)]}' { "log": [ { "commit": "fcc1d6eab4ce4ba86ae05a87ecf7ce06cd2ca4d8", "tree": "b56f99c2d0cc46ab2f8d9a53d833fbdaad841569", "parents": [ "5a7c42811589e2da5e7f1fcd45328e7ead70d008" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Mon Jul 27 17:11:25 2026 +0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Aug 27 05:37:45 2026 -0700" }, "message": "Input: st-keyscan - improve probe error handling\n\nUse dev_err_probe() for devm_clk_get() to prevent log spam when probe\nreturns -EPROBE_DEFER.\nDrop the redundant error message after devm_request_irq(), since the\nhelper already reports request failures internally.\nReturn the original error from platform_get_irq() instead of replacing\nit with -EINVAL.\n\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nLink: https://patch.msgid.link/20260727101125.28291-2-phucduc.bui@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "5a7c42811589e2da5e7f1fcd45328e7ead70d008", "tree": "48b0ccc557f61fc4f7c334a80b71cb696a22d90f", "parents": [ "9a29ee801f525bcad71fea021bfe2a030885c8df" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Mon Jul 27 17:11:24 2026 +0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Aug 27 05:37:45 2026 -0700" }, "message": "Input: snvs_pwrkey - tidy up error reporting in probe\n\nDo not print the error twice when acquiring clock fails and drop the\nredundant error message after devm_request_irq(), as the helper already\nreports request failures internally.\n\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nLink: https://patch.msgid.link/20260727101125.28291-1-phucduc.bui@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "9a29ee801f525bcad71fea021bfe2a030885c8df", "tree": "aa3686816899ae58e51de55c9b70bd255529f3cc", "parents": [ "c91d080c4e567562107bcb91c2f72556b317b0a8" ], "author": { "name": "David Heidelberg", "email": "david@ixit.cz", "time": "Thu Aug 06 19:17:46 2026 +0200" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Aug 13 12:13:43 2026 -0700" }, "message": "Input: rmi4 - use platform data instead of query, when available\n\nPlatform data may define touchscreen-x-mm and touchscreen-y-mm, but\nthese were quietly overridden by data provided by sensor.\n\nSigned-off-by: David Heidelberg \u003cdavid@ixit.cz\u003e\nLink: https://patch.msgid.link/20260731-respect-x-y-mm-v1-0-3e85a4bec745@ixit.cz\nLink: https://patch.msgid.link/20260806-respect-x-y-mm-v2-1-e0681ed3d63c@ixit.cz\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "c91d080c4e567562107bcb91c2f72556b317b0a8", "tree": "94f69dc8d031a9df590541875c3d2f298b859913", "parents": [ "ad255410cbfbbd8fb7ab3f86b9946e2b9fa840d4" ], "author": { "name": "Chen-Yu Tsai", "email": "wenst@chromium.org", "time": "Tue Aug 11 20:20:02 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 12 17:44:06 2026 -0700" }, "message": "Input: elan_i2c - sort include statements\n\nSort the include statements before adding new ones in the next change.\n\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Chen-Yu Tsai \u003cwenst@chromium.org\u003e\nLink: https://patch.msgid.link/20260811122011.3539250-3-wenst@chromium.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "ad255410cbfbbd8fb7ab3f86b9946e2b9fa840d4", "tree": "457ce8720b24ed645ec7217f54492d84d19cf9c0", "parents": [ "785a490556b549493a6a25409f16026ce0959b02" ], "author": { "name": "Jingle Wu 吳金國", "email": "jingle.wu@emc.com.tw", "time": "Wed Jul 29 06:19:19 2026 +0000" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 12 17:37:45 2026 -0700" }, "message": "Input: elan_i2c - optimize update speed for IC Type 0x19.\n\nReduce update time by optimizing the update sequence and removing\nunnecessary delays.\n\nSigned-off-by: jingle.wu@emc.com.tw\nLink: https://patch.msgid.link/KL1PR01MB5116A253A126179473EDB7ACDCCA2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "785a490556b549493a6a25409f16026ce0959b02", "tree": "7218a1ec454446a3734ef9cb2b101fd09a35abe6", "parents": [ "8c3ff3164b6ec28f2977f71645a5e6d7fde06924" ], "author": { "name": "Longlong Xia", "email": "xialonglong@kylinos.cn", "time": "Sun Aug 09 22:29:28 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 09 14:48:47 2026 -0700" }, "message": "Input: elan_i2c - use device-id/acpi.h for ACPI IDs\n\nelan-i2c-ids.h only needs struct acpi_device_id from the ACPI\ndevice ID definitions. The MODULE_DEVICE_TABLE() user already includes\n\u003clinux/module.h\u003e.\n\nInclude \u003clinux/device-id/acpi.h\u003e instead of the broader\n\u003clinux/mod_devicetable.h\u003e header.\n\nAssisted-by: Codex:GPT-5\nSigned-off-by: Longlong Xia \u003cxialonglong@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260809142928.4031270-1-xialonglong2025@163.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "8c3ff3164b6ec28f2977f71645a5e6d7fde06924", "tree": "a5ca19dfb9717f95246a389c5559ccd60cc7b009", "parents": [ "876848ad2203d225e927a5f3373900bcbb73c9c5" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Aug 03 16:48:11 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 05 23:01:44 2026 -0700" }, "message": "Input: reject inhibit and uninhibit requests on unregistering devices\n\nWhen an input device is being unregistered via input_unregister_device(),\ninput_disconnect_device() sets dev-\u003egoing_away \u003d true under dev-\u003emutex\nand releases the mutex.\n\nIf a concurrent sysfs write to the inhibited attribute executes\ninput_inhibit_device() or input_uninhibit_device(), it acquires\ndev-\u003emutex. Because neither function checks dev-\u003egoing_away (unlike\ninput_open_device()), input_uninhibit_device() proceeds to call\ndev-\u003eopen() and start polling on a device that is in the middle of being\nunregistered and torn down.\n\nFix this by checking dev-\u003egoing_away in input_inhibit_device() and\ninput_uninhibit_device() under dev-\u003emutex and returning -ENODEV if the\ndevice is going away.\n\nFixes: a181616487db (\"Input: Add \"inhibited\" property\")\nReported-by: sashiko-bot@kernel.org\nAssisted-by: Antigravity:gemini-3.6-flash\nLink: https://patch.msgid.link/anEolqA35rGei9ql@google.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "876848ad2203d225e927a5f3373900bcbb73c9c5", "tree": "1a8477ead76f5083cb9dccf17291874a20eba76e", "parents": [ "ceda733d49b8e94f2e7eac9b74853e635749c320" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 02 17:52:04 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 05 23:01:44 2026 -0700" }, "message": "Input: defer handler\u0027s start() until device is opened\n\nWhen registering an input handle, handler-\u003estart() is currently called\nimmediately. However, the input device might not be fully opened or\nready to process events at this stage, meaning any state synchronization\nevents (like setting LED states) injected by the handler\u0027s start method\nmight be dropped.\n\nMove the handler-\u003estart() invocation to input_open_device(). If it is\nthe first handle opening the device, start() is called after the driver\u0027s\nopen() method has successfully completed and the device is fully prepared.\n\nTo facilitate this, factor out the device startup logic (calling driver\u0027s\nopen and starting polling) into input_start_device().\n\nFor passive observer handlers, their start() method is also deferred\nuntil the handle is opened. Since opening a passive observer handle does\nnot start the underlying hardware device, their start() method is called\nimmediately upon opening, regardless of whether the device is active.\n\nFixes: c7e8dc6ee6d5 (\"Input: add start() method to input handlers\")\nLink: https://patch.msgid.link/20260803005210.1251102-4-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "ceda733d49b8e94f2e7eac9b74853e635749c320", "tree": "3afe46c3bff31ced445c2d17b5db9ebea24595ff", "parents": [ "34135f0540b480d63d76f9ca82c032a92e1f7fa6" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 02 17:52:03 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 05 23:01:44 2026 -0700" }, "message": "Input: call handler-\u003estart() when uninhibiting device\n\nWhen an input device is inhibited via input_inhibit_device(), the driver\nis closed and physical feedback (like LEDs and sounds) is toggled off.\nHowever, from the input core\u0027s perspective, the handles remain open.\n\nWhen the device is later uninhibited, the driver is re-opened. While the\ncore restores simple LED states via input_dev_toggle(), complex handlers\n(such as vt/keyboard) may need to re-synchronize their broader logical\nstate with the hardware.\n\nFixes: a181616487db (\"Input: Add \"inhibited\" property\")\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260803005210.1251102-3-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "34135f0540b480d63d76f9ca82c032a92e1f7fa6", "tree": "6e494111f5cad6570d919232d7201a9aa8003cc5", "parents": [ "35f0a0dceddce3a6008a24716bd02766e511ae49" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 02 17:52:02 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 05 23:01:44 2026 -0700" }, "message": "Input: clear inhibited flag before re-opening device on uninhibit\n\nWhen uninhibiting a device, we previously called dev-\u003eopen() and started\nthe poller before clearing dev-\u003einhibited. Since drivers (like\ngpio_keys) often report initial state during open(), and pollers report\nevents immediately upon starting, these initial events were dropped by\ninput_get_disposition() because dev-\u003einhibited was still true.\n\nFix this by clearing dev-\u003einhibited before calling dev-\u003eopen(), ensuring\ninitial events are delivered to handlers, and restoring dev-\u003einhibited \u003d\ntrue if dev-\u003eopen() fails.\n\nFixes: a181616487db (\"Input: Add \"inhibited\" property\")\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260803005210.1251102-2-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "35f0a0dceddce3a6008a24716bd02766e511ae49", "tree": "e581d08d9cbecab114abb79fbb07ede3df536a01", "parents": [ "e07c509ad6eae086e330db359a32663aabe2b0d3" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 02 17:52:01 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 05 23:01:44 2026 -0700" }, "message": "Input: ensure device is ready before delivering events\n\nWhen a device is opened via input_open_device(), the driver\u0027s open()\ncallback is invoked. Some drivers, like cm109, submit URBs or perform\nother hardware initialization in their open() callbacks.\n\nHowever, the input core does not prevent dev-\u003eevent() from being called\nconcurrently during the driver\u0027s open() execution. For instance, if a\nconsole beep occurs, the kbd handler might inject an EV_SND event. This\ncan lead to double list_add BUGs if the driver submits the same URB in\nboth open() and event() paths without adequate synchronization.\n\nTo fix this, introduce a ready flag in the input_dev structure.\nFor complex devices (where dev-\u003eopen is defined), this flag is set to true\nonly after the driver\u0027s open() method successfully completes. The core now\nchecks ready in input_event_dispose() and input_dev_toggle()\nto prevent events from reaching the hardware before it is fully prepared.\nFor simple devices (no open callback), events are delivered immediately.\n\nWe also replay the logical state in input_open_device() by calling\ninput_dev_toggle() right after marking the device ready, ensuring no\nevents are permanently lost.\n\nIn the inhibit path, we ensure that physical feedback (LEDs/sounds) is\nturned off before the device is closed, and we synchronize the inhibited\nstate transition under the event lock to prevent races with incoming events.\n\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260803005210.1251102-1-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "e07c509ad6eae086e330db359a32663aabe2b0d3", "tree": "fb6e4a9f7bde997bbc5e3fbdb63e4458c3d018cc", "parents": [ "f523729aa10bb721eced4784e20d11223255faf8" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 05 14:12:30 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Aug 05 22:45:01 2026 -0700" }, "message": "Input: gscps2 - supply PA-RISC keyboard keymap via device property\n\nInstead of hardcoding PA-RISC specific keycode tables into atkbd via\ncompile-time inclusion, have the gscps2 PS/2 port driver attach a\nlinux,keymap software node device property to the serio device when\na keyboard port is registered. This allows atkbd to dynamically fetch\nand apply the custom keymap when probing the port using generic\nfirmware property helpers, removing architecture-specific hacks from\ngeneric keyboard driver code.\n\nCo-locate the keymap definitions with the serio port driver by moving\nhpps2atkbd.h from drivers/input/keyboard/ to drivers/input/serio/.\nTo handle the five conflicting keys on RDI PrecisionBook laptops without\nruntime model string checks or duplicate keymap tables in memory, add\nCONFIG_SERIO_GSCPS2_RDI_KEYCODES to drivers/input/serio/Kconfig and\nresolve the conflicting keycodes at compile time via preprocessor\nmacros.\n\nLink: https://patch.msgid.link/am_9BvmZu9g4RlUM@google.com\nAcked-by: Helge Deller \u003cdeller@gmx.de\u003e\nTested-by: Helge Deller \u003cdeller@gmx.de\u003e\nAssisted-by: Antigravity:gemini-3.5-flash\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f523729aa10bb721eced4784e20d11223255faf8", "tree": "96cc8b65b0cfb0b6ed9715fc0f757e84ad3d1115", "parents": [ "5005fa144501d866c392f7fc3d84ba7c2939ee20" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Thu Jul 30 02:09:35 2026 +0900" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Aug 04 21:27:53 2026 -0700" }, "message": "Input: synaptics_i2c - return 0 explicitly on success\n\nerror is always zero at the last return in synaptics_i2c_reg_set().\nExplicitly return 0 on the success path instead of returning error,\nwhich is the preferred way when there are multiple failure points.\n\nNo functional change.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nLink: https://patch.msgid.link/20260729171001.260698-4-ekffu200098@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "5005fa144501d866c392f7fc3d84ba7c2939ee20", "tree": "5d4167c160f4e11cad8cd0e207926e67b66cf042", "parents": [ "f6efbdcecdeeba4bf81fcebb3397a817f5e3ae7b" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Thu Jul 30 02:09:34 2026 +0900" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Aug 04 21:27:53 2026 -0700" }, "message": "Input: rmi_smbus - remove conditional return with no effect\n\nBoth branches of the check return the same value, so the check has no\neffect. Remove it and return the value directly.\n\nThis is the result of running the Coccinelle script from\nscripts/coccinelle/misc/cond_return_no_effect.cocci.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nLink: https://patch.msgid.link/20260729171001.260698-3-ekffu200098@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f6efbdcecdeeba4bf81fcebb3397a817f5e3ae7b", "tree": "780f0c58bce49ba66d3e50d4828412df06fc64ef", "parents": [ "7f9c8c6716a97e55ab52426df98a3b4007174757" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Thu Jul 30 02:09:33 2026 +0900" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Aug 04 21:27:53 2026 -0700" }, "message": "Input: pmic8xxx-keypad - remove conditional return with no effect\n\nBoth branches of the check return the same value, so the check has no\neffect. Remove it and return the value directly.\n\nThis is the result of running the Coccinelle script from\nscripts/coccinelle/misc/cond_return_no_effect.cocci.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nLink: https://patch.msgid.link/20260729171001.260698-2-ekffu200098@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "7f9c8c6716a97e55ab52426df98a3b4007174757", "tree": "76e40ec495c1762a99a6c9981b9d97378a475cec", "parents": [ "fbe47f041262590f4dc1267f90fa97a0506acb28" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Aug 03 22:09:54 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Aug 03 22:24:02 2026 -0700" }, "message": "Input: focaltech - use signed coordinates to prevent underflow\n\nfocaltech_finger_state stores finger coordinates x and y as unsigned\nint. When processing relative packets, negative deltas can cause\nunsigned integer underflow if the finger moves past the left or bottom\nboundary of the touchpad, wrapping the coordinates to values near\nUINT_MAX.\n\nWhen clamping the coordinates in focaltech_report_state(), these\nunderflowed values are clamped against priv-\u003ex_max / priv-\u003ey_max instead\nof 0, causing the cursor to jump erratically to the opposite edge of the\ntouchpad.\n\nChange the coordinate variables and limits to signed int so that\nnegative values resulting from relative movements clamp correctly to 0,\nand write the clamped values back to state in focaltech_report_state()\nto prevent coordinate wind-up accumulation at the touchpad boundaries.\n\nFixes: 05be1d079ec0 (\"Input: psmouse - support for the FocalTech PS/2 protocol extensions\")\nReported-by: sashiko-bot@kernel.org\nLink: https://patch.msgid.link/am_tH_F938rK6ask@google.com\nAssisted-by: Antigravity:gemini-3.6-flash\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "fbe47f041262590f4dc1267f90fa97a0506acb28", "tree": "c0ee1554e1f6040bad2280faf2bd14765e5e948e", "parents": [ "c1df7e4e4951ee786c2e5eec002ac3a56848ea1f" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Jul 26 22:08:01 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Aug 03 17:06:27 2026 -0700" }, "message": "Input: psmouse - use guard() for resource management\n\nReplace manual serialization with guard(mutex) and guard(serio_pause_rx)\nwhere appropriate. This eliminates the need for explicit goto-based error\npaths.\n\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260727050803.1269941-4-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "c1df7e4e4951ee786c2e5eec002ac3a56848ea1f", "tree": "c28d737a29e027e115440023c7bc694454befb90", "parents": [ "ad8d3b91e48e1d9b7f94a5cc46cd6e4fd58dc6f5" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Jul 26 22:08:00 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Aug 03 17:06:26 2026 -0700" }, "message": "Input: psmouse - modernize PNP ID parsing\n\nRewrite psmouse_matches_pnp_id() to parse and match the space-separated\nPNP ID string directly in place without dynamic memory allocation.\n\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260727050803.1269941-3-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "ad8d3b91e48e1d9b7f94a5cc46cd6e4fd58dc6f5", "tree": "89b8d11ff839b33abb777dd7cda6271dea328cf3", "parents": [ "761c2040a7d4466c11fb59f3cab94d4078e6da29" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Jul 26 22:07:59 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Aug 03 17:06:26 2026 -0700" }, "message": "Input: psmouse - clean up locking around disable_work_sync()\n\nIn the past, psmouse_disconnect() used cancel_work_sync(). Because\ncancel_work_sync() must be called with the psmouse_mutex dropped, and we\nneeded to prevent psmouse_receive_byte() from re-queueing the work\nbehind our back, the code transitioned the device to PSMOUSE_CMD_MODE\nwhile holding the mutex, then dropped the mutex and cancelled the work.\n\nWhen cancel_work_sync() was replaced with disable_work_sync() in this\npath, the mutex juggling remained. However, disable_work_sync()\ninherently prevents the work from being executed or re-queued, making\nthe mutex juggling unnecessary.\n\nClean this up by moving disable_work_sync() to the very top of\npsmouse_disconnect(), before we acquire psmouse_mutex.\n\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260727050803.1269941-2-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "761c2040a7d4466c11fb59f3cab94d4078e6da29", "tree": "3f76a63dba615f42fcca9257598bfaf4945d2357", "parents": [ "50411cada028f54d859d4b2361c1d87168562c49" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Jul 26 22:07:58 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Aug 03 17:06:26 2026 -0700" }, "message": "Input: psmouse - fix use-after-free during protocol disconnect\n\nWhen a PS/2 mouse is disconnected or unbound, psmouse_disconnect() calls\nthe protocol disconnect handler (psmouse-\u003edisconnect()). During this time,\nstray bytes arriving from the physical controller can still be passed to\npsmouse_handle_byte(), which will invoke psmouse-\u003eprotocol_handler().\n\nThis creates an asynchronous race condition with vendor disconnect handlers\n(such as synaptics_disconnect()), which free vendor-specific private\nstructures (psmouse-\u003eprivate). If a byte arrives while the structures\nare being freed, it leads to a use-after-free or NULL pointer\ndereference in the protocol handler.\n\nFix this by explicitly setting psmouse-\u003eprotocol_handler to NULL\nsafely wrapped in scoped_guard(serio_pause_rx, serio) immediately before\ncalling the vendor disconnect handler. We also add an unlikely check\nin psmouse_handle_byte() to safely drop incoming bytes if the protocol\nhandler is NULL.\n\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260727050803.1269941-1-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "50411cada028f54d859d4b2361c1d87168562c49", "tree": "794c0c877fc5a38d99a86469261163d537203b90", "parents": [ "9ce8270e30f567a10a9f98083084938e02de957d" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jul 13 22:39:39 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 02 18:29:01 2026 -0700" }, "message": "Input: samsung-keypad - use pm_runtime_active guard\n\nSimplify the driver by using the block-scope guard(pm_runtime_active)\ninstead of manually invoking pm_runtime_get_sync() and\npm_runtime_put().\n\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260713-samsung-kp-irq-v2-3-acc84b6daf9a@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "9ce8270e30f567a10a9f98083084938e02de957d", "tree": "7dc7fa2c583e1c890f063ba8ce051c9b86793d57", "parents": [ "116087d9db1502de054fb0453fdb002c0562019d" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jul 13 22:39:38 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 02 18:29:01 2026 -0700" }, "message": "Input: samsung-keypad - keep interrupt disabled while closed\n\nThe driver requests the interrupt during probe, which by default enables\nit. If the bootloader left the keypad interrupts enabled, or if a\nspurious interrupt fires early before the driver is fully initialized\nand clocks are enabled, the interrupt handler will attempt to read\nregisters and may cause a synchronous external abort.\n\nFix this by requesting the interrupt with IRQF_NO_AUTOEN, keeping it\ndisabled during probe. Enable the interrupt in samsung_keypad_start()\nwhen the device is opened and ready, and disable it in\nsamsung_keypad_stop() when the device is closed. Remove the redundant\nre-enabling of the interrupt at the end of samsung_keypad_stop().\n\nAdditionally, manually clear the pending interrupt status during system\nresume when the device is closed to avoid immediate resume.\n\nFixes: 0fffed27f92d (\"Input: samsung-keypad - Add samsung keypad driver\")\nAssisted-by: Antigravity:gemini-3.1-pro\nLink: https://patch.msgid.link/20260713-samsung-kp-irq-v2-2-acc84b6daf9a@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "116087d9db1502de054fb0453fdb002c0562019d", "tree": "19f5a9719e6807b24df8d1fa070e43830c429633", "parents": [ "337e5910dcbc38a656e446a6c8a7b37bd496f476" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jul 13 22:39:37 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sun Aug 02 18:29:01 2026 -0700" }, "message": "Input: samsung-keypad - clean up wakeup configuration logic\n\nWhen checking if the device can wake the system, we should pull the\ndevice_may_wakeup() check to the caller instead of repeating it inside\nthe toggle_wakeup() handler. Furthermore, when configuring the wakeup,\nwe should safely ensure we write to the registers in the correct order:\nconfigure the interrupt receiver before enabling the peripheral\u0027s wake\nfunctionality, and vice-versa.\n\nAssisted-by: Antigravity:gemini-3.1-pro\nLink: https://patch.msgid.link/20260713-samsung-kp-irq-v2-1-acc84b6daf9a@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "337e5910dcbc38a656e446a6c8a7b37bd496f476", "tree": "0939c6ce33924b444125aa10cc76e7a897a95ba4", "parents": [ "aa7ab8c6f5bffcc502d444ba3f3c510fc6f00d4f" ], "author": { "name": "Bivash Kumar Singh", "email": "bivashraj750@gmail.com", "time": "Sat Jul 25 18:38:03 2026 +0530" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Jul 25 18:16:12 2026 -0700" }, "message": "Input: inexio - replace printk with dev_dbg and fix missing space\n\nReplace printk(KERN_DEBUG) with dev_dbg() using the serio device,\nwhich is the correct logging style for driver code. Also fix missing\nspace after comma in the function argument, and remove the redundant\n\u0027inexio.c:\u0027 filename prefix from the message.\n\nSigned-off-by: Bivash Kumar Singh \u003cbivashraj750@gmail.com\u003e\nLink: https://patch.msgid.link/20260725130803.6763-1-bivashraj750@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "aa7ab8c6f5bffcc502d444ba3f3c510fc6f00d4f", "tree": "09b74c222d53713eb01b87ca99ffc6e9a85f8924", "parents": [ "691f40e482dc853c4548cbdf4cab1aa666d20aab" ], "author": { "name": "Bivash Kumar Singh", "email": "bivashraj750@gmail.com", "time": "Sat Jul 25 17:06:38 2026 +0530" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Jul 25 18:13:53 2026 -0700" }, "message": "Input: elo - fix coding style issues in elo_setup_10()\n\nFix two checkpatch warnings in elo_setup_10():\n- Add missing space around \u0027-\u0027 operator in array index expression\n- Add missing \u0027const\u0027 qualifier to elo_types pointer array, since\n the array is never modified after initialization\n\nSigned-off-by: Bivash Kumar Singh \u003cbivashraj750@gmail.com\u003e\nLink: https://patch.msgid.link/20260725113638.5147-1-bivashraj750@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "691f40e482dc853c4548cbdf4cab1aa666d20aab", "tree": "49ef1686a700a1d16fe464822ee50a42bde80c87", "parents": [ "d519f155d14100b8cae47a2edee4f7cee38fe300" ], "author": { "name": "Eduard Bostina", "email": "egbostina@gmail.com", "time": "Thu Jul 23 10:06:01 2026 +0000" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 24 18:22:03 2026 -0700" }, "message": "dt-bindings: input: Convert TI TPS65217 power button to DT schema\n\nConvert the Texas Instruments TPS65217 and TPS65218 Power Button\nbindings to DT schema.\n\nSigned-off-by: Eduard Bostina \u003cegbostina@gmail.com\u003e\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260723100605.628882-4-egbostina@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "d519f155d14100b8cae47a2edee4f7cee38fe300", "tree": "06da27c471d149b484836ba35b39ebd6dc1580e7", "parents": [ "e640910640676b88883db616c78bd26dc9eab428", "6c0c972cacb5e78df02d44b5e89ed40779d26bba" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 24 18:20:28 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 24 18:20:28 2026 -0700" }, "message": "Merge branch \u0027ib-mfd-legacy-gpio-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next\n\nSync up with MFD tree to get updates to ROHM drivers.\n" }, { "commit": "e640910640676b88883db616c78bd26dc9eab428", "tree": "d9277b4fc0cc3cdfe5d1bc1eb635d5bf054cf692", "parents": [ "0aa7c205e901ad75f4785f786b32a2b01b896a9b" ], "author": { "name": "Surendra Singh Chouhan", "email": "kr494167@gmail.com", "time": "Thu Jul 23 07:59:43 2026 +0530" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 24 18:18:47 2026 -0700" }, "message": "Input: charlieplex_keypad - check gpiod_direction_output() return value\n\ncharlieplex_keypad_scan_line() currently ignores the return value of\ngpiod_direction_output() when setting the active output line for scanning.\n\nIf setting the GPIO direction fails (e.g. on I2C/SPI GPIO expanders or\nhardware errors), the function continues to sleep and read input values\nfrom an improperly configured GPIO line.\n\nFix this by capturing the return value of gpiod_direction_output() and\nreturning the error code immediately if it fails.\n\nFixes: 2ca45e57ea02 (\"Input: charlieplex_keypad - add GPIO charlieplex keypad\")\nSigned-off-by: Surendra Singh Chouhan \u003ckr494167@gmail.com\u003e\nLink: https://patch.msgid.link/20260723022943.9337-1-kr494167@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "0aa7c205e901ad75f4785f786b32a2b01b896a9b", "tree": "a62fbe34856efb91e94731eddcd0d32b9931115b", "parents": [ "d6b0c1c2f3e8d8bd7b6f60b02cc7a37bff117fa6" ], "author": { "name": "Pengpeng Hou", "email": "pengpeng@iscas.ac.cn", "time": "Wed Jul 15 16:38:50 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 24 18:18:47 2026 -0700" }, "message": "Input: iqs5xx - validate firmware record destination span\n\nThe firmware record parser checks that the record address starts within\nthe programmable map, but does not check that the complete record data\nfits in that map. A record near the end of the map can therefore make\nthe copy to pmap exceed its destination span.\n\nCheck the record length against the remaining programmable map range\nbefore copying the record data.\n\nFixes: 7b5bb55d0dad (\"Input: add support for Azoteq IQS550/572/525\")\nSigned-off-by: Pengpeng Hou \u003cpengpeng@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "d6b0c1c2f3e8d8bd7b6f60b02cc7a37bff117fa6", "tree": "581a14bb59d983f457e0802e5b50660dd008802c", "parents": [ "29fb42d56f1d8c10dd26e3f8410a825b6905dbc3" ], "author": { "name": "Pradyot Kumar Nayak", "email": "pradyot.nayak@oss.qualcomm.com", "time": "Fri Jul 17 17:28:34 2026 +0530" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 17 09:53:55 2026 -0700" }, "message": "dt-bindings: input: focaltech,ft8112: Add focaltech,ft3d81 compatible\n\nThe Focaltech ft3d81 is fully compatible with the ft8112 i.e.\nit uses the same I2C-HID protocol and the same power-on/reset sequencing,\nDT nodes for boards carrying an ft3d81,can therefore bind to the existing\nft8112 driver without any additional changes.\n\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nSigned-off-by: Pradyot Kumar Nayak \u003cpradyot.nayak@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260717-add_focaltech_ft3d81_touchscreen_support-v4-1-5dd091e25801@oss.qualcomm.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "29fb42d56f1d8c10dd26e3f8410a825b6905dbc3", "tree": "0ba0bf2624962841676fee20c3cf82098680f04c", "parents": [ "5a040cd37f397060e6ec8d6894ed0075859ff5cd" ], "author": { "name": "Joy Zou", "email": "joy.zou@nxp.com", "time": "Wed Jul 15 17:33:54 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 17 09:53:55 2026 -0700" }, "message": "Input: snvs_pwrkey - add press event reporting to avoid event loss during suspend\n\nThe driver implements debounce protection using a timer-based mechanism:\nwhen a key interrupt occurs, a timer is scheduled to verify the key state\nafter DEBOUNCE_TIME before reporting the event. This works well during\nnormal operation.\n\nHowever, key press events can be lost during system resume on platforms\nlike i.MX8MQ-EVK because:\n1. During the no_irq resume phase, PCIe driver restoration can take up to\n200ms with IRQs disabled.\n2. The power key interrupt remains pending during the no_irq phase.\n3. If the key is released before IRQs are re-enabled, the timer eventually\nruns but sees the key as released and skips reporting the event.\n\nTo prevent event loss during system suspend, set a pending_press flag in\nthe interrupt handler and report the press event from the timer callback\nwhen the flag is set. This avoids out-of-order event delivery and keeps\nthe existing timer-based debounce mechanism for normal operation.\n\nSigned-off-by: Joy Zou \u003cjoy.zou@nxp.com\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nLink: https://patch.msgid.link/20260715-b4-pwrkey-v5-4-07e7353c319e@oss.nxp.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "5a040cd37f397060e6ec8d6894ed0075859ff5cd", "tree": "3ae330dfc33a6f3c0f2aced8a954711d4fbddd98", "parents": [ "7ef54727f5a2deef5c59623f0685056b2e8a1676" ], "author": { "name": "Joy Zou", "email": "joy.zou@nxp.com", "time": "Wed Jul 15 17:33:53 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Jul 16 12:03:11 2026 -0700" }, "message": "Input: snvs_pwrkey - use local device pointer to simple code\n\nUse local struct device pointer to avoid reference the platform_device\npointer every time.\n\nNo functional change.\n\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Joy Zou \u003cjoy.zou@nxp.com\u003e\nLink: https://patch.msgid.link/20260715-b4-pwrkey-v5-3-07e7353c319e@oss.nxp.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "7ef54727f5a2deef5c59623f0685056b2e8a1676", "tree": "8d24807c3cc7db93ba05076dbb54e26e80f63822", "parents": [ "a1445ec0be7411f4c76458873ef7456b02688f63" ], "author": { "name": "Joy Zou", "email": "joy.zou@nxp.com", "time": "Wed Jul 15 17:33:52 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Jul 16 12:03:11 2026 -0700" }, "message": "Input: snvs_pwrkey - propagate error code of platform_get_irq()\n\nHardcoding -EINVAL discards the actual error code, which breaks probe\ndeferral (-EPROBE_DEFER) and loses critical diagnostic information\nneeded for proper kernel error handling.\n\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Joy Zou \u003cjoy.zou@nxp.com\u003e\nLink: https://patch.msgid.link/20260715-b4-pwrkey-v5-2-07e7353c319e@oss.nxp.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "a1445ec0be7411f4c76458873ef7456b02688f63", "tree": "d9aed35aa60ff35c903c0c5b838dec441c2f7cbc", "parents": [ "3ed4ba919eb35860ee1867e2851ee3e6f9fe37f5" ], "author": { "name": "Joy Zou", "email": "joy.zou@nxp.com", "time": "Wed Jul 15 17:33:51 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Jul 16 12:03:11 2026 -0700" }, "message": "Input: snvs_pwrkey - make use of dev_err_probe()\n\nAdd dev_err_probe() at return path of probe() to support users to\nidentify issues easier.\n\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Joy Zou \u003cjoy.zou@nxp.com\u003e\nLink: https://patch.msgid.link/20260715-b4-pwrkey-v5-1-07e7353c319e@oss.nxp.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "6c0c972cacb5e78df02d44b5e89ed40779d26bba", "tree": "527a7720af910b258f5514452b2b0601c7b0172b", "parents": [ "13b3dce7dab5cf515cbf43c1d9305269e891c5f4" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Jun 11 08:48:26 2026 -0700" }, "committer": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Thu Jul 16 13:33:04 2026 +0100" }, "message": "mfd: rohm-bd718x7: Use software nodes for gpio-keys\n\nRefactor the rohm-bd7182x7 MFD driver to use software nodes for\ninstantiating the gpio-keys child device, replacing the old\nplatform_data mechanism.\n\nThe power key\u0027s properties are now defined using software nodes and\nproperty entries. The IRQ is passed as a resource attached to the\nplatform device.\n\nThis will allow dropping support for using platform data for configuring\ngpio-keys in the future.\n\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nLink: https://patch.msgid.link/20260611-rohm-software-nodes-v5-2-0244664a3b65@gmail.com\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\n" }, { "commit": "13b3dce7dab5cf515cbf43c1d9305269e891c5f4", "tree": "83869cd4f869d4818b2d36f17db5706f32ad4e07", "parents": [ "dc59e4fea9d83f03bad6bddf3fa2e52491777482" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Thu Jun 11 08:48:25 2026 -0700" }, "committer": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Thu Jul 16 13:32:51 2026 +0100" }, "message": "mfd: rohm-bd71828: Use software nodes for gpio-keys\n\nRefactor the rohm-bd71828 MFD driver to use software nodes for\ninstantiating the gpio-keys child device, replacing the old\nplatform_data mechanism.\n\nThe power key\u0027s properties are now defined using software nodes and\nproperty entries. The IRQ is passed as a resource attached to the\nplatform device.\n\nThis will allow dropping support for using platform data for configuring\ngpio-keys in the future.\n\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nLink: https://patch.msgid.link/20260611-rohm-software-nodes-v5-1-0244664a3b65@gmail.com\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\n" }, { "commit": "3ed4ba919eb35860ee1867e2851ee3e6f9fe37f5", "tree": "3c9d24f443ee9154bca2972960a9f2fee3aa670c", "parents": [ "1cd52a99c868b19b419485d2ae9b76ac3e717c2c" ], "author": { "name": "Ian Bridges", "email": "icb@fastmail.org", "time": "Tue Jul 14 20:22:41 2026 -0500" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Jul 15 14:37:31 2026 -0700" }, "message": "Input: wacom_w8001 - replace strlcat() with a strscpy() helper\n\nIn preparation for removing the strlcat() API[1], replace its five\nuses with a small append helper built on strnlen() and strscpy().\n\nThe five calls append device name fragments to a basename buffer\nthat grows in place across the setup functions. The helper takes\nthe same arguments as strlcat() and writes the same bytes, including\nwhen a fragment is truncated.\n\nLink: https://github.com/KSPP/linux/issues/370 [1]\nSigned-off-by: Ian Bridges \u003cicb@fastmail.org\u003e\nLink: https://patch.msgid.link/albg4Rv7QxvLJD05@dev\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "1cd52a99c868b19b419485d2ae9b76ac3e717c2c", "tree": "5b5159f194b43f7a05c4027eb7ca569b1681fb22", "parents": [ "c31398588d295a77e6b5b62d9a59caafffc797e4" ], "author": { "name": "Zhian Liang", "email": "liangzhan5dev@gmail.com", "time": "Wed Jul 15 13:51:35 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Jul 15 13:57:14 2026 -0700" }, "message": "Input: tca8418_keypad - enable overflow mode per datasheet (SCPS215G)\n\nThe driver currently sets only the overflow interrupt enable bit\n(OVR_FLOW_IEN) in the configuration register, leaving the overflow\nmode bit (OVR_FLOW_M) at its default value of 0.\n\nAccording to the TCA8418 datasheet (SCPS215G, Section 8.6.4.1\n\"Overflow Errata - Description\"), both OVR_FLOW_M (Bit_5) and\nOVR_FLOW_IEN (Bit_3) must be set high for the overflow interrupt\nto be generated. If only OVR_FLOW_IEN is set, FIFO overflow events\nare silently lost without notifying the host.\n\nFix this by setting OVR_FLOW_M alongside OVR_FLOW_IEN in the\nconfiguration register.\n\nSigned-off-by: Zhian Liang \u003cliangzhan5dev@gmail.com\u003e\nLink: https://patch.msgid.link/20260529013900.43854-1-liangzhan5dev@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "c31398588d295a77e6b5b62d9a59caafffc797e4", "tree": "9174dc604cf47817c625d1b649e71be1ceff956a", "parents": [ "72fe16c61b1576176fddda0f84e04fc891f841ea" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 03 23:01:14 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jul 13 19:30:02 2026 -0700" }, "message": "Input: mms114 - fix Y-resolution configuration\n\nIn mms114_setup_regs(), the driver mistakenly uses props-\u003emax_x instead\nof props-\u003emax_y when configuring the low bits of the Y resolution\n(MMS114_Y_RESOLUTION).\n\nFix this by using the correct property.\n\nFixes: 07b8481d4aff (\"Input: add MELFAS mms114 touchscreen driver\")\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260704060115.353049-3-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "72fe16c61b1576176fddda0f84e04fc891f841ea", "tree": "d4ecdad796c24f53e303aa683335af507f262f14", "parents": [ "76904fccf81936c084faebc73ac72c0919a42941" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 03 23:01:13 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jul 13 19:30:02 2026 -0700" }, "message": "Input: mms114 - fix endianness portability in I2C packet layout\n\nThe driver defines the I2C packet layout using C bitfields in struct\nmms114_touch. This is not portable as the layout of bitfields within a\nbyte is compiler-dependent and varies with endianness. On Big Endian\nsystems, the fields will be parsed incorrectly.\n\nFix this by redefining struct mms114_touch with plain u8 fields and\nintroducing bitwise macros to extract the values portably.\n\nReported-by: sashiko-bot@kernel.org\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260704060115.353049-2-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "76904fccf81936c084faebc73ac72c0919a42941", "tree": "aee33280e3559d1efc4463cfebbca7ce9302fbec", "parents": [ "79d7a453c79e818b8059b1aa6d6a7ad53d9d4f72", "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jul 13 19:06:00 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Mon Jul 13 19:06:00 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc3\u0027 into next\n\nSync up with mainline to pull in stable fixes to avoid merge conflicts.\n" }, { "commit": "a13c140cc289c0b7b3770bce5b3ad42ab35074aa", "tree": "d9437e736cf07ba277c13260966ff39c45a58767", "parents": [ "f20d61c22bcaf172d6790b6500e3838e532e71c8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 14:16:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 14:16:39 2026 -0700" }, "message": "Linux 7.2-rc3\n" }, { "commit": "f20d61c22bcaf172d6790b6500e3838e532e71c8", "tree": "8761b3acd1f27a380e7a3ad9b9ebc93d717c82ad", "parents": [ "940d91caf09cc849ac514043bbf5c0e1b43aea0b" ], "author": { "name": "Jaewon Yang", "email": "yong010301@gmail.com", "time": "Mon Jul 13 02:11:47 2026 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:52:34 2026 -0700" }, "message": "tpm: Make the TPM character devices non-seekable\n\nThe TPM character devices expose a sequential command/response\ninterface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE\nenabled.\n\nAfter a command leaves a response pending, pread(fd, buf, 16, 0x1400)\npasses 0x1400 as *off to tpm_common_read(). The transfer length is\nbounded by response_length, but the offset is used unchecked when\nforming data_buffer + *off. A sufficiently large offset therefore causes\nan out-of-bounds heap read through copy_to_user() and, if the copy\nsucceeds, an out-of-bounds zero-write through the following memset().\n\nPositional I/O does not provide coherent semantics for this interface.\nAn arbitrary pread offset cannot represent how much of a response has\nbeen consumed sequentially. The write callback always stores a command\nat the start of data_buffer, while pwrite() does not update file-\u003ef_pos\nand can leave the sequential read cursor stale.\n\nCall nonseekable_open() from both open handlers. This removes\nFMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to\nfail with -ESPIPE before reaching the TPM callbacks, and explicitly\nmarks the files non-seekable. Normal read() and write() continue to use\nthe existing sequential f_pos cursor, leaving the response state machine\nunchanged.\n\nTested on Linux 6.12 with KASAN and a swtpm TPM2 device:\n\n - sequential partial reads returned the complete response\n - pread() and preadv() with offset 0x1400 returned -ESPIPE\n - pwrite() and pwritev() with offset zero returned -ESPIPE\n - the pending response remained intact after the rejected operations\n - a subsequent normal command/response cycle completed normally\n - no KASAN report was produced.\n\nFixes: 9488585b21be (\"tpm: add support for partial reads\")\nLink: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/\nCc: stable@vger.kernel.org\nSigned-off-by: Jaewon Yang \u003cyong010301@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "940d91caf09cc849ac514043bbf5c0e1b43aea0b", "tree": "ed20cdf5a34e7608cda8b4cedc74dfe93ff8ac08", "parents": [ "bffa972b3f66d28732f09d67db09711ac2f93ebe", "1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:43:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:43:26 2026 -0700" }, "message": "Merge tag \u0027staging-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are some staging driver fixes for 7.2-rc3 for some reported bugs\n in the vme_user and rtl8723bs drivers. These include:\n\n - many rtl8723bs OOB fixes for when connecting to \"bad\" wifi hosts\n\n - vme_user bugfixes to correctly validate some user-provided data\n\n All of these have been in linux-next for a while with no reported\n issues\"\n\n* tag \u0027staging-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()\n staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop\n staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop\n staging: rtl8723bs: fix OOB write in HT_caps_handler()\n staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()\n staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()\n staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\n staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()\n staging: vme_user: fix location monitor leak in tsi148 bridge\n staging: vme_user: fix location monitor leak in fake bridge\n staging: vme_user: bound slave read/write to the kern_buf size\n staging: rtl8723bs: don\u0027t drop short TX frames in _rtw_pktfile_read()\n" }, { "commit": "bffa972b3f66d28732f09d67db09711ac2f93ebe", "tree": "a32d462bc81254dedf4681fd2d83b627a76d0489", "parents": [ "8a65af0e39da4f8bfb594c331450bdba8db04add", "3585cfd4563731a8ae406b32807613c667c2b887" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:37:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:37:28 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull Android/IIO fixes from Greg KH:\n \"Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported\n issues in just the binder and iio codebases. Included in here are:\n\n - binder driver bugfixes for both the rust and c versions for\n reported problems\n\n - lots and lots of iio driver bugfixes for lots of reported issues\n (including a hid sensor driver bugfix)\n\n Full details are in the shortlog, all of these have been in linux-next\n with no reported issues\"\n\n* tag \u0027char-misc-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (36 commits)\n iio: event: Fix event FIFO reset race\n iio: imu: inv_icm42600: fix timestamp clock period by using lower value\n iio: light: al3010: fix incorrect scale for the highest gain range\n iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()\n iio: light: tsl2591: return actual error from probe IRQ failure\n iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading\n iio: imu: st_lsm6dsx: deselect shub page before reading whoami\n rust_binder: clear freeze listener on node removal\n rust_binder: reject context manager self-transaction\n rust_binder: use a u64 stride when cleaning up the offsets array\n binder: fix UAF in binder_free_transaction()\n binder: fix UAF in binder_thread_release()\n rust_binder: synchronize Rust Binder stats with freeze commands\n binder: cache secctx size before release zeroes it\n rust_binder: fix BINDER_GET_EXTENDED_ERROR\n iio: adc: ad7779: add missing \u0027select IIO_TRIGGERED_BUFFER\u0027 to Kconfig\n iio: adc: ad4130: add missing `select IIO_TRIGGERED_BUFFER` to Kconfig\n iio: adc: ti-ads124s08: Return reset GPIO lookup errors\n iio: temperature: Build mlx90635 with CONFIG_MLX90635\n iio: light: al3320a: add missing REGMAP_I2C to Kconfig\n ...\n" }, { "commit": "8a65af0e39da4f8bfb594c331450bdba8db04add", "tree": "00bec4501a5f4edcba339a61a2490431fcf4ce3a", "parents": [ "534f8f051e5e1cd9a0cb9e8e0314810f9f9dc069", "302fbbb4fcbdeac2dc8c63a56c1c4e38c4781958" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:29:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:29:38 2026 -0700" }, "message": "Merge tag \u0027tty-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty/serial fixes from Greg KH:\n \"Here are some small tty/serial/vt fixes for 7.2-rc3 that resolve some\n reported problems. Included in here are:\n\n - vt spurious modifier issue that showed up in -rc1 (reported a\n bunch)\n\n - 8250 driver bugfixes\n\n - msm serial driver bugfix\n\n - max310x serial driver bugfix\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027tty-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n serial: 8250: Ignore flow control on suspend/resume with no_console_suspend\n serial: 8250_mid: Disable DMA for selected platforms\n serial: 8250_omap: clear rx_running on zero-length DMA completes\n vt: fix spurious modifier in CSI/cursor key sequences\n serial: msm: Disable DMA for kernel console UART\n serial: max310x: implement gpio_chip::get_direction()\n" }, { "commit": "534f8f051e5e1cd9a0cb9e8e0314810f9f9dc069", "tree": "c5f05dec207c4cf2b23a8a0866795cf32da0f24b", "parents": [ "f4fb100039e96211609dfc44fb24b9e4a8a0f2f9", "6df47500b557e01737eef6f6b07b12f97a35d841" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:12:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:12:41 2026 -0700" }, "message": "Merge tag \u0027usb-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are a number of small USB driver fixes for many reported issues.\n Included in here are:\n\n - usb serial driver corruption and use-after-free fixes\n\n - usb gadget rndis bugfixes for malicious/buggy host connections\n\n - typec driver fixes for a load of different tiny reported issues\n\n - typec mux driver revert for a broken patch in -rc1\n\n - usb gadget driver fixes for many different reported problems\n\n - new usb device quirks added\n\n - usbip tool fixes and some core usbip fixes as well\n\n - dwc3 driver fixes for minor issues\n\n - xhci driver fixes for reported problems\n\n - lots of other tiny usb driver fixes for many tiny issues\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027usb-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits)\n USB: core: ratelimit cabling message\n usb: misc: usbio: fix disconnect UAF in client teardown\n Revert \"usb: typec: mux: avoid duplicated mux switches\"\n USB: chaoskey: Fix slab-use-after-free in chaoskey_release()\n usb: ucsi: huawei_gaokun: move typec_altmode off stack\n usb: typec: tcpci_rt1711h: unregister TCPCI port with devres\n usb: typec: tcpm: Fix VDM type for Enter Mode commands\n usb: typec: ucsi: cancel pending work on system suspend\n usb: typec: class: drop PD lookup reference\n usb: typec: ps883x: Fix DP+USB3 configuration\n usb: xhci: Fix sleep in atomic context in xhci_free_streams()\n xhci: sideband: fix ring sg table pages leak\n usb: gadget: udc: Fix use-after-free in gadget_match_driver\n usb: dwc3: run gadget disconnect from sleepable suspend context\n usb: sl811-hcd: disable controller wakeup on remove\n usb: typec: anx7411: use devm_pm_runtime_enable()\n usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()\n USB: misc: uss720: unregister parport on probe failure\n usb: gadget: function: rndis: add length check for header\n usb: gadget: function: rndis: add length check to response query\n ...\n" }, { "commit": "f4fb100039e96211609dfc44fb24b9e4a8a0f2f9", "tree": "7555e2168fff55bf38ecfe9ee989bba34a2e1a6e", "parents": [ "2f9eb0c54a834009a22f08903d4fdff48be62e28", "7d5c2f679147859c1db97d9f66366ff16909abee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:38:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:38:00 2026 -0700" }, "message": "Merge tag \u0027s390-7.2-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix missing array_index_nospec() call in diag310 memory topology code\n to prevent speculative execution with a user controlled array index\n\n - Fix get_align_mask() return type to match vm_unmapped_area_info\n align_mask, avoiding possible truncation for future larger masks\n\n - Remove empty zcrypt CEX2 files left over after CEX2 and CEX3 driver\n removal\n\n - Add build salt to the vDSO so it gets a unique build id, similar to\n the kernel and modules\n\n* tag \u0027s390-7.2-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390: Add build salt to the vDSO\n s390/zcrypt: Remove the empty file\n s390/mm: Fix type mismatch in get_align_mask().\n s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()\n" }, { "commit": "2f9eb0c54a834009a22f08903d4fdff48be62e28", "tree": "323aa05a37d29c36fa4e8f931d005da23aebc45b", "parents": [ "f4bf75d4e8d278f101254cc7e7f147d4158c0a01", "58a37e7317b06665e21609a2f867a9962e9e2919" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:25:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:25:40 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"The most notable change involves the rseq kselftest common Makefile\n (as it is not RISC-V-specific). The basic approach in the patch\n appears similar to one used in the KVM and S390 selftests (grep for\n LINUX_TOOL_ARCH_INCLUDE and SUBARCH), and the rseq kselftests pass a\n quick build test on x86 after this.\n\n - Avoid a null pointer deference in machine_kexec_prepare() that the\n IMA subsystem can trigger\n\n - Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid\n noise from child atfork handlers that libc might run\n\n - Include Kconfig support for UltraRISC SoCs, already referenced by\n some device drivers; and enable it in our defconfig\n\n - Fix the build of the rseq kselftest for RISC-V by borrowing a\n technique from the KVM and S390 kselftests that includes\n arch-specific header files from tools/arch/\u003carch\u003e/include\n\n - Fix some memory leaks in the RISC-V vector ptrace kselftests\n\n - Clean up some DT bindings and hwprobe documentation\"\n\n* tag \u0027riscv-for-linus-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests\n selftests/rseq: Fix a building error for riscv arch\n riscv: defconfig: enable ARCH_ULTRARISC\n riscv: add UltraRISC SoC family Kconfig support\n riscv: hwprobe.rst: Document EXT_ZICFISS and EXT_ZICFILP\n riscv: hwprobe.rst: Make indentation consistent\n dt-bindings: riscv: sort multi-letter Z extensions alphanumerically\n selftests: riscv: Bypass libc in inactive vector ptrace test\n riscv: Prevent NULL pointer dereference in machine_kexec_prepare()\n" }, { "commit": "f4bf75d4e8d278f101254cc7e7f147d4158c0a01", "tree": "ad79e8c2b0dd968b2795fb3135990b56a7982781", "parents": [ "6205562c5904ee23786239298299043876b1a977", "f47b6b313df9a17010a72b3f389f0a5e9e49db3b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 10:16:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 10:16:25 2026 -0700" }, "message": "Merge tag \u0027m68knommu-fixes-on-top-off-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu\n\nPull m68knommu fix from Greg Ungerer:\n \"Fix incorrectly updated local SoC IO access function names.\n\n Testing didn\u0027t pick them up because there was no specific defconfig\n for these particular SoC parts. New defconfigs will be introduced in\n the next merge cycle to remedy that\"\n\n* tag \u0027m68knommu-fixes-on-top-off-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:\n m68k: coldfire: fix breakage of missed IO access updates\n" }, { "commit": "6205562c5904ee23786239298299043876b1a977", "tree": "64ebf8fe15902607dd06155c9a1f81d498bc3748", "parents": [ "44696aa3a489d2baf58efa61b37833f100072bee", "601ddaceb861be7eb557278109966320a6f3478c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 09:46:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 09:46:37 2026 -0700" }, "message": "Merge tag \u0027trace-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Free field in error path of synthetic event parse\n\n In __create_synth_event() the field was allocated but was not freed\n in the error path\n\n - Fix ring_buffer_event_length() on 8 byte aligned architectures\n\n On architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, the\n ring_buffer_event_length() may return the wrong size. This is because\n archs with that config set will always use the \"big event meta\n header\" as that is 8 bytes keeping the payload 8 bytes aligned, even\n when a 4 byte header could hold the size of the event\n\n But ring_buffer_event_length() doesn\u0027t take this into account and\n only subtracts 4 bytes for the meta header in the length when it\n should have subtracted 8 bytes\n\n - Have osnoise wait for a full rcu synchronization on unregister\n\n osnoise_unregister_instance() used to call synchronize_rcu() before\n freeing its copy of the instance but was switched to kfree_rcu(). The\n osniose tracer has code that traverses the instances that it uses,\n and inst is just a pointer to that instance. By using kfree_rcu()\n instead of synchronize_rcu(), the instance that the inst pointer is\n pointing to can be freed while the osnoise code is still referencing\n it\n\n That is, a rmdir on an instance first unregisters the tracer. When\n the unregister finishes, the rmdir expects that the tracer is\n finished with the instance that it is using. By putting back the\n synchronize_rcu() in osnoise_unregister_instance() the unregistering\n of osnoise will now return when all the users of the instance have\n finished\n\n - Remove an unused setting of \"ret\" in tracing_set_tracer()\n\n - Fix ring_buffer_read_page() copying events\n\n The commit that changed ring_buffer_read_page() to show dropped\n events from the buffer itself, split the \"commit\" variable between\n the commit value (with flags) and \"size\" that holds the size of the\n sub-buffer. A cut and paste error changed the test of the reading\n from checking the size of the buffer to the size of the event causing\n reads to only read one event at a time\n\n - Make tracepoint_printk a static variable\n\n When the tracing sysctl knobs were move from sysctl.c to trace.c, the\n variable tracepoint_printk no longer needed to be global. Make it\n static\n\n - Fix some typos\n\n - Fix NULL pointer dereference in func_set_flag()\n\n The flags update of the function tracer first checks if the value of\n the flag is the same and exits if they are, and then it checks if the\n current tracer is the function tracer and exits if it isn\u0027t. The\n problem is that these checks need to be in a reversed order, as if\n the tracer isn\u0027t the function tracer, then the flag being checked may\n not exist. Reverse the order of these checks\n\n - Fix ufs core trace events to not dereference a pointer in TP_printk()\n\n The TP_printk() part of the TRACE_EVENT() macro is called when the\n user reads the \"trace\" file. This can be seconds, minutes, hours,\n days, weeks, and even months after the data was recorded into the\n ring buffer. Thus, saving a pointer to an object into the ring buffer\n and then dereferencing it from TP_printk() can cause harm as the\n object the pointer is pointing to may no longer exist\n\n Fix all the trace events in ufs core to save the device name in the\n ring buffer instead of dereferencing the device descriptor from\n TP_printk()\n\n - Prevent out-of-bound reads in glob matching of trace events\n\n The filter logic of events allows simple glob logic to add wild cards\n to filter on strings. But some events have fields that may not have a\n terminating \u0027nul\u0027 character. This may cause the glob matching to go\n beyond the string. Change the logic to always pass in the length of\n the field that is being matched\n\n - Add no-rcu-check version of trace_##event##_enabled()\n\n The trace_##event##_enabled() usually wraps trace events to do extra\n work that is only needed when the trace event is enabled. But this\n can hide events that are placed in locations where RCU is not\n watching, and can make lockdep not see these bugs when the event is\n not enabled\n\n The trace_##event##_enabled() was updated to always test to make sure\n RCU is watching to catch locations that may call events without RCU\n being active\n\n This caused a false positive for the irq_disabled() and related\n events. As that use trace_irq_disabled_enabled() to force RCU to be\n watching when the event is enabled via the ct_irq_enter() function,\n calls the event, and then calls ct_irq_exit() to put RCU back to its\n original state\n\n The trace_irq_disabled_enabled() should not trigger a warning when\n RCU is not watching because the code within its block handles the\n case properly. Make a __trace_##event##_enabled() version for this\n event to use that doesn\u0027t check RCU is watching as it handles the\n case when it isn\u0027t\n\n - Fix use-after-free in user_event_mm_dup()\n\n When the enabler is removed from the link list, it is freed\n immediately. But it is protected via RCU and needs to be freed after\n an RCU grace period. Use queue_rcu_work() so that the event_mutex can\n also be taken as user_event_put() takes the mutex on the last\n reference is released\n\n - Free type string in error path of parse_synth_field()\n\n There\u0027s an error path in parse_synth_field() where the allocated type\n string is not freed\n\n - Add selftest that tests deferred event teardown\n\n - Fix leak in error path of trace_remote_alloc_buffer()\n\n If page allocation fails, the desc-\u003enr_cpus is not incremented for\n the current CPU and the allocations done for it are not freed\n\n - Fix allocation length in trace_remote_alloc_buffer()\n\n The logic to calculate the struct_len was doing a double count and\n setting the value too large. Calculate the size upfront to fix the\n error and simplify the logic\n\n - Fix sparse CPU masks in ring_buffer_desc()\n\n If there are sparse CPUs (gaps in the numbering), the\n ring_buffer_desc() will fail as it tests the CPU number against the\n number of CPUs that are used\n\n* tag \u0027trace-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ring-buffer: Allow sparse CPU masks in ring_buffer_desc()\n tracing/remotes: Fix struct_len in trace_remote_alloc_buffer()\n tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path\n selftests/user_events: Wait for deferred event teardown after unregister\n tracing/synthetic: Free type string on error path\n tracing/user_events: Fix use-after-free in user_event_mm_dup()\n tracing: Add a no-rcu-check version of trace_##event##_enabled()\n tracing: Prevent out-of-bounds read in glob matching\n ufs: core: tracing: Do not dereference pointers in TP_printk()\n tracing: Fix NULL pointer dereference in func_set_flag()\n samples: ftrace: Fix typos in benchmark comment\n tracing: Make tracepoint_printk static as not exported\n ring-buffer: Fix ring_buffer_read_page() copying only one event per page\n tracing: Remove unused ret assignment in tracing_set_tracer()\n tracing/osnoise: Call synchronize_rcu() when unregistering\n ring-buffer: Fix event length with forced 8-byte alignment\n tracing/synthetic: Free pending field on error path\n" }, { "commit": "79d7a453c79e818b8059b1aa6d6a7ad53d9d4f72", "tree": "da6628de996f59c5405d5b6d1b001d6c8abadb91", "parents": [ "72870cd641edd69b520997c3232d765085a460f2" ], "author": { "name": "Ian Bridges", "email": "icb@fastmail.org", "time": "Tue Jul 07 01:04:19 2026 -0500" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Jul 11 15:51:48 2026 -0700" }, "message": "Input: i8042 - replace strlcat() with seq_buf and scnprintf()\n\nIn preparation for removing the strlcat() API[1], replace its uses in\ni8042-acpipnpio.h.\n\ni8042_pnp_id_to_string() accumulates a variable number of PNP ids in\na loop, which is what seq_buf is for. The kbd and aux probe functions\nbuild a name from at most three parts that are all known up front, so\nthe whole construction becomes a single scnprintf() there.\n\nLink: https://github.com/KSPP/linux/issues/370 [1]\nSigned-off-by: Ian Bridges \u003cicb@fastmail.org\u003e\nLink: https://patch.msgid.link/akyW4xkvCCROM0SE@dev\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "44696aa3a489d2baf58efa61b37833f100072bee", "tree": "51cd96451c8fa4ffa1829c86ffbf09cbcbbf3f05", "parents": [ "59dee6d28756c629f3a0bb56266f80e36ef7c99c", "adea84ee6cdea611146c4251d3c1616f5a09feca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 15:42:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 15:42:55 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - fix MELFAS MMS114 touchscreen driver to reject invalid touch IDs and\n avoid multi-touch slot corruption\n\n - fix a crash in the Sega Dreamcast (Maple) mouse driver when opening\n the device, caused by missing driver data\n\n - fixes for Maple drivers (keyboard, mouse, joystick) to properly order\n setting driver data and device registration to avoid races\n\n* tag \u0027input-for-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: mms114 - fix multi-touch slot corruption\n Input: maple_keyb - set driver data before registering input device\n Input: maplecontrol - set driver data before registering input device\n Input: maplemouse - set driver data before registering input device\n Input: maplemouse - fix NULL pointer dereference in open()\n" }, { "commit": "72870cd641edd69b520997c3232d765085a460f2", "tree": "c633c1d487f1dfb61522a5e2353ef47413cc7281", "parents": [ "8760a10464be92bd8428f62f91a5d77eebe2ecdb" ], "author": { "name": "Manuel Ebner", "email": "manuelebner@mailbox.org", "time": "Fri Jul 10 11:01:53 2026 +0200" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Jul 11 15:17:30 2026 -0700" }, "message": "dt-bindings: input: gpio-charlieplex-keypad: add missing parenthesis\n\nAdd missing \u0027(\u0027.\n\nSigned-off-by: Manuel Ebner \u003cmanuelebner@mailbox.org\u003e\nAcked-by: Hugo Villeneuve \u003chvilleneuve@dimonoff.com\u003e\nLink: https://patch.msgid.link/20260710090153.431170-2-manuelebner@mailbox.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "59dee6d28756c629f3a0bb56266f80e36ef7c99c", "tree": "f3f0c7acbcf3570973a7d6d5287269c5fa585837", "parents": [ "cab9e339cfbc1a4e075e53e281dfb00391e1a6bb", "4b22d0801fadfcae2e106e6ba32e49439c7c7ebf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 13:06:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 13:06:05 2026 -0700" }, "message": "Merge tag \u0027for-7.2/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fixes from Mikulas Patocka:\n\n - dm-log: fix overflow on 32-bit machines\n\n - dm-era: fix out of bounds memory access; fix crashes on invalid args\n\n - dm-verity: fix buffer overflow in forward error correction\n\n - dm-thin: fix misbehavior on I/O failures\n\n - dm-pcache: fix NULL pointer dereference on invalid arguments\n\n - dm-inlinecrypt: fix memory leak on error handling\n\n - dm-integrity: fix ignoring the \u0027fix_hmac\u0027 option on device open\n\n - dm: don\u0027t store the keyring in memory for a long term\n\n - 12 miscellaneous fixes for bugs found by Claude Opus 4.6\n\n* tag \u0027for-7.2/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (23 commits)\n dm thin metadata: fix superblock refcount leak on snapshot shadow failure\n dm-stats: fix dm_jiffies_to_msec64\n dm-stats: fix merge accounting\n dm-bufio: fix wrong count calculation in dm_bufio_issue_discard\n dm-verity: make error counter atomic\n dm-verity: increase sprintf buffer size\n dm-verity: fix a possible NULL pointer dereference\n dm-verity: avoid double increment of \u0026use_bh_wq_enabled\n dm-ioctl: fix a possible overflow in list_version_get_info\n dm_early_create: fix freeing used table on dm_resume failure\n dm-integrity: fix a bug if the bio is out of limits\n dm-integrity: don\u0027t increment hash_offset twice\n dm-integrity: fix leaking uninitialized kernel memory\n dm-integrity: fix the \u0027fix_hmac\u0027 option\n dm era: fix error code propagation in era_ctr()\n dm era: fix NULL pointer dereference in metadata_open()\n dm: avoid leaking the caller\u0027s thread keyring via the table device file\n dm-inlinecrypt: Fix an error handling path in inlinecrypt_ctr()\n dm-pcache: reject option groups without values\n dm thin metadata: fix metadata snapshot consistency on commit failure\n ...\n" }, { "commit": "cab9e339cfbc1a4e075e53e281dfb00391e1a6bb", "tree": "442d42b30a69feb7979458c5090053d9d0a06a32", "parents": [ "b37fa0d0a3cd39413355d4f748d2caf8002635f2", "47915e855fb38b42133e31ba917d99565f862154" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:11:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:11:45 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix SVM #GP on AMD CPUs that LBR but not BRS (Sandipan Das)\n\n - Fix UAF bug in the perf AUX code (Lee Jia Jie)\n\n - Fix address leakage in the AMD LBR code (Sandipan Das)\n\n - Fix address leakage in the AMD BRS code (Sandipan Das)\n\n* tag \u0027perf-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/amd/brs: Fix kernel address leakage\n perf/x86/amd/lbr: Fix kernel address leakage\n perf/aux: Fix page UAF in map_range()\n perf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n" }, { "commit": "b37fa0d0a3cd39413355d4f748d2caf8002635f2", "tree": "45aa3d512197ca58600e23a1e220b4741ca93cc0", "parents": [ "767707a53ef7d7cfe7d1b1f22c37fe4af17efc5e", "4c2509f3b79756679a02bea649c6a7501b58f52c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:09:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:09:23 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix resctrl resource leak (Tony Luck)\n\n - Fix resctrl umount race (Tony Luck)\n\n - Fix resctrl double-free (Reinette Chatre)\n\n - Fix x86 VGA display fallback logic during bootup on\n certain multi-GPU systems (Mario Limonciello)\n\n - Re-add a WBINVD call to the SNP bootstrap path to\n fix an SNP regression (Tycho Andersen)\n\n* tag \u0027x86-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/virt/sev: Revert \"Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN\"\n x86/video: Only fall back to vga_default_device() without screen info\n fs/resctrl: Fix double-add of pseudo-locked region\u0027s RMID to free list\n fs/resctrl: Fix use-after-free during unmount\n fs/resctrl: Free mon_data structures on rdt_get_tree() failure\n" }, { "commit": "767707a53ef7d7cfe7d1b1f22c37fe4af17efc5e", "tree": "ae2178a06ecffbf4eb2fadf26a05e321529bd29d", "parents": [ "64d9ca4b44f0c08db832e61df84921f9d1687bb7", "920f893f735e92ba3a1cd9256899a186b161928d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:54:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:54:05 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n\n - Fix a subtle posix-cpu-timers vs. exec() race, which\n unearthed other races in the area (Thomas Gleixner)\n\n* tag \u0027timers-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n posix-cpu-timers: Prevent UAF caused by non-leader exec() race\n" }, { "commit": "64d9ca4b44f0c08db832e61df84921f9d1687bb7", "tree": "8fd0c39b72dac0da6c18fa5e94fe349826d550e3", "parents": [ "596d603126e4fe6857e5e39b6d5433c3f6ab5cdd", "181bb9c9eae4f69fe510a62a42c2932d0314a800" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:35:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:35:33 2026 -0700" }, "message": "Merge tag \u0027block-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Limit blk_hctx_poll() to one jiffy. Prevents buggy drivers from\n spinning for too long, hence triggering a stalled RCU read section\n warning\n\n - Avoid a potential deadlock on zone revalidation failure, which could\n otherwise trigger a lockdep circular locking splat during a SCSI disk\n rescan\n\n - Remove a redundant GD_NEED_PART_SCAN set in add_disk_final()\n\n - Make writes to queue/wbt_lat_usec honor the WBT enable state\n\n - ublk fix to snapshot the batch commands before preparing IO, so that\n userspace can\u0027t change an already processed tag and trip the\n WARN_ON_ONCE() in the rollback path\n\n - xen-blkfront fix for a double completion of split requests on resume\n\n - drbd fix to reject data replies with an out-of-range payload size\n\n* tag \u0027block-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n block: remove redundant GD_NEED_PART_SCAN in add_disk_final()\n drbd: reject data replies with an out-of-range payload size\n xen-blkfront: fix double completion of split requests on resume\n ublk: snapshot batch commands before preparing I/O\n block: Make WBT latency writes honor enable state\n block: avoid potential deadlock on zone revalidation failure\n blk-mq: bound blk_hctx_poll() to one jiffy\n" }, { "commit": "596d603126e4fe6857e5e39b6d5433c3f6ab5cdd", "tree": "0524799989fc4f52c445c85146779fd036222469", "parents": [ "dd3210c47e8d3ac6b4e9141fc68acc03b38c0ba3", "f3176c8ac4217c88fe1147ab084c47092921ffc4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:24:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:24:38 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Restore full RCU read section in io_req_local_work_add(), which was\n mistakenly dropped with the DEFER_TASKRUN rework in this merge\n window. Revert the commit that grabbed the RCU read lock in\n io_ctx_mark_taskrun(), as that\u0027s no longer required with the previous\n fix.\n\n - Fix a dangling iovec after a provided-buffer bundle grow failure,\n also an issue introduced in this merge window.\n\n - Reject IORING_CQE_F_32 flag pass-through in MSG_RING to rings that\n weren\u0027t setup with CQE32 or CQE_MIXED.\n\n - Return -EINVAL rather than -ENOMEM from get_unmapped_area() when mmap\n validation fails, matching io_uring_mmap().\n\n* tag \u0027io_uring-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n Revert \"io_uring: grab RCU read lock marking task run\"\n io_uring: restore RCU read section in io_req_local_work_add()\n io_uring: fix dangling iovec after provided-buffer bundle grow failure\n io_uring/uring_cmd: fix uring_cmd.c comments\n io_uring/msg_ring: reject CQE32 flag pass-through to normal rings\n io_uring/memmap: return -EINVAL from get_unmapped_area() on bad mmap\n" }, { "commit": "4b22d0801fadfcae2e106e6ba32e49439c7c7ebf", "tree": "07a60ca856b0d5ebce79047ef0cf7772e89695c2", "parents": [ "386df1a57b631c456d14f857cb0c0c2e11c16bef" ], "author": { "name": "Genjian Zhang", "email": "zhanggenjian@kylinos.cn", "time": "Sat Jul 11 18:05:26 2026 +0800" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Sat Jul 11 15:18:51 2026 +0200" }, "message": "dm thin metadata: fix superblock refcount leak on snapshot shadow failure\n\n__reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the\nmetadata space map before shadowing it. When dm_tm_shadow_block()\nfails, a reference is leaked in the metadata space map.\n\nFix by adding the missing dm_sm_dec_block().\n\nSigned-off-by: Genjian Zhang \u003czhanggenjian@kylinos.cn\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nFixes: cc8394d86f04 (\"dm thin: provide userspace access to pool metadata\")\nCc: stable@vger.kernel.org\n" }, { "commit": "47915e855fb38b42133e31ba917d99565f862154", "tree": "1b9ab27b70a86fd9f311b9835aec2016104d6c49", "parents": [ "2a892294b83f541115c94b0bb637f39bef187657" ], "author": { "name": "Sandipan Das", "email": "sandipan.das@amd.com", "time": "Fri Jul 10 22:04:49 2026 +0530" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat Jul 11 12:19:28 2026 +0200" }, "message": "perf/x86/amd/brs: Fix kernel address leakage\n\nA user-only branch stack can contain branches that originate from\nthe kernel. As a result, kernel addresses are exposed to user space\neven when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors\nsupporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries\nsuch as SYSRET/interrupt returns for which the branch-from addresses\nare in the kernel.\n\nE.g.\n\n $ perf record -j any,u -c 4000 -e branch-brs -o - -- \\\n perf bench syscall basic --loop 1000 | \\\n perf script -i - -F brstack|tr \u0027 \u0027 \u0027\\n\u0027| \\\n grep -E \u00270x[89a-f][0-9a-f]{15}\u0027\n\n ...\n 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-\n 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-\n 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-\n ...\n\nBRS provides no hardware branch filtering, so privilege level\nfiltering is performed entirely in software. However, amd_brs_match_plm()\nonly validates the branch-to address against the requested privilege\nlevels. For branches from the kernel to user space, the branch-from\naddress is left unchecked and is leaked. Extend the software filter to\nalso validate the branch-from address, so that any branch record whose\nbranch-from address is in the kernel is dropped when\nPERF_SAMPLE_BRANCH_USER is requested.\n\nFixes: 8910075d61a3 (\"perf/x86/amd: Enable branch sampling priv level filtering\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Sandipan Das \u003csandipan.das@amd.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nLink: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com\nCloses: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/\n" }, { "commit": "8760a10464be92bd8428f62f91a5d77eebe2ecdb", "tree": "cd26bd566d73db57afe87f0be215be79b4a3e3fb", "parents": [ "136be950466b3ccf6c2256789db787259190f059" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Jul 10 23:19:54 2026 +0200" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 10 21:47:59 2026 -0700" }, "message": "Input: matrix_keyboard - remove linux/gpio.h inclusion\n\nlinux/gpio.h is going away, so remove that since the driver already\nincludes linux/gpio/consumer.h.\n\nAcked-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20260710211954.1373336-10-arnd@kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "adea84ee6cdea611146c4251d3c1616f5a09feca", "tree": "0490fdd052d99d6bc7bd75ac0d24672f03940c4c", "parents": [ "536394ec81419b67d9f4f0028812c4372397be1b" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 03 23:01:12 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 10 21:37:51 2026 -0700" }, "message": "Input: mms114 - fix multi-touch slot corruption\n\nIf the touchscreen controller reports a touch ID of 0, the driver\ncalculates the slot ID as touch-\u003eid - 1, which underflows to UINT_MAX.\nThis is passed to input_mt_slot() as -1.\n\nSince the input core ignores negative slot values, the active slot remains\nunchanged. The driver then reports the touch coordinates for the previously\nactive slot, corrupting its state.\n\nFix this by rejecting touch reports with ID 0.\n\nFixes: 07b8481d4aff (\"Input: add MELFAS mms114 touchscreen driver\")\nCc: stable@vger.kernel.org\nReported-by: sashiko-bot@kernel.org\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "dd3210c47e8d3ac6b4e9141fc68acc03b38c0ba3", "tree": "fbb912c5ef418f57529a40a886a0e7e6ca2ca0d9", "parents": [ "bf124bae08c35cb8b5392ec8005f9890833b9056", "d38f8bd771c4999b797d7074b348cf201414bd34" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:07:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:07:24 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of straightforward fixes for device loading, plus a fix for\n the core support for keeping multiple regulators with voltages close\n to each other that was sadly introduced due to one of the more\n beautiful corners of our API design\"\n\n* tag \u0027regulator-fix-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK\n regulator: mt6363: add missing MODULE_DEVICE_TABLE()\n regulator: mt6316: add missing MODULE_DEVICE_TABLE()\n" }, { "commit": "bf124bae08c35cb8b5392ec8005f9890833b9056", "tree": "fd4eaffef5c5821ba8c31a00e4f7df043b8c798b", "parents": [ "ccce5f6e7c86f103d76534e2d06d1c903dce551c", "65dfde57d1e29ce2b76fc23dd565eccd5c0bc0f0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:03:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:03:37 2026 -0700" }, "message": "Merge tag \u0027audit-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit\n\nPull audit fixes from Paul Moore:\n \"Two relatively small audit patches to fix potential data races with\n the main audit backlog queue as well as possible integer overflows\n when logging data as hex strings\"\n\n* tag \u0027audit-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:\n audit: fix potential integer overflow in audit_log_n_hex()\n audit: Fix data races of skb_queue_len() readers on audit_queue\n" }, { "commit": "ccce5f6e7c86f103d76534e2d06d1c903dce551c", "tree": "9833a14b8c64137afb2e0f7ec74b201e7a2f2e7a", "parents": [ "61c03dfde8540c7274d9a30dc576bc32951187cd", "56acfeb10019e200ab6787d01f8d7cbe0f01526f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:59:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:59:29 2026 -0700" }, "message": "Merge tag \u0027selinux-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fixes from Paul Moore:\n \"Two small SELinux patches to fix a missing permission check for TCP\n Fast Open operations and fix a socket lookup issue with SCTP ASCONF\n operations\"\n\n* tag \u0027selinux-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()\n selinux: check connect-related permissions on TCP Fast Open\n" }, { "commit": "61c03dfde8540c7274d9a30dc576bc32951187cd", "tree": "200ab0d1d5a4530bdeebe37e7e2ca3ed7eec6864", "parents": [ "58d9f84279a86b1b24239107a3d1c4d8dccb41e6", "0ebe8f625ab0520217a425d7cd366e4670484941" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:20:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:20:15 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - fix stale runlist element dereferences in MFT writeback and fallocate\n\n - fix mrec_lock ABBA deadlock in rename\n\n - prevent userspace modification of NTFS system files\n\n - avoid inode eviction/writeback self-deadlocks\n\n - reject malformed resident attributes in non-resident runlist mapping\n\n - avoid post_write_mst_fixup() on invalid index blocks\n\n - fix a hole runlist leak in insert-range error handling\n\n - sanitize directory lookup MFT references from disk\n\n - fail attribute-list updates after SB_ACTIVE is cleared during\n teardown\n\n* tag \u0027ntfs-for-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: fail attrlist updates when the superblock is inactive\n ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()\n ntfs: fix hole runlist memory leak in insert range error path\n ntfs: avoid calling post_write_mst_fixup() for invalid index_block\n ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()\n ntfs: avoid self-deadlock during inode eviction\n ntfs: make system files immutable to prevent corruption\n ntfs: fix mrec_lock ABBA deadlock in rename\n ntfs: avoid stale runlist element dereference in fallocate\n ntfs: avoid stale runlist element dereference in MFT writeback\n" }, { "commit": "58d9f84279a86b1b24239107a3d1c4d8dccb41e6", "tree": "92515cb9263a93a1b45325fd430b0987628c47e9", "parents": [ "8eae393cbfd79311c0736a5012d2c5b546d3b817", "27934d02cbeb8a957dd11c985a579e58d30c5270" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:15:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:15:26 2026 -0700" }, "message": "Merge tag \u0027nfs-for-7.2-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs\n\nPull NFS client fixes from Anna Schumaker:\n\n - SUNRPC:\n - Release lower rpc_clnt if killed waiting for XPRT_LOCKED\n - Pin upper rpc_clnt across the TLS connect_worker\n\n - NFS:\n - Include MAY_WRITE in open permission mask for O_TRUNC\n - Charge unstable writes by request size, not folio size\n\n* tag \u0027nfs-for-7.2-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs:\n NFS: Charge unstable writes by request size, not folio size\n NFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n SUNRPC: pin upper rpc_clnt across the TLS connect_worker\n SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED\n" }, { "commit": "8eae393cbfd79311c0736a5012d2c5b546d3b817", "tree": "4beaf6c2d3024449ec7c3f76a5d868e152cbc4cc", "parents": [ "d96fcfe1b7f94ac742984ae7986b94a116abff1b", "d2c46c9f7a9baf80a322eb1d4494a70e535b637c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:11:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:11:20 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n - DFS cache allocation fix\n - DFS referral bounds check fix\n - Fix absolute symlinks when mounting with POSIX extensions\n - Fixes for incorrect nlink returned by fstat\n - Fix atime in read completion\n - Fix busy dentry on umount\n - ioctl_query_info buffer overflow fix\n - Two fixes for creating special files with SFU\n - Fix mode mask in parse_dacl\n - SMB1 is_path_accessible wildcard fix and minor SMB1 cleanup\n - smb2_check_message fix\n - Debug message improvement\n - Minor cleanup\n\n* tag \u0027v7.2-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n cifs: Remove CIFSSMBSetPathInfoFB() fallback function\n cifs: Fix and improve cifs_is_path_accessible() function\n smb: client: mask server-provided mode to 07777 in modefromsid\n cifs: Show reason why autodisabling serverino support\n smb/client: fix incorrect nlink returned by fstat()\n smb/client: zero-initialize stack-allocated cifs_open_info_data\n smb/client: pass cifs_open_info_data to SMB2_open()\n smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()\n smb: client: fix overflow in passthrough ioctl bounds check\n smb: client: fix busy dentry warning on unmount after DIO\n cifs: Fix support for creating SFU fifo\n cifs: Fix support for creating SFU socket\n smb: client: fix atime clamp check in read completion\n cifs: validate DFS referral string offsets\n smb: client: use GFP_KERNEL for DFS cache allocations\n smb: client: restrict implied bcc[0] exemption to responses without data area\n smb: client: preserve leading slash for POSIX absolute symlink targets\n smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit()\n" }, { "commit": "601ddaceb861be7eb557278109966320a6f3478c", "tree": "14491826df18472040757bc8c1abebb66bd69487", "parents": [ "d471d4f86e8689ad15309e49da8e5e4e9bb9ce87" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Thu Jul 09 17:00:17 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 10 14:04:26 2026 -0400" }, "message": "ring-buffer: Allow sparse CPU masks in ring_buffer_desc()\n\nNo user currently relies on sparse CPU masks, but the descriptor logic already\nsupports them via linear fallback. Remove the arbitrary limitation.\n\nLink: https://patch.msgid.link/20260709160017.1729517-4-vdonnefort@google.com\nFixes: 2e67fabd8b77 (\"ring-buffer: Introduce ring-buffer remotes\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d471d4f86e8689ad15309e49da8e5e4e9bb9ce87", "tree": "aa31951f43c640f190372eb59f48d129d547284d", "parents": [ "ec082d0b978b5fb4c11205ccce63587ac94c74e1" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Thu Jul 09 17:00:16 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 10 14:04:26 2026 -0400" }, "message": "tracing/remotes: Fix struct_len in trace_remote_alloc_buffer()\n\nPre-calculate desc-\u003estruct_len up-front in trace_remote_alloc_buffer()\nwith trace_buffer_desc_size() to fix double-counting.\n\nWhile at it, use the accessor __first_ring_buffer_desc().\n\nLink: https://patch.msgid.link/20260709160017.1729517-3-vdonnefort@google.com\nFixes: 96e43537af54 (\"tracing: Introduce trace remotes\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "ec082d0b978b5fb4c11205ccce63587ac94c74e1", "tree": "13311750e22d84e82464f58e72755888b1bc7af3", "parents": [ "42e74d8f21ce448fe12ba3dd59db817b3e977f49" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Thu Jul 09 17:00:15 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 10 14:04:26 2026 -0400" }, "message": "tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path\n\nIf page allocation fails in trace_remote_alloc_buffer(), desc-\u003enr_cpus\nis not yet incremented for the current CPU. As a consequence, on error,\nhalf-allocated rb_desc will not be freed in trace_remote_free_buffer().\n\nIncrement desc-\u003enr_cpus as soon as the first allocation for the current\nCPU has succeeded.\n\nLink: https://patch.msgid.link/20260709160017.1729517-2-vdonnefort@google.com\nFixes: 96e43537af54 (\"tracing: Introduce trace remotes\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d96fcfe1b7f94ac742984ae7986b94a116abff1b", "tree": "0cd70ac5584238e6c65eb544104082ab1fc8a374", "parents": [ "1f0fe3220fcfe0b71793b84ef78f0c6d9a1f2e08", "a52d6c7160f7e2f8c56adf29146385b8f2868d3d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:59:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:59:55 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n\n - Fix crash when using SMT hotplug on ACPI systems in conjunction with\n maxcpus\u003d\n\n - Fix 30% kswapd performance regression introduced by C1-Pro SME\n erratum workaround\n\n - Fix TLB over-invalidation regression during memory hotplug\n\n - Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE\n\n - Typo fixes in the arm64 selftests\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n selftests/arm64: fix spelling errors in comments\n arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1\n arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()\n arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum\n cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()\n arm64: smp: Fix hot-unplug tearing by forcing unregistration\n" }, { "commit": "1f0fe3220fcfe0b71793b84ef78f0c6d9a1f2e08", "tree": "22161646ade1121b0e8767a41b38e24fb128bc52", "parents": [ "f827c27e573b475863d87bd2bab0b06f75aef5cd", "2726b5758f80a546a4ddeec5019e72035a7fa166" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:51:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:51:45 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - amd/pmc:\n - Use correct IP block table for AMD 1Ah M80H SoC\n - Avoid logging \"(null)\" for missing DMI values\n\n - asus-armoury: update power limits for G614PR\n\n - bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume\n\n* tag \u0027platform-drivers-x86-v7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: amd-pmc: Use correct IP block table for AMD 1Ah M80H SoC\n platform/x86: asus-armoury: update power limits for G614PR\n platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume\n platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values\n" }, { "commit": "386df1a57b631c456d14f857cb0c0c2e11c16bef", "tree": "ebca59da99310d9f074a5d3ee7b167e31c6bf145", "parents": [ "1917eb2db750ecbdf710f79a8042eaa545a063c7" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:37:15 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:40:27 2026 +0200" }, "message": "dm-stats: fix dm_jiffies_to_msec64\n\nThere were wrong calculations in dm_jiffies_to_msec64 that produced\nincorrect output when HZ was different from 1000. This commit fixes them.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nFixes: fd2ed4d25270 (\"dm: add statistics support\")\nCc: stable@vger.kernel.org\n" }, { "commit": "1917eb2db750ecbdf710f79a8042eaa545a063c7", "tree": "813f61e17603e24df1b1d5e3132aec13973bb538", "parents": [ "422f1d4f141eaa3a6e4199ceec86cc6b9bf26570" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:35:49 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:40:00 2026 +0200" }, "message": "dm-stats: fix merge accounting\n\nThere were wrong parentheses when setting stats_aux-\u003emerged, so that\nmerging was never properly accounted. This commit fixes it.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nFixes: fd2ed4d25270 (\"dm: add statistics support\")\nCc: stable@vger.kernel.org\n" }, { "commit": "422f1d4f141eaa3a6e4199ceec86cc6b9bf26570", "tree": "76bd7c98c3d7925da3c095e4f0dc91914d06aba3", "parents": [ "8ec4d9c5a5cf4b61fc087f871465b1f79b393325" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:32:49 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:39:17 2026 +0200" }, "message": "dm-bufio: fix wrong count calculation in dm_bufio_issue_discard\n\nblock_to_sector converts a block number to a sector number and adds\nc-\u003estart to the result. It is inappropriate to use this function for\nconverting the number of blocks to a number to sectors because c-\u003estart\nwould be incorrectly added to the result.\n\nLuckily, the only target that uses dm_bufio_issue_discard is dm-ebs,\nwhich sets c-\u003estart to 0, so this bug is latent.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nFixes: 6fbeb0048e6b (\"dm bufio: implement discard\")\nCc: stable@vger.kernel.org\n" }, { "commit": "f827c27e573b475863d87bd2bab0b06f75aef5cd", "tree": "ea08b002b29739c642f071fda9df5374dd3e1329", "parents": [ "8f964d992ee0ea1c0aca689b8b7d5607300f5e2a", "b11c513ad943f35cf5e8007d3a56279c79b7ed4b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:36:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:36:25 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - provide the missing .get_direction() callback in gpio-palmas\n\n - fix interrupt handling in gpio-dwapb\n\n - add a GPIO self-test program binary to .gitignore\n\n - fix a resource leak in gpio-mvebu\n\n - make the GPIO sharing heuristic more adaptable\n\n* tag \u0027gpio-fixes-for-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: mvebu: free generic chips on unbind\n selftests: gpio: add gpio-cdev-uaf to .gitignore\n gpio: dwapb: Mask interrupts at hardware initialization\n gpio: dwapb: Defer clock gating until noirq\n gpio: shared: make the voting mechanism adaptable\n gpios: palmas: add .get_direction() op\n" }, { "commit": "8f964d992ee0ea1c0aca689b8b7d5607300f5e2a", "tree": "11664c69d7582d9514e3e1eda7dc5457a17f3593", "parents": [ "ba0b7c62cea942cd0afa35a3768a9f4874874b2f", "793bf193b18e9bff6c4280268bbffd16a5b533e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:17:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:17:00 2026 -0700" }, "message": "Merge tag \u0027ata-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Damien Le Moal:\n\n - Fix handling of security locked drive revalidation. This prevents\n such drives from being dropped when locked on resume (Terrence)\n\n* tag \u0027ata-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-core: Allow capacity transition to zero for locked drives\n ata: libata-core: Skip HPA resize for locked drives\n" }, { "commit": "ba0b7c62cea942cd0afa35a3768a9f4874874b2f", "tree": "ba34dc3b1e1074b1a32c44dad26bc32ae812eb42", "parents": [ "a635d6748234582ea287c5ffeae28b9b23f91c7e", "6763a0aea6d658d69b9215ab9151d7bd4c1c314b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 08:53:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 08:53:32 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-07-10\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull for drm, amdgpu, amdxdna, xe leading the way, some\n small core fixes and a nouveau stability fix along with some minor\n changes in other drivers.\n\n Seems to be a bit quiter than last week at least.\n\n fb-helper:\n - Sync on first active crtc in fb_dirty, rather than first crtc\n\n drm_exec:\n - Use direct label in drm_exec\n\n buddy:\n - Rework try_harder in the buddy allocator\n\n i915:\n - fix underrun on panthor lake\n - LT PHY SSC programming fix\n - fix some NULL derefs and leaks\n\n nouveau:\n - fix a vmm large/small page table update race\n\n xe:\n - Fix PTE index in xe_vm_populate_pgtable for chunked binds\n - Wait on external BO kernel fences in exec IOCTL\n - Remove duplicate include\n - Free madvise VMA array on L2 flush failure\n - Stub notifier_lock helpers when DRM_GPUSVM\u003dn\n\n amdgpu:\n - PSP 15.0.9 update\n - SMU 15.0.9 update\n - VCN 5.3 fix\n - VI ASPM fix\n - Userq fix\n - lifetime fix for amdgpu_vm_get_task_info_pasid()\n - Gfx10 fix\n - SMU 14 fix\n\n amdkfd:\n - CRIU bounds checking fixes\n - secondary context id fix\n - Event bounds checking fix\n\n amdxdna:\n - Fix uaf in mmap failure path\n - A lot of deadlocks, access races and return value fixes\n\n analogix_dp:\n - Fix analogix_dp bitshifts during link training\n\n v3d:\n - Fix absent indirect bo handling\n\n imagination:\n - Make function static to solve compiler warning\n - Fix error checking\"\n\n* tag \u0027drm-fixes-2026-07-10\u0027 of https://gitlab.freedesktop.org/drm/kernel: (44 commits)\n nouveau/vmm: fix another SPT/LPT race\n drm/imagination: fix error checking of pvr_vm_context_lookup()\n drm/imagination: make pvr_fw_trace_init_mask_ops static\n gpu/buddy: bail out of try_harder when alignment cannot be honoured\n drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM\u003dn\n drm/xe: free madvise VMA array on L2 flush failure\n drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include\n drm/xe: Wait on external BO kernel fences in exec IOCTL\n drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds\n drm/fb-helper: Only consider active CRTCs for vblank sync\n drm/amdkfd: Check bounds on CRIU restore queue type and mqd size\n drm/amd/pm: fix smu14 power limit range calculation\n drm/amdkfd: Check bounds in allocate_event_notification_slot\n amdkfd: properly free secondary context id\n drm/amdkfd: Don\u0027t acquire buffers during CRIU queue restore\n drm/amdkfd: Check bounds on CRIU restore event id\n drm/gfx10: Program DB_RING_CONTROL\n drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()\n drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue\n drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled\n ...\n" }, { "commit": "58a37e7317b06665e21609a2f867a9962e9e2919", "tree": "294cd332db44cd3169fe9d6cea88b3aa921bd795", "parents": [ "a2ac823d8a228e392bc6a79ea63b550ab84a55b2" ], "author": { "name": "Wang Yan", "email": "wangyan01@kylinos.cn", "time": "Fri Jul 10 16:34:37 2026 +0800" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Fri Jul 10 09:32:35 2026 -0600" }, "message": "selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests\n\nThe regset_data buffer allocated with calloc() in the parent process\nof several vector ptrace tests is never freed before returning,\ncausing memory leaks in:\n\n- ptrace_v_not_enabled\n- ptrace_v_early_debug\n- ptrace_v_syscall_clobbering\n- v_csr_invalid/ptrace_v_invalid_values\n- v_csr_valid/ptrace_v_valid_values\n\nAdd free(regset_data) before kill(pid, SIGKILL) to release the\nallocated buffer.\n\nSigned-off-by: Wang Yan \u003cwangyan01@kylinos.cn\u003e\nReviewed-by: Sergey Matyukevich \u003cgeomatsi@gmail.com\u003e\nLink: https://patch.msgid.link/20260710083437.489648-1-wangyan01@kylinos.cn\n[pjw@kernel.org: Fixed Sergey\u0027s E-mail address]\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "181bb9c9eae4f69fe510a62a42c2932d0314a800", "tree": "37782d57a51f74dc88d8364feec6fbcbd9438fa9", "parents": [ "bd910a7660d280595ef94cb6d193951d855d330f" ], "author": { "name": "Connor Williamson", "email": "connordw@amazon.com", "time": "Mon Jun 15 13:07:15 2026 +0000" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Jul 10 09:08:50 2026 -0600" }, "message": "block: remove redundant GD_NEED_PART_SCAN in add_disk_final()\n\nadd_disk_final() sets GD_NEED_PART_SCAN before calling bdev_add(),\nthen calls disk_scan_partitions() which sets the flag itself. The\nearly set is redundant and introduces a race.\n\nBetween bdev_add() and disk_scan_partitions(), concurrent openers\n(multipathd, blkid, LVM) see the flag in blkdev_get_whole() and\ntrigger bdev_disk_changed(). When disk_scan_partitions() then runs,\nit calls bdev_disk_changed() again, dropping the partitions the\nconcurrent opener already created before re-adding them, which can\nresult in transient partition disappearances.\n\nThe race is observable by inserting an msleep() between bdev_add()\nand disk_scan_partitions() while running concurrent open() calls\nduring device bind. Without artificial delay, it manifests under\nscheduling pressure during boot on systems with aggressive device\nscanners (multipathd, systemd-udevd).\n\nTherefore, do not set GD_NEED_PART_SCAN in add_disk_final(). Other\nGD_NEED_PART_SCAN consumers (blkdev_get_whole(),\nsd_need_revalidate()) should not be affected as the flag\nis set internally by disk_scan_partitions().\n\nThe retry-on-next-open intention from commit e5cfefa97bcc\n(\"block: fix scan partition for exclusively open device again\")\nshould also not be affected as the early return paths in\ndisk_scan_partitions() should be unreachable at device registration\ntime (bd_holder is NULL and open_partitions is zero).\n\nFixes: e5cfefa97bcc (\"block: fix scan partition for exclusively open device again\")\nCc: stable@vger.kernel.org\nSigned-off-by: Connor Williamson \u003cconnordw@amazon.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nLink: https://patch.msgid.link/20260615130715.53693-1-connordw@amazon.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "2a892294b83f541115c94b0bb637f39bef187657", "tree": "aa7021f41d40c8e9f65cb2a68e3cd7f42e8b1bd4", "parents": [ "5948aaf64f81f217a25dcc2bf6c0779bca19566c" ], "author": { "name": "Sandipan Das", "email": "sandipan.das@amd.com", "time": "Fri Jul 10 16:15:27 2026 +0530" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Jul 10 15:37:53 2026 +0200" }, "message": "perf/x86/amd/lbr: Fix kernel address leakage\n\nA user-only branch stack can contain branches that originate from\nthe kernel. As a result, kernel addresses are exposed to user space\neven when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors\nsupporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET\nentries for which the branch-from addresses are in the kernel.\n\nE.g.\n\n $ perf record -e cycles -o - -j any,save_type,u -- \\\n perf bench syscall basic --loop 1000 | \\\n perf script -i - -F brstack|tr \u0027 \u0027 \u0027\\n\u0027| \\\n grep -E \u00270x[89a-f][0-9a-f]{15}\u0027\n\n ...\n 0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n ...\n\nThe reason is that the hardware filter only considers the privilege\nlevel applicable to the branch target. Extend software filtering to\nalso validate the branch-from addresses against br_sel, so that any\nbranch record whose branch-from address is in the kernel is dropped\nwhen PERF_SAMPLE_BRANCH_USER is requested.\n\nFixes: f4f925dae741 (\"perf/x86/amd/lbr: Add LbrExtV2 hardware branch filter support\")\nReported-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Sandipan Das \u003csandipan.das@amd.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/a898a29725f6b2f30518354cdc2e432db66c43cf.1783680119.git.sandipan.das@amd.com\n" }, { "commit": "bd910a7660d280595ef94cb6d193951d855d330f", "tree": "6550f6896624a6e6855b9b8f11999f3a936714b5", "parents": [ "5d72720365f973e2c21fa99505b627521de66c25" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Thu Jul 09 22:28:37 2026 -0400" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Jul 10 06:49:11 2026 -0600" }, "message": "drbd: reject data replies with an out-of-range payload size\n\nrecv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an\noutstanding read request. The peer-supplied payload length reaches it as\nthe signed int data_size, and two peer-controlled inputs can make it\nnegative. With a negotiated data-integrity-alg the digest length is\nsubtracted first, so a reply whose payload is smaller than the digest\nunderflows data_size. With no integrity algorithm (the default) data_size\nis assigned from the unsigned h95/h100 wire length and drbdd() never\nbounds it for a payload-carrying command, so a length above INT_MAX casts\nit negative; this path needs no non-default feature. The bio receive loop\nthen computes expect \u003d min_t(int, data_size, bv_len), which is negative,\nand drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX\ninto the first mapped page.\n\nThe sibling receive path read_in_block() is not affected: it uses an\nunsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.\nReject a data reply whose size is negative after the optional digest\nsubtraction, covering both triggers.\n\nImpact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen\nbytes past a bio page in the receiver, corrupting kernel memory. A node\nthat reads from its peer (a diskless node, or read-balancing to the peer)\nis exposed in the default configuration; data-integrity-alg is not\nrequired.\n\nFixes: b411b3637fa7 (\"The DRBD driver\")\nCc: stable@vger.kernel.org\nAssisted-by: Codex:gpt-5-5-xhigh\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nReviewed-by: Christoph Böhmwalder \u003cchristoph.boehmwalder@linbit.com\u003e\nLink: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "302fbbb4fcbdeac2dc8c63a56c1c4e38c4781958", "tree": "b2d33a4f34245cba6c326e6f51e2c051de730382", "parents": [ "b1b4efea05a56c0995e4702a86d6624b4fdff32f" ], "author": { "name": "John Ogness", "email": "john.ogness@linutronix.de", "time": "Tue Jul 07 16:16:04 2026 +0206" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 10 14:47:30 2026 +0200" }, "message": "serial: 8250: Ignore flow control on suspend/resume with no_console_suspend\n\nIf no_console_suspend is specified, on suspend the 8250 console driver\nuses a scratch register (UART_SCR) to store a special canary value. This\nis used during the resume path to identify a printk() call before the\ndriver\u0027s own -\u003eresume() callback. In this case,\nserial8250_console_restore() is called to quickly re-init the 8250 for\nconsole printing.\n\nSee commit 4516d50aabed (\"serial: 8250: Use canary to restart console after\nsuspend\") for the original motivation.\n\nUnfortunately, this canary workaround does not work in all cases (such as\nsuspend to mem) because the scratch register will not reset. This has not\nbeen a real issue until now because it could simply lead to some garbage\ncharacters upon resume. However, with the introduction of console flow\ncontrol it becomes a real problem because a failed suspend/resume detection\nwhen flow control is enabled leads to all characters hitting the flow\ncontrol timeout.\n\nWorkaround this issue by temporarily ignoring console flow control when\nthe debug canary suspend/resume detection is active.\n\nFixes: 5e6dfb87b191 (\"serial: 8250: Add support for console flow control\")\nSigned-off-by: John Ogness \u003cjohn.ogness@linutronix.de\u003e\nLink: https://patch.msgid.link/20260707141032.5074-1-john.ogness@linutronix.de\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b1b4efea05a56c0995e4702a86d6624b4fdff32f", "tree": "45ff87a2f0b5f7a577a06c6724adba39ed0d8775", "parents": [ "061b627ba534230a18ec4d7251562af12325d06a" ], "author": { "name": "Andy Shevchenko", "email": "andriy.shevchenko@linux.intel.com", "time": "Fri Jun 26 11:49:37 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 10 14:47:16 2026 +0200" }, "message": "serial: 8250_mid: Disable DMA for selected platforms\n\nIn accordance with Errata (specification updates)\nHSUART May Stop Functioning when DMA is Active.\n\n- Denverton document #572409, rev 3.4, DNV60\n- Ice Lake Xeon D document #714070, ICXD65\n- Snowridge document #731931, SNR44\n\nFor a quick fix just disable the respective callbacks during the device probe.\nDepending on the future development we might remove them completely.\n\nReported-by: micas-opensource \u003czjianan156@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-serial/20250625031409.2404219-1-opensource@ruijie.com.cn/\nFixes: 6ede6dcd87aa (\"serial: 8250_mid: add support for DMA engine handling from UART MMIO\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260626094937.561776-1-andriy.shevchenko@linux.intel.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "061b627ba534230a18ec4d7251562af12325d06a", "tree": "48fdad825e7c1145190dc5f98f880cc39963ab95", "parents": [ "e9ad4d5ca309cb517d3f7a85251c3c5328f40f1f" ], "author": { "name": "Matthias Feser", "email": "mfe@KBSgmbhfr.onmicrosoft.com", "time": "Tue May 26 07:35:09 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 10 14:46:54 2026 +0200" }, "message": "serial: 8250_omap: clear rx_running on zero-length DMA completes\n\nOn AM33xx RX DMA only triggers when the FIFO reaches the\nconfigured threshold (typically 48 bytes). For smaller bursts\nno DMA request is issued and the FIFO is drained by RX timeout.\n\nIn this case __dma_rx_do_complete() can legitimately see count \u003d\u003d 0.\n\nThe current code exits early in this case and does not clear\ndma-\u003erx_running, leaving the DMA state inconsistent. This can\nprevent RX DMA from restarting and may cause\nomap_8250_rx_dma_flush() to fail, marking DMA as broken.\n\nFix this by clearing dma-\u003erx_running once the DMA transfer has\ncompleted or been terminated, even if no data was transferred.\n\nFixes: a5fd8945a478 (\"serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Matthias Feser \u003cmfe@KBSgmbhfr.onmicrosoft.com\u003e\nReviewed-by: Moteen Shah \u003cm-shah@ti.com\u003e\nLink: https://patch.msgid.link/BE3P281MB55155F2F5795E411F5A65282EE0B2@BE3P281MB5515.DEUP281.PROD.OUTLOOK.COM\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e9ad4d5ca309cb517d3f7a85251c3c5328f40f1f", "tree": "7319df25bc0dca85b58bdd3882eee967412087d4", "parents": [ "22dd2777e6c180e1c945b00f6d18550979436324" ], "author": { "name": "Nicolas Pitre", "email": "npitre@baylibre.com", "time": "Thu Jun 25 22:48:33 2026 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 10 14:46:00 2026 +0200" }, "message": "vt: fix spurious modifier in CSI/cursor key sequences\n\ncsi_modifier_param() builds the xterm modifier parameter from\nshift_state, counting KG_SHIFTL/KG_SHIFTR as Shift, KG_ALTGR as Alt\nand KG_CTRLL/KG_CTRLR as Ctrl in addition to the canonical KG_SHIFT,\nKG_ALT and KG_CTRL.\n\nThat is wrong when those weights are not plain modifiers. Keymaps\nderived from XKB layouts (by kbd\u0027s xkbsupport, and by the\nconsole-setup used in Debian, Ubuntu and others) encode the active\nlayout group using KG_SHIFTL/KG_SHIFTR:\n\n\tgroup 1: -\n\tgroup 2: shiftl\n\tgroup 3: shiftr\n\tgroup 4: shiftl | shiftr\n\nSo while a non-default layout group is selected, KG_SHIFTL and/or\nKG_SHIFTR are set in shift_state with no Shift key held.\ncsi_modifier_param() then adds a spurious Shift to every cursor and\nCSI key: pressing Up while group 2 is active emits ESC[1;2A (Shift+Up)\ninstead of ESC[A. KG_ALTGR has the same problem since it is the\nstandard third-level selector.\n\nNormal keymaps bind the physical Shift/Ctrl/Alt keys to KG_SHIFT,\nKG_CTRL and KG_ALT, leaving the left/right and AltGr weights free for\nlayout and level selection. Count only those canonical weights, so\ngenuine modifiers are still encoded while layout/level selectors are\nnot.\n\nFixes: 4af70f151671 (\"vt: add modifier support to cursor keys\")\nReported-by: Alexey Gladkov \u003clegion@kernel.org\u003e\nCloses: https://lore.kernel.org/kbd/aj2gR0Y7sM6i9s2G@example.org/\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Nicolas Pitre \u003cnpitre@baylibre.com\u003e\nLink: https://patch.msgid.link/20260626024833.3419086-1-nico@fluxnic.net\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8ec4d9c5a5cf4b61fc087f871465b1f79b393325", "tree": "13f5b9258cf64f48db5bab90009038bcf03d29ae", "parents": [ "88dd117c92a142253fb7a17e791773902b3babc6" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:37:38 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:42:33 2026 +0200" }, "message": "dm-verity: make error counter atomic\n\nThe error counter \"v-\u003ecorrupted_errs\" was not atomic, thus it could be\nsubject to race conditions. The call to\ndm_audit_log_target(\"max-corrupted-errors\") may be skipped due to the\nraces.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nFixes: 65ff5b7ddf05 (\"dm verity: add error handling modes for corrupted blocks\")\nCc: stable@vger.kernel.org\n" }, { "commit": "88dd117c92a142253fb7a17e791773902b3babc6", "tree": "205cd7768ea1730196af4682f4d5afa9ab86e7d5", "parents": [ "e72b793ae440f6900fb17a4b8518c707b5cd3e17" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:36:01 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:42:05 2026 +0200" }, "message": "dm-verity: increase sprintf buffer size\n\nThe prefix \"DM_VERITY_ERR_BLOCK_NR\" is 22 chars. Add \u0027\u003d\u0027, one digit for\ntype, \u0027,\u0027, up to 20 digits for a u64 block number, and a NUL terminator:\nthat\u0027s 46 bytes. The buffer is 42 bytes. For block numbers \u003e\u003d 16 decimal\ndigits (devices larger than ~16 EB with 4K blocks), snprintf silently\ntruncates the uevent environment variable.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nFixes: 65ff5b7ddf05 (\"dm verity: add error handling modes for corrupted blocks\")\nCc: stable@vger.kernel.org\n" }, { "commit": "e72b793ae440f6900fb17a4b8518c707b5cd3e17", "tree": "bcda4db241368a1c88f50d1c69259e35437e9c33", "parents": [ "72e9ec2fe32b00994f41719cf77423fca67d48b2" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:35:06 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:41:43 2026 +0200" }, "message": "dm-verity: fix a possible NULL pointer dereference\n\nFix a possible NULL pointer dereference dm_verity_loadpin_is_bdev_trusted\nif the device has no table.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nFixes: b6c1c5745ccc (\"dm: Add verity helpers for LoadPin\")\nCc: stable@vger.kernel.org\n" }, { "commit": "72e9ec2fe32b00994f41719cf77423fca67d48b2", "tree": "44c9f7fde47977b02b75a319aed362276aa962b2", "parents": [ "76c6f845dc0c614304a6e6ee619b552f97cf24b3" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:33:16 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:41:17 2026 +0200" }, "message": "dm-verity: avoid double increment of \u0026use_bh_wq_enabled\n\nverity_parse_opt_args is called twice, first with the only_modifier_opts,\nfirst with only_modifier_opts \u003d\u003d true and then with only_modifier_opts \u003d\u003d\nfalse. Thus, the static branch \u0026use_bh_wq_enabled was incremented twice\nand the destructor verity_dtr would only decrement it once.\n\nFix tihs bug by only incrementing it on the first call, on the second\ncall, when v-\u003euse_bh_wq is true, do nothing.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nCc: stable@vger.kernel.org\nFixes: df326e7a0699 (\"dm verity: allow optional args to alter primary args handling\")\n" }, { "commit": "76c6f845dc0c614304a6e6ee619b552f97cf24b3", "tree": "5ecbae47ec8b8a22a98380c8b5e8cf50cca2c880", "parents": [ "366665416f20527ff7cad548a32d1ddf23195740" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:31:47 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:40:51 2026 +0200" }, "message": "dm-ioctl: fix a possible overflow in list_version_get_info\n\nsizeof(tt-\u003eversion) is 12 bytes, but the code writes 16 bytes into the\noutput buffer - info-\u003evers-\u003eversion[0], info-\u003evers-\u003eversion[1],\ninfo-\u003evers-\u003eversion[2] and info-\u003evers-\u003enext. This can cause buffer\noverflow.\n\nFix this buffer overflow by replacing \"sizeof(tt-\u003eversion)\" with\n\"sizeof(struct dm_target_versions)\".\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nCc: stable@vger.kernel.org\n" }, { "commit": "366665416f20527ff7cad548a32d1ddf23195740", "tree": "c4e78655f1e1886e6c51291702bd4c7b0a4f4ed7", "parents": [ "5a266764fadaff8b5c1fe37a186ebf9b09cb953e" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:29:11 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:40:24 2026 +0200" }, "message": "dm_early_create: fix freeing used table on dm_resume failure\n\nIf dm_resume fails, the kernel attempts to free table with\ndm_table_destroy, but the table was already instantiated with\ndm_swap_table. This commit skips the call to dm_table_destroy in this\ncase.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nFixes: 6bbc923dfcf5 (\"dm: add support to directly boot to a mapped device\")\nCc: stable@vger.kernel.org\n" }, { "commit": "5a266764fadaff8b5c1fe37a186ebf9b09cb953e", "tree": "fd1b6f1fc0ca287089e176a95fabf06704a256cb", "parents": [ "edf025f083854f80032b73a1aad69a3c90db236f" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:25:39 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:39:47 2026 +0200" }, "message": "dm-integrity: fix a bug if the bio is out of limits\n\nIf dm_integrity_check_limits fails, the code would exit with\nDM_MAPIO_KILL. However, the range would be already locked at this point,\nand it wouldn\u0027t be unlocked, resulting in a deadlock. Let\u0027s move the\nlimit check up, so that when it exits, no resources are leaked.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nFixes: fb0987682c62 (\"dm-integrity: introduce the Inline mode\")\nCc: stable@vger.kernel.org\n" }, { "commit": "edf025f083854f80032b73a1aad69a3c90db236f", "tree": "15653558257c68417a463130b3dc4caa927ea4fa", "parents": [ "7bb03b2b01b814a9fc14afbfc2cbb2cca5b34750" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:24:09 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:39:16 2026 +0200" }, "message": "dm-integrity: don\u0027t increment hash_offset twice\n\nhash_offset is already incremented in the loop \"for (i \u003d 0; i \u003c to_copy;\ni++, ts--)\". Do not increment it again.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nFixes: 84597a44a9d8 (\"dm-integrity: dm integrity: add optional discard support\")\nCc: stable@vger.kernel.org\n" }, { "commit": "7bb03b2b01b814a9fc14afbfc2cbb2cca5b34750", "tree": "ae08e2458a6c9f3d78157f4e037477225edcfb2f", "parents": [ "24d7e5e39b04c1ef8eee0688ca1527e879b22a40" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Jul 09 21:22:47 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:38:50 2026 +0200" }, "message": "dm-integrity: fix leaking uninitialized kernel memory\n\nIf hash size is less than device\u0027s tuple size, dm-integrity is supposed\nto zero the remaining space. There was a bug in the code that zeroing\ndidn\u0027t work. This commit fixes it.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nFixes: fb0987682c62 (\"dm-integrity: introduce the Inline mode\")\nCc: stable@vger.kernel.org\n" }, { "commit": "24d7e5e39b04c1ef8eee0688ca1527e879b22a40", "tree": "197f19213fac79a31a64adc533b4d3875643850d", "parents": [ "8d4dd2db7f4f3af0d3cd51111d050301c1f00a5c" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:31:25 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 14:38:01 2026 +0200" }, "message": "dm-integrity: fix the \u0027fix_hmac\u0027 option\n\nWhen the \"fix_hmac\" argument is used, dm-integrity is supposed to check\nthe superblock with the journal_mac. However, there was a logic bug in\nthe code - the code only checked the superblock mac if the bit\nSB_FLAG_FIXED_HMAC was set in the superblock. So, the attacker could\nclear this bit and bypass the checking trivially.\n\nThis commit changes dm-integrity so that when the user specified the\n\"fix_hmac\" flag and the superblock doesn\u0027t have the bit\nSB_FLAG_FIXED_HMAC set, the activation is aborted with an error.\n\nUnfortunatelly, there\u0027s a bug in the integritysetup tool that when using\nthe \u0027open\u0027 command it passes the \"fix_hmac\" argument to the kernel even\nif the user specified --integrity-legacy-hmac. The bug will be fixed in\nthe upcoming 2.8.7 release.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nReported-by: Shukai Ni \u003cshukai.ni@kuleuven.be\u003e\n" }, { "commit": "5948aaf64f81f217a25dcc2bf6c0779bca19566c", "tree": "56c00d2b0465ed08cccf93b3fd4f918002c79703", "parents": [ "07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2" ], "author": { "name": "Lee Jia Jie", "email": "jiajie.lee@starlabs.sg", "time": "Thu Jul 09 21:56:19 2026 +0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Jul 10 12:12:24 2026 +0200" }, "message": "perf/aux: Fix page UAF in map_range()\n\nmap_range() reads rb-\u003eaux_pages[], rb-\u003eaux_nr_pages and rb-\u003eaux_pgoff via\nperf_mmap_to_page() while holding only event-\u003emmap_mutex. Those fields are\nserialized by rb-\u003eaux_mutex, and mmap_mutex is per event.\n\nThus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race\nrb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows:\n\n CPU 0 CPU 1\n \u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\n rb_alloc_aux() map_range()\n [1]: allocate rb-\u003eaux_pages[0]\n [2]: rb-\u003eaux_nr_pages++\n [3]: perf_mmap_to_page()\n returns rb-\u003eaux_pages[0]\n [4]: map it as VM_PFNMAP\n [5]: rb-\u003eaux_pgoff \u003d 1\n\n munmap the page\n [6]: free rb-\u003eaux_pages[0]\n\nPages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a\nmapping to a freed physical frame.\n\nFix this by taking rb-\u003eaux_mutex across the page walk in map_range().\n\nFixes: b709eb872e19 (\"perf: map pages in advance\")\nSigned-off-by: Lee Jia Jie \u003cjiajie.lee@starlabs.sg\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" } ], "next": "6763a0aea6d658d69b9215ab9151d7bd4c1c314b" }