634ee65c592f900abc4" ], "author": { "name": "Thorsten Blum", "email": "blum@kernel.org", "time": "Sun Nov 08 00:43:47 2026 +0100" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Nov 07 20:25:16 2026 -0800" }, "message": "Input: amijoy - remove amijoy_phys\n\namijoy_phys has only two entries and is only used by amijoy_init().\nSelect the physical path directly and remove the array.\n\nSigned-off-by: Thorsten Blum \u003cblum@kernel.org\u003e\nLink: https://patch.msgid.link/20261107234349.382944-3-blum@kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "fa4ad798f6f681031775266044ba1b0cf3c670bd", "tree": "5f20e6a3e5fbc24910a4a46ac7ba846a151fce9f", "parents": [ "7f75cd8ccd9588e969158c5dc92a8cc217663f5b", "8c66a6aa59a5df1d672d72b7cd379d897ff73200" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:52:02 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:52:02 2026 -0800" }, "message": "Merge tag \u0027for-7.4-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"A btrfs fixes. The ones that could have some user noticeable impact\n are enumerated, the rest is one-liners.\n\n - fix chattr failing on files with nodatasum and compress flags\n\n - fix inode defrag status with concurrent truncation so it\u0027s not\n skipped in defrag in the future\n\n - fix merging compressed extent in fiemap output\n\n - fix deleting wrong subvolume by id if it gets renamed during the\n ioctl\n\n - error handling fixes: sysfs, quotas, fs-verity, scrub, zoned mode\"\n\n* tag \u0027for-7.4-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: zoned: fix double free of bitmaps on clone failure\n btrfs: prevent deleting the wrong subvolume by ID\n btrfs: scrub: fix race between scrub and scrub progress ioctl\n btrfs: scrub: fix race leading to use-after-free in the scrub progress ioctl\n btrfs: scrub: fix lost wakeup and hang when cancelling a scrub that is finishing\n btrfs: scrub: fix lost error return value when scrubbing raid56 parity stripe\n btrfs: fix fiemap merging compressed extents\n btrfs: fix the fsverity callback where unexpected range is verified\n btrfs: verity: propagate orphan insertion errors when enabling verity\n btrfs: sysfs: restore NOFS context on early return in btrfs_sysfs_add_block_group_type()\n btrfs: defrag: prevent inode truncated to zero from not being defragged again\n btrfs: cleanup dirty_cowonly_roots during btrfs_free_fs_roots()\n btrfs: cleanup qgroup swapped blocks at root release\n btrfs: always remove quota_root from dirty_cowonly_roots\n btrfs: unwind device add when sysfs registration fails\n btrfs: fix chattr failing on nodatasum files that have the compress flag\n" }, { "commit": "7f75cd8ccd9588e969158c5dc92a8cc217663f5b", "tree": "b0fb74033001a90c1980776cfb802de8796855a6", "parents": [ "12419f306c3ca34a38064d2b502966fa01650b49", "e49296d51ccbf2ad0ed0484db1382f1d7217bd6e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:44:05 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:44:05 2026 -0800" }, "message": "Merge tag \u0027ksmbd-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server updates from Namjae Jeon:\n\n - Validate EA-name NUL termination to prevent out-of-bounds reads in\n debug logging. Return STATUS_EA_LIST_INCONSISTENT for malformed EA\n names in CREATE and SET_INFO requests.\n\n - Grant the owner\u0027s implicit READ_CONTROL and WRITE_DAC rights when no\n ACE names it, including MAXIMUM_ALLOWED handling, while respecting\n applicable OWNER RIGHTS ACEs.\n\n - Check group membership before granting permissions from a POSIX ACL\n group entry, preventing unintended access when a caller\u0027s UID matches\n the group\u0027s numeric GID.\n\n - Avoid reading past the DACL when logging an access denial by printing\n the requested and allowed access masks instead.\n\n - Handle unauthenticated sessions in procfs reporting without\n dereferencing a NULL session-\u003euser.\n\n - Fix credential cleanup on attribute lookup failures during durable\n handle reconnect or request replay, preventing subsequent requests\n from running with another user\u0027s credentials.\n\n - Fix read-only share handling for named stream creation, including\n AFP_AfpInfo synthesis on Time Machine shares.\n\n - Validate DELETE access for FILE_DELETE_ON_CLOSE opens, including\n MAXIMUM_ALLOWED handling, to prevent unauthorized deletion or\n delete-pending states.\n\n* tag \u0027ksmbd-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:\n ksmbd: require NUL-terminated EA names\n ksmbd: let the owner read and change the DACL when no ACE names it\n ksmbd: grant a POSIX ACL group entry only to the group\u0027s members\n ksmbd: do not read past the DACL in the access denied debug message\n ksmbd: fix NULL pointer dereference in session_user_name() and session_account_type()\n ksmbd: revert fsids on durable reconnect and replay failure\n ksmbd: enforce the read-only share flag when creating a stream\n ksmbd: require DELETE access for delete-on-close opens\n" }, { "commit": "12419f306c3ca34a38064d2b502966fa01650b49", "tree": "29a1daca56423eeb77be5a8682e7a4664c39b274", "parents": [ "a41e364995bbcfa627418a70fe913c35b7510728", "c77ab4eeeb3ed471bcc99a94673f0e0142c4b84a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:35:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:35:13 2026 -0800" }, "message": "Merge tag \u0027ntfs-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - Don\u0027t allow compression to be enabled through system.ntfs_attrib on\n volumes with clusters larger than 4 KiB, preventing out-of-bounds\n accesses in the compressed read path.\n\n - Don\u0027t allow resident attribute values to overlap the attribute\n header, preventing malformed records from causing writes outside the\n MFT record buffer.\n\n - Fix recursive acquisition of the mapping invalidate lock when writing\n to non-resident named streams through NTFS_IOC_STREAM_WRITE.\n\n - Keep the file size unchanged when extending the initialized size\n fails, avoiding unintended truncation and page-cache removal.\n\n - Avoid integer overflow when limiting attribute reads to the attribute\n size.\n\n - Initialize the promoted index entry\u0027s child VCN before inserting it\n into the parent during an index split.\n\n - Validate index entry VCNs and return an error for negative attribute\n read positions before they reach pointer arithmetic.\n\n - Fix cleanup after ACL initialization fails in __ntfs_create(),\n avoiding an erroneous free of $MFT, unmapping an unmapped record, and\n unlocking mutexes that were never held.\n\n* tag \u0027ntfs-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: don\u0027t allow compression on volumes with clusters larger than 4K\n ntfs: don\u0027t allow resident values to overlap the attribute header\n ntfs: fix a self-deadlock on writes to non-resident named streams\n ntfs: keep the file size on a failed initialized-size extension\n ntfs: avoid overflow when limiting attribute read length\n ntfs: initialize VCN when inserting index entries\n ntfs: reject negative attribute read positions\n ntfs: Fix error handling in __ntfs_create()\n" }, { "commit": "a41e364995bbcfa627418a70fe913c35b7510728", "tree": "ad641ad6f60e12195aa56c58067e581839f07509", "parents": [ "c1c70a8431be6df4ada55ed4930ea9bac9baab48", "ca14cc05808f9c0115c38bec53573bf93e030435" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 12:21:33 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 12:21:33 2026 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Mostly fixes in drivers.\n\n The three core changes are moving the target reap into the main exit\n path of pseudo device allocation to fix a leak and a couple of minor\n error propagation updates in bsg.\n\n The largest driver fix is the rethreading of Buslogic to enable\n context locking that was held back from the merge window pull due to\n problems spotted by the maintainer\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store\n scsi: target: Verify the iSCSI ISID is null-terminated\n scsi: bsg: Report io_uring data copyback failures\n scsi: bsg: Report synchronous data copyback failures\n scsi: target: Validate REGISTER AND MOVE TransportID length\n scsi: mpt3sas: Register devices during SANITIZE\n scsi: libsas: Add __printf attribute to sas_ata_printk()\n scsi: target: Fix demo-mode dynamic ACL dev-entry UAF vs LUN teardown\n scsi: aha1542: Remove unneeded scsi_dma_unmap() call\n scsi: BusLogic: Prepare for enabling lock context analysis\n scsi: BusLogic: Pass the host pointer directly to several functions\n scsi: ufs: core: Change the error check sequence for auto hibern8\n scsi: core: Balance the pseudo target reap reference\n scsi: scsi_debug: Drain target cleanup before module exit\n scsi: aic79xx: Fix NULL pointer dereference in device reset\n scsi: aic7xxx: Use default settings on the SGI O2 onboard controllers\n scsi: aic7xxx: Fix REQUEST SENSE allocation length on big-endian hosts\n" }, { "commit": "c1c70a8431be6df4ada55ed4930ea9bac9baab48", "tree": "db08272b29a1ea6047adda1361fbc14a45e7a045", "parents": [ "91fd3a15265f095a9632d8f9d9732b37363ed121", "059518f775baecc9803fc97787bd0b17558f8047" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:53:43 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:53:43 2026 -0800" }, "message": "Merge tag \u0027spi-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"As well as a few driver specific fixes we have a couple of core fixes\n here.\n\n One avoids requesting interrupts until we have validated that we have\n a SPI device, avoiding triggering warnings on boot.\n\n The other avoids a request for a zero length scatterlist triggering a\n BUG_ON() in swiotlb on 64k page systems, this was due to using both\n DIV_ROUND_UP() and min() to compute lengths\"\n\n* tag \u0027spi-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: cadence-quadspi: Fix race between DMA completion and transfer start\n spi: ljca: Don\u0027t require data in write replies\n spi: acpi: only look up the IRQ of confirmed SPI devices\n spi: pic32-sqi: fail transfer when the BD ring is exhausted\n spi: fix zero-length scatterlist entries for vmalloc buffers\n spi: rtk-nor: Limit exec_op writes to one byte per operation\n spi: amd: validate FIFO usage before executing message\n" }, { "commit": "91fd3a15265f095a9632d8f9d9732b37363ed121", "tree": "a642d7f9f0b93bd5c97472229c1906a6594bda01", "parents": [ "d164c7d754f0e1f020298366ea92430e62476089", "7904338c38426d72c5f7cd9402cb9a20232a7af5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:51:34 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:51:34 2026 -0800" }, "message": "Merge tag \u0027regulator-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A small collection of mostly fairly standard driver specific fixes.\n\n The mt6363 changes are a little large but are the result of two\n independent users running into the same issues and testing each\n other\u0027s changes so given that it\u0027s only -rc1 it seemed sensible to\n take the changes as fixes\"\n\n* tag \u0027regulator-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: mt6363: Fix VEMC voltage selection\n regulator: mt6363: Use 8-bit register values\n regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs\n regulator: qcom_spmi: don\u0027t take a sleeping lock in the SAW IPI\n" }, { "commit": "d164c7d754f0e1f020298366ea92430e62476089", "tree": "7da4976758631907e4aca13b97dfb4ed89755b4b", "parents": [ "fd7e9dc9997a3e792e93f8b6795cba1de0f52726", "9c1075791172d936935ca20d7f0c1da601c4f408" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:28:55 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:28:55 2026 -0800" }, "message": "Merge tag \u0027devicetree-fixes-for-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux\n\nPull devicetree fixes from Rob Herring:\n \"All of these are patches that didn\u0027t get picked up for the merge\n window. They all fix new warnings because the corresponding .dts\n changes did get applied\n\n - Add Altera Agilex5 DWC3 controller and Raspberry Pi RP1 PWM\n controller bindings\n\n - Make \"peer-hub\" property optional on cypress,hx3 USB hubs\"\n\n* tag \u0027devicetree-fixes-for-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:\n dt-bindings: usb: add Altera Agilex5 DWC3 controller\n dt-bindings: pwm: Add Raspberry Pi RP1 PWM controller\n dt-bindings: usb: cypress,hx3: make peer-hub property optional\n" }, { "commit": "fd7e9dc9997a3e792e93f8b6795cba1de0f52726", "tree": "475ac49d64aa250287fb7824adcc9d7e5c2a691f", "parents": [ "543b7d2ca09b4b08d518d668ac2fdc361f231785", "22733b6e2e1ebf75228a1e15b9fb9760a86137cc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:26:06 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:26:06 2026 -0800" }, "message": "Merge tag \u0027sound-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of (unsurprisingly high amount of) small fixes since the\n previous PR. Majority of changes are device-specific quirks and driver\n fixes, along with a few ALSA core fixes and USB-audio driver\n hardening.\n\n ALSA Core:\n - Fix page leak on WC DMA buffer allocation failure\n - Prevent O_APPEND on OSS streams to avoid UAF\n - A PCM regression fix for PulseAudio to allow hw_refine with mmap\n - Serialize DSP image loading requests in hwdep\n - Clear user-provided numid before adding a control\n - Fix dropped data bytes in UMP to MIDI 1.0 System message conversion\n\n HD-audio:\n - Fix double-free on stream page allocation failure in core\n - Stop capability walk cleanly on empty capability header\n - Fix silent output on Nvidia codecs due to shared converters\n - Restore audio registers after AE-5 LED strip transmission\n - Calibration data validation and custom address fixes for TAS2781\n - Shared boot wait and reset helpers for CS35L41\n - Cleanups and fixes for CS35L56 and AW88399\n - Add Tegra268 HDMI/DP codec ID\n - Device quirks for Acer, Alienware, ASUS, HP, Huawei, Lenovo, MSI\n\n USB-audio:\n - Hardening and bug fixes for usx2y and us122l drivers\n - Delay MIDI URB retry on -EPIPE to allow disconnect handling\n - Fix use-after-free of MIDI URBs on close in bcd2000\n - Reject undersized capture buffers in line6 driver\n - Fix URB leak on input setup failure in caiaq driver\n - Check return value of qmi_handle_init() in Qualcomm offload driver\n - Quirks for Yamaha ZG02, HIK camera, and CVT Touch Device\n\n ASoC:\n - AMD: Support more ACP7.0 projects, quirks for HP and Lenovo models\n - Intel: Dummy topology for SN624x codec, SOF BPT DMA stream fix\n - Qualcomm: Guard q6apm callbacks, fix runtime PM refcount leak\n - Rockchip: Add missing REGMAP_MMIO Kconfig dependencies\n - Meson: Request IRQ with clock enabled in axg-fifo\n - Codec fixes for cs35l41, cs_dsp, wm_adsp, wm8904, ES8389, tas2770,\n sn624x, and aw88399\n\n Misc:\n - FireWire: Fix inverted streaming speed in firewire-tascam\n - PCI: Check SCB creation failures in legacy cs46xx driver\"\n\n* tag \u0027sound-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (72 commits)\n ALSA: hda/realtek: Add quirk for Acer Predator PHN16-71\n ALSA: hda/realtek: Use inverted mute LED quirk for HP ZBook 8 G2a\n ALSA: hda: cs35l41: Add support for HP OmniBook 7 Laptop 16-ay0xxx\n ALSA: usx2y: Guard the playback copy\n ALSA: usx2y: Require a buffer of two URBs\n ALSA: hda: cs35l56: Stop cs_dsp before calling cs_dsp_power_down()\n ALSA: doc: cs35l56: Update calibration write failure message info\n ALSA: hda: cs35l56: Fix mixed cleanup and goto in cs35l56_hda_fw_load()\n ALSA: hda/tegra: Add Tegra268 HDMI/DP codec ID\n ALSA: hda/realtek: Fix pop noise on ASUS PRIME B650M-K\n ALSA: hda/realtek: Fix DAC binding for Legion Pro 7 16ARX8H variant\n ALSA: hda/realtek: Fix DAC binding for Lenovo Legion Pro 7 16ARX8H\n ALSA: caiaq: free the EP4 URB when input setup fails\n ALSA: line6: Reject capture buffers smaller than two packets\n ALSA: pcm: Allow HW_REFINE queries with mapped buffers\n ALSA: hda/ca0132: Restore AE-5 audio registers after LED strip send\n ALSA: hda/tas2781: Only accept CRC-less V1 data if all entries are valid\n ALSA: hda/realtek: Enable mute and mic-mute LEDs on HP ENVY 17-cr0xxx\n ALSA: usb-audio: Add quirk for Yamaha ZG02\n ALSA: pcm: Prevent O_APPEND open on OSS streams\n ...\n" }, { "commit": "5cdc3746fa163fb4e8d05fa3cabf46bc6aa7df75", "tree": "778707265bb10722f237267d1e6410f8f2323bae", "parents": [ "cb319926808b1cca522d2087a13205e840beb45b" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Fri Nov 06 18:47:17 2026 -0500" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Sat Nov 07 10:35:02 2026 -0800" }, "message": "x86/mm: Fix global ASID handed out to two processes\n\nOn AMD CPUs with INVLPGB, two live processes can get the same MAX_ASID_AVAILABLE\nglobal ASID value. The two then hit each other\u0027s TLB entries, so each can read\nor corrupt the other\u0027s memory.\n\nThe global ASID space is managed lazily. When a global ASID is freed, its bit is\nset in the global_asid_freed bitmap. Once the free ASID search reaches the end\nof the global_asid_used bitmap, a global flush is done to really reclaim the\nlazily freed global ASIDs.\n\nHowever, the current code can assign the same global ASID to two different\nprocesses, if one process is assigned MAX_ASID_AVAILABLE - 1, another process\nMAX_ASID_AVAILABLE, and both stick around (keeping their global ASID numbers in\nuse) until the search wraps around again. At that point a third process could\nalso get assigned MAX_ASID_AVAILABLE.\n\n the highest ASID stays in use, so it is not handed out again\n last_global_asid stays below it, so no reset\n the clear bits run out\n find_next_zero_bit() returns MAX_ASID_AVAILABLE\n global_asid_available \u003e 0, so the failure is not caught\n MAX_ASID_AVAILABLE is handed out as an ASID\n\nA search only looks at the bits below MAX_ASID_AVAILABLE, so it cannot see that\nthis value is in use. The next failed search hands it out again, even if the\nfirst process still holds it.\n\nThe fix used here is to reset the global ASID space after a failed search, and\nto search again. If that search fails too, no global ASID is handed out.\n\nThe test for !global_asid_available is removed, because use_global_asid() only\ncalls allocate_global_asid() if global_asid_available \u003e 0. The remaining test is\nfor a condition that should be impossible.\n\n [ riel: simplify code, massage changelog and comment ]\n\nFixes: d504d1247e36 (\"x86/mm: Add global ASID allocation helper functions\")\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nSigned-off-by: Rik van Riel \u003criel@surriel.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: \u003cstable@kernel.org\u003e\n" }, { "commit": "543b7d2ca09b4b08d518d668ac2fdc361f231785", "tree": "cb725d1b6a2b9f60045e14d28e0de09569d5631a", "parents": [ "d48723711bae9b8cdc56719c448ba42fef28cbee", "19e67d977d3d4d0c54f03906ef578578190db9e1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 10:20:51 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 10:20:51 2026 -0800" }, "message": "Merge tag \u0027drm-fixes-2026-11-07\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"This is the weekly drm fixes, amdgpu leading the way with some i915,\n nouveau and other fixes.\n\n There should be a bunch of xe fixes, but their tree got screwed up so\n I guess I\u0027ll send those next week once they cleanup whatever happened.\n\n atomic:\n - Fix CRTC dma-fence handling\n\n drm:\n - Add parsing for additional HDMI 2.2 FRL rates\n\n bridge:\n - nwl-dsi: Fix LCDIF handling\n\n dma-buf:\n - Fix IOVA offset\n - Restore the scatter-list entry count before freeing\n\n dp:\n - Keep MOT set between messages when no_zero_sized is set\n\n panel:\n - visionox-r66451: Set brightness MSB first; Increase reset waiting time\n\n panic:\n - Fix display loop\n - Fix line parsing\n\n sched:\n - Fix out of bounds entity priority check\n - Adjust run-queue when changing priority at runtime\n\n amdgpu:\n - UALink fixes\n - RAS fixes\n - GEM_OP fix\n - Parse IB fixes\n - CS user fence fix\n - GPU reset fixes\n - Multi-media idle work handler cleanup fixes\n - UserQ fixes\n - CRC fix\n - SR-IOV fixes\n - IP discovery fix\n - HDMI 2.2 FRL fixes\n - DDC pin fix\n - HUBP fix\n - SPM fix\n - DCN 3.2 fixes\n - VRR/freesync fix\n - Seamless boot fix\n - SMU 13.0.7 fix\n - Backlight fix\n - dma-buf fixes\n - GPUVM fixes\n - Move DMCUB back to VRAM\n - Non-DC audio fix\n - BACO fix\n\n amdkfd:\n - Fix WPTR BO eviction fence handling\n - GPUVM locking fix\n\n i915:\n - Fix GitLab #8991 where tiled displays (LG UltraFine 5K) broken on PTL\n - Limit NVL TRANS_VTOTAL.Vtotal skip display workaround to A-step\n - Single scaler per pipe number to 1 and disable pipe joiner on WCL\n - Add quirk to force backlight type on some TUXEDO devices\n - Fix \"CMTG: A disable timeout\" splat\n - Fix intel_vrr_dcb_vmin_vblank_start\n - Bunch of PSR fixes\n - Static checker fixes\n\n etnaviv:\n - Fix NULL dereference in etnaviv_unbind()\n - Flush the tile status cache through both the PE and BLT\n\n imagination:\n - Align rogue_fwif_hwrtdata to 64 bytes\n\n loongson:\n - Fix BO handling in several places\n\n nouveau:\n - Map Kepler video engine contexts non-privileged\n - Clear use.enabled when subdev init fails\n - Avoid running VBIOS twice\n - Fix CE channel creation on pre-Kepler GPUs\n\n v3d:\n - Initialize job timedout_batches\n - Fix cache_clean_lock\n\n vc4:\n - Move output fence and BO unreserve out of job_lock\n - Power down PYH when output is disabled\n - hdmi: Fix scrambling\"\n\n* tag \u0027drm-fixes-2026-11-07\u0027 of https://gitlab.freedesktop.org/drm/kernel: (91 commits)\n drm/sched: Adjust run-queue when changing priority at runtime\n drm/sched: Fix out of bounds entity priority check\n drm/etnaviv: Flush the tile status cache through both the PE and BLT\n drm/etnaviv: Fix NULL dereference on unbind without PPU flop reset\n drm/nouveau: Fix CE channel creation on pre-Kepler GPUs\n drm/nouveau/devinit/gf100-: try to avoid double-running vbios scripts\n drm/dp: keep MOT set between messages when no_zero_sized is set\n drm/nouveau/nvkm: clear use.enabled when subdev init fails\n drm/nouveau/fifo: map Kepler video engine contexts non-privileged\n drm/amdgpu: don\u0027t drop the gang dependency fence twice\n drm/amdgpu: stop GPU recovery wait for the JPEG/VCN idle work\n drm/amd/pm: track BACO state in the SMU v11 ArmD3 sequence\n drm/amdgpu: Only enable HDMI audio if display supports it\n Revert \"drm/amd/display: Allocate DCN32/1 dmub memory to GTT\"\n drm/amdgpu: don\u0027t walk the CS chunks when allocating them failed\n drm/amdgpu/vce: don\u0027t allocate a scheduler fence in the direct IB test\n drm/amdgpu: rewrite all PTEs of the BOs after a VM reset\n drm/amdgpu: unlock the VM and BO when attaching a KFD BO fails\n drm/amdgpu: drop the dma-buf reference when a KFD import fails\n drm/amdgpu: Clamp the ATIF backlight curve to its 99 points\n ...\n" }, { "commit": "a4845f077415ef32fe672c841e2fc58ae9e28273", "tree": "cf55bae5f04fd79bf752bf22cd6b5059fb743a2e", "parents": [ "6b67cdb463b006e57f15e3fe4ea03b00f0ac9ee5" ], "author": { "name": "Zhao Gongyi", "email": "zhaogongyi@bytedance.com", "time": "Wed Nov 04 21:06:38 2026 +0800" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 14:35:25 2026 +0100" }, "message": "ata: libata-scsi: reject data-in commands with a data-out buffer\n\nSG_IO can submit a data-in SCSI command with DMA_TO_DEVICE. The\nscatterlist can then contain pages pinned without write access.\nata_scsi_rbuf_fill() writes simulated replies to that scatterlist;\nin the reported case, the copy tried to write the shared zero page\nand faulted in the kernel.\n\nThe same mismatch can affect SG_IO commands translated by libata.\nZBC IN and GET PHYSICAL ELEMENT STATUS completion handlers can modify\nthe receive buffer even if the drive aborts the command. For ATAPI,\nthe successful INQUIRY completion also rewrites the buffer in\natapi_fixup_inquiry().\n\nReject these mismatched commands before the buffer is written or the\ncommand is issued. Report ABORTED COMMAND / DATA IN BUFFER ERROR because\nthe CDB itself can be valid; the supplied transfer direction is wrong.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nLink: https://lore.kernel.org/r/20261027090809.94126-1-zhaogongyi@bytedance.com\nSuggested-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSuggested-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Zhao Gongyi \u003czhaogongyi@bytedance.com\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261104130638.37882-1-zhaogongyi@bytedance.com\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "6b67cdb463b006e57f15e3fe4ea03b00f0ac9ee5", "tree": "77b72bc8942cd41940f785da9864e8d056396153", "parents": [ "7c972e73641cbe5f77f63c336de15c7a30268d49" ], "author": { "name": "Marco Ziliani", "email": "rylos78@gmail.com", "time": "Sat Nov 07 14:13:30 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 14:15:58 2026 +0100" }, "message": "ata: libata-pmp: disable the SEMB port on Marvell 88SM9705\n\nThe Marvell 88SM9705 is a 1-to-5 SATA port multiplier with one\nadditional SEMB (SATA Enclosure Management Bridge) port [1]. Ports\n0-4 are device ports and port 5 is the SEMB. The number of fan-out\nports in GSCR[2] is 6 when the SEMB is enabled and 5 when it is not,\nso on boards without the SEMB there is no link 5 and this quirk does\nnothing. That includes the common 8-port PCIe cards that pair an\n88SE9215 with an 88SM9705, which report 5 ports.\n\nThe SEMB port never answers SRST. libata probes it like a device\nport, and every EH round on the PMP ends in a retry loop that lasts\nabout a minute before EH gives up, then starts over:\n\n ata19.15: Port Multiplier 1.2, 0x1b4b:0x9705 r160, 6 ports, feat 0x1/0x1f\n ata19.05: hard resetting link\n ata19.05: failed to resume link (SControl 0)\n ata19.05: softreset failed (1st FIS failed)\n ata19.05: hard resetting link\n ...\n ata20.05: reset failed, giving up\n\nDisk discovery waits for this, including disks on other controllers.\n\nlibata.force only partly works around it. The \"disable\" horkage\nonly takes effect after IDENTIFY, which the SEMB link never reaches.\n\"norst\" on port 5 stops the retry loop, but the disks still come up\nabout a minute later than with this change (see below).\n\nTreat port 5 the same way as port 4 of the Marvell 88SM4140 and mark\nthe link ATA_LFLAG_DISABLED.\n\nTested on a Synology DX1222 expansion unit (four 88SM9705 r160 behind\na Marvell 88SE9235, passed through to a KVM guest, 6 disks), 7.4-rc1\nwith and without this change, one boot each:\n\n softreset reset failed, last disk\n failed giving up attached\n 7.4-rc1, no libata.force 60 12 197 s\n 7.4-rc1, libata.force\u003dN.05:norst 0 0 70 s\n 7.4-rc1 + this patch, no force 0 0 11 s\n\nThe problem was first found on a Synology DX1215 with the same chain,\nwhere this change brought the disks up after about 20 s instead of\nabout 200 s, including a disk on a separate AHCI controller.\n\nEach PMP still logs one \"failed to resume link (SControl 0)\" for port 5\nat probe time.\n\nLink: https://www.marvell.com/content/dam/marvell/en/public-collateral/storage/marvell-storage-88sm9705-functional-specifications-2015-06.pdf [1]\nCc: stable@vger.kernel.org\nTested-by: Kyrylo Biryuk \u003cillofspeed@gmail.com\u003e\nSigned-off-by: Marco Ziliani \u003crylos78@gmail.com\u003e\nLink: https://lore.kernel.org/r/20261107-pmp-88sm9705-v2-1-18eed983d3db@gmail.com\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "7c972e73641cbe5f77f63c336de15c7a30268d49", "tree": "9edc59338113bc6b986343134352ab4cb08943cf", "parents": [ "0fdb8eef88a886751e33600d446a66c529384f11" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Tue Nov 03 21:54:56 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: set the field pointer when rejecting CDL\n\nata_mselect_control_ata_feature() rejects enabling CDL while NCQ\npriority is enabled, but unlike its other error branches it returns\nwithout setting *fp.\n\nata_scsi_mode_select_xlat() initializes fp to 0xffff and, when the\nhandler fails, adds the offset of the mode page in the parameter list\nto it, i.e. the length of the mode parameter header and of the block\ndescriptors. As fp is a u16, this wraps around, so the resulting sense\ndata reports the byte before the mode page, i.e. the last byte of the\nmode parameter header or of the block descriptors, as the FIELD\nPOINTER, instead of the byte containing the CDL_CTRL field that\nrequests enabling CDL.\n\nSet *fp to 4, i.e. to the byte containing the CDL_CTRL field, like the\nbranch rejecting an invalid CDL_CTRL value does.\n\nFixes: df60f9c64576 (\"scsi: ata: libata: Add ATA feature control sub-page translation\")\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\n[cassel: set *fp to 4, the offset of CDL_CTRL in the mode page]\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-17-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "0fdb8eef88a886751e33600d446a66c529384f11", "tree": "975173f76e61e793ffe069fb876ed30472ae7ed0", "parents": [ "a3e52dcf0fbaa1a103accef3e8861cdc250ee5d6" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:55 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: pass the whole mode page to the MODE SELECT handlers\n\nata_scsi_mode_select_xlat() strips the mode page header before calling\nthe mode page handlers, which report the position of an invalid field\nas an offset relative to the mode page data. It then converts this\noffset into an offset in the parameter list by adding the length of the\nmode parameter header and of the block descriptors, but not the length\nof the mode page header. As a result, the FIELD POINTER of the INVALID\nFIELD IN PARAMETER LIST sense data points 2 bytes (page_0 format) or 4\nbytes (sub_page format) before the byte that is actually invalid. For\nexample, changing byte 3 of the caching mode page in a MODE SELECT(10)\nparameter list without block descriptors reports byte 9 instead of\nbyte 11.\n\nPass the whole mode page, starting with its mode page header, to the\nhandlers instead, like the ata_msense_*() functions, which generate the\nwhole mode page. Offsets in buf are then the byte numbers of the mode\npage, as used in the mode page definitions of SPC, SBC and SAT, the\nhandlers can compare buf with the mode page generated by the matching\nata_msense_*() function without adjusting offsets, and the conversion\ndone by ata_scsi_mode_select_xlat() becomes correct. This also allows\nreporting an invalid PAGE LENGTH at the PAGE LENGTH field, which was not\npart of buf before. As ata_scsi_mode_select_xlat() rejects SUBPAGE CODE\nFFh and mode pages with a wrong SPF bit, each handler only gets its mode\npage in a single format, so the mode page header length is known.\n\nDocument what buf, len and fp are, and the return values, in kernel-doc\ncomments for all the handlers.\n\nFixes: 7780081c1f04 (\"libata-scsi: Set information sense field for invalid parameter\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-16-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "a3e52dcf0fbaa1a103accef3e8861cdc250ee5d6", "tree": "eadeddac5201ec51eba0c317600e116409021e50", "parents": [ "2a4c61cf94d48ec8560473d4fd5383583ce8809c" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:54 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: fix MODE SELECT field pointer for block descriptor length\n\nata_scsi_mode_select_xlat() only accepts MODE SELECT parameter lists\nwithout block descriptors or with a single 8 byte block descriptor. For\nany other BLOCK DESCRIPTOR LENGTH, it terminates the command with\nINVALID FIELD IN PARAMETER LIST, and the FIELD POINTER should point at\nthe BLOCK DESCRIPTOR LENGTH field, i.e. at byte 3 of the mode parameter\nheader(6) or at byte 6 of the mode parameter header(10), as SPC requires\nthe FIELD POINTER of a multiple-byte field to point at its first byte.\n\nHowever, the mode parameter header length and the BLOCK DESCRIPTOR\nLENGTH are added to the offset of the field, so the FIELD POINTER points\n3 or 6 bytes after the end of the block descriptors instead. For\nexample, a MODE SELECT(10) with a BLOCK DESCRIPTOR LENGTH of 16 reports\nbyte 30 instead of byte 6.\n\nDo not add the mode parameter header length and the BLOCK DESCRIPTOR\nLENGTH to the offset of the BLOCK DESCRIPTOR LENGTH field.\n\nFixes: 7780081c1f04 (\"libata-scsi: Set information sense field for invalid parameter\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-15-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "2a4c61cf94d48ec8560473d4fd5383583ce8809c", "tree": "e62095243025586c98204895c5123ac8542e5c03", "parents": [ "a1eb72c477ec1320c540f27ce1e2f717d4518e62" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:53 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: fix MODE SELECT field pointer for unsupported subpages\n\nWhen the mode page of a MODE SELECT parameter list has an unsupported\nSUBPAGE CODE, ata_scsi_mode_select_xlat() sets the FIELD POINTER of the\nINVALID FIELD IN PARAMETER LIST sense data to the SUBPAGE CODE byte of\nthe mode page header (byte 1 of the page) if the SPF bit is set, and to\nthe PAGE CODE byte (byte 0 of the page) otherwise.\n\nHowever, the SPF bit is tested on p[0] after p has already been advanced\npast the mode page header, so the test reads bit 6 of the first byte of\nthe mode page data instead. If the parameter list ends with the mode\npage header, it even reads the byte that follows the parameter list in\nbuffer, which is not initialized when no data beyond the parameter list\nwas transferred.\n\nThe test is not needed anyway: spg can only be non-zero for a mode page\nin sub_page format, i.e. with the SPF bit set, and the field in error is\nthe SUBPAGE CODE. Always set the FIELD POINTER to the SUBPAGE CODE byte,\nwhich follows the mode parameter header, the block descriptors and the\nPAGE CODE byte.\n\nFixes: 7780081c1f04 (\"libata-scsi: Set information sense field for invalid parameter\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-14-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "a1eb72c477ec1320c540f27ce1e2f717d4518e62", "tree": "de4b7b90c2e8fae3d9f39a2856a8c92c7d418198", "parents": [ "b29c40dc150b0b4218c4d6844770892eb6b2f6b5" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:52 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: reject MODE SELECT mode pages with a wrong SPF bit\n\nata_scsi_mode_select_xlat() accepts the caching and control mode pages\nboth in page_0 format and in sub_page format with SUBPAGE CODE 00h.\n\nHowever, SAT-2 and later versions of SAT define the SPF bit of the\nCaching mode page and of the Control mode page as not changeable and\nset to zero (see SAT-6, 10.4.9 and 10.4.6), and SPC-7 (6.12, MODE\nSELECT(10) command) requires the device server to terminate a MODE\nSELECT command with INVALID FIELD IN PARAMETER LIST if the application\nclient sets any field that is reported as not changeable to a value\nother than its current value.\n\nReject a mode page with the SPF bit set to one and SUBPAGE CODE 00h,\nwith the FIELD POINTER set to the byte containing the SPF bit. The only\nmode page with the SPF bit set to one that remains accepted is the ATA\nFeature Control mode page (control mode page, sub-page f2h), for which\nSAT-6 (12.3.4) requires the SPF bit to be set to one. The opposite case\ndoes not need a check: a mode page in page_0 format always has subpage\ncode 00h, so it can never be the ATA Feature Control mode page.\n\nThis also allows the mode page handlers to rely on the format of their\nmode page, which a later patch will make use of.\n\nFixes: 1b26d29ccd59 (\"[libata] scsi: implement MODE SELECT command\")\nLink: https://lore.kernel.org/r/20261103205448.931471-13-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "b29c40dc150b0b4218c4d6844770892eb6b2f6b5", "tree": "66a71340b0e15fbe3ae20710e71ae61c29db0219", "parents": [ "6fde0444d07ec954f3d885375e0402ff2f2e5064" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:51 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:20:41 2026 +0100" }, "message": "ata: libata-scsi: do not accept subpage code FFh in MODE SELECT\n\nWhen the SUBPAGE CODE of the mode page in a MODE SELECT parameter list\nis FFh, ata_scsi_mode_select_xlat() rejects it for the control mode\npage, but accepts it for all other mode pages, i.e. for the caching\nmode page, the only other mode page that it supports.\n\nHowever, FFh is not the subpage code of an actual mode page: SPC-7\n(7.5.2) only defines it as the MODE SENSE request code for all\nsubpages. SUBPAGE CODE FFh only means \"all subpages\" in requests, i.e.\nin the MODE SENSE CDB for mode pages and in the LOG SELECT CDB for log\npages (see SPC-5, 6.8), while the SUBPAGE CODE of a mode page in a MODE\nSELECT parameter list identifies a specific mode page. Also, SAT-2 and\nlater versions of SAT define the Caching mode page with the SPF bit set\nto zero (see SAT-6, 10.4.9), i.e. without a SUBPAGE CODE field.\n\nRemove the ALL_SUB_MPAGES case, so that SUBPAGE CODE FFh is rejected\nlike any other unsupported subpage.\n\nFixes: 1b26d29ccd59 (\"[libata] scsi: implement MODE SELECT command\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-12-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "6fde0444d07ec954f3d885375e0402ff2f2e5064", "tree": "7ac931795eed5b322d0543444ab394ed6f14e633", "parents": [ "ec585ac78742527f80495dd8f451dcda7e9e7f59" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:50 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:20:41 2026 +0100" }, "message": "ata: libata-scsi: fix MODE SELECT handling of data after the mode page\n\nata_scsi_mode_select_xlat() only supports one mode page per MODE SELECT\ncommand, and rejects a parameter list with data after the mode page with\nINVALID FIELD IN PARAMETER LIST. However:\n\n- It does not set the field pointer, so the sense data reports 0xffff as\n the FIELD POINTER.\n\n- It only checks for data after the mode page after the mode page\n handler has been called. ata_mselect_control_ata_feature() has then\n already updated the CDL enabled flag of the device, even though the\n command is rejected and the CDL setting of the device is not changed.\n\n- For the control mode page, ata_mselect_control_spg0() does not need an\n ATA command, so the check is skipped, and the data after the mode page\n is silently ignored.\n\nCheck for data after the mode page before calling the mode page\nhandlers, and set the FIELD POINTER to the first byte after the mode\npage, i.e. to the first byte of the next mode page.\n\nThe reason why only one mode page per command is supported is that a\nMODE SELECT command is translated into at most one ATA command, so\nupdate the comment accordingly.\n\nFixes: 1b26d29ccd59 (\"[libata] scsi: implement MODE SELECT command\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-11-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "d48723711bae9b8cdc56719c448ba42fef28cbee", "tree": "01dee483dfd26ba340ee4d3653f6c848b24fe823", "parents": [ "bdeb84ed24e543930487f03f5243bbf83aebaf31", "58c1eb84e97701c583605ba2fd553b69afba2245" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:18:19 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:18:19 2026 -0800" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n \"Fix SDEI (software delegated exception interface) handlers taking\n nested exceptions (looping on the KPTI trampoline vectors and\n clobbering the interrupted context\u0027s exception registers), TPIDR2_EL0\n preservation across CPU suspend, a kexec_file_load() memory leak and\n an overflow in the /dev/mem valid_mmap_phys_addr_range() check:\n\n - Fix nested exceptions taken by SDEI event handlers.\n\n With KPTI, an event interrupting user space left the trampoline\n vectors installed and any exception in the handler looped forever.\n Also save and restore ELR/SPSR/ESR/FAR around the handler since an\n event can interrupt exception entry or return where these registers\n are live\n\n - Save and restore TPIDR2_EL0 across CPU suspend.\n\n Its value is UNKNOWN after a warm reset and the task initiating\n suspend could return to user space with a corrupted value\n\n - Fix an overflow in valid_mmap_phys_addr_range() allowing /dev/mem\n to map out-of-range PFNs\n\n - Fix an elf_headers memory leak in the kexec_file segment placement\n retry loop\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: sdei: Preserve the interrupted context\u0027s exception registers\n arm64: sdei: Run the event handler on the kernel vectors\n arm64: kexec_file: Fix elf_headers memory leak in retry loop\n arm64: mm: validate /dev/mem mmap ranges without overflow\n arm64: suspend: Save and restore TPIDR2_EL0 across CPU suspend\n" }, { "commit": "bdeb84ed24e543930487f03f5243bbf83aebaf31", "tree": "701efcdca2b8f7b74e930f0435756092602cd49b", "parents": [ "a7963b12ca3e764e6ad3b15d1373430eb02492ee", "8a7f26aa072a4e63bc3b1adfe649546709db722e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:13:41 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:13:41 2026 -0800" }, "message": "Merge tag \u0027printk-for-7.4-fixups\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux\n\nPull printk fixes from Petr Mladek:\n\n - Prevent possible use-after-free when printk kthreads\n could not be created\n\n - Fix computation of the free space when allocating a\n bigger ring buffer\n\n - Add info about the new printk mailing list for\n printk-related subsystems\n\n* tag \u0027printk-for-7.4-fixups\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:\n printk: Avoid multiple unregistration in unregister_console_locked()\n MAINTAINERS: Add new \"printk\" mailing list for PRINTK, PRINTK INDEXING, and VSPRINTF\n printk_ringbuffer: Fix space_used() when blk_lpos-\u003enext overflows\n" }, { "commit": "a7963b12ca3e764e6ad3b15d1373430eb02492ee", "tree": "b44ef3f445e404a9c72c7fd4f2cb307a84701204", "parents": [ "c53d8fc9a7571b63482548a7e5284ef9f025fd3f", "2cf4be57b301ed2d7af82e70cff5dfd96894d8de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:02:02 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:02:02 2026 -0800" }, "message": "Merge tag \u0027iommu-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"AMD IOMMU:\n\n - Move PerfOpt management into the IOMMU domain attachment paths,\n enabling it automatically for supported integrated GPUs in identity\n mode and clearing it before switching to translated or blocked\n domains\n\n - Fix a boot panic in the GPU identity-mapping quirk when a GPU has\n no upstream PCI bridge\n\n - Clear the IOMMU SNP enable flag when RMP table initialization\n fails, preventing subsequent initialization from assuming SNP setup\n succeeded\n\n - Check IVRS subtable types before parsing memory definitions,\n avoiding bogus PCI segments caused by misinterpreting IVHD entries\n under QEMU\n\n - Remove an obsolete warning on device release that incorrectly fires\n for devices required to remain attached to an identity domain\"\n\n* tag \u0027iommu-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge\n iommu/amd: remove obsolete domain pointer warning on release\n iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions\n iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails\n iommu/amd: Enable PerfOpt automatically for integrated GPUs\n" }, { "commit": "c53d8fc9a7571b63482548a7e5284ef9f025fd3f", "tree": "5365b3daafb2c0256dee4d434d8edb412878008d", "parents": [ "90d9e367d4dc3e4bec20c2919c1beab69a4d7431", "28f7d31c2aeb350df9a0116093fade0a840fb4ce" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:36:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:36:20 2026 -0800" }, "message": "Merge tag \u0027block-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed\n connect, and the nvme-rdma counterpart of the NULL queue-\u003ectrl on\n reconnect\n - nvmet-rdma iWARP disconnect and device removal fixes\n - nvmet-tcp: ask for the TLS record type on every receive, and bound\n the connections accepted per work run so a connect flood can\u0027t\n hold up port removal; nvmet-auth keep the old keys if the new ones\n fail to decode; nvme-loop delete the controller if a reset fails\n - nvmet-auth reject incomplete DHCHAP messages, and a keep-alive\n timeout overflow\n - nvmet locking and bounds fixes for tbkas reconnects and the\n traddr/trsvcid configfs writes, don\u0027t leak stale memory in the ANA\n log page, and cache the passthru reference across queue_response\n - Wait for SRCU readers before splicing the namespace list, with a\n new list_splice_init_srcu() helper, and drop an extra grace period\n in nvmet_ns_disable()\n - Unregister when pr_register() is given a zero new key, and don\u0027t\n drop the cdev reference twice on cdev_device_add() failure\n - Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d\n - Various smaller fixes and cleanups\n\n - blk-mq: end the request if getting a keyslot fails, which left the\n in-flight count and zone write plug stuck, reset the queue state on\n scheduler teardown so requests don\u0027t stall in software queues, and\n fix an out-of-bounds read in blk_mq_free_rqs() after a failed\n nr_hw_queues update\n\n - Only serialize elevator switches of the same queue\n\n - dma-buf bio fixes: don\u0027t use the bvec fast path for them, and only\n fail the ones that need block layer PI\n\n - Reject GPT entries with starting_lba \u003e ending_lba\n\n - Return the soft block size for compat BLKBSZGET, report the correct\n discard alignment in sysfs, and account the flush sequence latency\n only once in iocost\n\n - virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue\n layout at probe time, clamp max_segments to the ring size, and fix\n zone append sector reporting in batched completion\n\n - null_blk zone fixes and a cache state reset\n\n - zloop fixes\n\n - ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build\n\n* tag \u0027block-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)\n nvmet: cache passthru reference in __nvmet_req_complete()\n nvmet: drop the redundant auth check in nvmet_parse_io_cmd()\n nvmet: bound the traddr and trsvcid configfs writes\n nvmet: take subsys-\u003elock when forcing reconnects for tbkas\n nvme: wait for SRCU readers before splicing the namespace list\n srcu: Add list_splice_init_srcu()\n nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d\n nvmet: don\u0027t return memory contents beyond valid data when reading ANA log page\n nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE\n nvmet: drop the extra RCU grace period in nvmet_ns_disable()\n nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()\n ublk: add missing DEL_DEV_ASYNC to unprivileged permission check\n selftests: ublk: fix the build and file offsets on 32-bit\n nvmet-rdma: disconnect a queue on device removal\n nvmet-rdma: queue the release work under the mutex\n nvmet-rdma: take a device off the list last\n nvmet-tcp: limit the connections accepted per work run\n nvmet-rdma: disconnect only established queues\n nvmet-auth: keep the old keys if the new ones fail\n nvmet-tcp: ask for the TLS record type on every receive\n ...\n" }, { "commit": "90d9e367d4dc3e4bec20c2919c1beab69a4d7431", "tree": "fa9342a4a7c5c526d740e897188f87c245712532", "parents": [ "a91337fb5e8e0127c8b5be87be9f3027f95b48bc", "cf6542493e35ab9e72ac07da10a178ac78db5a16" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:30:19 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:30:19 2026 -0800" }, "message": "Merge tag \u0027io_uring-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Only wait for in-flight requests on ring release if the closing task\n actually uses the ring.\n\n - SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,\n as memory.high reclaim and blkcg throttling otherwise only ran at\n thread exit, and don\u0027t set the stop bit on thread exit, which tripped\n a WARN_ON_ONCE() in the ring teardown.\n\n - Don\u0027t poll a writer for a read side hangup or for urgent data, as a\n half-closed peer or unread OOB data kept the async poll of a send\n ready on every re-arm.\n\n - Cancel all matching poll requests in one pass for CANCEL_ALL rather\n than restarting the hash walk per request.\n\n - Hold uring_lock across the put_user() for the index-alloc file\n install.\n\n - Don\u0027t arm an hrtimer and schedule for a wait whose timeout has\n already expired.\n\n - Add a feature flag for the dma-buf registered buffer support.\n\n - selftests 32-bit cast fix\n\n* tag \u0027io_uring-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: only wait for in-flight requests if the closing task uses the ring\n io_uring: add feature flag for dma-buf support\n io_uring/wait: don\u0027t sleep on an already expired timeout\n io_uring/rsrc: hold uring_lock across index-alloc put_user\n selftests/io_uring: cast optval through uintptr_t in mini_liburing.h\n io_uring/poll: don\u0027t poll a writer for urgent data\n io_uring/poll: don\u0027t poll a writer for a read side hangup\n io_uring/poll: cancel all matching requests in one pass\n io_uring/cancel: count all requests that a CANCEL_ALL cancels\n io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread\n io_uring/sqpoll: don\u0027t set IO_SQ_THREAD_SHOULD_STOP on thread exit\n" }, { "commit": "fc90c18c4bb6f57a6cb90634ee65c592f900abc4", "tree": "ce22c1a5eb0d73f71d5958b6b819dea0c4a760ec", "parents": [ "f7a8b89bc067fa1cbcd3312539bc0d61810d3280" ], "author": { "name": "Roman Vivchar", "email": "rva333@protonmail.com", "time": "Thu Nov 05 13:29:12 2026 +0200" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Nov 06 10:08:07 2026 -0800" }, "message": "dt-bindings: input: mediatek,mt6779-keypad: add mt6595\n\nAdd a compatible string for the mt6595 keypad, that is compatible with\nmt6779.\n\nSigned-off-by: Roman Vivchar \u003crva333@protonmail.com\u003e\nReviewed-by: AngeloGioacchino Del Regno \u003cangelogioacchino.delregno@collabora.com\u003e\nReviewed-by: Mattijs Korpershoek \u003cmkorpershoek@kernel.org\u003e\nLink: https://patch.msgid.link/20261105-6595-dt-keypad-v1-1-f0911f40d3ad@protonmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "58c1eb84e97701c583605ba2fd553b69afba2245", "tree": "0a10c684cb1127d414c669333fac05129a101eaf", "parents": [ "9bf6ee7952c7ee151c30e0fffcfc61b58127c899" ], "author": { "name": "Kiryl Shutsemau (Meta)", "email": "kas@kernel.org", "time": "Thu Nov 05 12:08:34 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 17:43:20 2026 +0000" }, "message": "arm64: sdei: Preserve the interrupted context\u0027s exception registers\n\nAn SDEI event is dispatched by firmware regardless of PSTATE.DAIF, so it\ncan interrupt the kernel where the exception registers are live:\n\n - exception entry, before kernel_entry has saved ELR_EL1/SPSR_EL1 and\n before the C handler has read ESR_EL1/FAR_EL1;\n - exception return, after kernel_exit has loaded ELR_EL1/SPSR_EL1 and\n before the ERET.\n\nAn IRQ or pseudo-NMI cannot arrive there with PSTATE.I set. Firmware\nsaves only x0-x17, PC and PSTATE around an SDEI event, so a synchronous\nexception taken by the handler overwrites the interrupted context\u0027s\nELR, SPSR, ESR and FAR. do_sdei_event() only notices that ELR changed,\nand warns.\n\nThe interrupted context then carries on with the handler\u0027s state. A\ntask interrupted on its way into the kernel can be sent SIGILL for the\nhandler\u0027s kernel data abort. A task interrupted on its way back to user\nspace ERETs to EL1, at the handler\u0027s fixup address, with user registers\nloaded.\n\nWith SDEI delivering NMI backtraces, this happens in normal operation.\nThe handler runs show_regs(), which reads through possibly-NULL pointers\nwith the _nofault() accessors. print_worker_info() faults this way for a\nkworker that is not running a work item, and a single sysrq-l warned\nonce per such kworker.\n\nSave ELR, SPSR, ESR and FAR in __sdei_handler() before\nirqentry_nmi_enter(), which can take an exception too, and restore them\nafter irqentry_nmi_exit().\n\nOnce they are restored, a nested exception is harmless if its handler is\nsafe in NMI context. That holds for EL1 data aborts on translation,\npermission and access-flag faults, which never take the mmap lock in NMI\ncontext, and for BRK. Warn once, with the syndrome, about any other\nexception class.\n\nFixes: f5df26961853 (\"arm64: kernel: Add arch-specific SDEI entry code and CPU masking\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nTested-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "9bf6ee7952c7ee151c30e0fffcfc61b58127c899", "tree": "93f56b4959bb18af21fffabe91e44be8f32c2c63", "parents": [ "ac302aea3d824ccc99f29b8e499c365cb9a684a9" ], "author": { "name": "Kiryl Shutsemau (Meta)", "email": "kas@kernel.org", "time": "Thu Nov 05 12:08:33 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 17:43:12 2026 +0000" }, "message": "arm64: sdei: Run the event handler on the kernel vectors\n\nWith KPTI, VBAR_EL1 holds the trampoline vectors from the return to EL0\nuntil the next exception from EL0 maps the kernel and installs the\nkernel vectors. The trampoline vectors only handle exceptions from EL0;\ntheir current-EL half is zero-filled.\n\nAn SDEI event is dispatched regardless of PSTATE.DAIF, so it lands there\nwhenever the CPU is in user space. The SDEI entry trampoline maps the\nkernel but leaves VBAR_EL1 alone. An exception taken by the handler then\nexecutes the zeros, takes an undefined instruction exception to the same\nvector, and loops there forever. The event never completes and the CPU\nis lost; RCU stall reports are the first sign of it.\n\nRAS notifications land in user space whenever a task consumes the\nerror, and NMI backtraces land wherever the CPU happens to be. The GHES\nhandler takes no exception on its own, but any exception in the handler\npath does it: a WARN, a kprobe hit, or a fault fixed up by a _nofault()\naccessor.\n\nInstall the kernel vectors in __sdei_handler() when VBAR_EL1 holds the\ntrampoline vectors, and restore it before returning to firmware. The\nswitch covers irqentry_nmi_enter() and irqentry_nmi_exit() too, as Usama\nArif pointed out: their tracepoints and context tracking WARNs can take\nan exception as well.\n\nThe IRQ-like resume into user space must still go through the\ntrampoline to map the kernel. do_sdei_event() takes the interrupted\nVBAR_EL1 and keeps basing the resume address on it.\n\nFixes: 79e9aa59dc29 (\"arm64: sdei: Add trampoline code for remapping the kernel\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nTested-by: Breno Leitao \u003cleitao@debian.org\u003e\n[catalin.marinas@arm.com: use raw_cpu_read() for this_cpu_vector]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "a91337fb5e8e0127c8b5be87be9f3027f95b48bc", "tree": "29a4aab100d12968f421c2373b5d6f21a6962ad1", "parents": [ "b556f1c4dc9fa538bb3b27c0b9710e62baca692f", "57d94d26ed42773d6378da45eed9de03b116e7f7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:38:11 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:38:11 2026 -0800" }, "message": "Merge tag \u0027configfs-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux\n\nPull configfs fix from Breno Leitao:\n\n - Fix the build of the configfs selftest on 32-bit architectures,\n broken since the test was added in the v7.4 merge window.\n\n The harness casts the ASSERT_NE() operands to intmax_t, so handing it\n the pointer returned by mkdtemp() triggers gcc\u0027s pointer-to-int-cast\n warning on 32-bit, and the test builds with -Werror.\n\n KernelCI\u0027s 32-bit arm kselftest builds hit this.\n\n* tag \u0027configfs-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:\n selftests/configfs: fix the build on 32-bit architectures\n" }, { "commit": "cb319926808b1cca522d2087a13205e840beb45b", "tree": "85b520c0f06418218284b2917088f7b06f9f1738", "parents": [ "b73fdd0f49e175dd733650669193c1504d283955" ], "author": { "name": "Thorsten Blum", "email": "blum@kernel.org", "time": "Fri Sep 18 16:27:13 2026 +0200" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri Nov 06 09:05:23 2026 -0800" }, "message": "x86/boot: Fix off-by-one error in sme_clear_pgd()\n\nThe mapping helpers __sme_map_range_pmd() and __sme_map_range_pte(), and\ntherefore sme_encrypt_kernel(), use exclusive end addresses and stop\nbefore vaddr reaches vaddr_end.\n\nHowever, sme_clear_pgd() treats vaddr_end as inclusive when calculating\nthe last PGD entry to clear. If vaddr_end is PGD-aligned, the first PGD\nentry outside the range is cleared too.\n\nUse vaddr_end - 1 to calculate the last PGD entry within the range.\n\nFixes: 6ebcb060713f (\"x86/mm: Add support to encrypt the kernel in-place\")\nSigned-off-by: Thorsten Blum \u003cblum@kernel.org\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nCc: \u003cstable@kernel.org\u003e\nLink: https://patch.msgid.link/20260918142714.242711-2-blum@kernel.org\n" }, { "commit": "b556f1c4dc9fa538bb3b27c0b9710e62baca692f", "tree": "92fe3a7e319d79105df14e1bc41e2cca4d3287cf", "parents": [ "fb382e8efdd4b89b0dcd0169abd31d90b7ddd570", "e5801273f93eb7513850b1c38ea14d69f2de1592" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:00:12 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:00:12 2026 -0800" }, "message": "Merge tag \u0027fs_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull udf, ext2, isofs and quota fixes from Jan Kara:\n - Some disk format validation improvements for udf\n - Fix isofs handling of dates before 1900\n - Fix ext2 inadvertedly syncing buffer on every directory modification\n - Fix ext2 O_DSYNC handling for direct IO\n - A couple of smaller ext2 fixes\n - Fix tmpfs quotas for root filesystem\n - Unify my email addresses in MAINTAINERS file\n\n* tag \u0027fs_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n udf: Fix incorrect error code in udf_current_aext()\n udf: Simplify udf_table_prealloc_blocks()\n udf: don\u0027t use eloc after the end of the unallocated space table\n udf: fix preallocation discarding before an empty allocation extent\n udf: check the unallocated space table when it is loaded\n udf: don\u0027t let the extent type hide an exhausted free-space table extent\n ext2: preserve IOMAP_F_DIRTY for extending direct writes\n udf, ext2, quota, jbd2: Unify email addresses in MAINTAINERS\n isofs: handle Rock Ridge long-form dates before 1900\n ext2: only flush DIRSYNC directories on every change\n ext2: preserve completed DIO bytes when buffered fallback fails\n ext2: take invalidate_lock in ext2_write_failed()\n ext2: Make sbi an proper alias for EXT2_SB(sb) in ext2_fill_super()\n udf: Validate extended attribute space is large enough\n quota: initialize dquot cache before mounting rootfs\n udf: validate vat20-\u003elengthHeader and VAT inode size in udf_load_vat()\n" }, { "commit": "fb382e8efdd4b89b0dcd0169abd31d90b7ddd570", "tree": "600300070cc8fdfca73cba8f8d4c085b8b58b381", "parents": [ "0ccc72d4b3fcf8c79178b7024541e1aa694e08a7", "581230d2ec3c0380917d1255792508851e7c4627" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:55:48 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:55:48 2026 -0800" }, "message": "Merge tag \u0027fsnotify_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull fsnotify fixes from Jan Kara:\n \"Two small fixes for fsnotify\"\n\n* tag \u0027fsnotify_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n inotify: do not coalesce rename events\n fsnotify: preserve 64-bit pre-content ranges\n" }, { "commit": "b73fdd0f49e175dd733650669193c1504d283955", "tree": "09ea669d7adfde36769379572e79dfd31dd79174", "parents": [ "ade63af6cfb7b3ca19ced28730fd6461e8d1d410" ], "author": { "name": "Reinette Chatre", "email": "reinette.chatre@intel.com", "time": "Wed Nov 04 16:37:47 2026 -0800" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri Nov 06 08:53:29 2026 -0800" }, "message": "MAINTAINERS: Add Ben Horgan as fs/resctrl reviewer\n\nThe resctrl filesystem provides the user interface to the resource control\nfeatures of multiple architectures, among them Arm\u0027s MPAM. Ben Horgan,\nMPAM maintainer, has consistently helped keep MPAM\u0027s requirements in view,\nboth in discussions about new resctrl features and in review of resctrl\nchanges.\n\nAdd Ben Horgan as a reviewer so that he is copied on resctrl submissions.\n\nSigned-off-by: Reinette Chatre \u003creinette.chatre@intel.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nAcked-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nLink: https://patch.msgid.link/c68cbba4455d3f5e65c38b76b3daadc04217abca.1793838993.git.reinette.chatre@intel.com\n" }, { "commit": "0ccc72d4b3fcf8c79178b7024541e1aa694e08a7", "tree": "59a031210383c8e677ccadb2d3b402886cdec645", "parents": [ "ce8f7280865e90c02878419733b7bed420eba94b", "7ba9663607b31108b4350b604a3c85ae86c67c19" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:50:27 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:50:27 2026 -0800" }, "message": "Merge tag \u0027xfs-fixes-7.4-rc2\u0027 of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"The most notable fix here IMO is for xfs\u0027s pNFS support (mostly\n related to LAYOUTCOMMIT) and for that it contains several patches.\n\n Besides that, this contains bug fixes for different subsystems in xfs.\n The last patch is mostly a refactor than a bug fix, but the refactor\n is done to prevent a nasty journal transaction state corruption to\n happen\"\n\n* tag \u0027xfs-fixes-7.4-rc2\u0027 of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux:\n xfs: kill xfs_trans_set/clear_context() helpers\n xfs: fix recovery of partial attr removals\n xfs: make pNFS LAYOUTCOMMIT stable the way fdatasync does\n xfs: add datasync and log_flushed arguments to xfs_log_force_inode()\n xfs: take the invalidate lock while mapping a pNFS layout\n xfs: clamp the pNFS layout range to the maximum file size\n xfs: cap the block count of xfs_iomap_write_direct() at one extent\n xfs: clamp a pNFS LAYOUTCOMMIT extent before computing its end\n xfs: refuse a pNFS LAYOUTCOMMIT of a range without blocks\n xfs: add a flag to convert unwritten extents without allocating blocks\n xfs: mark the inode preallocated for pNFS write layouts past EOF\n xfs: fix wrong compat fields in xfs_ioctl32_bstat_copyin()\n xfs: fix temporary cursor leak in btree shift corruption paths\n xfs: skip iunlock with empty iolock flags in xfs_file_dio_write_aligned\n xfs: don\u0027t skip free extents of the longest length in a whole-AG FITRIM\n xfs: don\u0027t skip free extents in later batches of a whole-AG FITRIM\n xfs: fix unwind handling during xfs_mount_sysfs_init()\n xfs: mark i_mode\u003d0 and shut down on attr fork inactivation failure\n xfs: set healthmon mount cookie before publishing it\n" }, { "commit": "ce8f7280865e90c02878419733b7bed420eba94b", "tree": "24bc88d3f33422d7360389a242a210c2f1bf4bbd", "parents": [ "41b77d5dccc7809f5f56f0822e00ea55b42691a8", "db1c5da238dc80a61ab429a7b71b0e2835766c45" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:28:14 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:28:14 2026 -0800" }, "message": "Merge tag \u0027ovl-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs\n\nPull overlayfs fixes from Amir Goldstein:\n\n - Fix a self deadlock of a fanotify permission event listener that also\n watches the layers, when it reads an overlay directory\n\n - Three casefold fixes, found by Chris Mason\u0027s AI review\n\n - Fix a decode of a modified file handle with nfs_export\u003don, which\n could read the stale lower data of a copied up file, also found by\n Chris Mason\u0027s AI review\n\n - Fix an overlay selftest after an errno change\n\n* tag \u0027ovl-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:\n selftests/fscontext_ns: expect EINVAL for overlay descendant userns create\n ovl: look up the index by the decoded origin\n ovl: inherit FMODE_NONOTIFY when reading directory layers\n ovl: inherit FMODE_NONOTIFY when opening directory realfiles\n ovl: fix whiteout creation in casefolded directories\n ovl: do not let chattr change the casefold flag\n ovl: fail the mount if the casefold flag has changed\n" }, { "commit": "ac302aea3d824ccc99f29b8e499c365cb9a684a9", "tree": "d83c1190893e2223afd4ff37f6694cc7c24b4df5", "parents": [ "b0958b1397fb5ffdb995c0ccc74349841929c08d" ], "author": { "name": "Jinjie Ruan", "email": "ruanjinjie@huawei.com", "time": "Thu Nov 05 20:57:24 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 16:25:34 2026 +0000" }, "message": "arm64: kexec_file: Fix elf_headers memory leak in retry loop\n\nA retry allocates new elf headers and overwrites image-\u003eelf_headers,\nleaking the previous buffer.\n\nFree it before assigning.\n\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Thomas Huth \u003cthuth@redhat.com\u003e\nCc: Breno Leitao \u003cleitao@debian.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Yeoreum Yun \u003cyeoreum.yun@arm.com\u003e\nCc: Baoquan He \u003cbhe@redhat.com\u003e\nCc: stable@vger.kernel.org\nFixes: 108aa503657e (\"arm64: kexec_file: try more regions if loading segments fails\")\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Jinjie Ruan \u003cruanjinjie@huawei.com\u003e\n[catalin.marinas@arm.com: drop the redundant NULL check before vfree()]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "41b77d5dccc7809f5f56f0822e00ea55b42691a8", "tree": "4e8145baa0871f805bf3bab96f53c2f170fdf98e", "parents": [ "f66469d9905b39d2c260a15d7d6db450f4db67c1", "a02926f7c89bfc798ee9514e09694ff4279928a1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:16:23 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:16:23 2026 -0800" }, "message": "Merge tag \u0027xsa526-xsa528-7.4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n \"Fix three UAF issues that can be hit in the Xen netback and blkback\n drivers when a guest is forcing a teardown of a PV device\"\n\n* tag \u0027xsa526-xsa528-7.4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen-blkback: Avoid UAF when reading I/O statistics\n xen-netback: defer xenvif_mcast_addr_list_free()\n xen-netback: Fix UAF when reading statistics data\n" }, { "commit": "a02926f7c89bfc798ee9514e09694ff4279928a1", "tree": "9e7e8cad8dc7b350aea8a69d385a7130dc8cb92d", "parents": [ "bfddc420afe827d9f06458cdf8087cd602f8c9cb" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu Nov 05 08:27:38 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:09:08 2026 +0100" }, "message": "xen-blkback: Avoid UAF when reading I/O statistics\n\nReading I/O statistics via sysfs concurrently with tearing down a\nfrontend device might result in UAF or a NULL dereference, as the\nreading of the statistics data is not synchronized with freeing the\ndata.\n\nUse a rwlock for synchronizing.\n\nThis is XSA-528 / CVE-2026-100082\n\nFixes: db6fbc106786 (\"xen/blkback: make st_ statistics per ring\")\nReported-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nAcked-by: Roger Pau Monné \u003croger@xenproject.org\u003e\n" }, { "commit": "bfddc420afe827d9f06458cdf8087cd602f8c9cb", "tree": "2e68b6d1562e5807055a26eb1a4653ec2df0648b", "parents": [ "5fb756f1bbec7a3862dda5d79028bf656271804c" ], "author": { "name": "Jan Beulich", "email": "jbeulich@suse.com", "time": "Fri Nov 06 17:07:01 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:09:08 2026 +0100" }, "message": "xen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()\u0027s error path doesn\u0027t require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081.\n\nFixes: b17075d5c198 (\"xen-netback: fix race condition on XenBus disconnect\")\nReported-by: kerhunt \u003ckerhunt@proton.me\u003e\nSigned-off-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "5fb756f1bbec7a3862dda5d79028bf656271804c", "tree": "15aedb616568e17d286e04d1a2cb8f71f5e00166", "parents": [ "05441d697f7f9a927264f4058cbbc6a03dfcac9d" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 13:07:52 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:08:55 2026 +0100" }, "message": "xen-netback: Fix UAF when reading statistics data\n\nThe network statistic data in the driver is protected by RCU.\nUnfortunately when tearing down the queues after an error during\nconnecting to the frontend (e.g. due to illegal Xenstore data filled\nin by the guest), the statistic data is being freed without\nsynchronizing the RCU state. In case the data is being read via sysfs\nin this phase, access to already freed memory or memory being in new\nuse is possible.\n\nFix that by calling synchronize_net() before freeing the queue data.\n\nThis is XSA-526 / CVE-2026-100080\n\nReported-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "2cf4be57b301ed2d7af82e70cff5dfd96894d8de", "tree": "840554440aef942334f2800bf8a5ebe2347e7364", "parents": [ "fa77b023eb80cdb297ff32f6b13786e483a81ca8" ], "author": { "name": "Jean-Christophe Guillain", "email": "jean-christophe@guillain.net", "time": "Thu Nov 05 16:32:19 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:44 2026 +0100" }, "message": "iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge\n\npci_upstream_bridge() can return NULL for devices without an upstream\nbridge. The AMD GPU identity mapping quirk dereferences the returned\npointer unconditionally, causing a kernel panic during boot.\n\nCheck the pointer before accessing the bridge vendor ID.\n\nThis fixes a boot regression on a Lenovo system with an AMD PRO\nA10-9700E APU. The system now boots with AMD IOMMU enabled.\n\nFixes: bf5bdfd1f8d4 (\"iommu/amd: Force identity mode for selected GPUs only\")\n\nSigned-off-by: Jean-Christophe Guillain \u003cjean-christophe@guillain.net\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "fa77b023eb80cdb297ff32f6b13786e483a81ca8", "tree": "b07d2c97d7d863f5faadcb7433c9e115448d286b", "parents": [ "e62df37e0eff4d670e78bbd415be2c1675883c15" ], "author": { "name": "Kevin Mitchell", "email": "kevmitch@arista.com", "time": "Thu Nov 05 16:32:18 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:44 2026 +0100" }, "message": "iommu/amd: remove obsolete domain pointer warning on release\n\nA warning is triggered in amd_iommu_release_device() on removal of a\ndevice with an IOMMU_RESV_DIRECT region. The warning is based on the\nfalse assumption that correct attachment to the release_domain will\nalways result in a NULL dev_data-\u003edomain pointer. For devices with\nIOMMU_RESV_DIRECT (and consequently dev-\u003eiommu-\u003erequire_direct), the\nrelease domain is the permanent identity_domain which sets\nitself to dev_data-\u003edomain on attach.\n\nThis behaviour was added in commit e94160488e65 (\"iommu: Generic support\nfor RMRs during device release\"). Commit c21b34762e2f (\"iommu/amd: Set\nrelease_domain to blocked_domain\") caused it to take effect for AMD\nIOMMU.\n\nRemove the warning as it is no longer strictly an error to have a non-NULL\ndomain pointer. As this leaves amd_iommu_release_device() empty, remove it.\n\nThe warning was observed for a device with direct mapped region:\n\n/sys/bus/pci/devices/0000:04:00.0/iommu_group/reserved_regions:\n\n 0x00000000fee00000 0x00000000feefffff msi\n 0x000000fd00000000 0x000000ffffffffff reserved\n 0x0000fffd00000000 0x0000ffffffffffff direct\n\nUpon hotunplug:\n\n[ 28.715475] pcieport 0000:00:03.1: pciehp: Slot(0-3): Link Down\n[ 28.715482] pcieport 0000:00:03.1: pciehp: Slot(0-3): Card not present\n[ 28.715601] ------------[ cut here ]------------\n[ 28.715603] WARNING: drivers/iommu/amd/iommu.c:2521 at amd_iommu_release_device+0x5d/0x70, CPU#4: irq/29-pciehp/99\n[ 28.715657] RIP: 0010:amd_iommu_release_device+0x5d/0x70\n[ 28.715687] Call Trace:\n[ 28.715689] \u003cTASK\u003e\n[ 28.715694] iommu_deinit_device+0x84/0x110\n[ 28.715699] __iommu_group_remove_device+0xa8/0xd0\n[ 28.715703] iommu_bus_notifier+0x48/0x70\n[ 28.715707] notifier_call_chain+0x48/0xe0\n[ 28.715712] blocking_notifier_call_chain+0x45/0x60\n[ 28.715716] bus_notify+0x3b/0x60\n[ 28.715720] device_del+0x259/0x3b0\n[ 28.715730] pci_remove_bus_device+0x85/0x100\n[ 28.715735] pciehp_unconfigure_device+0x9d/0x180\n[ 28.715743] __pciehp_disable_slot+0x47/0xe0\n[ 28.715747] pciehp_handle_presence_or_link_change+0x80/0x5e0\n[ 28.715753] pciehp_ist+0x162/0x290\n\nFixes: c21b34762e2f (\"iommu/amd: Set release_domain to blocked_domain\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kevin Mitchell \u003ckevmitch@arista.com\u003e\nReviewed-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "e62df37e0eff4d670e78bbd415be2c1675883c15", "tree": "11ced107ed00d943dd364ea60d5fe2f0dd6e772d", "parents": [ "ec91bb159dc24eefe144ef8867937f4a055dd0e2" ], "author": { "name": "Akshay Jindal", "email": "Akshay.Jindal@amd.com", "time": "Thu Nov 05 16:32:17 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:43 2026 +0100" }, "message": "iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions\n\ninit_memory_definitions() walks every top-level subtable including the\nIVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets\neach one as a \u0027struct ivmd_header\u0027, solely on m-\u003eflags, without first\nchecking that the subtable\u0027s type actually is one of the IVMD types\n(ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE).\n\n if (m-\u003eflags \u0026 (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))\n init_unity_map_range(m, table);\n\nIVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD\nflags field\u0027s HtTunEn bit. Unlike real hardware, QEMU\u0027s AMD IOMMU\nemulation sets HtTunEn unconditionally (flags\u003d0xD1 for type 0x10,\n0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified\nas a unity-map/exclusion-range IVMD entry, which subsequently results\nin the creation of a bogus pci segment. Eg:\n\n AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000\n\nFix by checking the subtable\u0027s type before treating it as IVMD.\n\nFixes: be2a022c0dd0 (\"x86, AMD IOMMU: add functions to parse IOMMU memory mapping requirements for devices\")\nCc: stable@vger.kernel.org\nSigned-off-by: Akshay Jindal \u003cAkshay.Jindal@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "ec91bb159dc24eefe144ef8867937f4a055dd0e2", "tree": "00787bab9a3345387259654cdbf6fa0645cc3dfb", "parents": [ "b32ecac779bba6e7ac7caeae8c40db4280941634" ], "author": { "name": "Dheeraj Kumar Srivastava", "email": "dheerajkumar.srivastava@amd.com", "time": "Thu Nov 05 16:32:16 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:43 2026 +0100" }, "message": "iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails\n\niommu_snp_enable() checks that the IOMMU can support SNP and sets\namd_iommu_snp_en, then calls snp_rmptable_init() to map the RMP table.\nIf that call fails, CC_ATTR_HOST_SEV_SNP is cleared but amd_iommu_snp_en\nis left set. Later IOMMU initialization uses amd_iommu_snp_en to\nconfigure the IOMMU for SNP, on the assumption that RMP setup succeeded.\n\nClear amd_iommu_snp_en along with CC_ATTR_HOST_SEV_SNP.\n\nFixes: 409f45387c93 (\"x86/sev: Fix broken SNP support with KVM module built-in\")\nSigned-off-by: Dheeraj Kumar Srivastava \u003cdheerajkumar.srivastava@amd.com\u003e\nReviewed-by: Ankit Soni \u003cAnkit.Soni@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "b32ecac779bba6e7ac7caeae8c40db4280941634", "tree": "9bc62b6b19e7267d39ead4ab721ebc1d7995d5ee", "parents": [ "6628e7d4c6b25c8d18f1345e3a20d21829aae7e4" ], "author": { "name": "Mario Limonciello (AMD)", "email": "superm1@kernel.org", "time": "Thu Nov 05 16:32:15 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:42 2026 +0100" }, "message": "iommu/amd: Enable PerfOpt automatically for integrated GPUs\n\nPerfOpt is usable by integrated GPUs in identity mode. Enable it from\nthe IOMMU driver\u0027s domain attachment paths instead of requiring an\namdgpu policy knob and exported enable/disable interfaces.\n\nMark supported integrated GPUs as PerfOpt-eligible when selecting their\ndefault identity domain. Skip GCR3 setup and ATS/PRI/PASID enablement for\nthese identity attachments, then enable PerfOpt after installing the DTE.\nClear PerfOpt before attaching an eligible GPU to a translated or blocked\ndomain, including unmanaged domains used by VFIO. Propagate failures to\nclear bypass, but keep a completed identity attachment successful if the\noptional PerfOpt enable fails.\n\nClear inherited PerfOpt state during initialization, including when a crash\nkernel reuses device tables. Read feature support directly from hardware\nbecause cached features may not be available yet, and stop initialization\nif the initial clear fails.\n\nEach IOMMU has at most one PerfOpt-eligible GPU, so track activation with a\nboolean under the IOMMU lock. Preserve this state while clearing hardware\nat suspend and shutdown, and restore the bit on resume only where it was\nactive. Do not enable PerfOpt unconditionally during early IOMMU\ninitialization.\n\nRemove the amdgpu parameter, driver callbacks, and exported interfaces.\nTranslated attachments retain their normal device capability setup.\n\nSuggested-by: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nSigned-off-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "408b129aac48b574c0c9d11137a89eefba825d5d", "tree": "2762b3f85eaac9bc8d5391b460141b0486def8de", "parents": [ "1b9e01fcc47aff00d2fd64693c5dcd620eff5865" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Sep 15 13:51:12 2026 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 11:16:14 2026 +0100" }, "message": "locking/osq: Fix unlink queue corruption\n\nVery similar to commit 50972fe78f24 (\"locking/osq_lock: Fix osq_lock\nqueue corruption\"), make sure to order the prev-\u003enext store against\nthe next-\u003eprev store.\n\nFixes: 50972fe78f24 (\"locking/osq_lock: Fix osq_lock queue corruption\")\nSuggested-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Waiman Long \u003clongman@redhat.com\u003e\nCc: linux-kernel@vger.kernel.org\n" }, { "commit": "1b9e01fcc47aff00d2fd64693c5dcd620eff5865", "tree": "999018e40020b468e914cb7002505a6cd4c287cd", "parents": [ "aa63c0df79920f6abe1b66e1f8b6443ad2d62d0e" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Sep 15 13:09:33 2026 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 11:16:14 2026 +0100" }, "message": "locking/osq: Switch osq_wait_next()/atomic_cmpxchg() ordering\n\nThe atomic_cmpxchg() in osq_wait_next() removes the current CPU\u0027s node\nfrom the tail of the queue and puts @old_cpu back.\n\nThis is very much like an \u0027unlock\u0027, which is RELEASE, rather than\nACQUIRE.\n\nAdditionally, on success (the only case where the ordering is\neffective), this returns NULL which means both callsites will do nothing\nmore, there are no subsequent operations to order against.\n\nFurthermore, the osq_lock() caller will then return false, indicating\nfailure to acquire -- the mutex must go block. Again, not making a case\nfor ACQUIRE. Neither atomics nor locks provide ordering on failure.\n\nSince ACQUIRE makes no sense, while RELEASE makes it more symmetric with\nosq_unlock(), switch the ordering. This then makes osq_unlock()\nconsistently RELEASE.\n\nFixes: c55a6ffa6285 (\"locking/osq: Relax atomic semantics\")\nSuggested-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Waiman Long \u003clongman@redhat.com\u003e\nCc: linux-kernel@vger.kernel.org\n" }, { "commit": "aa63c0df79920f6abe1b66e1f8b6443ad2d62d0e", "tree": "59390b59c04c8368dc5cb06c0ff7f4c9100a45cc", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Zhuangzhuang Wang", "email": "3050681779@qq.com", "time": "Fri Oct 30 07:07:27 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 11:16:04 2026 +0100" }, "message": "locking/lockdep: Fix inverted \"on\"/\"last\" CPU label in lockdep_print_held_locks()\n\nCommit 051f5d223dfc (\"lockdep: Enable the printing of held locks of\nremote running tasks and print task CPU\") added the task\u0027s CPU to the\n\"locks held by\" line. As the comment above the printk() describes, a\nrunning task should be reported as \"on CPU#N\" and a task that is not\nrunning as \"last CPU#N\". The ternary has the two strings swapped, so\nthe labels are inverted.\n\nSwap the strings so the output matches the comment.\n\nFixes: 051f5d223dfc (\"lockdep: Enable the printing of held locks of remote running tasks and print task CPU\")\nSigned-off-by: Zhuangzhuang Wang \u003c3050681779@qq.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261030-lockdep-fix-cpu-label-v1-1-96875c74b15b@qq.com\n" }, { "commit": "ade63af6cfb7b3ca19ced28730fd6461e8d1d410", "tree": "f166fb5186b24359faa9e122943dd472095fb4ce", "parents": [ "fb685de78e6bf79e49854e7d149f69b125583de5" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Oct 27 03:43:51 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:48:59 2026 +0100" }, "message": "x86/nmi: Ignore negative NMI handler durations\n\nI am seeing NMI handlers in the Meta fleet reported as running for\nabout 584 years. Over 30 days, 11 AMD and Intel machines logged 637\nsuch lines, for example:\n\n AMD EPYC 9D25 (family 0x1a, model 0x11, stepping 0x0):\n [ 1650.616627] INFO: NMI handler (nmi_cpu_backtrace_handler.llvm.9643156322683129580) took too long to run: 18446744073709.551 msecs\n\n Intel Xeon Platinum 8321HC (family 0x6, model 0x55, stepping 0xb):\n [360448.230129] INFO: NMI handler (perf_event_nmi_handler) took too long to run: 18446744071018.936 msecs\n\n Intel Xeon D-2191A (family 0x6, model 0x55, stepping 0x4):\n [81787.188959] INFO: NMI handler (ghes_notify_nmi) took too long to run: 18446744073709.545 msecs\n\nnmi_handle() times each handler with two sched_clock() reads. When the\nsecond read is lower than the first, the u64 subtraction wraps, and\nnmi_check_duration() treats the result as a duration. In the three\nexamples, the clock went back by less than 1 us, by 2.7 s and by about\n6 us.\n\nThe wrapped value is also stored in action-\u003emax_duration. Every later\nreal duration is smaller, so the handler is never reported again until\nthe next boot.\n\nWhatever makes the clock read lower, a negative difference is not a\nduration, so return before it is stored or reported. A clock that steps\nforward is not covered, since that cannot be told from a real stall.\n\nA backwards clock is still worth knowing about, so print the size of\nthe step once per boot. This uses pr_warn_once() rather than WARN, as a\nstack trace says nothing about the clock and panic_on_warn machines\nshould not go down for it.\n\nFixes: 2ab00456ea8a (\"x86: Warn when NMI handlers take large amounts of time\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261027-nmi_negative-v1-1-b436a005eb8a@debian.org\n" }, { "commit": "fb685de78e6bf79e49854e7d149f69b125583de5", "tree": "9b8f01329c1893dc498eef59d3b7a56091185eb6", "parents": [ "dc2334c1752b3c5f58af74f1e7ad6769b38e1f33" ], "author": { "name": "Ridge Lomont", "email": "cyridge@proton.me", "time": "Tue Oct 27 15:29:21 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:47:57 2026 +0100" }, "message": "x86/kcfi: Don\u0027t emit KCFI_REFERENCE() in modules\n\nKCFI_REFERENCE() takes the address of a symbol so that the compiler\nemits its __kcfi_typeid_ symbol, which the SYM_TYPED_FUNC_START()\nassembly implementing it needs. It is used from arch/x86 headers for\n__clear_pages_unrolled(), copy_page(), __memset() and __memmove(), and\nall of that assembly is built into vmlinux.\n\nModules include the same headers, so with CONFIG_CFI\u003dy every module\nalso gets an __ADDRESSABLE() reference to each of these symbols in\n.discard.addressable. This serves no purpose there, and since\n__clear_pages_unrolled() is EXPORT_SYMBOL_GPL, modpost now rejects any\nGPL-incompatible module that includes \u003clinux/mm.h\u003e:\n\n ERROR: modpost: GPL-incompatible module repro.ko uses GPL-only\n symbol \u0027__clear_pages_unrolled\u0027\n\neven though the module never uses the symbol. This makes OpenZFS\nimpossible to build against CFI kernels; its configure checks fail\nin the same way and are misreported as CONFIG_DEBUG_LOCK_ALLOC.\n\nscripts/module.lds.S does not help here: modpost checks \u003cmodule\u003e.o\nbefore the final link, and even after it the discarded section only\nloses its relocations, the undefined symbols stay in .symtab, where\nthe module loader resolves them with the same license check.\n\nOnly emit the reference when building vmlinux.\n\nTested on x86_64 with clang 23.1.3 and CONFIG_CFI\u003dy, with both\nCONFIG_LTO_CLANG_FULL\u003dy (the configuration from the Fixes: commit) and\nCONFIG_LTO_CLANG_THIN\u003dy: vmlinux links without warnings and still contains\n__kcfi_typeid___clear_pages_unrolled, __kcfi_typeid_copy_page,\n__kcfi_typeid___memset and __kcfi_typeid___memmove. It boots in QEMU\nwith no CFI failures. A minimal module with MODULE_LICENSE(\"Proprietary\")\nincluding \u003clinux/mm.h\u003e fails modpost before this change and builds and\nloads after it. OpenZFS builds against a CFI kernel with this change,\nand its pool, encryption, checksum and send/recv operations run\nwithout CFI failures, in QEMU and on a desktop with CFI enforcing.\n\nFixes: 9b041a4b66b3 (\"x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols\")\nAssisted-by: LLM\nSigned-off-by: Ridge Lomont \u003ccyridge@proton.me\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://github.com/openzfs/zfs/issues/18092\nLink: https://patch.msgid.link/20261027-kcfi-reference-modules-v2-1-3a3247f15806@proton.me\n" }, { "commit": "006991aa89974378ee579416dba87adc22cd60fd", "tree": "be01ff0666a019fcdcb24724e662aaf7bdbc4b6f", "parents": [ "5ebdfe12ab96368d0339593129d4ce0bc2bd06f5" ], "author": { "name": "Kayra Cizmeci", "email": "kayracizmeci@gmail.com", "time": "Tue Oct 20 21:54:01 2026 +0300" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:10:52 2026 +0100" }, "message": "sched/cache: Ignore non-fair current in alb_break_llc()\n\nCommit d6b9afab44e23 (\"sched/cache: Fix\nchecking active load balance by only considering the CFS task\")\nstopped using task_util() for non-fair cur.\n\n__active_load_balance_cpu_stop() calls detach_one_task(), that only looks\nto cfs_tasks list. So if the rq-\u003ecurr is not fair, doing a decision\naccording to it is wrong, since we only migrate tasks that is fair.\n\nCommit f0d243a96f26 (\"sched/fair: Avoid creating misfits during\ncache-aware balancing\") passes cur to task_misfits_asym_cpu()\nwithout checking if the cur is in fair class or not. Fix this.\n\nFixes: f0d243a96f26 (\"sched/fair: Avoid creating misfits during cache-aware balancing\")\nSigned-off-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Tim Chen \u003ctim.c.chen@linux.intel.com\u003e\nLink: https://patch.msgid.link/20261020185402.57017-1-kayracizmeci@gmail.com\n" }, { "commit": "5ebdfe12ab96368d0339593129d4ce0bc2bd06f5", "tree": "8dd4d8df49917d611663ebcf99a8186dd5cd0bac", "parents": [ "a0c755e574e37fddb59edf175f27dc3877e7fe23" ], "author": { "name": "Hui Su", "email": "sh_def@163.com", "time": "Wed Oct 21 13:38:34 2026 +0900" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:04:57 2026 +0100" }, "message": "sched/topology: Balance cluster static-key updates\n\nbuild_sched_domains() increments sched_cluster_active once per newly\nbuilt partition that contains an SD_CLUSTER domain.\ndetach_destroy_domains() instead tested the global static key before\ndecrementing it, so destroying a cluster-less partition could drop a\nreference owned by another partition and disable cluster-aware\nscheduling while SD_CLUSTER domains remained installed.\n\nCheck the installed domains before detaching them, only while the key is\nenabled, and decrement only when the removed partition contains an\nSD_CLUSTER domain.\n\nWith two cluster-bearing partitions installed, removing a singleton\npartition left the baseline count at 1 where 2 partitions still\ncarried SD_CLUSTER; the fixed kernel correctly reports 2. On an\nasymmetric cluster topology where the parent partition gains no\ncluster domain, the baseline count drops to 0 while a cluster\npartition remains installed; the fixed kernel keeps it at 1.\n\nFixes: 8881e1639f1f (\"sched/fair: Scan cluster before scanning LLC in wake-up path\")\nSigned-off-by: Hui Su \u003csh_def@163.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: K Prateek Nayak \u003ckprateek.nayak@amd.com\u003e\nReviewed-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nLink: https://patch.msgid.link/20261021043834.1140951-1-sh_def@163.com\n" }, { "commit": "a0c755e574e37fddb59edf175f27dc3877e7fe23", "tree": "cf4ca14b75052a64ca789ba5a4c206f81b0a2e24", "parents": [ "c282051fc2cae2ea54770ebe435dbea090272c25" ], "author": { "name": "Hui Su", "email": "sh_def@163.com", "time": "Fri Oct 23 11:52:07 2026 +0900" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:04:11 2026 +0100" }, "message": "sched/pelt: Fix u32 truncation of the PELT period count\n\naccumulate_sum() computes the number of elapsed PELT periods in a\nu64 but returns u32. When the count is a multiple of 2^32, it is\ntruncated to zero even though the PELT sums have been updated.\n\nThe caller interprets zero as no period boundary crossed and skips\nrecomputing the averages, leaving *_avg stale relative to *_sum.\n\nReturn the period count as u64 so the caller can test it without\ntruncation.\n\nFixes: a481db34b9be (\"sched/fair: Optimize ___update_sched_avg()\")\nSigned-off-by: Hui Su \u003csh_def@163.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Vincent Guittot \u003cvincent.guittot@linaro.org\u003e\nReviewed-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nLink: https://patch.msgid.link/20261023025207.2967903-1-sh_def@163.com\n" }, { "commit": "c282051fc2cae2ea54770ebe435dbea090272c25", "tree": "445875f359c848d13d22dcfbfd3422f53f6b27ce", "parents": [ "0965587d00b84f0a3b0fc94930d4a5f8ff011eda" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Oct 23 08:52:33 2026 +0900" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:04:04 2026 +0100" }, "message": "sched/fair: Clear throttle state when leaving the fair class\n\nTask-based CFS bandwidth throttling removes a task\u0027s fair sched_entity\nwhile the scheduler core still considers the task queued. p-\u003ethrottled\ncarries the fair-specific state across dequeue/enqueue operations.\n\nDEQUEUE_CLASS removes the task from cfs_rq-\u003ethrottled_limbo_list\nbut retains the bit. If the last finite CFS quota is disabled while\nthe task runs in another class, it is absent from the unthrottle walk and\nthe bit survives.\nReturning to fair while cfs_bandwidth_used() is false then performs a real\nfair enqueue with p-\u003ethrottled still set.\n\nAfter bandwidth is re-enabled, a class-change dequeue treats the\nstale bit as limbo state and skips __dequeue_task(). p-\u003ese.on_rq therefore\nremains set, and put_prev_task_fair() places the entity in the EEVDF tree\nwhile the task moves to RT. On exit, the fair picker can select the\nTASK_DEAD task. __schedule() then returns to do_task_dead(),\nwhich hits BUG().\n\nKeep p-\u003ethrottled across migrations and group moves, but clear it on\nDEQUEUE_CLASS because fair-specific state must not outlive fair-class\nmembership. A later return to fair uses the normal enqueue path. That path\nstill respects a throttled cfs_rq.\n\nA KASAN, LOCKDEP and DEBUG_LIST v7.3 kernel reproduced the do_task_dead()\nBUG in 3/3 root and 3/3 delegated uid-1000 runs with CapPrm\u003dCapEff\u003d0 and\nRLIMIT_RTPRIO\u003d1. The fix passed both matrices plus a 3/3 class-switch\ncontrol with bandwidth continuously enabled, without a scheduler warning,\nKASAN report, lockdep splat or crash.\n\nAn AI coding assistant analyzed the state mismatch and drafted the initial\nreproducer, fix candidate and this changelog. The source paths, trigger,\ncontrols and results were rechecked against the cited revisions.\n\nFixes: e1fad12dcb66 (\"sched/fair: Switch to task based throttle model\")\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Aaron Lu \u003cziqianlu@bytedance.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261022235234.150957-1-4ncienth@gmail.com\n" }, { "commit": "0965587d00b84f0a3b0fc94930d4a5f8ff011eda", "tree": "c767901fd3e5fc7adebb3987957d78b0c299cede", "parents": [ "0c93e25ef11a9dee43f6076bd1f09771dc2b167e" ], "author": { "name": "Christian Loehle", "email": "christian.loehle@arm.com", "time": "Thu Oct 15 12:37:54 2026 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:01:52 2026 +0100" }, "message": "sched/core: Account I/O waits independently of delayed dequeue\n\nStarting blkio delay accounting and incrementing rq-\u003enr_iowait in\n__block_task() ties both to removal from the runqueue. With EEVDF delayed\ndequeue, this misses the initial part of an I/O sleep, or the entire\nsleep if the task wakes before it is dequeued. Such tasks are also\nmissing from procs_blocked while their dequeue is delayed. Final dequeue\ncan run in another task\u0027s context, causing delayacct_blkio_start() to\ntimestamp the wrong task.\n\nStart both forms of accounting in try_to_block_task(), when the current\ntask commits to blocking, before delayed dequeue or proxy execution can\nretain it on the runqueue. End both when clearing is_blocked, including\nqueued wakeups and the proxy execution paths that let the current task\ncontinue. Checking is_blocked excludes wakeups that precede blocking.\n\nSave the CPU charged at the start of the wait. Delayed tasks can migrate\nwhile still queued, and proxy execution can also move blocked tasks.\nDecrement the saved CPU\u0027s counter on unblock, regardless of the task\u0027s\ncurrent placement, and remove the old dequeue-based accounting.\n\nCPU iowait continues to classify idle time using the counter on the\ncharged CPU; it does not accumulate the full per-task blocked duration.\n\nCloses: https://lore.kernel.org/r/20261014081731.1068794-1-zhanxusheng@xiaomi.com\nFixes: 152e11f6df29 (\"sched/fair: Implement delayed dequeue\")\nReported-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nSigned-off-by: Christian Loehle \u003cchristian.loehle@arm.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nReviewed-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nLink: https://patch.msgid.link/fd8578a1-e60b-4993-ab51-2b5d63abcf77@arm.com\n" }, { "commit": "0c93e25ef11a9dee43f6076bd1f09771dc2b167e", "tree": "7eff74007a78d83052bb5c6d0b9b19d815adb288", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Sun Oct 25 08:46:57 2026 -0400" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:00:50 2026 +0100" }, "message": "sched/deadline: Fix this_bw on class change of a dying task\n\nMoving a SCHED_DEADLINE task out of the class with sched_setscheduler(2)\nafter it stored TASK_DEAD in do_task_dead(), but before __schedule()\ndequeued it, subtracts its bandwidth from the runqueue\u0027s this_bw twice.\nthis_bw then stays short until reboot: __sub_rq_bw() warns about the\nunderflow or about running_bw \u003e this_bw, and GRUB reclaim for\nSCHED_FLAG_RECLAIM tasks on that CPU is miscomputed.\n\nThe class change dequeues the still queued task with DEQUEUE_SAVE, which\nremoves its bandwidth from running_bw and this_bw. switched_from_dl()\nthen calls task_non_contending(), which, if the 0-lag time has passed,\nremoves it from this_bw again because the task is TASK_DEAD. That\nremoval is meant for the dying task\u0027s own DEQUEUE_SLEEP dequeue, which\nhas removed nothing before it.\n\nDo the TASK_DEAD removal only on that dequeue path.\n\nReproduced under QEMU on x86_64 and riscv64 by moving exiting deadline\ntasks to SCHED_OTHER in a loop; with this patch there is no warning.\n\nFixes: 8fd27231c330 (\"sched/deadline: Track the \"total rq utilization\" too\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nTested-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nLink: https://patch.msgid.link/20261025124657.836229-1-nickolai@csail.mit.edu\n" }, { "commit": "6f083fbccd5f06889bc08e1182bd02c0383b9121", "tree": "04b1666020bcd4f2bc4153c0a07b457c8d1136eb", "parents": [ "526d945ad9c09d42f2482f058e1f41376681627e" ], "author": { "name": "Danish Khateeb", "email": "danishkhateeb03@gmail.com", "time": "Thu Oct 15 10:20:13 2026 -0500" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:52:11 2026 +0100" }, "message": "perf/core: Don\u0027t send SIGTRAP after exec removed the event\n\nA sigtrap event must also set remove_on_exec, so that its SIGTRAP never\nreaches a program after exec. But the signal is sent from task work,\nwhich only runs on the way back to user space. If the event overflows\nshortly before execve(), the task work can still be pending when the\ntask enters execve(), and then runs when execve() returns. By then\nperf_event_exec() has removed the event and the new program has default\nsignal handlers, so the SIGTRAP kills it.\n\nThe exec_stress test in the remove_on_exec selftest catches this and\nfails about half the time in a VM. A process that opens a sigtrap event\non itself and then calls execve() is killed by SIGTRAP in 15% to 50% of\nruns, both on an AMD machine running v7.2 and in a VM, with or without\nclose-on-exec on the event fd.\n\nCommit ffb684f2aa14 (\"perf: Fix race between perf_event_exit_task() and\nperf_pending_task()\") made perf_sigtrap() return once\nperf_event_exit_task() has set ctx-\u003etask to TASK_TOMBSTONE. Exec only\ncalls perf_event_exit_task() when the new program is not dumpable, such\nas a setuid one. An ordinary exec keeps the context and only removes the\nremove_on_exec events, so the SIGTRAP is still sent.\n\nperf_event_exit_event() sets PERF_EVENT_STATE_EXIT when exec removes the\nevent. If the event fd is close-on-exec and was the last reference to\nthe file, exec also queues the file release as task work. Task work runs\nnewest first, so perf_release() runs before the SIGTRAP work and moves\nthe event on to PERF_EVENT_STATE_DEAD. So don\u0027t send the signal when the\nevent state is PERF_EVENT_STATE_EXIT or lower, which means the event has\nbeen removed. That also covers PERF_EVENT_STATE_REVOKED, where the PMU\nis gone.\n\nFixes: 97ba62b27867 (\"perf: Add support for SIGTRAP on perf events\")\nAssisted-by: LLM\nSigned-off-by: Danish Khateeb \u003cdanishkhateeb03@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261015152013.106040-1-danishkhateeb03@gmail.com\n" }, { "commit": "526d945ad9c09d42f2482f058e1f41376681627e", "tree": "c3909ca243e868a9445ab2986d332c1a491c3c90", "parents": [ "927f9c5cdadbc4ac6973bcd1690107fcb392612c" ], "author": { "name": "Leo Yan", "email": "leo.yan@arm.com", "time": "Sun Oct 25 16:24:06 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:50:37 2026 +0100" }, "message": "Revert \"perf/aux: Allocate non-contiguous AUX pages by default\"\n\nThis reverts commit 18049c8cff9cc89daadc4df6975f7d9069638926.\n\nThe original commit claimed that contiguous AUX pages unnecessarily\nexacerbate fragmentation for SPE, TRBE and ETR. This is not generally\nvalid: larger allocations can keep pages with the same lifetime\ntogether, while order-0 allocations can scatter them across large\nblocks and prevent free pages from coalescing [1]. The follow-up\ndiscussion [2] has not established how forcing order-0 allocations\naddresses the reported problem.\n\nTRBE and SPE write to virtually addressed buffers. The TRBE L1 TLB\nhas one entry on Neoverse V2 [3] and two on Neoverse V3 [4]. Small\nmappings increase translation pressure, and TTW stalls can contribute\nto FIFO overflow and trace loss on TRBE.\n\nLarger allocations provide contiguous, aligned chunks for PMD or\ncontiguous-PTE mappings with the proposed vmap() support [5].\nWith the proposed vmap() support already applied, the tests in [2]\nshowed that preferring larger AUX allocations reduced L2 data TLB\nrefills by 99.68% in the TRBE test and 34.74% in the SPE test.\n\nRestore the previous policy of trying higher-order allocations first.\nThe allocator already uses __GFP_NORETRY and falls back to smaller\norders, including order 0, when larger allocations fail.\n\nRemove PERF_PMU_CAP_AUX_PREFER_LARGE, since the restored default\nprovides that preference. Intel PT retains its existing allocation\nbehaviour, with no functional change.\n\n[1] https://lore.kernel.org/all/aPjrRkjiIt6HmXmT@casper.infradead.org/\n[2] https://lore.kernel.org/linux-arm-kernel/20260810-perf_aux_trace_large_granule-v1-0-03306c9339e3@arm.com/\n[3] https://documentation-service.arm.com/static/633fe1ec4c59b30b517730b8#page\u003d52\n[4] https://documentation-service.arm.com/static/67361bd2c7fc0d1f211da382#page\u003d54\n[5] https://lore.kernel.org/linux-mm/20260715120813.3609949-1-jiangwen6@xiaomi.com/\n\nSigned-off-by: Leo Yan \u003cleo.yan@arm.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: James Clark \u003cjames.clark@linaro.org\u003e\nReviewed-by: Dev Jain \u003cdev.jain@arm.com\u003e\nLink: https://patch.msgid.link/20261025-perf_revert_prefer_large_alloc-v1-1-5fb431bbd624@arm.com\n" }, { "commit": "927f9c5cdadbc4ac6973bcd1690107fcb392612c", "tree": "82dbae4480c2a45fc016de5b200c3c816440eb43", "parents": [ "b61c12527223423ab66891b2e8131da0d66537c4" ], "author": { "name": "Ravi Bangoria", "email": "ravi.bangoria@amd.com", "time": "Mon Oct 26 04:18:37 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:50:21 2026 +0100" }, "message": "perf/amd/ibs: Simplify event state handling with IBS_CAPS_DIS\n\nThe IBS_{FETCH|OP}_CTL2[Dis] bit allows IBS sampling to be stopped without\na RMW of IBS_{FETCH,OP}_CTL. Systems providing this bit therefore do not\nrequire the IBS_STARTED and IBS_STOPPED states used to coordinate control\nMSR updates with late NMIs.\n\nAdd a separate stop path for these systems. Preserve the Val bit while\ndisabling the event so that a delayed NMI can be identified and consumed,\nand wait briefly for such an NMI before restarting the event.\n\nLeave the existing handling unchanged on systems without IBS_CAPS_DIS.\n\nCloses: https://lore.kernel.org/r/20261007234815.4026028-1-jmattson@google.com\nFixes: efa5700ec0da (\"perf/amd/ibs: Support IBS_{FETCH|OP}_CTL2[Dis] to eliminate RMW race\")\nReported-by: Jim Mattson \u003cjmattson@google.com\u003e\nSigned-off-by: Ravi Bangoria \u003cravi.bangoria@amd.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Jim Mattson \u003cjmattson@google.com\u003e\nLink: https://lore.kernel.org/r/20261007234815.4026028-1-jmattson@google.com\nLink: https://patch.msgid.link/20261026041838.941-4-ravi.bangoria@amd.com\n" }, { "commit": "b61c12527223423ab66891b2e8131da0d66537c4", "tree": "ecbc4e1cfd663ac002a9d9154e9d723d0bf0a15f", "parents": [ "2c1d35bd95b13b50b43a0cb2167305dabfb54c07" ], "author": { "name": "Ravi Bangoria", "email": "ravi.bangoria@amd.com", "time": "Mon Oct 26 04:18:36 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:45:25 2026 +0100" }, "message": "perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR\n\nIBS hardware captures a sample and raises an NMI. Since the NMI can be\ndelivered with a delay, a privilege change may occur between sample\ncapture and NMI delivery. Because IBS only provides the sample RIP, the\nkernel records GPRs from the NMI pt_regs, which may reflect kernel mode\nif a privilege switch occurred in the interim. This can leak kernel\naddresses to unprivileged users through PERF_SAMPLE_REGS_USER and/or\nPERF_SAMPLE_REGS_INTR.\n\nFix this by using interrupt regs while preparing PERF_SAMPLE_REGS_USER\nand PERF_SAMPLE_REGS_INTR. With the change, when IBS samples a user mode\ninstruction but the NMI is delivered in kernel mode, PERF_SAMPLE_REGS_USER\nwill source its register state from task_pt_regs(current) and\nPERF_SAMPLE_REGS_INTR will be omitted from the data sent to userspace.\n\nIn addition to fixing the kernel address leak, this change also ensures\nGPR snapshot consistency, which resolves the DWARF unwinding issue with\nIBS.\n\nCloses: https://lore.kernel.org/r/CAPu-DQqF0aF6\u003dGS8Z6KKWeeX_V5LiXeKU_rJQZC+uGg8zuTPNw@mail.gmail.com\nFixes: d29e744c7167 (\"perf/x86: Relax privilege filter restriction on AMD IBS\")\nReported-by: Gennady Kupava \u003cgennady.kupava@gmail.com\u003e\nReported-by: Jayapal Ashwin Nair \u003cjanair@amd.com\u003e\nSigned-off-by: Ravi Bangoria \u003cravi.bangoria@amd.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261026041838.941-3-ravi.bangoria@amd.com\n" }, { "commit": "2c1d35bd95b13b50b43a0cb2167305dabfb54c07", "tree": "04beb70a49f2492d9a6902e46b5584ec6b30879c", "parents": [ "5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87" ], "author": { "name": "Ravi Bangoria", "email": "ravi.bangoria@amd.com", "time": "Mon Oct 26 04:18:35 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:40:55 2026 +0100" }, "message": "perf/amd/ibs: Reset CPU0 IBS state on syscore resume\n\nDuring a suspend/resume cycle, all CPUs except CPU0 go through hotplug\ncallbacks, which sets up IBS state. CPU0 bypasses this path, leaving its\nIBS state stale after resume.\n\nFix this bug by explicitly setting CPU0\u0027s IBS state in the\nsyscore -\u003eresume() callback.\n\nFixes: efa5700ec0da (\"perf/amd/ibs: Support IBS_{FETCH|OP}_CTL2[Dis] to eliminate RMW race\")\nSigned-off-by: Ravi Bangoria \u003cravi.bangoria@amd.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Jim Mattson \u003cjmattson@google.com\u003e\nLink: https://patch.msgid.link/20261026041838.941-2-ravi.bangoria@amd.com\n" }, { "commit": "5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87", "tree": "bf949e0a6e7d1d6c8fb8ba92286b14844bb9145f", "parents": [ "772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Sun Oct 25 14:55:08 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:39:43 2026 +0100" }, "message": "perf/core: Clamp deferred callchain entry count to fit u16 header.size\n\nIn perf_callchain_deferred_output(), if trace-\u003enr is large enough that\nsizeof(deferred_event-\u003eevent) + trace-\u003enr * sizeof(u64) + id_header_size\nexceeds U16_MAX, header.size wraps while the output loop still writes\nall trace-\u003enr entries into the ring buffer.\n\nClamp nr per event (accounting for event-\u003eid_header_size when\nsample_id_all is enabled) so the record never overflows u16 header.size.\n\nFixes: c69993ecdd4d (\"perf: Support deferred user unwind\")\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261025215508.1237480-2-irogers@google.com\n" }, { "commit": "772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8", "tree": "a1502666857734d93b1d1849cfc11d826b10ba70", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Sun Oct 25 14:55:07 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:38:16 2026 +0100" }, "message": "perf/core: Include perf_event_attr::defer_output in is_sb_event() check\n\nEvents configured with attr.defer_output \u003d 1 receive deferred callchain\nsideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().\n\nInclude attr-\u003edefer_output in is_sb_event() so that such events are\nattached to the sideband event list even when no other sideband flags\n(such as mmap or comm) are enabled on the event.\n\nFixes: c69993ecdd4d (\"perf: Support deferred user unwind\")\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261025215508.1237480-1-irogers@google.com\n" }, { "commit": "4dd10fbbeb9c33709edc89916e19c03c780a0751", "tree": "9871d2e04bda459c4982438d837e3255d0857cac", "parents": [ "bcd347f31e84ecfb1e45be488b1c7c835b8feb4c" ], "author": { "name": "Kees Cook", "email": "kees+treewide@kernel.org", "time": "Wed Oct 28 23:16:33 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Nov 05 21:55:50 2026 -0800" }, "message": "treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family\n\nMirroring the earlier kmalloc_obj() conversion, convert the\ndevice-managed allocators over to the type-based API using the now\nupdated scripts/coccinelle/api/kmalloc_objs.cocci. The size is derived\nfrom the type rather than written out as a sizeof(), and the result is\na pointer to that type rather than void *, so a mismatch between the\nsize requested and the variable assigned becomes a build error instead\nof being silently accepted.\n\nThe conversions break down as:\n\n\t6713\tdevm_kzalloc_obj()\n\t1749\tdevm_kzalloc_objs()\n\t 307\tdevm_kzalloc_flex()\n\t 91\tdevm_kmalloc_objs()\n\t 82\tdevm_kmalloc_obj()\n\t 2\tdevm_kmalloc_flex()\n\nThe rules deliberately leave alone allocations sized by a string or a\nbyte-sized type, or assigned to a pointer to a byte-sized type, since\nthose are byte buffers rather than objects. Allocations sized by a\nmulti-byte integer type are only converted when they are assigned to a\npointer to that same type, and allocations of pointers to integers or of\nvoid pointers are left alone too. After this change, 528 files still\ncall devm_kmalloc(), devm_kzalloc(), devm_kcalloc(), or\ndevm_kmalloc_array().\n\nBuild tested with allmodconfig on x86_64, arm64, i386, arm, riscv, s390,\nm68k, mips, parisc, sparc, loongarch, arc, xtensa, and openrisc with GCC\n16.2.0 with no new warnings.\n\nSigned-off-by: Kees Cook \u003ckees+treewide@kernel.org\u003e\n" }, { "commit": "bcd347f31e84ecfb1e45be488b1c7c835b8feb4c", "tree": "b8cb15bc70805420800f17c8df03ebcddf87a35d", "parents": [ "0af298e62e5cff4ebf9bec47b8711177a7e2f115" ], "author": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Sun Aug 09 12:41:08 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Nov 05 21:55:49 2026 -0800" }, "message": "coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules\n\nMirroring the kmalloc -\u003e kmalloc_obj conversion rules, do the same for\ndevm_kmalloc. The device-managed allocators differ only by taking the\nmanaging \"struct device *\" as a leading argument, so capture the leading\narguments in an \"expression list\" metavariable rather than repeating\nevery pattern.\n\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\nCc: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\nCc: Nicolas Palix \u003cnicolas.palix@imag.fr\u003e\nCc: \u003ccocci@inria.fr\u003e\n" }, { "commit": "0af298e62e5cff4ebf9bec47b8711177a7e2f115", "tree": "e0582f1712814a4a71743467f2ad2ca6566165ce", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Kees Cook", "email": "kees+treewide@kernel.org", "time": "Wed Oct 28 23:08:12 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Nov 05 21:55:37 2026 -0800" }, "message": "treewide: refresh kmalloc_obj() conversions\n\nRefresh the tree with run of the existing Coccinelle rules in\nscripts/coccinelle/api/kmalloc_objs.cocci, now that they also convert\narrays of multi-byte integers.\n\nThe conversions break down as:\n\n\t435\tkzalloc_objs()\n\t169\tkmalloc_objs()\n\t 52\tkvzalloc_objs()\n\t 47\tkzalloc_obj()\n\t 42\tkvmalloc_objs()\n\t 8\tkmalloc_obj()\n\t 2\tkzalloc_flex()\n\t 2\tkvmalloc_flex()\n\nand 37 existing kmalloc_obj() family calls drop a redundant GFP_KERNEL.\n\nBuild tested with allmodconfig on x86_64 with GCC 16.2.0, and, together\nwith the devm_kmalloc_obj() conversion that follows, on x86_64, arm64,\ni386, arm, riscv, s390, m68k, mips, parisc, sparc, loongarch, arc,\nxtensa, and openrisc with GCC 16.2.0 with no new warnings.\n\nSigned-off-by: Kees Cook \u003ckees+treewide@kernel.org\u003e\n" } ], "next": "f66469d9905b39d2c260a15d7d6db450f4db67c1" }