)]}'
{
  "log": [
    {
      "commit": "a6bb28c8c6bcc7218eb7c978362fc1f40549abd6",
      "tree": "45a98a99d9eaaca96228b0e6d646f45b9de03788",
      "parents": [
        "16b06f4e78f969e046991b2fb861cb6832248319",
        "7bc02ab446d38d8d56c548abcb974dfd6fade147"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 16:29:00 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 16:29:00 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "7bc02ab446d38d8d56c548abcb974dfd6fade147",
      "tree": "0040f0eb4b53341d669b06d439306e4907e5638a",
      "parents": [
        "764e7ed16d2d6a5948a9e8032b2ef7f77678a8ae"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Wed Jun 10 08:31:30 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 16:28:48 2026 +0200"
      },
      "message": "ALSA: pcm: Fix unlocked state reads in read/write file ops\n\nThe PCM read/write and readv/writev file operations reject streams in\nOPEN or DISCONNECTED state before accessing the configured runtime\nparameters. However, each operation reads runtime-\u003estate without the\nPCM stream lock.\n\nPCM state updates are serialized by the stream lock and may occur\nconcurrently from IRQ context. Use a local predicate based on\nsnd_pcm_get_state() to take a locked state snapshot for these VFS entry\nchecks.\n\nThis also consolidates the duplicated OPEN and DISCONNECTED tests. The\nconditions and returned errors remain unchanged.\n\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260610-alsa-pcm-read-write-state-helper-v1-1-93b7b992db09@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "16b06f4e78f969e046991b2fb861cb6832248319",
      "tree": "e527534141548828d8db010e352274ef6b36b9c7",
      "parents": [
        "f7e8e3da7d38cd3aac7cd25aeb475ea5f56c9f7a",
        "764e7ed16d2d6a5948a9e8032b2ef7f77678a8ae"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:36:36 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:36:36 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "764e7ed16d2d6a5948a9e8032b2ef7f77678a8ae",
      "tree": "0c0d2c09b70e6e2c29b21f6cd74690dd72547d18",
      "parents": [
        "dde75ff0f651182b671da700441406b8f9de3984"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 09 13:50:55 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:36:28 2026 +0200"
      },
      "message": "ALSA: timer: Disable work at freeing timer object\n\nThere might be a pending work at freeing a timer object, hence clean\nit up properly.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260609115100.806869-4-tiwai@suse.de\n"
    },
    {
      "commit": "dde75ff0f651182b671da700441406b8f9de3984",
      "tree": "4a5f08571571600bc80716ffe1e6b89f76604ae9",
      "parents": [
        "ccd0db6671d2cae986b2daa1c538b6d541a9d62c"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 09 13:50:54 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:36:28 2026 +0200"
      },
      "message": "Revert \"ALSA: timer: Fix UAF at snd_timer_user_params()\"\n\nThis reverts commit 053a401b592be424fea9d57c789f66cd5d8cec11.\n\nWith the change of the timer object lifecycle with kref, this\ntemporary workaround is no longer needed.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260609115100.806869-3-tiwai@suse.de\n"
    },
    {
      "commit": "ccd0db6671d2cae986b2daa1c538b6d541a9d62c",
      "tree": "c46c45e75df4d63b18a19bdd8ebf02ddf6deacc4",
      "parents": [
        "98e157916f83c26a41448267180944048d2f1460"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 09 13:50:53 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:36:28 2026 +0200"
      },
      "message": "ALSA: timer: Manage timer object with kref\n\nSo far we\u0027ve tried to address UAFs in ALSA timer code by applying the\nlocks at various places, but the fundamental problem is that the timer\nobject may be released while the belonging timer instance objects are\nstill present and accessing to it.  This patch is a more proper fix to\naddress that issue, namely, by refcounting and keeping the timer\nobject.\n\nThe basic implementation is to use kref for the refcount of the timer\nobject, and take/release the reference at assigning/releasing the\ninstance, as well as at referring from ioctls or ALSA sequencer code.\nThe reference from ioctl or ALSA sequencer is abstracted with\nsnd_timeri_timer auto-cleanup.\n\nNote that this change assumes that the code already took the fix\ncommit da3039e91d1f (\"ALSA: timer: Forcibly close timer instances at\nclosing\"); otherwise the refcount may be unbalanced when the timer is\nfreed while slave instances are still present.\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260609115100.806869-2-tiwai@suse.de\n"
    },
    {
      "commit": "98e157916f83c26a41448267180944048d2f1460",
      "tree": "51358d432fc37b4e200118eab15c0d14af466f3d",
      "parents": [
        "fcd4ccebc0c1b24b52c6d282c4a503af988e3d42"
      ],
      "author": {
        "name": "Furst Blumier",
        "email": "seal@furst.blue",
        "time": "Tue Jun 09 22:17:06 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:25:56 2026 +0200"
      },
      "message": "ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC\n\nThe HP 255 15.6 inch G9 Notebook PC (PCI SSID 103c:8a1b) uses the\nALC236 codec but lacks an entry in the quirk table, causing the kernel\nto fall back to a null SSID match (103c:0000) and skip the necessary\nfixup. Add a quirk entry using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2,\nmatching the HP 255 G8 which uses the same codec and fixup. This fixes\nthe mute-button LED and fixes an issue with unplugging and replugging a\nheadset jack not being recognized as an audio sink.\n\nSigned-off-by: Furst Blumier \u003cseal@furst.blue\u003e\nLink: https://patch.msgid.link/20260609201706.502075-1-seal@furst.blue\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "fcd4ccebc0c1b24b52c6d282c4a503af988e3d42",
      "tree": "3dd7347361e8de944b81784cb272a8417a579a0d",
      "parents": [
        "513480da5e9c8f55b4f8f5e89f386e26188fbb3f"
      ],
      "author": {
        "name": "Uwe Kleine-König (The Capable Hub)",
        "email": "u.kleine-koenig@baylibre.com",
        "time": "Tue Jun 09 18:46:10 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:25:03 2026 +0200"
      },
      "message": "ALSA: Improve style of pnp_device_id array terminators\n\nTo match how device-id array terminators look like for other device\ntypes drop `.id \u003d \"\"` from it and let the compiler care for zeroing the\nentry.\n\nThere are no changes in the compiled drivers, only the source looks\nnicer.\n\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\nLink: https://patch.msgid.link/47ae32220446ec1869898cf5e4b75ec94c32dfdf.1781023479.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "513480da5e9c8f55b4f8f5e89f386e26188fbb3f",
      "tree": "996eef9835f747d5c93e4b7663a686cb27a40f00",
      "parents": [
        "853e10ec445984e99b3c7f6375f4e185614b842a"
      ],
      "author": {
        "name": "Baojun Xu",
        "email": "baojun.xu@ti.com",
        "time": "Tue Jun 09 18:52:53 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:24:23 2026 +0200"
      },
      "message": "ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing\n\nFix reset for device-0:‌ In older projects (e.g., Merino), the hardware\nreset pin for the first SPI device (device-0) is ineffective, causing\ninitialization failures. Added a software reset sequence for device-0\nto ensure proper initialization.\n\n‌Handle -EXDEV correctly:‌ When processing block data, if the data does\nnot belong to the current SPI device, the driver returned -EXDEV.\nThis error code is now ignored to allow the driver to continue iterating\nthrough the block data and correctly calculate the total block size.\n\nSigned-off-by: Baojun Xu \u003cbaojun.xu@ti.com\u003e\nLink: https://patch.msgid.link/20260609105253.19510-1-baojun.xu@ti.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "853e10ec445984e99b3c7f6375f4e185614b842a",
      "tree": "19309464ff40ef05e60e6dad83c8c6b2eabe2bab",
      "parents": [
        "123fd13f35ccaf7d2b98f5a8cc6c8a3de378568d"
      ],
      "author": {
        "name": "Moritz Baron",
        "email": "moritz.baron@stud.uni-hannover.de",
        "time": "Tue Jun 09 16:16:48 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Jun 10 09:23:49 2026 +0200"
      },
      "message": "ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8\n\nThe Lenovo Yoga Pro 7 14IRH8 (ALC287 codec, subsystem ID 0x17aa:0x38b1)\nhas bass speakers on pin 0x17 that are not routed through a DAC with\nvolume control. This causes the bass speakers to play at full volume\nregardless of the volume slider position.\n\nApply ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN which corrects the DAC\nrouting for pin 0x17, enabling proper volume control. This is the same\nfix used for other Yoga Pro 7 models with identical audio topology\n(14APH8, 14AHP9, 14ASP10, 14IAH10).\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d217949\n\nCo-developed-by: Felix Aljoscha Schnuell \u003cfelix.aljoscha.schnuell@stud.uni-hannover.de\u003e\nSigned-off-by: Felix Aljoscha Schnuell \u003cfelix.aljoscha.schnuell@stud.uni-hannover.de\u003e\nSigned-off-by: Moritz Baron \u003cmoritz.baron@stud.uni-hannover.de\u003e\nLink: https://patch.msgid.link/20260609141648.60608-1-moritz.baron@stud.uni-hannover.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "f7e8e3da7d38cd3aac7cd25aeb475ea5f56c9f7a",
      "tree": "44e5037c823ff09cd566557da36456b4d5405b72",
      "parents": [
        "d765dc14b9ebff5f1155aaf1eedffc576ee5a596",
        "123fd13f35ccaf7d2b98f5a8cc6c8a3de378568d"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 09 13:07:41 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 09 13:07:41 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "123fd13f35ccaf7d2b98f5a8cc6c8a3de378568d",
      "tree": "acaa0a868cd3c9d6b2d8b229acb9c73b0dac799c",
      "parents": [
        "422e42b7c2b882ba1d16d4afc8891bcea7c4de93"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 09 09:49:04 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 09 12:50:06 2026 +0200"
      },
      "message": "ALSA: aloop: Drop superfluous break\n\nAt converting the spinlock to guard(), a break statement was put in\nthe scoped_guard block in loopback_jiffies_timer_function(), but it\u0027s\nobviously superfluous (although it\u0027s harmless).  Better to drop it for\navoiding confusion.\n\nFixes: 1ef2cb6b29c2 (\"ALSA: aloop: Use guard() for spin locks\")\nLink: https://patch.msgid.link/20260609074907.726593-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "d765dc14b9ebff5f1155aaf1eedffc576ee5a596",
      "tree": "f17eec9ba29a2623d2f5947241198e729f31cb35",
      "parents": [
        "779a6047f9fcf79fb345a1459abdc9919e49aaa2",
        "422e42b7c2b882ba1d16d4afc8891bcea7c4de93"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 11:45:52 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 11:45:52 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "422e42b7c2b882ba1d16d4afc8891bcea7c4de93",
      "tree": "66822a70229e3acb3b36ca8e1f552c9171aa6ef5",
      "parents": [
        "27ceefc5317e4294c225d67815a79b0415ad0dc6"
      ],
      "author": {
        "name": "Ruoyu Wang",
        "email": "ruoyuw560@gmail.com",
        "time": "Sun Jun 07 15:42:19 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 11:45:03 2026 +0200"
      },
      "message": "ALSA: es18xx: check control allocation before private data setup\n\nsnd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores\nbookkeeping pointers or sets private_free before calling snd_ctl_add().\nsnd_ctl_new1() can return NULL on allocation failure, so those writes\ncan dereference a NULL control pointer.\n\nCheck the returned control pointers before using them and return -ENOMEM\non allocation failure.\n\nSigned-off-by: Ruoyu Wang \u003cruoyuw560@gmail.com\u003e\nLink: https://patch.msgid.link/20260607074219.3-1-ruoyuw560@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "779a6047f9fcf79fb345a1459abdc9919e49aaa2",
      "tree": "e04f3e7f0c6c0e4259471634c958b9b2aaea803c",
      "parents": [
        "879cea87f612845bda3d2f9681ab315f4463424d",
        "27ceefc5317e4294c225d67815a79b0415ad0dc6"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:27:31 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:27:31 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "27ceefc5317e4294c225d67815a79b0415ad0dc6",
      "tree": "1230183cd5be6e9f30603fd249d746ba663ee908",
      "parents": [
        "705dd6dcbc0ea87351c660c1a6443f85f1001c76",
        "053a401b592be424fea9d57c789f66cd5d8cec11"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:26:48 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:27:04 2026 +0200"
      },
      "message": "Merge branch \u0027for-linus\u0027 into for-next\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "879cea87f612845bda3d2f9681ab315f4463424d",
      "tree": "e04f3e7f0c6c0e4259471634c958b9b2aaea803c",
      "parents": [
        "c2c0139be5819ec38fc52753c9c28cf552118fe4",
        "705dd6dcbc0ea87351c660c1a6443f85f1001c76"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:25:44 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:25:44 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "705dd6dcbc0ea87351c660c1a6443f85f1001c76",
      "tree": "4609a3420746ddff6d04ca66173a8671ef4f6ba2",
      "parents": [
        "98fe3988a2efe89a1a1ded213a0561e6543e94e2"
      ],
      "author": {
        "name": "Kyle Zeng",
        "email": "kylebot@openai.com",
        "time": "Sat Jun 06 17:41:29 2026 -0700"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:24:16 2026 +0200"
      },
      "message": "ALSA: seq: Clear variable event pointer on read\n\nsnd_seq_read() copies a queued variable-length event header to userspace\nbefore expanding the payload. Queued variable-length events use\nSNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first\nextension cell.\n\nThe read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the\ncopy, but it leaves data.ext.ptr untouched. A userspace sequencer client\ncan therefore write a direct variable event to itself and read back the\nextension-cell kernel address from the returned header.\n\nClear the temporary header pointer before copy_to_user(). The original\nqueued event remains unchanged and is still passed to\nsnd_seq_expand_var_event(), so payload expansion keeps using the\ninternal chain.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nLink: https://patch.msgid.link/20260607004129.61345-1-kylebot@openai.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "c2c0139be5819ec38fc52753c9c28cf552118fe4",
      "tree": "8ef0cb3cd4e8241a32f9fd75dd0cd965faa5e58a",
      "parents": [
        "a91c34ce24d51ce9217a7c63b8eba33d4d0edb8a",
        "053a401b592be424fea9d57c789f66cd5d8cec11"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:23:51 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:23:51 2026 +0200"
      },
      "message": "Merge branch \u0027for-linus\u0027\n"
    },
    {
      "commit": "053a401b592be424fea9d57c789f66cd5d8cec11",
      "tree": "c80938a1ddfa82dfbdd1d4879d31cf0d98dba653",
      "parents": [
        "da3039e91d1f835874ed6e9a33ea19ee80c2cb92"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sat Jun 06 18:11:41 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:23:44 2026 +0200"
      },
      "message": "ALSA: timer: Fix UAF at snd_timer_user_params()\n\nAt releasing a timer object, e.g. when a userspace timer\n(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it\ntries to detach the timer instances and release the resources.\nHowever, it\u0027s still possible that other in-flight tasks are holding\nthe timer instance where the to-be-deleted timer object is associated,\nand this may lead to racy accesses.\n\nFortunately, most of ioctls dealing with the timer instance list\nalready have the protection with register_mutex, and this also avoids\nsuch races.  But, SNDRV_TIMER_IOCTL_PARAMS isn\u0027t protected, hence the\nconcurrent ioctl may lead to use-after-free.\n\nThis patch just adds the guard with register_mutex to protect\nsnd_timer_user_params() for covering the code path as a quick\nworkaround.  It\u0027s no hot-path but rather a rarely issued ioctl, so the\nperformance penalty doesn\u0027t matter.\n\nReported-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nTested-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nLink: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "da3039e91d1f835874ed6e9a33ea19ee80c2cb92",
      "tree": "c19d55aea2d130e55dc3e1caaf4c2a52af415e4e",
      "parents": [
        "2b5ff4db5d7aa5b981d966df02e687f79ad7b311"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sat Jun 06 18:11:40 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun Jun 07 09:23:33 2026 +0200"
      },
      "message": "ALSA: timer: Forcibly close timer instances at closing\n\nWhen snd_timer object is freed via snd_timer_free() and still pending\nsnd_timer_instance objects are assigned to the timer object, it tries\nto unlink all instances and just set NULL to each ti-\u003etimer, then\nreleases the resources immediately.  The problem is, however, when\nthere are slave timer instances that are associated with a master\ninstance linked to this timer: namely, those slave instances still\npoint to the freed timer object although the master instance is\nunlinked, which may lead to user-after-free.  The bug can be easily\ntriggered particularly when a new userspace-driven timers\n(CONFIG_SND_UTIMER) is involved, since it can create and delete the\ntimer object via a simple file open/close, while the other\napplications may keep accessing to that timer.\n\nThis patch is an attempt to paper over the problem above: now instead\nof just unlinking, call snd_timer_close[_locked]() forcibly for each\npending timer instance, so that all assigned slave timer instances are\nproperly detached, too.  Since snd_timer_close() might be called later\nby the driver that created that instance, the check of\nSNDRV_TIMER_IFLG_DEAD is added at the beginning, too.\n\nReported-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nTested-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nFixes: 37745918e0e7 (\"ALSA: timer: Introduce virtual userspace-driven timers\")\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260606161145.1933447-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "98fe3988a2efe89a1a1ded213a0561e6543e94e2",
      "tree": "7389a3517220e0830919057779340b8806b53d06",
      "parents": [
        "2b7bd6f548292aec92a386deebe62324d21d62a9"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Fri Jun 05 12:48:27 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sat Jun 06 18:18:04 2026 +0200"
      },
      "message": "ALSA: pcm: Fix unlocked runtime state reads in xfer ioctls\n\nThe recent runtime state locking cleanup converted several PCM ioctl state\nchecks to snd_pcm_get_state(), including snd_pcm_pre_prepare(),\nsnd_pcm_drain() and snd_pcm_kernel_ioctl(). The native and compat xfer\nioctl paths still sample runtime-\u003estate directly before dispatching to the\nPCM transfer helpers, and snd_pcm_common_ioctl() still samples the\nDISCONNECTED state directly in its common precheck.\n\nUse snd_pcm_get_state() for those ioctl-side prechecks as well. This keeps\nthe externally visible ioctl entry checks consistent with the stream-locked\nstate access used by the recent PCM state-read cleanup.\n\nFixes: 032322b44c02 (\"ALSA: pcm: oss: use proper stream lock for runtime-\u003estate access\")\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260605-alsa-pcm-xfer-state-helper-v1-1-eba97cecf820@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "2b7bd6f548292aec92a386deebe62324d21d62a9",
      "tree": "2e3d4f20f1554efd27f6a2a6aafe39a3283e29c4",
      "parents": [
        "1516134cb65526aba5319bb446c296fc8a192f84"
      ],
      "author": {
        "name": "HyeongJun An",
        "email": "sammiee5311@gmail.com",
        "time": "Sat Jun 06 13:09:13 2026 +0900"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sat Jun 06 18:12:31 2026 +0200"
      },
      "message": "ALSA: seq: Fix partial userptr event expansion\n\nsnd_seq_expand_var_event_at() clamps the number of bytes to copy to the\nremaining variable-event length, but passes the original buffer size to\nexpand_var_event().\n\nFor SNDRV_SEQ_EXT_USRPTR events, expand_var_event() copies exactly the\nsize argument from userspace.  On the final chunk, when the remaining\nevent data is shorter than the caller\u0027s buffer, this can read past the\ndeclared event data and can spuriously fail with -EFAULT if the extra\nbytes cross an unmapped page.\n\nPass the clamped length instead.  The chained and kernel-backed paths\nalready reclamp in dump_var_event(), but the user-pointer path handles\nthe size directly.\n\nFixes: ea46f79709b6 (\"ALSA: seq: Add snd_seq_expand_var_event_at() helper\")\nSigned-off-by: HyeongJun An \u003csammiee5311@gmail.com\u003e\nLink: https://patch.msgid.link/20260606040913.230213-1-sammiee5311@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "a91c34ce24d51ce9217a7c63b8eba33d4d0edb8a",
      "tree": "d790b368b56faffb37caa23910bd59a83995985b",
      "parents": [
        "acfce4774d974f8fce06527f9c45e4210715e7da",
        "1516134cb65526aba5319bb446c296fc8a192f84"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 18:25:40 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 18:25:40 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "1516134cb65526aba5319bb446c296fc8a192f84",
      "tree": "23484b49fe3d171764f3cab4e1de1eff7e956624",
      "parents": [
        "2b5632d72fca0841bea283da2e3a478d24118508"
      ],
      "author": {
        "name": "Oliver Hartkopp",
        "email": "socketcan@hartkopp.net",
        "time": "Fri May 29 17:23:59 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 18:25:32 2026 +0200"
      },
      "message": "ALSA: hda: fix Kconfig dependency of HD Audio PCI\n\nWith commit 2d9223d2d64c (\"ALSA: hda: Move controller drivers into\nsound/hda/controllers directory\") the HD Audio drivers have been moved\nfrom linux/sound/pci/hda to linux/sound/hda.\n\nBut the Kconfig dependency for SND_HDA_INTEL stayed on SND_PCI instead of\ndepending on PCI directly. To make the \"HD Audio PCI\" configuration entry\nvisible it is currently needed to enable \"PCI sound devices\" although\nno PCI device in the submenu needs to be selected.\n\nMake SND_HDA_INTEL directly depending on hardware/architecture like the\nother entries in this Kconfig.\n\nFixes: 2d9223d2d64c (\"ALSA: hda: Move controller drivers into sound/hda/controllers directory\")\nSigned-off-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nLink: https://patch.msgid.link/20260529-hda-kconfig-v1-1-4a2c6a0efd56@hartkopp.net\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "acfce4774d974f8fce06527f9c45e4210715e7da",
      "tree": "01ae74d499f4a30d039f188a8360604e02c927dd",
      "parents": [
        "bc137fa9d76f65e959cb0ee35b36511bec03f75e",
        "2b5632d72fca0841bea283da2e3a478d24118508"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 13:14:15 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 13:14:15 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "2b5632d72fca0841bea283da2e3a478d24118508",
      "tree": "b503e572533c2903bbb8e0ecf779446b9b71403e",
      "parents": [
        "5061b090db75c9fb98c8024779f771d92e5cf3a8"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Fri Jun 05 01:14:40 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 13:13:55 2026 +0200"
      },
      "message": "ALSA: usb-audio: qcom: Initialize offload control return value\n\nsnd_usb_offload_create_ctl() returns ret after walking the USB PCM list,\nbut ret is only assigned after a playback stream passes the endpoint and\nPCM-index filters.\n\nIf all playback streams are skipped, for example because there is no\nplayback endpoint or because all PCM indexes exceed the 0xff control\nrange, the function returns an uninitialized stack value.\n\nInitialize ret to 0 so the no-control-created path returns deterministic\nsuccess, while preserving the existing negative error return when\nsnd_ctl_add() fails.\n\nFixes: a67656f011d1 (\"ALSA: usb-audio: qcom: Add USB offload route kcontrol\")\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260605-alsa-usb-qcom-offload-ret-init-v1-1-dc72fcc4bd3b@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "bc137fa9d76f65e959cb0ee35b36511bec03f75e",
      "tree": "84b4aaf0e13228dbfb9d679f9f39bb876dd29145",
      "parents": [
        "a5b51356e6b570571592b1a0f9a994f2573227e2",
        "2b5ff4db5d7aa5b981d966df02e687f79ad7b311"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 10:09:20 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 10:09:20 2026 +0200"
      },
      "message": "Merge branch \u0027for-linus\u0027\n"
    },
    {
      "commit": "2b5ff4db5d7aa5b981d966df02e687f79ad7b311",
      "tree": "faf75d419abbf4db327a9d546cf255e639a7646c",
      "parents": [
        "d76b56b06b2734c6e0ff519599126919fa4f154b"
      ],
      "author": {
        "name": "Kyle Zeng",
        "email": "kylebot@openai.com",
        "time": "Fri Jun 05 01:02:04 2026 -0700"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Jun 05 10:08:57 2026 +0200"
      },
      "message": "ALSA: seq: dummy: fix UMP event stack overread\n\nThe dummy sequencer port forwards events by copying an incoming\nstruct snd_seq_event into a stack temporary, rewriting source and\ndestination, and dispatching the temporary to subscribers. That legacy\nevent storage is smaller than struct snd_seq_ump_event.\n\nWhen a UMP event reaches the dummy client, the copy leaves the UMP flag\nset but only provides legacy-sized stack storage. The subscriber\ndelivery path then uses snd_seq_event_packet_size() and copies a\nUMP-sized packet from that stack object, reading past the end of the\ntemporary.\n\nUse the existing union __snd_seq_event storage and copy the packet size\nreported for the incoming event before rewriting the common routing\nfields. This preserves the full UMP packet for UMP events while keeping\nlegacy event handling unchanged.\n\nFixes: 32cb23a0f911 (\"ALSA: seq: dummy: Allow UMP conversion\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nLink: https://patch.msgid.link/20260605080204.32045-1-kylebot@openai.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "a5b51356e6b570571592b1a0f9a994f2573227e2",
      "tree": "a50342e230c5dd3eceeed0384dfd2af94bafcd56",
      "parents": [
        "964223bac7ead864ad210c981561d2c1a49f6481",
        "d76b56b06b2734c6e0ff519599126919fa4f154b"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:27:48 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:27:48 2026 +0200"
      },
      "message": "Merge branch \u0027for-linus\u0027\n"
    },
    {
      "commit": "d76b56b06b2734c6e0ff519599126919fa4f154b",
      "tree": "d4501adc3369a548f55692351bbef66f406556d5",
      "parents": [
        "88fe2e3658726cb21ff2dcf9770bf672f9b9d31b"
      ],
      "author": {
        "name": "Lianqin Hu",
        "email": "hulianqin@vivo.com",
        "time": "Thu Jun 04 12:40:28 2026 +0000"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:27:35 2026 +0200"
      },
      "message": "ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio\n\nSetting up the interface when suspended/resumeing fail on this card.\nAdding a reset and delay quirk will eliminate this problem.\n\nusb 1-1: new full-speed USB device number 2 using xhci-hcd\nusb 1-1: New USB device found, idVendor\u003d3c20, idProduct\u003d3d21\nusb 1-1: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\nusb 1-1: Product: AB13X USB Audio\nusb 1-1: Manufacturer: Generic\nusb 1-1: SerialNumber: 20210726905926\n\nSigned-off-by: Lianqin Hu \u003chulianqin@vivo.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/TYUPR06MB62174610061C213260E1A992D2102@TYUPR06MB6217.apcprd06.prod.outlook.com\n"
    },
    {
      "commit": "964223bac7ead864ad210c981561d2c1a49f6481",
      "tree": "16ca5e62ab143cb43de20cd85809e9cb2de5e31a",
      "parents": [
        "36af4c48cd89b6c5522e8c5a3301f57f2a6dd4e3",
        "88fe2e3658726cb21ff2dcf9770bf672f9b9d31b"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:26:45 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:26:45 2026 +0200"
      },
      "message": "Merge branch \u0027for-linus\u0027\n"
    },
    {
      "commit": "36af4c48cd89b6c5522e8c5a3301f57f2a6dd4e3",
      "tree": "f898bcd3f35f93d601b55d93694a1a7358abb4d9",
      "parents": [
        "67d2ef3ba77a1aed63e2a9d4cfa57442381f56b7",
        "5061b090db75c9fb98c8024779f771d92e5cf3a8"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:26:40 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:26:40 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "5061b090db75c9fb98c8024779f771d92e5cf3a8",
      "tree": "922b0467d36449cb71241f6ad4e53105781e27d7",
      "parents": [
        "64917f839d373df2573eb47f271df98f1daef7fa"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:19:17 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:26:04 2026 +0200"
      },
      "message": "ALSA: usb: qcom: Drop unused variables\n\nForgot to clean up the unused variables after the code refactoring,\nwhich leads to compile warnings.\n\nReported-by: Mark Brown \u003cbroonie@kernel.org\u003e\nCloses: https://lore.kernel.org/aiGUoChmVKE-xwvC@sirena.org.uk\nFixes: f1f16e1809c8 (\"ALSA: usb-audio: qcom: Use PAGE_ALIGN macro for buffer size calculation\")\nLink: https://patch.msgid.link/20260604151927.1227105-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "88fe2e3658726cb21ff2dcf9770bf672f9b9d31b",
      "tree": "c42310a7be73cf7083633816e2b22d0c8bba6ffc",
      "parents": [
        "b734412619821f3ed63ba63533f539672cb7a76d"
      ],
      "author": {
        "name": "Ji\u0027an Zhou",
        "email": "eilaimemedsnaimel@gmail.com",
        "time": "Thu Jun 04 14:25:59 2026 +0000"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:24:26 2026 +0200"
      },
      "message": "ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_wait_queue with a conditional\nremove_wait_queue that is skipped when to_check is no longer\nin the group after concurrent UNLINK.  The orphaned wait entry\nremains on the unlinked substream sleep queue.  On the next\ndrain iteration, add_wait_queue adds the entry to a new queue\nwhile still linked on the old one, corrupting both lists.  A\nsubsequent wake_up dereferences NULL at the func pointer\n(mapped from the spinlock at offset 0 of the misinterpreted\nwait_queue_head_t), causing a kernel panic.\n\nReplace init_waitqueue_entry/add_wait_queue/conditional\nremove_wait_queue with init_wait_entry/prepare_to_wait/\nfinish_wait.  init_wait_entry clears prev/next via\nINIT_LIST_HEAD on each iteration and sets\nautoremove_wake_function which auto-removes the entry on\nwake-up.  finish_wait safely handles both the already-removed\nand still-queued cases.\n\nFixes: 9b1dbd69ba6f (\"ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain\")\nSigned-off-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nLink: https://patch.msgid.link/20260604142559.3840881-1-eilaimemedsnaimel@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "b734412619821f3ed63ba63533f539672cb7a76d",
      "tree": "bda3035a3667723e8215d3a4bd099ef71ec0a34c",
      "parents": [
        "aa2f4addab44407c7aa742321de5dc1914ab5762",
        "d2dcd85f9e09fe3566d4cdcd357856a42ac73f93"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:21:01 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 17:21:01 2026 +0200"
      },
      "message": "Merge tag \u0027asoc-fix-v7.1-rc6\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nThere\u0027s only one actual fix here, for the TDM configuration on the\nFreescale SAI controller, everytihng else is DMI quirks for AMD systems.\nOne of those is relatively large as it adds a bunch of different structs\nbut it\u0027s all data.\n"
    },
    {
      "commit": "d2dcd85f9e09fe3566d4cdcd357856a42ac73f93",
      "tree": "b569c8c3745778f03e452cc90123d946d8b61b74",
      "parents": [
        "cad530a8371124da988608f11df30b7dd82391ef"
      ],
      "author": {
        "name": "Aleksander Pshenitsyn",
        "email": "brains.fatman@gmail.com",
        "time": "Sun May 31 13:11:59 2026 +0300"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Thu Jun 04 11:35:06 2026 +0100"
      },
      "message": "ASoC: amd: acp70: add standalone RT721 SoundWire machine\n\nThe ASUS Vivobook 18 M1807GA (AMD ACP7.x, PCI 1022:15e2, subsystem\n1043:3531) exposes a single Realtek RT721 SDCA codec on SoundWire link 1.\nThe BIOS reports the ACP audio config flag as 0 (SoundWire mode), so\nsnd_pci_ps claims the device, brings up the SoundWire managers and\nenumerates the RT721 peripheral (sdw:0:1:025d:0721:01); the rt721-sdca\ncodec driver binds successfully.\n\nNo sound card is created, however: acp63_sdw_machine_select() walks\nsnd_soc_acpi_amd_acp70_sdw_machines[] and finds no entry whose declared\nSoundWire peripherals are all present on the bus. The only existing RT721\nentry, acp70_rt721_l1u0_tas2783x2_l1u8b, additionally requires two\nTAS2783 amplifiers and deliberately exposes the RT721 as jack + DMIC\nonly. This M1807GA variant has no external amplifiers - the RT721\u0027s\ninternal AIF2 amplifier path drives the speakers - so that entry never\nmatches and no machine device is registered.\n\nAdd a standalone RT721 machine entry for link 1 exposing all three RT721\nendpoints (jack/AIF1, speaker amplifier/AIF2, DMIC/AIF3), mirroring the\nstandalone RT722 configuration. Place it after the TAS2783 combo entry so\nplatforms that do have the external amplifiers continue to match the more\nspecific entry first.\n\nACPI _ADR of the codec: 0x000130025D072101\n(link_id\u003d1 version\u003d3 mfg_id\u003d0x025d Realtek part_id\u003d0x0721 class\u003d0x01).\n\nVerified on the hardware: with the entry present the amd_sdw machine\nbinds, an \"amd-soundwire\" card is registered exposing the rt721-sdca\nAIF1 (SimpleJack) and AIF2 (SmartAmp) PCM devices, and audio plays out\nof the built-in speakers.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221282\nSigned-off-by: Aleksander Pshenitsyn \u003cbrains.fatman@gmail.com\u003e\nLink: https://patch.msgid.link/20260531101159.14241-1-brains.fatman@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "cad530a8371124da988608f11df30b7dd82391ef",
      "tree": "45ec63f69155235767b5ebfaee47e1daf157b530",
      "parents": [
        "4790af1cc2e8871fb31f28c66e42b9a949a23992"
      ],
      "author": {
        "name": "David Glushkov",
        "email": "david.glushkov@sntiq.com",
        "time": "Sun May 31 23:45:12 2026 +0200"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Thu Jun 04 11:20:33 2026 +0100"
      },
      "message": "ASoC: amd: yc: Add MSI Raider A18 HX A9WJG to quirk table\n\nThe MSI Raider A18 HX A9WJG has an internal digital microphone\nconnected through AMD ACP6x, but this machine does not expose the\nAcpDmicConnected ACPI property, so acp_yc_mach does not bind.\n\nAdd a DMI quirk for this model.\n\nThis was tested on an MSI Raider A18 HX A9WJG with board MS-182L,\nBIOS E182LAMS.31A, AMD ACP6x rev 0x62, and Realtek ALC274. After\napplying the quirk, the internal microphone appears as an acp6x DMIC\ncapture device and records correctly.\n\nSigned-off-by: David Glushkov \u003cdavid.glushkov@sntiq.com\u003e\nLink: https://patch.msgid.link/20260531214512.170716-1-david.glushkov@sntiq.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "4790af1cc2e8871fb31f28c66e42b9a949a23992",
      "tree": "be8d9148f8e0398f301b696f00c190c2913b4c3f",
      "parents": [
        "c9c64820a48dcc739311fd7a9138511888539d02"
      ],
      "author": {
        "name": "Chancel Liu",
        "email": "chancel.liu@nxp.com",
        "time": "Mon Jun 01 17:33:27 2026 +0900"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Thu Jun 04 11:16:58 2026 +0100"
      },
      "message": "ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write\n\nWhen configuring 32 slots TDM (channels \u003d\u003d slots \u003d\u003d 32), the xMR\n(Mask Register) write used:\n~0UL - ((1 \u003c\u003c min(channels, slots)) - 1)\n\nThe literal \"1\" is a signed 32-bit int. Shifting it by 32 positions is\nundefined behaviour which may set this register to 0xFFFFFFFF, masking\nall 32 slots.\n\nUse GENMASK_U32() macro instead. For 32 slots this produces a zero mask:\n~GENMASK_U32(31, 0) \u003d ~0xFFFFFFFF \u003d 0x00000000\nBehaviour for fewer than 32 slots is unchanged.\n\nFixes: 770f58d7d2c5 (\"ASoC: fsl_sai: Support multiple data channel enable bits\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chancel Liu \u003cchancel.liu@nxp.com\u003e\nReviewed-by: Shengjiu Wang \u003cshengjiu.wang@gmail.com\u003e\nLink: https://patch.msgid.link/20260601083327.1535185-1-chancel.liu@oss.nxp.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "67d2ef3ba77a1aed63e2a9d4cfa57442381f56b7",
      "tree": "d703f17f4dcf6c4af66a8ee1955fdc01dc45c505",
      "parents": [
        "10a5707d968cf679d3ceb849eae5317b45c80c60",
        "64917f839d373df2573eb47f271df98f1daef7fa"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:21:43 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:21:43 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "64917f839d373df2573eb47f271df98f1daef7fa",
      "tree": "b312aacfbb4db86dfd4a957f26701b2d0067dc62",
      "parents": [
        "c6c6f0aec6fb4cbcc547bb265315fd76f18be731"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Thu Jun 04 01:48:14 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:20:41 2026 +0200"
      },
      "message": "ALSA: seq: oss: Use scoped cleanup for temporary MIDI use lock\n\nThe OSS sequencer write and out-of-band paths may receive a temporary\nsnd_use_lock_t reference from snd_seq_oss_process_event(). This was added\nto keep MIDI device data alive until events with embedded SysEx data are\ndispatched.\n\nUse a scoped cleanup helper for that temporary reference. This keeps the\nlifetime rule local to the variable declaration and avoids future missing\nsnd_use_lock_free() paths if these event handling paths gain more exits.\n\nNo functional change is intended.\n\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260604-alsa-scoped-cleanups-v1-3-10c43152a728@gmail.com\n"
    },
    {
      "commit": "c6c6f0aec6fb4cbcc547bb265315fd76f18be731",
      "tree": "397dec1d2152b1eb96dceb63b82ec449b59192a5",
      "parents": [
        "83615ff7c61ce2336b81b68cfbba6eadaf7843e9"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Thu Jun 04 01:48:13 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:20:41 2026 +0200"
      },
      "message": "ALSA: core: Add scoped cleanup helper for card references\n\nSeveral ALSA paths acquire temporary card references with snd_card_ref()\nand release them manually with snd_card_unref(). control_led.c already\ndefines a local cleanup helper for this pattern, while other core paths\nstill open-code the release.\n\nMove the helper to the common ALSA core header and use it in control-layer\ncard-reference paths. This makes the ownership rule explicit and avoids\nfuture missing-unref mistakes when adding early exits.\n\nNo functional change is intended.\n\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260604-alsa-scoped-cleanups-v1-2-10c43152a728@gmail.com\n"
    },
    {
      "commit": "83615ff7c61ce2336b81b68cfbba6eadaf7843e9",
      "tree": "0c5e1c353c1db42b50d8e4302bf8be4c289d495a",
      "parents": [
        "3580bc53520ce4efc94ece5886ad3670b93667ba"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Thu Jun 04 01:48:12 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:20:41 2026 +0200"
      },
      "message": "ALSA: control: Use scoped cleanup for user control buffers\n\nUser-defined control TLV data and enum names are copied from user space\nwith vmemdup_user() before being installed in the user_element. Until\nownership is transferred, these temporary buffers have to be released on\nevery validation exit.\n\nUse __free(kvfree) for the temporary buffers and no_free_ptr() when\nownership is transferred to the user_element. This removes the manual\nkvfree() calls from the unchanged-TLV and enum-name validation paths,\nmakes the ownership hand-off explicit, and keeps the existing allocation\naccounting and ABI unchanged.\n\nNo functional change is intended.\n\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260604-alsa-scoped-cleanups-v1-1-10c43152a728@gmail.com\n"
    },
    {
      "commit": "3580bc53520ce4efc94ece5886ad3670b93667ba",
      "tree": "f4cf7c535114be6f2b357627db554b4a422fc30d",
      "parents": [
        "f1f16e1809c8f9e4a3c39f165efe114e0e292d8e"
      ],
      "author": {
        "name": "Andrei Faleichyk",
        "email": "andrei.faleichyk@noogadev.com",
        "time": "Thu Jun 04 01:33:13 2026 +0400"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:17:22 2026 +0200"
      },
      "message": "ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP\n\nThe internal microphone on ASUS VivoBook X509DAP (subsystem ID\n0x1043:0x197e) is not detected without a quirk entry. Add\nALC256_FIXUP_ASUS_MIC_NO_PRESENCE to fix the issue.\n\nSigned-off-by: Andrei Faleichyk \u003candrei.faleichyk@noogadev.com\u003e\nLink: https://patch.msgid.link/20260603213313.6298-1-andrei.faleichyk@noogadev.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "f1f16e1809c8f9e4a3c39f165efe114e0e292d8e",
      "tree": "7c1d68bd6c4a6b2a54215b23c5b6f33326befe0e",
      "parents": [
        "9beb7dbbc567bb6ad7741140dd359d805734e664"
      ],
      "author": {
        "name": "wangdicheng",
        "email": "wangdicheng@kylinos.cn",
        "time": "Wed Jun 03 17:11:02 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:15:10 2026 +0200"
      },
      "message": "ALSA: usb-audio: qcom: Use PAGE_ALIGN macro for buffer size calculation\n\nUse the kernel\u0027s PAGE_ALIGN() macro instead of open-coding the page\nalignment calculation. This improves code readability and follows\nkernel coding style.\n\nThe manual calculation:\n  mult \u003d len / PAGE_SIZE;\n  remainder \u003d len % PAGE_SIZE;\n  len \u003d mult * PAGE_SIZE;\n  len +\u003d remainder ? PAGE_SIZE : 0;\n\nis equivalent to:\n  len \u003d PAGE_ALIGN(len);\n\nSigned-off-by: wangdicheng \u003cwangdicheng@kylinos.cn\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260603091102.231370-4-wangdich9700@163.com\n"
    },
    {
      "commit": "9beb7dbbc567bb6ad7741140dd359d805734e664",
      "tree": "37094ad00fb9adf9a155f74658f7f67174ce4d4d",
      "parents": [
        "537153aaafa94efe77efd566eada7dbab9fb76dd"
      ],
      "author": {
        "name": "wangdicheng",
        "email": "wangdicheng@kylinos.cn",
        "time": "Wed Jun 03 17:11:01 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:15:09 2026 +0200"
      },
      "message": "ALSA: usb-audio: qcom: Fix return value in qc_usb_audio_offload_fill_avail_pcms\n\nThe function qc_usb_audio_offload_fill_avail_pcms() always returns -1\nregardless of how many PCM devices were successfully filled. This makes\nit impossible for callers to know the actual number of available PCMs.\n\nReturn the actual count of filled PCM devices instead, which allows\ncallers to verify that all expected PCMs were properly enumerated.\n\nSigned-off-by: wangdicheng \u003cwangdicheng@kylinos.cn\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260603091102.231370-3-wangdich9700@163.com\n"
    },
    {
      "commit": "537153aaafa94efe77efd566eada7dbab9fb76dd",
      "tree": "8d6ef28e4ab0a2fc81625bd5f7d0dc986a131aef",
      "parents": [
        "addf2286331adc72a81de2179887671ecbf9f314"
      ],
      "author": {
        "name": "wangdicheng",
        "email": "wangdicheng@kylinos.cn",
        "time": "Wed Jun 03 17:11:00 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:15:09 2026 +0200"
      },
      "message": "ALSA: usb-audio: qcom: Use snprintf for mixer control name formatting\n\nThe current code uses sprintf() to format control names without bounds\nchecking, which could lead to buffer overflow if PCM index is large.\nReplace sprintf with snprintf to ensure buffer safety.\n\nThe ctl_name buffer is 48 bytes, and the formatted string could exceed\nthis with large PCM index values. Using snprintf with sizeof(ctl_name)\nprevents potential buffer overflow.\n\nSigned-off-by: wangdicheng \u003cwangdicheng@kylinos.cn\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260603091102.231370-2-wangdich9700@163.com\n"
    },
    {
      "commit": "addf2286331adc72a81de2179887671ecbf9f314",
      "tree": "814387faf0fdf1a6f7d2a55389a6fdcd9982f219",
      "parents": [
        "def5e78a4e003c83adc9a8b4b72534def3a49641"
      ],
      "author": {
        "name": "wangdicheng",
        "email": "wangdicheng@kylinos.cn",
        "time": "Wed Jun 03 17:10:59 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:15:09 2026 +0200"
      },
      "message": "ALSA: usb-audio: qcom: Improve error logging in USB offload\n\nAdd error codes to error messages for better debugging.\nThis helps identify the root cause when USB audio offload fails.\n\nError messages now include the actual error code returned by\nxhci_sideband operations, making it easier to diagnose failures\nduring USB audio offload setup.\n\nSigned-off-by: wangdicheng \u003cwangdicheng@kylinos.cn\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260603091102.231370-1-wangdich9700@163.com\n"
    },
    {
      "commit": "def5e78a4e003c83adc9a8b4b72534def3a49641",
      "tree": "bf18892b5039d2cf2b04f81a30ef320d2d85247d",
      "parents": [
        "611f538253d970f4d152003841544e875828d015"
      ],
      "author": {
        "name": "Evelyn Ali",
        "email": "evelynali99@gmail.com",
        "time": "Tue Jun 02 17:41:22 2026 -0400"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 04 10:12:57 2026 +0200"
      },
      "message": "ALSA: hda/realtek: ALC882: Fixup for Clevo P775TM1\n\nClevo P775TM1 laptops come with an ESS Sabre HiFi DAC. Setting\n0x1b pin VREF to 80% enables said DAC output.\n\nSigned-off-by: Evelyn Ali \u003cevelynali99@gmail.com\u003e\nLink: https://patch.msgid.link/20260602214122.78020-1-evelynali99@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "10a5707d968cf679d3ceb849eae5317b45c80c60",
      "tree": "afd3384791172264223b0af3da26d4893077550f",
      "parents": [
        "96d4780e9ff5168195e891c474a85bb0d510fe9f",
        "611f538253d970f4d152003841544e875828d015"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 02 19:49:34 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 02 19:49:34 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "611f538253d970f4d152003841544e875828d015",
      "tree": "1cbdd8f3fd16065ed5eb8a81ae6e68675c450e79",
      "parents": [
        "f8e357ac28c3eb06a266bd10443b3eace6eebd22"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Tue Jun 02 08:18:39 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 02 19:49:29 2026 +0200"
      },
      "message": "ALSA: seq: oss: Reject reads that cannot fit the next event\n\nsnd_seq_oss_read() checks whether the next queued OSS sequencer event\nfits in the remaining userspace buffer before removing it from the read\nqueue.\n\nThe check is inverted. It currently stops when the event is smaller than\nthe remaining buffer, so a normal 4-byte event is not copied for an\n8-byte read buffer. Conversely, an 8-byte event can be copied for a\nsmaller read count.\n\nBreak only when the remaining userspace buffer is smaller than the next\nevent, and report -EINVAL if no complete event has been copied. This\nprevents an undersized read from looking like end-of-file while leaving\nthe event queued for a later read with a large enough buffer.\n\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260602-alsa-seq-oss-read-size-check-v1-1-10e59b1742e0@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "f8e357ac28c3eb06a266bd10443b3eace6eebd22",
      "tree": "b064698b5a351962a6b8da34cfbcd4ce3a831ae9",
      "parents": [
        "af31e980def6cd6554ad4d7f266ecf5c4ebce4e3"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Tue Jun 02 07:55:46 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 02 19:48:40 2026 +0200"
      },
      "message": "ALSA: seq: Restore created port information after insertion\n\nCommit 2ee646353cd5 (\"ALSA: seq: Register kernel port with full\ninformation\") split sequencer port creation from list insertion so a\nport can be filled before it becomes visible.\n\nHowever, snd_seq_ioctl_create_port() still copies port-\u003eaddr back to the\nioctl argument before snd_seq_insert_port() assigns the final port\nnumber. A successful SNDRV_SEQ_IOCTL_CREATE_PORT without\nSNDRV_SEQ_PORT_FLG_GIVEN_PORT can therefore report port -1 to userspace.\n\nMove the ioctl address copy after successful insertion, and keep the\ndefault \"port-%d\" name assignment from overwriting a caller-provided port\nname. This restores the observable behavior from before the split while\nkeeping the port populated before publication.\n\nFixes: 2ee646353cd5 (\"ALSA: seq: Register kernel port with full information\")\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260602-alsa-seq-create-port-info-fix-v1-1-eec0280131e9@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "96d4780e9ff5168195e891c474a85bb0d510fe9f",
      "tree": "d1d9be472ae491766671f104c9ee603ddbf1403c",
      "parents": [
        "b641e25c7a06dac52914ccc60a9b4ac68e9aa3b3",
        "af31e980def6cd6554ad4d7f266ecf5c4ebce4e3"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 02 08:24:45 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 02 08:24:45 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "af31e980def6cd6554ad4d7f266ecf5c4ebce4e3",
      "tree": "b0e827f37c6b816686dc285c7adbe98e4044c68b",
      "parents": [
        "e9c82f767f0f46ef90eeefccc0a8006cc86aff40"
      ],
      "author": {
        "name": "Ferus Castor",
        "email": "feruscastor@proton.me",
        "time": "Sun May 31 18:58:48 2026 -0700"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Jun 02 08:24:06 2026 +0200"
      },
      "message": "ALSA: oxygen: add HT-Omega eClaro (7284:9783) support\n\nThe HT-Omega eClaro is a PCI sound card built on the C-Media CMI8788\n(Oxygen HD) controller, with PCI subsystem ID 7284:9783.\n\nOutput hardware:\n - AK4396VF stereo DAC: front L/R output, connected via SPI CE0\n - CS4362A 6-channel DAC: surround, center/LFE, and side outputs,\n   connected via SPI CE1 with a 3-byte [0x30, reg, val] frame\n\nThe CS4362A uses inverse attenuation encoding (0 \u003d 0 dB, 127 \u003d max\nattenuation) and a 0.5 dB/step logarithmic scale. Volume TLV is set\nto TLV_DB_SCALE(-6350, 50, 0) to match the hardware. The channel-to-\nregister mapping was verified by listening test:\n - Pair 1 (regs 7/8):   side L/R   (ALSA channels 6/7)\n - Pair 2 (regs 10/11): center/LFE (ALSA channels 4/5)\n - Pair 3 (regs 13/14): rear L/R   (ALSA channels 2/3)\n\nInput hardware:\n - CS5361 stereo ADC: Line In and Mic In capture\n\nGPIO assignments:\n - GPIO 0 (0x0001): CS4362A RESET# (active-low, driven high)\n - GPIO 2/3:        CS5361 M0/M1 (sample rate mode)\n - GPIO 5 (0x0020): front output stage enable (driven high)\n - GPIO 8 (0x0100): headphone amplifier enable\n\nSigned-off-by: Ferus Castor \u003cferuscastor@proton.me\u003e\nAssisted-by: Claude:claude-sonnet-4-6\nLink: https://patch.msgid.link/20260601015848.128566-1-feruscastor@proton.me\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "c9c64820a48dcc739311fd7a9138511888539d02",
      "tree": "a3898cbf4dd1ccbe4a0e37532a588ab76d4c6f80",
      "parents": [
        "fc12cf16df9af867e1455b011cdd9310474a612e"
      ],
      "author": {
        "name": "João Miguel",
        "email": "jmiguel.ghp@gmail.com",
        "time": "Sat May 23 22:35:48 2026 +0100"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Mon Jun 01 17:19:50 2026 +0100"
      },
      "message": "ASoC: amd: yc: Enable internal mic on MSI Bravo 17 C7VF\n\nThe MSI Bravo 17 C7VF routes its internal digital microphone through\nthe ACP6x. The machine driver only enables the DMIC for boards present\nin the DMI quirk table, so on this model the internal mic is never\ndetected and no capture device is created.\n\nAdd a quirk entry matching the board\u0027s DMI identifiers so the DMIC is\nenabled and the internal microphone works.\n\nSigned-off-by: João Miguel \u003cjmiguel.ghp@gmail.com\u003e\nLink: https://patch.msgid.link/20260523213548.5219-1-jmiguel.ghp@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "fc12cf16df9af867e1455b011cdd9310474a612e",
      "tree": "69d384f2995706b64e2573859ec414eaa0e55b08",
      "parents": [
        "e43ffb69e0438cddd72aaa30898b4dc446f664f8"
      ],
      "author": {
        "name": "Jackie Dong",
        "email": "xy-jackie@139.com",
        "time": "Wed May 27 18:20:05 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Mon Jun 01 17:05:09 2026 +0100"
      },
      "message": "ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11\n\nLenovo Yoga Pro 7 15ASH11 with AMD RYZEN AI MAX+ 388 (Strix Halo, ACP\n7.0) uses Realtek ALC287 series codec and no any DMIC connected by ACP.\nAll DMICs directly connet with ALC codec.\n\nWithout this quirk, Input Device of Gnome Sound settings shows Internal\nStereo Microphone and Digital Microphone by default. In fact, Digital\nMicrophone of ACP doesn\u0027t work due to no connecting with ALC287 codec,\nthe Internal Stereo Microphone as analog device based on snd_hda_intel\ndriver can work well.\n\nAdd a DMI quirk to override the flag to 0, consistent with the existing\nentry for the HN7306EA.\n\nSigned-off-by: Jackie Dong \u003cxy-jackie@139.com\u003e\nLink: https://patch.msgid.link/20260527102005.58528-1-xy-jackie@139.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "b641e25c7a06dac52914ccc60a9b4ac68e9aa3b3",
      "tree": "3726324443deef40a26571e6ffadc8a83cae1b36",
      "parents": [
        "5fa82dd6492e9ac3ab27d2c15d73b601b4e6a87d",
        "e9c82f767f0f46ef90eeefccc0a8006cc86aff40"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Mon Jun 01 11:29:47 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Mon Jun 01 11:29:47 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "e9c82f767f0f46ef90eeefccc0a8006cc86aff40",
      "tree": "0f2a30dfa45fb67d68a28817ed91b82cf79155c6",
      "parents": [
        "8a2d0b5496850403d1105efbbe54aa8fc68cae6f"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Sun May 31 22:23:35 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Mon Jun 01 11:29:02 2026 +0200"
      },
      "message": "ALSA: core: Use flexible array for card private data\n\nsnd_card_new() and snd_devm_card_new() allocate struct snd_card\ntogether with optional driver-private storage. The storage is currently\ndescribed only by open-coded sizeof(*card) + extra_size arithmetic, and\nsnd_card_init() reaches it by manually adding sizeof(struct snd_card) to\nthe card pointer.\n\nMake the trailing storage explicit with a flexible array member. Use\nkzalloc_flex() for the regular allocation path and struct_size() for the\ndevres allocation size. This documents the layout and avoids open-coded\nvariable-size object arithmetic.\n\nAlign the flexible array to unsigned long long so the driver-private area\ndoes not become less aligned than the old sizeof(struct snd_card) tail\naddress on 32-bit ABIs.\n\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260531-alsa-card-private-flex-array-v2-1-e4ff67f5bd23@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "8a2d0b5496850403d1105efbbe54aa8fc68cae6f",
      "tree": "47c0e38d39234ad8f6eb3ac8303ed78a06d19dde",
      "parents": [
        "635b5c6622f317a06c11ee050c2665c1085b68a0"
      ],
      "author": {
        "name": "Cássio Gabriel",
        "email": "cassiogabrielcontato@gmail.com",
        "time": "Sun May 31 20:41:41 2026 -0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Mon Jun 01 11:28:32 2026 +0200"
      },
      "message": "ALSA: seq: Use flexible array for device arguments\n\nsnd_seq_device_new() allocates struct snd_seq_device together with a\ncaller-specific argument area. SNDRV_SEQ_DEVICE_ARGPTR() reaches that\narea by adding sizeof(struct snd_seq_device) to the object pointer.\n\nMake the trailing storage explicit with a flexible array and allocate it\nwith kzalloc_flex(). This makes the object layout self-describing and\navoids open-coded size arithmetic in the allocation and accessor.\n\nReject negative argsize values before calculating the allocation size.\nCurrent in-tree callers pass either zero or sizeof() values, but the\nfunction takes an int size argument and should not let a negative value\nflow into unsigned allocation arithmetic.\n\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260531-alsa-seq-flex-args-v2-1-6e068d4ed9b0@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "e43ffb69e0438cddd72aaa30898b4dc446f664f8",
      "tree": "4f844efc76f40c4cb998567f5348b46c128b6415",
      "parents": [
        "8d9c51eac648ec953ea534b536d62337be3744b7"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 15:14:24 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 15:14:24 2026 -0700"
      },
      "message": "Linux 7.1-rc6\n"
    },
    {
      "commit": "8d9c51eac648ec953ea534b536d62337be3744b7",
      "tree": "94032dd5785d14a2dc3b38a8a5d116b2a703cf34",
      "parents": [
        "968966c2823a4b426a1c71101cb682faa0982892",
        "171022c7d594c133a45f92357a2a91475edabe20"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 11:50:39 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 11:50:39 2026 -0700"
      },
      "message": "Merge tag \u0027media/v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fixes from Mauro Carvalho Chehab:\n\n - rc: igorplugusb: fix control request setup packet\n\n - vsp1: revert a couple patches to fix regressions when setting DRM\n   pipelines\n\n* tag \u0027media/v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n  media: rc: igorplugusb: fix control request setup packet\n  Revert \"media: renesas: vsp1: brx: Fix format propagation\"\n  Revert \"media: renesas: vsp1: Initialize format on all pads\"\n"
    },
    {
      "commit": "968966c2823a4b426a1c71101cb682faa0982892",
      "tree": "60745a176326282c90775e53a156920ad6446126",
      "parents": [
        "13bd441bb98e9cc91f9fb4449415e0519a0de7a9",
        "44eeff9bc467bc7d1fec34fc3f6001f385fe462c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:52:16 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:52:16 2026 -0700"
      },
      "message": "Merge tag \u0027x86-urgent-2026-05-31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Make the clearcpuid\u003d boot parameter less prominent\n   and warn about its dangers \u0026 caveats (Borislav Petkov)\n\n - Do not access the (new) PLATFORM_ID MSR when running\n   as a guest (Borislav Petkov)\n\n - x86 ftrace: Relocate %rip-relative percpu refs in dynamic\n   trampolines, to fix crash when using such trampolines\n   (Alexis Lothoré)\n\n - Fix x86-64 CFI build error (Peter Zijlstra)\n\n - Revert FPU signal return magic number check optimization,\n   because it broke CRIU and gVisor in certain FPU configurations\n   (Andrei Vagin)\n\n* tag \u0027x86-urgent-2026-05-31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  Revert \"x86/fpu: Refine and simplify the magic number check during signal return\"\n  x86/kvm/vmx: Fix x86_64 CFI build\n  x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines\n  x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a guest\n  Documentation/arch/x86: Hide clearcpuid\u003d\n"
    },
    {
      "commit": "5fa82dd6492e9ac3ab27d2c15d73b601b4e6a87d",
      "tree": "4c72685b59958713d68139ea337153d6d56d3369",
      "parents": [
        "4fb0a7b737a400e0ce3a92a6aca1965933b63ea3",
        "635b5c6622f317a06c11ee050c2665c1085b68a0"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 17:49:18 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 17:49:18 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "635b5c6622f317a06c11ee050c2665c1085b68a0",
      "tree": "bda3b55ecd9fdd8121313b6143194686aa4e7531",
      "parents": [
        "3207ed0f704987d412ac6a7fb32a9ed65b995882"
      ],
      "author": {
        "name": "Rong Zhang",
        "email": "i@rong.moe",
        "time": "Sun May 31 23:45:22 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 17:48:49 2026 +0200"
      },
      "message": "ALSA: usb-audio: Add quirk flag for Edifier MF200\n\nThe UAC mixer of Edifier MF200 works fine except that its volume GET_CUR\nmethod is somehow stubbed and returns a constant value. Since commit\n86aa1ea1f15c (\"ALSA: usb-audio: Do not expose sticky mixers\"), the\nsticky check considers the mixer to be sticky and unnecessarily disables\nthe mixer.\n\nAdd a quirk table entry matching VID/PID\u003d0x2d99/0xa024 and applying\nthe MIXER_SKIP_GET_CUR_VOL quirk flag, so that the mixer is usable\nagain.\n\nQuirky device sample:\n\n  usb 1-3.2: new full-speed USB device number 7 using xhci_hcd\n  usb 1-3.2: New USB device found, idVendor\u003d2d99, idProduct\u003da024, bcdDevice\u003d 0.00\n  usb 1-3.2: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\n  usb 1-3.2: Product: EDIFIER MF200\n  usb 1-3.2: Manufacturer: EDIFIER\n  usb 1-3.2: SerialNumber: EDI00000X06\n  input: EDIFIER EDIFIER MF200 Consumer Control as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0e:00.0/usb1/1-3/1-3.2/1-3.2:1.0/0003:2D99:A024.0003/input/input8\n  input: EDIFIER EDIFIER MF200 Mouse as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0e:00.0/usb1/1-3/1-3.2/1-3.2:1.0/0003:2D99:A024.0003/input/input9\n  input: EDIFIER EDIFIER MF200 Keyboard as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0e:00.0/usb1/1-3/1-3.2/1-3.2:1.0/0003:2D99:A024.0003/input/input10\n  input: EDIFIER EDIFIER MF200 as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0e:00.0/usb1/1-3/1-3.2/1-3.2:1.0/0003:2D99:A024.0003/input/input11\n  input: EDIFIER EDIFIER MF200 as /devices/pci0000:00/0000:00:02.1/0000:05:00.0/0000:06:0c.0/0000:0e:00.0/usb1/1-3/1-3.2/1-3.2:1.0/0003:2D99:A024.0003/input/input12\n  hid-generic 0003:2D99:A024.0003: input,hiddev1,hidraw2: USB HID v1.10 Mouse [EDIFIER EDIFIER MF200] on usb-0000:0e:00.0-3.2/input0\n  usb 1-3.2: 9:1: sticky mixer values (-32768/-32513/1 \u003d\u003e -32702), disabling\n\nReported-by: Steve Smith \u003ctarkasteve@gmail.com\u003e\nCloses: https://lore.kernel.org/r/CAHLWS5FJCx66GQ-O10pu+nEudEo_QgQAM9vt76T7vT0zGPPC1g@mail.gmail.com\nTested-by: Steve Smith \u003ctarkasteve@gmail.com\u003e\nSigned-off-by: Rong Zhang \u003ci@rong.moe\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260531-uac-quirk-get-cur-vol-v4-3-ede643dca151@rong.moe\n"
    },
    {
      "commit": "3207ed0f704987d412ac6a7fb32a9ed65b995882",
      "tree": "a9be7e076371a1e8e6ded80ffa61edb9aeb657dc",
      "parents": [
        "ad2c7d2c42af943a3e711bdc1e4fd55b76fcbe55"
      ],
      "author": {
        "name": "Rong Zhang",
        "email": "i@rong.moe",
        "time": "Sun May 31 23:45:21 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 17:48:48 2026 +0200"
      },
      "message": "ALSA: usb-audio: Add quirk flag for Sennheiser MOMENTUM 3\n\nThe Sennheiser MOMENTUM 3 is a wireless around-ear headphones featuring\nANC, which can be connected via Bluetooth or USB-C.\n\nWhen connecting via USB-C, its UAC mixer works fine and precisely\ncorresponds to the reported dB range. However, the mixer\u0027s volume\nGET_CUR method is somehow stubbed and returns a constant value (15dB).\nSince commit 86aa1ea1f15c (\"ALSA: usb-audio: Do not expose sticky\nmixers\"), the sticky check considers the mixer to be sticky and\nunnecessarily disables the mixer.\n\nAdd a quirk table entry matching VID/PID\u003d0x1377/0x6004 and applying\nthe MIXER_GET_CUR_BROKEN quirk flag, so that the mixer is usable again.\n\nQuirky device sample:\n\n  usb 7-1.4.4.1.1.1: new full-speed USB device number 30 using xhci_hcd\n  usb 7-1.4.4.1.1.1: New USB device found, idVendor\u003d1377, idProduct\u003d6004, bcdDevice\u003d38.85\n  usb 7-1.4.4.1.1.1: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\n  usb 7-1.4.4.1.1.1: Product: MOMENTUM 3\n  usb 7-1.4.4.1.1.1: Manufacturer: Sennheiser electronic GmbH \u0026 Co. KG\n  usb 7-1.4.4.1.1.1: SerialNumber: \u003cREDACTED\u003e\n  usb 7-1.4.4.1.1.1: Found last interface \u003d 0\n  usb 7-1.4.4.1.1.1: 1:1: add audio endpoint 0x3\n  usb 7-1.4.4.1.1.1: Creating new data endpoint #3\n  usb 7-1.4.4.1.1.1: 1:1 Set sample rate 48000, clock 0\n  usb 7-1.4.4.1.1.1: 6:0: sticky mixer values (0/11520/768 \u003d\u003e 3840), disabling\n  usb 7-1.4.4.1.1.1: [6] FU [PCM Playback Volume] skipped due to invalid volume\n  input: Sennheiser electronic GmbH \u0026 Co. KG MOMENTUM 3 as /devices/pci0000:00/0000:00:08.3/0000:67:00.4/usb7/7-1/7-1.4/7-1.4.4/7-1.4.4.1/7-1.4.4.1.1/7-1.4.4.1.1.1/7-1.4.4.1.1.1:1.2/0003:1377:6004.002B/input/input208\n  input: Sennheiser electronic GmbH \u0026 Co. KG MOMENTUM 3 Consumer Control as /devices/pci0000:00/0000:00:08.3/0000:67:00.4/usb7/7-1/7-1.4/7-1.4.4/7-1.4.4.1/7-1.4.4.1.1/7-1.4.4.1.1.1/7-1.4.4.1.1.1:1.2/0003:1377:6004.002B/input/input209\n  hid-generic 0003:1377:6004.002B: input,hiddev99,hidraw12: USB HID v1.11 Device [Sennheiser electronic GmbH \u0026 Co. KG MOMENTUM 3] on usb-0000:67:00.4-1.4.4.1.1.1/input2\n\nSigned-off-by: Rong Zhang \u003ci@rong.moe\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260531-uac-quirk-get-cur-vol-v4-2-ede643dca151@rong.moe\n"
    },
    {
      "commit": "ad2c7d2c42af943a3e711bdc1e4fd55b76fcbe55",
      "tree": "56f28f4fe0f2c465a505cdd52292f0695fa5b584",
      "parents": [
        "f52b1b0506c6a209c10a741d031944d1ed19548c"
      ],
      "author": {
        "name": "Rong Zhang",
        "email": "i@rong.moe",
        "time": "Sun May 31 23:45:20 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 17:48:48 2026 +0200"
      },
      "message": "ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN\n\nSince commit 86aa1ea1f15c (\"ALSA: usb-audio: Do not expose sticky\nmixers\"), the UAC mixer core utilizes volume SET_CUR and GET_CUR to\nidentify devices with sticky mixers. Unfortunately, even though most\ndevices with sticky GET_CUR also have corresponding sticky SET_CUR,\nwhich I actually met more since the commit had been merged, there is\nalso a rare case that some devices may have volume mixers that responds\nto SET_CUR properly but with its GET_CUR stubbed. This cause the sticky\ncheck to consider the mixer to be sticky and unnecessarily disable it.\n\nAs the sticky check can\u0027t distinguish between sticky mixers and working\nSET_CUR but broken GET_CUR, add QUIRK_FLAG_MIXER_GET_CUR_BROKEN to tell\nthat the device should fall into the second category when GET_CUR\nreturns a constant value. In this case, the sticky check becomes\nnon-fatal and only disables GET_CUR instead of the whole mixer. The\ncurrent volume will then be provided by the internal cache that stores\nthe last set volume.\n\nAn info message prompting users to check MIXER_GET_CUR_BROKEN for\npotential sticky mixers is also added, so that users can learn how to do\nsome experiments to determine what\u0027s going on. If the mixer surprisingly\nturns out to be non-sticky, they can submit a patch for a new quirk\ntable entry.\n\nSigned-off-by: Rong Zhang \u003ci@rong.moe\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260531-uac-quirk-get-cur-vol-v4-1-ede643dca151@rong.moe\n"
    },
    {
      "commit": "13bd441bb98e9cc91f9fb4449415e0519a0de7a9",
      "tree": "25041ee4cfae04300db785d0aa69308ae4446335",
      "parents": [
        "9cf1afe6de1dc9dfced6070328626830794bac9d",
        "85db7391310b1304d2dc8ae3b0b12105a9567147"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:45:08 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:45:08 2026 -0700"
      },
      "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Two core changes, the only one of significance being the change to\n  kick queues in SDEV_CANCEL which had a small window for stuck\n  requests.\n\n  The major driver fixes are the one to the FC transport class to widen\n  the FPIN counter to counter a theoretical (and privileged) fabric\n  traffic injection attack and the other is an iscsi fix where a\n  malicious target could trick the kernel into an output buffer overrun.\n\n  Both the driver fixes were AI assisted\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n  scsi: target: iscsi: Validate CHAP_R length before base64 decode\n  scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n  scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n  scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n  scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n  scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()\n  scsi: megaraid_sas: Fix NULL pointer dereference on firmware duplicate completion\n  scsi: devinfo: Add BLIST_NO_RSOC for Promise VTrak E310f\n  scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues\n"
    },
    {
      "commit": "9cf1afe6de1dc9dfced6070328626830794bac9d",
      "tree": "8368901815ce319358123ca1aae4c484592eecc7",
      "parents": [
        "227abb780c68687d6800cf9eafaff0cbeca4bf45",
        "1d774589f924056b8403e271fdecaf9a803a50fc"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:33:08 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:33:08 2026 -0700"
      },
      "message": "Merge tag \u0027i2c-for-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n\n - davinci: fix fallback bus frequency on missing clock-frequency\n\n - virtio: mark device ready initially\n\n* tag \u0027i2c-for-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n  i2c: virtio: mark device ready before registering the adapter\n  i2c: davinci: fix division by zero on missing clock-frequency\n"
    },
    {
      "commit": "227abb780c68687d6800cf9eafaff0cbeca4bf45",
      "tree": "7d73343a34379cea7cc755fa4c964f5b150f0933",
      "parents": [
        "174914ea551314c52a61713b9c4bde9e42d48073",
        "dab48a7e74e6a394f3aa0461a2b1fb0c7b38fcb8"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:27:18 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun May 31 08:27:18 2026 -0700"
      },
      "message": "Merge tag \u0027input-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - updates to Elan I2C touchpad driver to handle a new IC type and to\n   validate size of supplied firmware to prevent OOB access\n\n - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II\n   and \"Nova 2 Lite\" from GameSir controllers as well as a fix to\n   prevent a potential OOB access when handling \"Share\" button\n\n - an update to Synaptics touchpad driver to use RMI mode for touchpad\n   in Thinkpad E490\n\n - updates to Atmel MXT driver adding checks to prevent potential OOB\n   accesses\n\n - a fix to IMS PCU driver to free correct amount of memory when tearing\n   it down\n\n - a fixup to the recent change to Atlas buttons driver\n\n - a small cleanup in fm801-fp for PCI IDs table initialisation\n\n* tag \u0027input-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n  Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()\n  Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490\n  Input: atlas - check ACPI_COMPANION() against NULL\n  Input: atmel_mxt_ts - check mem_size before calculating config memory size\n  Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem\n  Input: fm801-gp - simplify initialisation of pci_device_id array\n  Input: xpad - add \"Nova 2 Lite\" from GameSir\n  Input: xpad - add support for ASUS ROG RAIKIRI II\n  Input: elan_i2c - validate firmware size before use\n  Input: xpad - fix out-of-bounds access for Share button\n  Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n  Input: elan_i2c - increase device reset wait timeout after update FW\n  Input: elan_i2c - add ic type 0x19\n"
    },
    {
      "commit": "f52b1b0506c6a209c10a741d031944d1ed19548c",
      "tree": "1f494771dd504b132c0c9f4b2d5f2cabf1e7e686",
      "parents": [
        "ca06d8c68060b754e22eb999b6f35a5b7fc6ae79",
        "aa2f4addab44407c7aa742321de5dc1914ab5762"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:49:30 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:49:36 2026 +0200"
      },
      "message": "Merge branch \u0027for-linus\u0027 into for-next\n\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "4fb0a7b737a400e0ce3a92a6aca1965933b63ea3",
      "tree": "2d9b4cf38587cb366a61d53bb53a81e55d7aa885",
      "parents": [
        "ae7d950e16fcd1fc0d0a5833c0f061dc1c1fbb41",
        "ca06d8c68060b754e22eb999b6f35a5b7fc6ae79"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:48:20 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:48:20 2026 +0200"
      },
      "message": "Merge branch \u0027for-next\u0027\n"
    },
    {
      "commit": "ca06d8c68060b754e22eb999b6f35a5b7fc6ae79",
      "tree": "2e2f53b7e8a80a6086324bfccde13e55d3048a8a",
      "parents": [
        "17065203e1bc7e7f2786998d532cd93a06265156"
      ],
      "author": {
        "name": "Colin Ian King",
        "email": "colin.i.king@gmail.com",
        "time": "Sun May 31 11:13:39 2026 +0100"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:47:51 2026 +0200"
      },
      "message": "ALSA: hda/tas2781: Fix spelling mistake: \"Froce\" -. \"Force\"\n\nThere is a spelling mistake in a snprintf statement. Fix it.\n\nSigned-off-by: Colin Ian King \u003ccolin.i.king@gmail.com\u003e\nLink: https://patch.msgid.link/20260531101339.42155-1-colin.i.king@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "ae7d950e16fcd1fc0d0a5833c0f061dc1c1fbb41",
      "tree": "fd857a5ba0ad7f43016aed76e089608d7e839003",
      "parents": [
        "c784d0e6a62abbd2af58bbbe2d20f88dd550e3eb",
        "aa2f4addab44407c7aa742321de5dc1914ab5762"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:07:38 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:07:38 2026 +0200"
      },
      "message": "Merge branch \u0027for-linus\u0027\n"
    },
    {
      "commit": "aa2f4addab44407c7aa742321de5dc1914ab5762",
      "tree": "1c9d0d5f09044536ea579e4d3b5487bfa1277d8b",
      "parents": [
        "2c142b63c8ee982cdfdba49a616027c266294838"
      ],
      "author": {
        "name": "Rong Zhang",
        "email": "i@rong.moe",
        "time": "Sun May 31 03:52:49 2026 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Sun May 31 16:07:32 2026 +0200"
      },
      "message": "ALSA: usb-audio: Set the value of potential sticky mixers to maximum\n\nIt makes no sense to restore the saved value for a sticky mixer, since\nsetting any value is a no-op.\n\nHowever, in some rare cases, SET_CUR is effective despite GET_CUR always\nreturns a constant value. These mixers are not sticky, but there\u0027s no\nway to distinguish them. Without any additional information, the best\nthing we can do is to set the mixer value to the maximum before bailing\nout, so that a soft mixer can still reach the maximum hardware volume if\nthe mixer turns out to be non-sticky. Meanwhile, all channels must be\nsynchronized to prevent imbalance volume.\n\nFixes: 86aa1ea1f15c (\"ALSA: usb-audio: Do not expose sticky mixers\")\nSigned-off-by: Rong Zhang \u003ci@rong.moe\u003e\nLink: https://patch.msgid.link/20260531-uac-sticky-error-path-v1-1-12c2329d17ef@rong.moe\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "174914ea551314c52a61713b9c4bde9e42d48073",
      "tree": "c7035bc0abc5c8165911490194e52a303123633a",
      "parents": [
        "9d87d0fc8c8e0a2a2b5026a169db2f270b4828c1",
        "9d2491197a00acf8c423512078458c2855102b66"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 17:05:58 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 17:05:58 2026 -0700"
      },
      "message": "Merge tag \u0027v7.1-rc6-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - fix uninitialized variable in smb2_writev_callback()\n\n - detect short folioq copy in cifs_copy_folioq_to_iter()\n\n* tag \u0027v7.1-rc6-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n  smb: client: fix uninitialized variable in smb2_writev_callback\n  smb: client: detect short folioq copy in cifs_copy_folioq_to_iter()\n"
    },
    {
      "commit": "9d87d0fc8c8e0a2a2b5026a169db2f270b4828c1",
      "tree": "c981811edb000e4fe0481b8e21265ef809eb0972",
      "parents": [
        "a29c0b0cafc78a45f44ac4a98efee0c11dd7996d",
        "8fd2f26fa2a33cfe8ac043f976137ecf5b567f03"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 15:39:47 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 15:39:47 2026 -0700"
      },
      "message": "Merge tag \u0027liveupdate-fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux\n\nPull liveupdate fixes from Mike Rapoport:\n \"Two kexec handover regression fixes:\n\n   - fix order calculation for kho_unpreserve_pages() to make sure sure\n     that the order calculation in kho_unpreserve_pages() mathes the\n     order calculation in kho_preserve_pages().\n\n   - fix math in calculation of KHO_TREE_MAX_DEPTH to make it work with\n     16KB pages\"\n\n* tag \u0027liveupdate-fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:\n  kho: fix order calculation for kho_unpreserve_pages()\n  kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes\n"
    },
    {
      "commit": "a29c0b0cafc78a45f44ac4a98efee0c11dd7996d",
      "tree": "23c4227493d89a0276b0331e96285982a51bae8d",
      "parents": [
        "670b77dfebe7257adc0defbc48a4c43cfdf6c8f6",
        "7c2eee9c136734825ff524dd8b2146438a4f8250"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 15:37:05 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 15:37:05 2026 -0700"
      },
      "message": "Merge tag \u0027fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock\n\nPull memblock fix from Mike Rapoport:\n \"Fix regression from memblock_free_late() refactoring\n\n  After refactoring of memblock_free_late() and free_init_pages() it\n  became possible to call memblock_free() after memblock init data was\n  discarded.\n\n  Make sure memblock_free() does not touch memblock.reserved unless it\n  is called early enough or when ARCH_KEEP_MEMBLOCK is enabled\"\n\n* tag \u0027fixes-2026-05-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:\n  memblock: don\u0027t touch memblock arrays when memblock_free() is called late\n"
    },
    {
      "commit": "171022c7d594c133a45f92357a2a91475edabe20",
      "tree": "87ffeb174ec8aa00c51ee37dcb3d18a079a9117d",
      "parents": [
        "f78073e84c800ae146ce62447e7a685a5ceeb92d"
      ],
      "author": {
        "name": "Henri A",
        "email": "contact@henrialfonso.com",
        "time": "Wed May 20 10:25:44 2026 -0400"
      },
      "committer": {
        "name": "Hans Verkuil",
        "email": "hverkuil+cisco@kernel.org",
        "time": "Sat May 30 18:21:47 2026 +0200"
      },
      "message": "media: rc: igorplugusb: fix control request setup packet\n\nCommit eac69475b01f (\"media: rc: igorplugusb: heed coherency\nrules\") changed the control request storage from an embedded struct to\nan allocated pointer so it can obey DMA coherency rules.\n\nHowever, the driver still passes \u0026ir-\u003erequest to usb_fill_control_urb().\nThat points the URB setup packet at the pointer field itself rather than\nat the allocated struct usb_ctrlrequest.\n\nUSB core then interprets pointer bytes as the setup packet. This can\nproduce an invalid bRequestType and trigger the control direction warning\nreported by syzbot:\n\n  usb 2-1: BOGUS control dir, pipe 80003580 doesn\u0027t match bRequestType 0\n\nPass ir-\u003erequest itself as the setup packet.\n\nFixes: eac69475b01f (\"media: rc: igorplugusb: heed coherency rules\")\nReported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d11f0e4f957c7c3bf3d51\nTested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com\nCc: stable@vger.kernel.org\nAssisted-by: Codex:GPT-5.5\nSigned-off-by: Henri A \u003ccontact@henrialfonso.com\u003e\nSigned-off-by: Sean Young \u003csean@mess.org\u003e\nSigned-off-by: Hans Verkuil \u003chverkuil+cisco@kernel.org\u003e\n"
    },
    {
      "commit": "670b77dfebe7257adc0defbc48a4c43cfdf6c8f6",
      "tree": "60f52a85ef4edabdc8a8da0dac1a453efa287386",
      "parents": [
        "495fb8dd7f1da991c5325f4a0a50d0b042f19523",
        "645d4eda1d0db0202ed8e4a2c3abb2ebce6b86ef"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 08:37:45 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 08:37:45 2026 -0700"
      },
      "message": "Merge tag \u0027usb-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB and Thunderbolt fixes from Greg KH:\n \"Here is a set of USB fixes and new device ids for 7.1-rc6. Nothing\n  major in here, just lots of tiny fixes for reported issues found by\n  users and some older patches found by some scanning tools. Included in\n  here are:\n\n   - typec fixes found by fuzzers that have decided to finally look at\n     that device interaction path (i.e. before a driver is bound to a\n     device)\n\n   - typec fixes for issues found by users\n\n   - thunderbolt driver fixes for reported problems\n\n   - cdns3 driver fixes\n\n   - dwc3 driver fixes\n\n   - new device quirks added\n\n   - usb serial driver fixes for broken devices\n\n   - other small driver fixes\n\n  All of these have been in linux-next for over a week with no reported\n  issues\"\n\n* tag \u0027usb-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (54 commits)\n  USB: serial: cypress_m8: validate interrupt packet headers\n  USB: serial: safe_serial: fix memory corruption with small endpoint\n  USB: serial: omninet: fix memory corruption with small endpoint\n  USB: serial: mxuport: fix memory corruption with small endpoint\n  USB: serial: cypress_m8: fix memory corruption with small endpoint\n  USB: cdc-acm: Fix bit overlap and move quirk definitions to header\n  usb: dwc2: Fix use after free in debug code\n  usb: chipidea: core: convert ci_role_switch to local variable\n  usb: gadget: f_fs: serialize DMABUF cancel against request completion\n  usb: gadget: f_fs: copy only received bytes on short ep0 read\n  usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports\n  dt-bindings: usb: Fix EIC7700 USB reset\u0027s issue\n  usbip: vudc: Fix use after free bug in vudc_remove due to race condition\n  dt-bindings: usb: ti,omap4-musb: Drop duplicate \u0027usb-phy\u0027 property constraints\n  usb: storage: Add quirks for PNY Elite Portable SSD\n  USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers\n  usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize\n  usb: usbtmc: check URB actual_length for interrupt-IN notifications\n  xhci: tegra: Fix ghost USB device on dual-role port unplug\n  usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind\n  ...\n"
    },
    {
      "commit": "495fb8dd7f1da991c5325f4a0a50d0b042f19523",
      "tree": "becb7b0c9a08fd796a91f50ab119e33d32d11fe3",
      "parents": [
        "25447851777a53bd4b501e7f2cb418332ad584cc",
        "e4240d8845445d58b4b96f7066adfe175a61bd0c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 08:34:03 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 08:34:03 2026 -0700"
      },
      "message": "Merge tag \u0027tty-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty/serial driver fixes from Greg KH:\n \"Here are some small serial driver fixes for 7.1-rc6. Included in here\n  are:\n\n   - mips serial driver fixes to resolve some long-standing issues with\n     how they interacted with the console. That\u0027s the \"majority\" of the\n     changes in this merge request\n\n   - sh-sci driver regression fix\n\n   - 8250 driver regression fixes\n\n   - other small serial driver fixes for reported problems.\n\n  All of these have been in linux-next for over a week with no reported\n  issues\"\n\n* tag \u0027tty-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n  serial: dz: Enable modular build\n  serial: zs: Convert to use a platform device\n  serial: dz: Convert to use a platform device\n  serial: zs: Switch to using channel reset\n  serial: zs: Fix bootconsole handover lockup\n  serial: dz: Fix bootconsole handover lockup\n  serial: dz: Fix bootconsole message clobbering at chip reset\n  serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()\n  serial: 8250: dispatch SysRq character in serial8250_handle_irq()\n  serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)\n  tty: serial: samsung: Remove redundant port lock acquisition in rx helpers\n  serial: altera_jtaguart: handle uart_add_one_port() failures\n  serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ\n  serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma\n  tty: add missing tty_driver include to tty_port.h\n  serial: qcom-geni: fix UART_RX_PAR_EN bit position\n  serial: sh-sci: fix memory region release in error path\n  tty: serial: pch_uart: add check for dma_alloc_coherent()\n  serial: zs: Fix swapped RI/DSR modem line transition counting\n"
    },
    {
      "commit": "25447851777a53bd4b501e7f2cb418332ad584cc",
      "tree": "df40431330ef03032ee1e68393cc6632c416156a",
      "parents": [
        "1246c246d9f684599e1dd7498043062c89fb0a36",
        "05d5d79440c2cc0784f91b61f2012753e66be472"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 08:30:12 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat May 30 08:30:12 2026 -0700"
      },
      "message": "Merge tag \u0027char-misc-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc/iio fixes from Greg KH:\n \"Here are some small char/misc/iio driver fixes for 7.1-rc6. Included\n  in here are:\n\n   - lots of small IIO driver fixes for reported problems.\n\n   - Android binder bugfixes for reported issues.\n\n   - small comedi test driver fixes\n\n   - counter driver fix\n\n   - parport driver fix (people still use this?)\n\n   - rpi driver fix\n\n   - uio driver fix\n\n  All of these have been in linux-next for over a week with no reported\n  problems\"\n\n* tag \u0027char-misc-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (41 commits)\n  Revert \"gpib: cb7210: Fix region leak when request_irq fails\"\n  misc: rp1: Send IACK on IRQ activate to fix kdump/kexec\n  gpib: cb7210: Fix region leak when request_irq fails\n  parport: Fix race between port and client registration\n  uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\n  rust_binder: Avoid holding lock when dropping delivered_death\n  rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN\n  comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()\n  comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()\n  iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw\n  iio: gyro: itg3200: fix i2c read into the wrong stack location\n  iio: dac: ad5686: fix powerdown control on dual-channel devices\n  iio: dac: ad5686: acquire lock when doing powerdown control\n  iio: temperature: tsys01: fix broken PROM checksum validation\n  iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings\n  iio: buffer: hw-consumer: fix use-after-free in error path\n  iio: dac: ad5686: fix input raw value check\n  iio: dac: ad5686: fix ref bit initialization for single-channel parts\n  iio: ssp_sensors: cancel delayed work_refresh on remove\n  iio: adc: meson-saradc: fix calibration buffer leak on error\n  ...\n"
    },
    {
      "commit": "1d774589f924056b8403e271fdecaf9a803a50fc",
      "tree": "e3c4046812d76509a5c53dcfd8b4005860440dd8",
      "parents": [
        "e2aecff95bc6d59030332959a18f8c9f654961be"
      ],
      "author": {
        "name": "Alexis Bouzigues",
        "email": "BouziguesAlexis@JohnDeere.com",
        "time": "Fri May 29 09:28:14 2026 -0500"
      },
      "committer": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Sat May 30 15:56:07 2026 +0200"
      },
      "message": "i2c: virtio: mark device ready before registering the adapter\n\nvirtio_i2c_probe() synchronously probes child i2c drivers on the bus,\nbut peripherals may use the bus at probe for tasks like reading a chip\nid. The vhost-user-i2c backend stalls at such probes unless DRIVER_OK\nis already set before the virtqueue is first kicked.\n\nSet DRIVER_OK explicitly before i2c_add_adapter(), as done for the\nsame reason in commit f5866db64f34 (\"virtio_console: enable VQs\nearly\") and commit 71e4b8bf0482 (\"virtio_rpmsg: set DRIVER_OK before\nusing device\").\n\nSigned-off-by: Alexis Bouzigues \u003cBouziguesAlexis@JohnDeere.com\u003e\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\n"
    },
    {
      "commit": "e2aecff95bc6d59030332959a18f8c9f654961be",
      "tree": "6d04c27c7114441f9ab9dfa3dd2f00a17b865c29",
      "parents": [
        "e7ae89a0c97ce2b68b0983cd01eda67cf373517d",
        "030675aa54cf757769b3db65642433d626b3ed7c"
      ],
      "author": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Sat May 30 15:50:41 2026 +0200"
      },
      "committer": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Sat May 30 15:50:41 2026 +0200"
      },
      "message": "Merge tag \u0027i2c-host-fixes-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-host-fixes for v7.1-rc6\n\ndavinci: fix fallback bus frequency on missing clock-frequency\n"
    },
    {
      "commit": "05d5d79440c2cc0784f91b61f2012753e66be472",
      "tree": "5dd739fd70746f2806be734a5cc6ecbeac388ac1",
      "parents": [
        "36770417153644bc88281c7284730ef1d14d8d3c"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sat May 30 12:25:36 2026 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sat May 30 12:25:36 2026 +0200"
      },
      "message": "Revert \"gpib: cb7210: Fix region leak when request_irq fails\"\n\nThis reverts commit 2eae90a457baa0048a96ed38ad93090ee38c8b2f.\n\nTurns out not to be correct.\n\nLink: https://lore.kernel.org/r/PpNUbGhrvT8I_KayoDvQYI2PYjmMw1QEkuVBDZz2PwBsVVgPkBXJarc2mBM0IhiH3AQG0GtgqEsDRXNj3yUKEDBaZa25u73pAjvcE6vfRsg\u003d@protonmail.com\nReported-by: Dominik Karol Piątkowski \u003cdominik.karol.piatkowski@protonmail.com\u003e\nCc: Mark Brown \u003cbroonie@kernel.org\u003e\nCc: Hongling Zeng \u003czhongling0719@126.com\u003e\nCc: Hongling Zeng \u003czenghongling@kylinos.cn\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "1246c246d9f684599e1dd7498043062c89fb0a36",
      "tree": "8a900b1660d4d2a93e05d8cf0431a8c3b5901918",
      "parents": [
        "2765233a483febb1bf56f0abdcc5aa06d25633d7",
        "cc57232cae23c0df91b4a59d0f519141ce9b5b02"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 21:50:56 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 21:50:56 2026 -0700"
      },
      "message": "Merge tag \u0027v7.1-rc6-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - security fix for FSCTL_SET_SPARSE\n\n - fix leak in ksmbd_query_inode_status()\n\n - fix OOB read in smb_check_perm_dacl()\n\n* tag \u0027v7.1-rc6-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n  ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE\n  ksmbd: release ksmbd_inode ref via ksmbd_inode_put on lookup paths\n  ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops\n"
    },
    {
      "commit": "2765233a483febb1bf56f0abdcc5aa06d25633d7",
      "tree": "284f469b4544480c55fb6296ac35a15d96c77ae1",
      "parents": [
        "f5e5d3509bffb95c6648eb9795f7f236852ae62d",
        "7164d78559b0ff29931a366a840a9e5dd53d4b7c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 19:08:20 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 19:08:20 2026 -0700"
      },
      "message": "Merge tag \u0027drm-fixes-2026-05-30\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Regular pull, doesn\u0027t seem too insane or AI owned, couple of UAF fixes\n  and another repair for an earlier fix, mostly amdgpu and i915 display\n  with xe/i915 accel, and misc core/driver fixes.\n\n  It might be a bit bigger than usual at this stage, but I\u0027m not seeing\n  anything too scary here.\n\n  dumb-buffer:\n   - prevent overflows in dumb-buffer creation\n\n  dma-buf:\n   - fix UAF in dma_buf_fd() tracepoint\n\n  gem:\n   - fix for the fix for the fix for the change handle ioctl\n\n  i915:\n   - Fix potential UAF in TTM object purge\n   - Use polling when irqs are unavailable\n   - Fix HDR pre-CSC LUT programming loop\n   - Block DC states on vblank enable when Panel Replay supported\n   - Use DC_OFF wake reference to block DC6 on vblank enable\n\n  xe:\n   - Restore IDLEDLY regiter on engine reset\n\n  amdgpu:\n   - GEM_OP warning fix\n   - GEM_OP locking fix\n   - Userq fixes\n   - DCN 2.1 refclk fix\n   - SI fix\n   - HMM fixes\n\n  amdkfd:\n   - svm_range_set_attr locking fix\n   - CRIU restore fix\n   - KFD debugger fix\n\n  amdxdna:\n   - require IOMMU on AIE2\n\n  hyperv:\n   - improve protocol validation\n\n  ivpu:\n   - test write offset in debugfs\n\n  rocket:\n   - fix UAF in bo creation\"\n\n* tag \u0027drm-fixes-2026-05-30\u0027 of https://gitlab.freedesktop.org/drm/kernel: (33 commits)\n  drm/gem: fix race between change_handle and handle_delete\n  drm: prevent integer overflows in dumb buffer creation helpers\n  dma-buf: fix UAF in dma_buf_fd() tracepoint\n  drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx\n  drm/amdgpu: fix amdgpu_hmm_range_get_pages\n  drm/amdgpu/userq: use array instead of list for userq_vas\n  drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid\n  drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger\n  drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper\n  drm/amd/pm/si: Disregard vblank time when no displays are connected\n  drm/amdkfd: Check for pdd drm file first in CRIU restore path\n  drm/amdgpu: fix potential overflow in fs_info.debugfs_name\n  drm/amdgpu/userq: make sure queue is valid in the hang_detect_work\n  drm/amdgpu/userq: reserve root bo without interruption\n  drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails\n  drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index\n  drm/amdkfd: fix NULL pointer bug in svm_range_set_attr\n  drm/amd/display: Write REFCLK to 48MHz on DCN21\n  drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock\n  drm/amdgpu/userq: Fix doorbell object cleanup of queue\n  ...\n"
    },
    {
      "commit": "f5e5d3509bffb95c6648eb9795f7f236852ae62d",
      "tree": "a94c864e86a17c42b663a51546ca3cfdd7badcfc",
      "parents": [
        "230ff934f744a4c2e4b74893ccf6734f6556db90",
        "79378db6a86c7014cce40b65252e6c18f5b8bcc2"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 18:07:37 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 18:07:37 2026 -0700"
      },
      "message": "Merge tag \u0027spi-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"One substantive fix here, fixing corruption of the maximum frequency\n  for spi-mem operations which caused users to remember what should have\n  been a temporarily modified maximum frequency as the standard going\n  forward, potentially causing instability when the modification raised\n  rather than lowered the frequency.\n\n  We also have a trivial patch which just documents the correct way to\n  describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no\n  code changes\"\n\n* tag \u0027spi-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n  spi: spi-mem: avoid mutating op template in spi_mem_supports_op()\n  spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible\n"
    },
    {
      "commit": "230ff934f744a4c2e4b74893ccf6734f6556db90",
      "tree": "0479ce6ed10b277e82f1f0509a3781dfa2ea8498",
      "parents": [
        "f3be0c984ecbcb82b0bec408022c4ef738cb3843",
        "006c66d1d52f1905e6ccfb615cf27235e4e6e745"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 16:39:56 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 16:39:56 2026 -0700"
      },
      "message": "Merge tag \u0027regmap-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fix from Mark Brown:\n \"Some other fixing in an API user turned up the fact that we weren\u0027t\n  correctly applying cache only mode to volatile registers in\n  regmap_update_bits(), causing us to try to access hardware that was\n  powered off or otherwise not in a state to accept I/O. This fix\n  returns an error instead, avoiding more serious consequences\"\n\n* tag \u0027regmap-fix-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n  regmap: reject volatile update_bits() in cache-only mode\n"
    },
    {
      "commit": "f3be0c984ecbcb82b0bec408022c4ef738cb3843",
      "tree": "83120ec6d347562f899901db9e793864c398776e",
      "parents": [
        "77590cacabb3bffba7e2e95c359889bc44241b68",
        "78ef59e7a6459b16f8102e0ee1c718443323d1af"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 15:46:40 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 15:46:40 2026 -0700"
      },
      "message": "Merge tag \u0027net-7.1-rc6-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull more networking fixes from Jakub Kicinski:\n \"Quick follow up, nothing super urgent here. Main reason I\u0027m sending\n  this out is because the IPsec and Bluetooth PRs did not make it\n  yesterday. I don\u0027t want to have to send you all of this + whatever\n  comes next week, for rc7. The fixes under \"Previous releases -\n  regressions\" are for real user-reported regressions from v7.0.\n\n  Previous releases - regressions:\n\n   - Revert \"ipv6: preserve insertion order for same-scope addresses\"\n\n   - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU on\n     netns exit got backported to stable and was causing serious\n     accumulation of dying netns\u0027s for real workloads\n\n   - pcs-mtk-lynxi: fix bpi-r3 serdes configuration\n\n  Previous releases - always broken:\n\n   - usual grab bag of race, locking and leak fixes for Bluetooth\n\n   - handful of page handling fixes for IPsec\"\n\n* tag \u0027net-7.1-rc6-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits)\n  wireguard: send: append trailer after expanding head\n  Revert \"ipv6: preserve insertion order for same-scope addresses\"\n  net: skbuff: fix pskb_carve leaking zcopy pages\n  ipv6: fix possible infinite loop in fib6_select_path()\n  ipv6: fix possible infinite loop in rt6_fill_node()\n  bpf: sockmap: fix tail fragment offset in bpf_msg_push_data\n  vsock/virtio: bind uarg before filling zerocopy skb\n  Revert \"esp: fix page frag reference leak on skb_to_sgvec failure\"\n  net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration\n  sctp: fix race between sctp_wait_for_connect and peeloff\n  net: mana: Skip redundant detach on already-detached port\n  net: mana: Add NULL guards in teardown path to prevent panic on attach failure\n  Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()\n  Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n  Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions\n  Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n  Bluetooth: ISO: fix UAF in iso_recv_frame\n  Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n  Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success\n  Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading\n  ...\n"
    },
    {
      "commit": "77590cacabb3bffba7e2e95c359889bc44241b68",
      "tree": "70ef63a498a8e0cf4c0fbf05e354f8c44bb6ee9b",
      "parents": [
        "d0ee290071b475410476b4126c72da4bf6a2194c",
        "175db11786bde9061db526bf1ac5107d915f5163"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 15:17:53 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 15:17:53 2026 -0700"
      },
      "message": "Merge tag \u0027clang-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux\n\nPull clang build fix from Nathan Chancellor:\n \"A small fix to disable -Wattribute-alias for clang in the few places\n  it is already disabled for GCC, now that tip of tree clang has\n  implemented -Wattribute-alias as GCC has\"\n\n* tag \u0027clang-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux:\n  Disable -Wattribute-alias for clang-23 and newer\n"
    },
    {
      "commit": "44eeff9bc467bc7d1fec34fc3f6001f385fe462c",
      "tree": "53ac15a19f33cfdb0ee0d1a2c28e05fcdbf62056",
      "parents": [
        "8aeb879baf12fe64889f019da9a4f8347c604e91"
      ],
      "author": {
        "name": "Andrei Vagin",
        "email": "avagin@google.com",
        "time": "Tue May 26 20:50:43 2026 +0000"
      },
      "committer": {
        "name": "Borislav Petkov (AMD)",
        "email": "bp@alien8.de",
        "time": "Fri May 29 15:05:30 2026 -0700"
      },
      "message": "Revert \"x86/fpu: Refine and simplify the magic number check during signal return\"\n\nThis reverts\n\n  dc8aa31a7ac2 (\"x86/fpu: Refine and simplify the magic number check during signal return\").\n\nThe aforementioned commit broke applications that construct signal frames in\nuserspace (such as CRIU and gVisor) if the frame\u0027s xstate size is smaller than\nthe kernel\u0027s fpstate-\u003euser_size.\n\nFurthermore, this introduces a critical issue for checkpoint/restore tools\nlike CRIU. If a process is checkpointed while inside a signal handler, its\nstack contains a signal frame formatted according to the source host\u0027s xstate\ncapabilities.\n\nIf that process is later restored on a destination host with larger xstate\ncapabilities (e.g., a newer CPU with more features enabled, resulting in\na larger fpstate-\u003euser_size), the kernel will look for FP_XSTATE_MAGIC2 at the\ndestination host\u0027s larger user_size offset instead of the offset encoded in\nthe frame\u0027s fx_sw-\u003exstate_size.\n\nThis causes the magic2 check to fail, forcing sigreturn to silently fall back\nto \"FX-only\" mode. Upon return from the signal handler, the process\u0027s extended\nstate is reset to initial values instead of being restored, leading to silent\ndata corruption.\n\nThe aforementioned commit cited\n\n  d877550eaf2d (\"x86/fpu: Stop relying on userspace for info to fault in xsave buffer\")\n\nas justification to stop relying on userspace for the magic number check.\n\nHowever, these two changes are fundamentally different. The last one only\nchanged how much memory the kernel ensures is paged-in before running XRSTOR\nto prevent an infinite loop. It did not change the signal frame format or how\nthe layout is validated.\n\nReverting this change restores the use of fx_sw-\u003exstate_size for\nlocating magic2 and restores the necessary sanity checks, ensuring that\nthe signal frame remains self-describing and portable.\n\n  [ bp: Massage commit message. ]\n\nFixes: dc8aa31a7ac2 (\"x86/fpu: Refine and simplify the magic number check during signal return\")\nSigned-off-by: Andrei Vagin \u003cavagin@google.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nAcked-by: Chang S. Bae \u003cchang.seok.bae@intel.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/all/20260429000623.3356606-1-avagin@google.com\n"
    },
    {
      "commit": "7164d78559b0ff29931a366a840a9e5dd53d4b7c",
      "tree": "d3e48551711e666c87e29e29cc2fb17867a7a4ee",
      "parents": [
        "6e40c937893338ed0b627c08f712ce7d66ddcf84"
      ],
      "author": {
        "name": "Zhenghang Xiao",
        "email": "kipreyyy@gmail.com",
        "time": "Tue May 26 16:53:13 2026 +0800"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat May 30 07:01:39 2026 +1000"
      },
      "message": "drm/gem: fix race between change_handle and handle_delete\n\ndrm_gem_change_handle_ioctl leaves the old handle live in the IDR\nduring the window between spin_unlock(table_lock) and the final\nspin_lock(table_lock). A concurrent drm_gem_handle_delete on the old\nhandle succeeds in this window, decrements handle_count to 0, and frees\nthe GEM object while the new handle\u0027s IDR entry still references it.\n\nNULL the old handle\u0027s IDR entry before dropping table_lock so that any\nconcurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.\nRestore the old entry on the prime-bookkeeping error path.\n\nFixes: 5e28b7b94408 (\"drm: Set old handle to NULL before prime swap in change_handle\")\nSigned-off-by: Zhenghang Xiao \u003ckipreyyy@gmail.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://patch.msgid.link/20260526085313.26791-1-kipreyyy@gmail.com\n"
    },
    {
      "commit": "d0ee290071b475410476b4126c72da4bf6a2194c",
      "tree": "82001265fdeda5056a72d53871b8f73c6dd4abea",
      "parents": [
        "9215e74f228f2b239f41271da9e5076ee3439d1b",
        "713074d53be5c8684cb31fa7a8f09ffb679338d9"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 13:47:55 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri May 29 13:47:55 2026 -0700"
      },
      "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"arm64:\n\n   - Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by\n     making sure the config symbol is correctly spelled out in the code\n\n   - Don\u0027t reset the AArch32 view of the PMU counters to zero when the\n     guest is writing to them\n\n   - Fix an assorted collection of memory leaks in the newly added\n     tracing code\n\n   - Fix the capping of ZCR_EL2 which could be used in an unsanitised\n     way by an L2 guest\n\n  x86:\n\n   - Include the kernel\u0027s linux/mman.h in KVM selftests to ensure\n     MADV_COLLAPSE is defined, as older libc versions may not provide\n     it.\n\n   - Include execinfo.h if and only if KVM selftests are building\n     against glibc, and provide a test_dump_stack() for non-glibc\n     builds.\n\n   - Silence an annoying RCU splat on (even non-KVM-related) panics.\n\n     The splat is technically legit, but in practice not an issue. To\n     have a race, you would need to unload the KVM modules at exactly\n     the time a panic happens; and speaking of incredibly rare races,\n     taking the locks risks introducing a deadlock if the module unload\n     code took the lock on a CPU that has been halted. Which seems\n     possibly more likely than the RCU grace period issue, so just shut\n     it up. This code used to be in KVM but is now outside it; but the\n     x86 maintainers haven\u0027t picked it up, so here we are.\n\n   - Rate-limit global clock updates once again (but without delayed\n     work), as KVM was subtly relying on the old rate-limiting for NPT\n     correction to guard against \"update storms\" when running without a\n     master clock on systems with overcommitted CPUs.\n\n   - Fix a brown paper bag goof where KVM checked if ERAPS is \"dirty\"\n     instead of marking it dirty when emulating INVPCID.\n\n   - Flush the TLB when transitioning from xAVIC \u003d\u003e x2AVIC to ensure the\n     CPU TLB doesn\u0027t contain AVIC-tagged entries for the APIC base GPA.\n\n   - The top 10 commits fix buffer overflow (and potential TOC/TOU)\n     flaws in the page state change protocol for encrypted VMs. AI\n     models find it quite easily given it was reported three times, but\n     aren\u0027t as good at writing a comprehensive fix. There\u0027s more to\n     clean up in the area, which will come in 7.2\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)\n  KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer\n  KVM: SEV: Check PSC request indices against the actual size of the buffer\n  KVM: SEV: Don\u0027t explicitly pass PSC buffer to snp_begin_psc()\n  KVM: SEV: WARN if KVM attempts to setup scratch area with min_len\u003d\u003d0\n  KVM: SEV: Compute the correct max length of the in-GHCB scratch area\n  KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests\n  KVM: SEV: Ignore Port I/O requests of length \u00270\u0027\n  KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+\n  KVM: SEV: Ignore MMIO requests of length \u00270\u0027\n  KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n  KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor\n  KVM: arm64: Fix memory leak in hyp_trace_unload()\n  KVM: arm64: Fix rollback in hyp_trace_buffer_share_hyp()\n  KVM: arm64: Fix meta-page unsharing in pKVM hyp tracing\n  KVM: arm64: PMU: Preserve AArch32 counter low bits\n  KVM: SVM: Flush the current TLB when transitioning from xAVIC \u003d\u003e x2AVIC\n  KVM: x86: Fix ERAPS RAP clear on INVPCID single-context invalidation\n  KVM: arm64: Fix CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC\n  KVM: selftests: Guard execinfo.h inclusion for non-glibc builds\n  KVM: x86: Rate-limit global clock updates on vCPU load\n  ...\n"
    },
    {
      "commit": "6e40c937893338ed0b627c08f712ce7d66ddcf84",
      "tree": "e97796af5ff2b9d72193a4edaad4b446395f708c",
      "parents": [
        "e81d3b59f7288a7ffa81175586c2148dfa9d7dd9",
        "5ab62dd3687bcc2cc542b99385aabac5c996db6f"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat May 30 06:39:58 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat May 30 06:40:28 2026 +1000"
      },
      "message": "Merge tag \u0027drm-misc-fixes-2026-05-29\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namdxdna:\n- require IOMMU on AIE2\n\ndumb-buffer:\n- prevent overflows in dumb-buffer creation\n\ndma-buf:\n- fix UAF in dma_buf_fd() tracepoint\n\nhyperv:\n- improve protocol validation\n\nivpu:\n- test write offset in debugfs\n\nrocket:\n- fix UAF in bo creation\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260529070009.GA313534@linux.fritz.box\n"
    },
    {
      "commit": "78ef59e7a6459b16f8102e0ee1c718443323d1af",
      "tree": "f0fbbe0162be13360b5e09262b90a2fcf5d0389b",
      "parents": [
        "072aa0f5c3d8f11f3159037418ec45edce7440b8",
        "f75e3eb08fe31d30a9af6ed80cdd22e6772837e2"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 13:01:31 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 13:01:31 2026 -0700"
      },
      "message": "Merge branch \u0027wireguard-fixes-for-7-1-rc6\u0027\n\nJason A. Donenfeld says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWireGuard fixes for 7.1-rc6\n\nPlease find one small patch, fixing the order of adding padding onto a\npacket, to ensure padding bytes get zeroed properly.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260529173134.3080773-1-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "f75e3eb08fe31d30a9af6ed80cdd22e6772837e2",
      "tree": "f0fbbe0162be13360b5e09262b90a2fcf5d0389b",
      "parents": [
        "072aa0f5c3d8f11f3159037418ec45edce7440b8"
      ],
      "author": {
        "name": "Jason A. Donenfeld",
        "email": "Jason@zx2c4.com",
        "time": "Fri May 29 19:31:34 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 13:01:27 2026 -0700"
      },
      "message": "wireguard: send: append trailer after expanding head\n\nWith how this is currently written, we add the trailer, zero it out, and\nthen add the header space on. If that header space requires a\nreallocation + copy, the zeros in the trailer aren\u0027t copied, because the\nskb len hasn\u0027t actually been yet expanded to cover that. Instead add the\npadding at the end of the process rather than at the beginning.\n\nFixes: e7096c131e51 (\"net: WireGuard secure network tunnel\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20260529173134.3080773-2-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "072aa0f5c3d8f11f3159037418ec45edce7440b8",
      "tree": "9a5d7dc6df6c5c76679fe5b676c7a1c994ca0a01",
      "parents": [
        "c84ff04def255edb51e57c9f969efdfade0da16a"
      ],
      "author": {
        "name": "Fernando Fernandez Mancera",
        "email": "fmancera@suse.de",
        "time": "Fri May 29 13:23:57 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 13:00:54 2026 -0700"
      },
      "message": "Revert \"ipv6: preserve insertion order for same-scope addresses\"\n\nChris Adams reported that preserving insertion order for same-scope\naddresses is causing SSH connections to be dropped after stopping a VM\nwhile running NetworkManager.\n\nNetworkManager caches the IPv6 address configuration, when a RA arrives,\nit determines the list of addresses to configure and checks if the\naddresses are already in the right order in the kernel. If they aren\u0027t,\nNetworkManager removes and re-adds them to achieve the desired order.\n\nAs the order changes, NetworkManager is confused and reconfigures the\naddresses on every update. In addition, this would also affect to cloud\ntooling that relies on IPv6 addresses order to identify primary and\nsecondaries addresses.\n\nThis reverts commit cb3de96eea66f5e4a580086c6a1be46e765f97f4.\n\nFixes: cb3de96eea66 (\"ipv6: preserve insertion order for same-scope addresses\")\nReported-by: Chris Adams \u003clinux@cmadams.net\u003e\nCloses: https://lore.kernel.org/netdev/20260521135310.GC977@cmadams.net/\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260529112357.5079-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "c84ff04def255edb51e57c9f969efdfade0da16a",
      "tree": "d9d91746256c5170bf2ac70b129abcfc3c887c2e",
      "parents": [
        "ff6e798c2eac3ebd0501ad7e796f583fab928de8",
        "6851161feb01cea41358c9ec304bd2f981fc8505"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 12:57:22 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 12:57:23 2026 -0700"
      },
      "message": "Merge tag \u0027ipsec-2026-05-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-05-29\n\n1) xfrm: route MIGRATE notifications to caller\u0027s netns\n   Thread the caller\u0027s netns through km_migrate() so that\n   MIGRATE notifications go to the issuing netns, fixing both the\n   init_net listener leak and MOBIKE notifications inside\n   non-init netns. From Maoyi Xie.\n\n2) xfrm: ipcomp: Free destination pages on acomp errors\n   Move the out_free_req label up so that allocated destination\n   pages are released on decompression errors, not only on success.\n   From Herbert Xu.\n\n3) xfrm: Check for underflow in xfrm_state_mtu\n   Reject configurations that cause xfrm_state_mtu() to underflow,\n   preventing a negative TFCPAD value from becoming a memset size\n   that triggers an out-of-bounds write of several terabytes.\n   From David Ahern.\n\n4) xfrm: ah: use skb_to_full_sk in async output callbacks\n   Convert the possibly-incomplete skb-\u003esk to a full socket pointer\n   in async AH callbacks so that a request_sock or timewait_sock\n   never reaches xfrm_output_resume() downstream consumers.\n   From Michael Bommarito.\n\n5) Add and revert: esp: fix page frag reference leak on skb_to_sgvec failure\n   The patch does not fix te issue completely.\n\n6) xfrm: esp: restore combined single-frag length gate\n   Check the aligned post-trailer combined length against a page limit\n   in the fast path, preventing skb_page_frag_refill() from falling\n   back to a page too small for the destination scatterlist.\n   From Jingguo Tan.\n\n7) xfrm: iptfs: reset runtime state when cloning SAs\n   Reinitialise the clone\u0027s mode_data runtime objects before\n   publishing it, preventing queued skbs from being freed with\n   list state copied from the original SA when migration fails.\n   From Shaomin Chen.\n\n8) xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit\n   Flush policy tables and drain the workqueue in a .pre_exit handler\n   so that cleanup_net() pays one RCU grace period per batch instead\n   of one per namespace, fixing stalls at high CLONE_NEWNET rates.\n   From Usama Arif.\n\n9) xfrm: input: hold netns during deferred transport reinjection\n   Take a netns reference when queueing deferred transport reinjection\n   work and drop it after the callback completes, keeping the skb-\u003ecb\n   net pointer valid until the deferred work runs.\n   From Zhengchuan Liang.\n\n* tag \u0027ipsec-2026-05-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n  Revert \"esp: fix page frag reference leak on skb_to_sgvec failure\"\n  xfrm: input: hold netns during deferred transport reinjection\n  xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit\n  xfrm: iptfs: reset runtime state when cloning SAs\n  xfrm: esp: restore combined single-frag length gate\n  esp: fix page frag reference leak on skb_to_sgvec failure\n  xfrm: ah: use skb_to_full_sk in async output callbacks\n  xfrm: Check for underflow in xfrm_state_mtu\n  xfrm: ipcomp: Free destination pages on acomp errors\n  xfrm: route MIGRATE notifications to caller\u0027s netns\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260529092648.3878973-1-steffen.klassert@secunet.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "ff6e798c2eac3ebd0501ad7e796f583fab928de8",
      "tree": "d3a7c5c004e21d60fe354db604d20e7d1e3f4f32",
      "parents": [
        "9c7da87c2dc860bb17ca1ece942495d28b1ce3b9"
      ],
      "author": {
        "name": "Pavel Begunkov",
        "email": "asml.silence@gmail.com",
        "time": "Thu May 28 19:43:53 2026 +0100"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 12:55:27 2026 -0700"
      },
      "message": "net: skbuff: fix pskb_carve leaking zcopy pages\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, frag pages are not refcounted but\ntheir lifetime is controlled by the attached ubuf_info. To make a copy\nof the skb_shared_info, we either should clear the flag and reference\nthe frags, or keep the flag and have frags unreferenced.\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() don\u0027t\nfollow the rule and thus can leak page references. Let\u0027s clear\nSKBFL_MANAGED_FRAG_REFS from the original skb to fix it. It\u0027s the\nsimplest way to address it, but there are more performant ways to do\nthat if it ever becomes a problem.\n\nLink: https://lore.kernel.org/all/20260523085809.26331-1-nvminh232@clc.fitus.edu.vn/\nFixes: 753f1ca4e1e50 (\"net: introduce managed frags infrastructure\")\nReported-by: Minh Nguyen \u003cminhnguyen.080505@gmail.com\u003e\nReported-by: Willem de Bruijn \u003cwillemdebruijn.kernel@gmail.com\u003e\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/1e2086aa69217d7f9c8da3d38f5be7160f1b4cd1.1779993185.git.asml.silence@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "9c7da87c2dc860bb17ca1ece942495d28b1ce3b9",
      "tree": "d7fd1bb4dd324a79e403e40f5aff59fd1cd252ea",
      "parents": [
        "9f72412bcf60144f252b0d6205106abf14344abc"
      ],
      "author": {
        "name": "Jiayuan Chen",
        "email": "jiayuan.chen@linux.dev",
        "time": "Wed May 27 13:31:31 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Fri May 29 12:41:00 2026 -0700"
      },
      "message": "ipv6: fix possible infinite loop in fib6_select_path()\n\nFound while auditing the same pattern Sashiko reported in\nrt6_fill_node() [1]. Apply the same fix as\ncommit f8d8ce1b515a (\"ipv6: fix possible infinite loop in fib6_info_uses_dev()\").\n\nWriters holding tb6_lock can list_del_rcu(\u0026first-\u003efib6_siblings)\nwithout waiting for RCU readers; first-\u003efib6_siblings.next then\nstill points into the old ring and this softirq-side walker never\nreaches \u0026first-\u003efib6_siblings as its terminator. fib6_purge_rt()\nalways WRITE_ONCE()s first-\u003efib6_nsiblings to 0 before\nlist_del_rcu(), so an inside-loop check is a reliable detach signal.\n\n[1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev\n\nFixes: d9ccb18f83ea (\"ipv6: Fix soft lockups in fib6_select_path under high next hop churn\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260527053133.180695-2-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    }
  ],
  "next": "9f72412bcf60144f252b0d6205106abf14344abc"
}