)]}'
{
  "log": [
    {
      "commit": "399af66228cfd7df79dc360810b6b673000f8090",
      "tree": "69be367f431555217d41c937e38eee96795cb4ea",
      "parents": [
        "d874ca0522389405e26bc2ba38b59c9849c52cc1",
        "362c490980867930a098b99f421268fbd7ca05fd"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:49:15 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:49:15 2026 -0700"
      },
      "message": "Merge tag \u0027xfs-fixes-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"A couple race fixes found on the new healthmon mechanism, and another\n  flushing dquots during filesystem shutdown\"\n\n* tag \u0027xfs-fixes-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n  xfs: fix integer overflow in bmap intent sort comparator\n  xfs: fix undersized l_iclog_roundoff values\n  xfs: ensure dquot item is deleted from AIL only after log shutdown\n  xfs: remove redundant set null for ip-\u003ei_itemp\n  xfs: fix returned valued from xfs_defer_can_append\n  xfs: Remove redundant NULL check after __GFP_NOFAIL\n  xfs: fix race between healthmon unmount and read_iter\n  xfs: remove scratch field from struct xfs_gc_bio\n"
    },
    {
      "commit": "d874ca0522389405e26bc2ba38b59c9849c52cc1",
      "tree": "548558472a729e84c477b824ed91973abc99c580",
      "parents": [
        "b36eb6e3f5d8d48798617e554fc886d277921f69",
        "e3beefd3af09f8e460ddaf39063d3d7664d7ab59"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:46:32 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:46:32 2026 -0700"
      },
      "message": "Merge tag \u0027v7.0-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n - Fix reconnect when using non-default port\n - Fix default retransmission behavior\n - Fix open handle reuse in cifs_open\n - Fix export for smb2-mapperror-test\n - Fix potential corruption on write retry\n - Fix potentially uninitialized superblock flags\n - Fix missing O_DIRECT and O_SYNC flags on create\n\n* tag \u0027v7.0-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n  cifs: make default value of retrans as zero\n  smb: client: fix open handle lookup in cifs_open()\n  smb: client: fix iface port assignment in parse_server_interfaces\n  smb/client: only export symbol for \u0027smb2maperror-test\u0027 module\n  smb: client: fix in-place encryption corruption in SMB2_write()\n  smb: client: fix sbflags initialization\n  smb: client: fix atomic open with O_DIRECT \u0026 O_SYNC\n"
    },
    {
      "commit": "b36eb6e3f5d8d48798617e554fc886d277921f69",
      "tree": "2f4b5d68bae56502b3809a318d62271337b9cc64",
      "parents": [
        "ff30ea1fb1c0f3077ce02781641e240964b7fb89",
        "f879365c5bb210ed0d0b0aae1a0202d0c0b4b9d0"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:31:10 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:31:10 2026 -0700"
      },
      "message": "Merge tag \u0027spi-fix-v7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A couple of device ID and quirk updates, plus a bunch of small fixes\n  most of which (other than the Cadence one) are unremarkable error\n  handling fixes\"\n\n* tag \u0027spi-fix-v7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n  spi: atcspi200: Handle invalid buswidth and fix compiler warning\n  spi: dt-bindings: sun6i: Allow Dual SPI and Quad SPI for newer SoCs\n  spi: intel-pci: Add support for Nova Lake mobile SPI flash\n  spi: cadence-qspi: Fix requesting of APB and AHB clocks on JH7110\n  spi: rockchip-sfc: Fix double-free in remove() callback\n  spi: atcspi200: Fix double-free in atcspi_configure_dma()\n  spi: amlogic: spifc-a4: Fix DMA mapping error handling\n"
    },
    {
      "commit": "ff30ea1fb1c0f3077ce02781641e240964b7fb89",
      "tree": "2f29a3e206fe581b9c07fd193fe230f35f046b02",
      "parents": [
        "56cf10db2ae0bb90c69b644d639b559106d52a8d",
        "21b3fb7dc19caa488d285e3c47999f7f1a179334"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:29:45 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:29:45 2026 -0700"
      },
      "message": "Merge tag \u0027regulator-fix-v7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of small driver specific fixes for pca9450, cleaning up\n  logging and fixing warnings due to confusion with interrupt type\"\n\n* tag \u0027regulator-fix-v7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n  regulator: pca9450: Correct probed name for PCA9452\n  regulator: pca9450: Correct interrupt type\n"
    },
    {
      "commit": "56cf10db2ae0bb90c69b644d639b559106d52a8d",
      "tree": "7cf178df155f6442d47e2329d2cbb80a69801538",
      "parents": [
        "73548503dca50d2c2aa8c8cbb6eb8c1bf5959b21",
        "9250673cf23572b08c51bcdbb2919e9982bfc36b"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:15:14 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:15:14 2026 -0700"
      },
      "message": "Merge tag \u0027sound-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"There have been continuous flux but most of them are device-specific\n  small fixes, while we see a few core fixes at this time (minor PCM fix\n  for linked streams and a few ASoC core fixes for delayed work, etc)\n\n  Core:\n   - PCM: Fix use-after-free in linked stream drain\n\n  ASoC:\n   - core: Fixes for delayed works, empty DMI string handling and DT overlay\n   - qcom: qdsp6: Fix ADSP stop/start crash via component removal ordering\n   - tegra: Add support for Tegra238 audio graph card\n   - amd: Fix missing error checks for clock acquisition\n   - rt1011: Fix incorrect DAPM context retrieval helper\n\n  HD-audio:\n   - Add quirk for Gigabyte H610M, ASUS UM6702RC, HP 14s-dr5xxx, and\n     ThinkPad X390\n\n  USB-audio:\n   - Scarlett2: Fix NULL dereference for malformed endpoint descriptors\n   - Add quirk for SPACETOUCH\"\n\n* tag \u0027sound-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n  ASoC: amd: acp-mach-common: Add missing error check for clock acquisition\n  ASoC: detect empty DMI strings\n  ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition\n  ALSA: usb-audio: Add iface reset and delay quirk for SPACETOUCH USB Audio\n  ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put\n  ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces\n  ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays\n  ASoC: soc-core: flush delayed work before removing DAIs and widgets\n  ASoC: soc-core: drop delayed_work_pending() check before flush\n  ASoC: tegra: Add support for Tegra238 soundcard\n  ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390\n  ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk\n  ALSA: hda/realtek: add quirk for ASUS UM6702RC\n  ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()\n  ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone\n  firmware: cs_dsp: Fix fragmentation regression in firmware download\n  ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start\n"
    },
    {
      "commit": "73548503dca50d2c2aa8c8cbb6eb8c1bf5959b21",
      "tree": "e95b6cc2d9b613766865d13843795dc9ef4fdfff",
      "parents": [
        "e67bf352a0847a65a157d5b02a6024c65a781e08",
        "7d0abefec48dfefeec28dc7c3105a88c43747d02"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:13:06 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:13:06 2026 -0700"
      },
      "message": "Merge tag \u0027block-7.0-20260312\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe pull request via Keith:\n      - Fix nvme-pci IRQ race and slab-out-of-bounds access\n      - Fix recursive workqueue locking for target async events\n      - Various cleanups\n\n - Fix a potential NULL pointer dereference in ublk on size setting\n\n - ublk automatic partition scanning fix\n\n - Two s390 dasd fixes\n\n* tag \u0027block-7.0-20260312\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n  nvme: Annotate struct nvme_dhchap_key with __counted_by\n  nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue()\n  nvme-pci: Fix race bug in nvme_poll_irqdisable()\n  nvmet: move async event work off nvmet-wq\n  nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set\n  s390/dasd: Copy detected format information to secondary device\n  s390/dasd: Move quiesce state with pprc swap\n  ublk: don\u0027t clear GD_SUPPRESS_PART_SCAN for unprivileged daemons\n  ublk: fix NULL pointer dereference in ublk_ctrl_set_size()\n"
    },
    {
      "commit": "e67bf352a0847a65a157d5b02a6024c65a781e08",
      "tree": "c903bd4fc63eadb518ad9fce5d3effb5a82a9125",
      "parents": [
        "8174dafb2d9a85c895d3bfb9cc3e7c236107c93f",
        "c2c185be5c85d37215397c8e8781abf0a69bec1f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:09:35 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:09:35 2026 -0700"
      },
      "message": "Merge tag \u0027io_uring-7.0-20260312\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix an inverted true/false comment on task_no_new_privs, from the\n   BPF filtering changes merged in this release\n\n - Use the migration disabling way of running the BPF filters, as the\n   io_uring side doesn\u0027t do that already\n\n - Fix an issue with -\u003erings stability under resize, both for local\n   task_work additions and for eventfd signaling\n\n - Fix an issue with SQE mixed mode, where a bounds check wasn\u0027t correct\n   for having a 128b SQE\n\n - Fix an issue where a legacy provided buffer group is changed to to\n   ring mapped one while legacy buffers from that group are in flight\n\n* tag \u0027io_uring-7.0-20260312\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n  io_uring/kbuf: check if target buffer list is still legacy on recycle\n  io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops\n  io_uring/eventfd: use ctx-\u003erings_rcu for flags checking\n  io_uring: ensure ctx-\u003erings is stable for task work flags manipulation\n  io_uring/bpf_filter: use bpf_prog_run_pin_on_cpu() to prevent migration\n  io_uring/register: fix comment about task_no_new_privs\n"
    },
    {
      "commit": "8174dafb2d9a85c895d3bfb9cc3e7c236107c93f",
      "tree": "7fdfb0d7fd07ef274b3189a152cd8b1fb4fc3db0",
      "parents": [
        "92e989acfb83493e0305bc9fdcc666275ddd46c9",
        "464b1c115852fe025635ae2065e00caced184d92"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:07:33 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:07:33 2026 -0700"
      },
      "message": "Merge tag \u0027slab-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fixes from Vlastimil Babka:\n\n - Fix for a memory leak that can occur when already so low on memory\n   that we can\u0027t allocate a new slab anymore (Qing Wang)\n\n - Fix for a case where slabobj_ext array for a slab might be allocated\n   from the same slab, making it permanently non-freeable (Harry Yoo)\n\n* tag \u0027slab-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n  slab: fix memory leak when refill_sheaf() fails\n  mm/slab: fix an incorrect check in obj_exts_alloc_size()\n"
    },
    {
      "commit": "92e989acfb83493e0305bc9fdcc666275ddd46c9",
      "tree": "c079d612d14d5ccec0061fc48c4a7f32293626e3",
      "parents": [
        "0257f64bdac7fdca30fa3cae0df8b9ecbec7733a",
        "5c3daa5301693d2e5364483a3405649a0fdaed98"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:06:00 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 13 10:06:00 2026 -0700"
      },
      "message": "Merge tag \u0027pwrseq-fixes-for-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull power sequencing fix from Bartosz Golaszewski:\n\n - fix OF-node reference leak in pwrseq-pcie-m2\n\n* tag \u0027pwrseq-fixes-for-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n  power: sequencing: pcie-m2: Fix device node reference leak in probe\n"
    },
    {
      "commit": "7d0abefec48dfefeec28dc7c3105a88c43747d02",
      "tree": "5a2fe139205a0b613dafb30b1d896555077c4fb5",
      "parents": [
        "4c527c7e030672efd788d0806d7a68972a7ba3c1",
        "fa655a9ca73f7df32b8ca4d14ce11742f9578288"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 12 15:15:53 2026 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 12 15:15:53 2026 -0600"
      },
      "message": "Merge tag \u0027nvme-7.0-2026-03-12\u0027 of git://git.infradead.org/nvme into block-7.0\n\nPull NVMe fixes from Keith:\n\n\"- Fix nvme-pci IRQ race and slab-out-of-bounds access (Sungwoo Kim)\n - Fix recursive workqueue locking for target async events (Chaitanya)\n - Various cleanups (Maurizio Lombardi, Thorsten Blum)\"\n\n* tag \u0027nvme-7.0-2026-03-12\u0027 of git://git.infradead.org/nvme:\n  nvme: Annotate struct nvme_dhchap_key with __counted_by\n  nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue()\n  nvme-pci: Fix race bug in nvme_poll_irqdisable()\n  nvmet: move async event work off nvmet-wq\n  nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set\n"
    },
    {
      "commit": "0257f64bdac7fdca30fa3cae0df8b9ecbec7733a",
      "tree": "65dae98b02dff81f8882eb5fe287bac66ba94f0c",
      "parents": [
        "61c0b2ae734fc9d33ede9cbf7d3cad67a7b0ce28",
        "a076cc74744d83fb9f70147a154b99278945a3d2"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 13:01:37 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 13:01:37 2026 -0700"
      },
      "message": "Merge tag \u0027pm-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n\n - Make the idle loop skip the cpuidle governor .reflect() callback\n   after it has skipped the .select() one (Rafael Wysocki)\n\n - Fix swapped power/energy unit labels in cpupower (Kaushlendra Kumar)\n\n - Add support for setting EPP via systemd service and intel_pstate\n   turbo boost support to cpupower (Jan Kiszka, Zhang Rui)\n\n* tag \u0027pm-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  sched: idle: Make skipping governor callbacks more consistent\n  cpupower: Add intel_pstate turbo boost support for Intel platforms\n  cpupower: Add support for setting EPP via systemd service\n  cpupower: fix swapped power/energy unit labels\n"
    },
    {
      "commit": "61c0b2ae734fc9d33ede9cbf7d3cad67a7b0ce28",
      "tree": "4def659b70b24bd00f256769d944d54028a611a6",
      "parents": [
        "8004279c41adf3238ba71931219205cd1f59343b",
        "97d9960f355cca99960eb44cd1bba1d7ba1073ee"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 12:43:19 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 12:43:19 2026 -0700"
      },
      "message": "Merge tag \u0027acpi-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fixes from Rafael Wysocki:\n\n - On some platforms, the ACPI companion object of the ACPI video bus\n   platform device is shared with multiple other platform devices which\n   leads to driver probe issues, so replace that device with an\n   auxiliary one (which arguably is a better match for the given use\n   case) and update the ACPI video bus driver accordingly (Rafael\n   Wysocki)\n\n - Address sparse warnings in acpi_os_initialize() by adding __iomem to\n   a local variable declaration (Ben Dooks)\n\n* tag \u0027acpi-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()\n  ACPI: video: Switch over to auxiliary bus type\n"
    },
    {
      "commit": "8004279c41adf3238ba71931219205cd1f59343b",
      "tree": "6f4c63a8fe74764c9cd16f3dd179a65b72bfbc05",
      "parents": [
        "e0b38d286eef4633d231859e47679772db07db07",
        "4529e0015432977af3ecc3b9f940fc2a1ef1b265"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 12:38:17 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 12:38:17 2026 -0700"
      },
      "message": "Merge tag \u0027nfs-for-7.0-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs\n\nPull NFS client fixes from Anna Schumaker:\n\n - Fix NFS KConfig typos\n\n - Decrement re_receiving on the early exit paths\n\n - return EISDIR on nfs3_proc_create if d_alias is a dir\n\n* tag \u0027nfs-for-7.0-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs:\n  NFS: Fix NFS KConfig typos\n  xprtrdma: Decrement re_receiving on the early exit paths\n  nfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n"
    },
    {
      "commit": "e0b38d286eef4633d231859e47679772db07db07",
      "tree": "8d4dd22b87d624355e6479d24be49893b101eeac",
      "parents": [
        "2c7e63d702f6c4209c5af833308e7fcbc7d4ab17",
        "0749cab6174dc035b1628fb6db03abf758cfda6f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 12:15:27 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 12:15:27 2026 -0700"
      },
      "message": "Merge tag \u0027for-7.0-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - detect possible file name hash collision earlier so it does not lead\n   to transaction abort\n\n - handle b-tree leaf overflows when snapshotting a subvolume with set\n   received UUID, leading to transaction abort\n\n - in zoned mode, reorder relocation block group initialization after\n   the transaction kthread start\n\n - fix orphan cleanup state tracking of subvolume, this could lead to\n   invalid dentries under some conditions\n\n - add locking around updates of dynamic reclain state update\n\n - in subpage mode, add missing RCU unlock when trying to releae extent\n   buffer\n\n - remap tree fixes:\n     - add missing description strings for the newly added remap tree\n     - properly update search key when iterating backrefs\n\n* tag \u0027for-7.0-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n  btrfs: remove duplicated definition of btrfs_printk_in_rcu()\n  btrfs: remove unnecessary transaction abort in the received subvol ioctl\n  btrfs: abort transaction on failure to update root in the received subvol ioctl\n  btrfs: fix transaction abort on set received ioctl due to item overflow\n  btrfs: fix transaction abort when snapshotting received subvolumes\n  btrfs: fix transaction abort on file creation due to name hash collision\n  btrfs: read key again after incrementing slot in move_existing_remaps()\n  btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer()\n  btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create\n  btrfs: zoned: move btrfs_zoned_reserve_data_reloc_bg() after kthread start\n  btrfs: hold space_info-\u003elock when clearing periodic reclaim ready\n  btrfs: print-tree: add remap tree definitions\n"
    },
    {
      "commit": "2c7e63d702f6c4209c5af833308e7fcbc7d4ab17",
      "tree": "e46b218ced108b588a1d83364397d57334121efd",
      "parents": [
        "281f36d4a9970c206c2c44042904d4e34c092fbe",
        "c38b8f5f791ecce13ab77e2257f8fd2444ba80f6"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 11:33:35 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 11:33:35 2026 -0700"
      },
      "message": "Merge tag \u0027net-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from CAN and netfilter.\n\n  Current release - regressions:\n\n   - eth: mana: Null service_wq on setup error to prevent double destroy\n\n  Previous releases - regressions:\n\n   - nexthop: fix percpu use-after-free in remove_nh_grp_entry\n\n   - sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit\n\n   - bpf: fix nd_tbl NULL dereference when IPv6 is disabled\n\n   - neighbour: restore protocol !\u003d 0 check in pneigh update\n\n   - tipc: fix divide-by-zero in tipc_sk_filter_connect()\n\n   - eth:\n      - mlx5:\n         - fix crash when moving to switchdev mode\n         - fix DMA FIFO desync on error CQE SQ recovery\n      - iavf: fix PTP use-after-free during reset\n      - bonding: fix type confusion in bond_setup_by_slave()\n      - lan78xx: fix WARN in __netif_napi_del_locked on disconnect\n\n  Previous releases - always broken:\n\n   - core: add xmit recursion limit to tunnel xmit functions\n\n   - net-shapers: don\u0027t free reply skb after genlmsg_reply()\n\n   - netfilter:\n      - fix stack out-of-bounds read in pipapo_drop()\n      - fix OOB read in nfnl_cthelper_dump_table()\n\n   - mctp:\n      - fix device leak on probe failure\n      - i2c: fix skb memory leak in receive path\n\n   - can: keep the max bitrate error at 5%\n\n   - eth:\n      - bonding: fix nd_tbl NULL dereference when IPv6 is disabled\n      - bnxt_en: fix RSS table size check when changing ethtool channels\n      - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled\n      - octeontx2-af: devlink: fix NIX RAS reporter recovery condition\"\n\n* tag \u0027net-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (71 commits)\n  net: prevent NULL deref in ip[6]tunnel_xmit()\n  octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status\n  octeontx2-af: devlink: fix NIX RAS reporter recovery condition\n  net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support\n  net/mana: Null service_wq on setup error to prevent double destroy\n  selftests: rtnetlink: add neighbour update test\n  neighbour: restore protocol !\u003d 0 check in pneigh update\n  net: dsa: realtek: Fix LED group port bit for non-zero LED group\n  tipc: fix divide-by-zero in tipc_sk_filter_connect()\n  net: dsa: microchip: Fix error path in PTP IRQ setup\n  bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled\n  bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled\n  net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled\n  ipv6: move the disable_ipv6_mod knob to core code\n  net: bcmgenet: fix broken EEE by converting to phylib-managed state\n  net-shapers: don\u0027t free reply skb after genlmsg_reply()\n  net: dsa: mxl862xx: don\u0027t set user_mii_bus\n  net: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n  page_pool: store detach_time as ktime_t to avoid false-negatives\n  net: macb: Shuffle the tx ring before enabling tx\n  ...\n"
    },
    {
      "commit": "a076cc74744d83fb9f70147a154b99278945a3d2",
      "tree": "9be18f68e87b0121f5b01cd4b1b41cbea7641e3d",
      "parents": [
        "d557640e4ce589a24dca5ca7ce3b9680f471325f",
        "06c2a67e90c1f04de10ac3091b97665beacb48ce"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 12 19:00:30 2026 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 12 19:00:30 2026 +0100"
      },
      "message": "Merge branch \u0027pm-tools\u0027\n\nMerge cpupower utility updates, including a fix and improvements of the\nexisting functionality, for 7.0-rc4.\n\n* pm-tools:\n  cpupower: Add intel_pstate turbo boost support for Intel platforms\n  cpupower: Add support for setting EPP via systemd service\n  cpupower: fix swapped power/energy unit labels\n"
    },
    {
      "commit": "281f36d4a9970c206c2c44042904d4e34c092fbe",
      "tree": "7b2929fbf31fc694f0598b910239a9b8023a2fdf",
      "parents": [
        "80234b5ab240f52fa45d201e899e207b9265ef91",
        "8e135b8aee5a06c52a4347a5a6d51223c6f36ba3"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 10:58:02 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 12 10:58:02 2026 -0700"
      },
      "message": "Merge tag \u0027apparmor-pr-mainline-2026-03-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor\n\nPull AppArmor fixes from John Johansen:\n - fix race between freeing data and fs accessing it\n - fix race on unreferenced rawdata dereference\n - fix differential encoding verification\n - fix unconfined unprivileged local user can do privileged policy management\n - Fix double free of ns_name in aa_replace_profiles()\n - fix missing bounds check on DEFAULT table in verify_dfa()\n - fix side-effect bug in match_char() macro usage\n - fix: limit the number of levels of policy namespaces\n - replace recursive profile removal with iterative approach\n - fix memory leak in verify_header\n - validate DFA start states are in bounds in unpack_pdb\n\n* tag \u0027apparmor-pr-mainline-2026-03-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:\n  apparmor: fix race between freeing data and fs accessing it\n  apparmor: fix race on rawdata dereference\n  apparmor: fix differential encoding verification\n  apparmor: fix unprivileged local user can do privileged policy management\n  apparmor: Fix double free of ns_name in aa_replace_profiles()\n  apparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n  apparmor: fix side-effect bug in match_char() macro usage\n  apparmor: fix: limit the number of levels of policy namespaces\n  apparmor: replace recursive profile removal with iterative approach\n  apparmor: fix memory leak in verify_header\n  apparmor: validate DFA start states are in bounds in unpack_pdb\n"
    },
    {
      "commit": "97d9960f355cca99960eb44cd1bba1d7ba1073ee",
      "tree": "71bd7c8c52304d88d43f613b8c8b38bd16bb4b0d",
      "parents": [
        "6ab3532b4c98f4e51969f0e5f3fc919c535f3ce1",
        "393815f57651101f1590632092986d1d5a3a41bd"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 12 18:42:41 2026 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 12 18:42:41 2026 +0100"
      },
      "message": "Merge branch \u0027acpi-osl\u0027\n\nMerge an ACPI OS services layer (OSL) fix that addresses sparse warnings\nin acpi_os_initialize() (Ben Dooks)\n\n* acpi-osl:\n  ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()\n"
    },
    {
      "commit": "c38b8f5f791ecce13ab77e2257f8fd2444ba80f6",
      "tree": "d12f2dd1c32a6d73f1049cca8c3f5cfcb8e6a70e",
      "parents": [
        "87f7dff3ec75b91def0024ebaaf732457f47a63b"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Thu Mar 12 04:39:08 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Mar 12 16:03:41 2026 +0100"
      },
      "message": "net: prevent NULL deref in ip[6]tunnel_xmit()\n\nBlamed commit missed that both functions can be called with dev \u003d\u003d NULL.\n\nAlso add unlikely() hints for these conditions that only fuzzers can hit.\n\nFixes: 6f1a9140ecda (\"net: add xmit recursion limit to tunnel xmit functions\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCC: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20260312043908.2790803-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "c2c185be5c85d37215397c8e8781abf0a69bec1f",
      "tree": "904d5a38e0ecaf3e5a5805cea2e28e5cad19bda3",
      "parents": [
        "6f02c6b196036dbb6defb4647d8707d29b7fe95b"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 12 08:59:25 2026 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 12 08:59:25 2026 -0600"
      },
      "message": "io_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere\u0027s a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could\u0027ve\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it\u0027s of the correct type. Add those\nchecks.\n\nCc: stable@vger.kernel.org\nFixes: c7fb19428d67 (\"io_uring: add support for ring mapped supplied buffers\")\nReported-by: Keenan Dong \u003ckeenanat2000@gmail.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "9250673cf23572b08c51bcdbb2919e9982bfc36b",
      "tree": "b511cc8f3c7ffaa304ccb5da1bfd6705e01f1928",
      "parents": [
        "5182e5ec4355dd690307f5d5c28cbfc5b2c06a97",
        "30c64fb9839949f085c8eb55b979cbd8a4c51f00"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Mar 12 12:59:28 2026 +0100"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Mar 12 12:59:28 2026 +0100"
      },
      "message": "Merge tag \u0027asoc-fix-v7.0-rc3\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.0\n\nQuite a large pull request, but nothing too concerning here - everything\nis fairly small.  We\u0027ve got a couple of smaller core fixes for races on\ncard teardown from Matteo Cotifava, a fix for handling dodgy DMI\ninformation generated by u-boot, some driver specific fixes and some new\ndevice IDs for Tegra.\n"
    },
    {
      "commit": "87f7dff3ec75b91def0024ebaaf732457f47a63b",
      "tree": "3069d101966273960035a54288c9019a4893cd1c",
      "parents": [
        "dc26ca99b835e21e76a58b1463b84adb0ca34f58"
      ],
      "author": {
        "name": "Alok Tiwari",
        "email": "alok.a.tiwari@oracle.com",
        "time": "Tue Mar 10 11:48:17 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 20:39:19 2026 -0700"
      },
      "message": "octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status\n\nThe NIX RAS health report path uses nix_af_rvu_err when handling the\nNIX_AF_RVU_RAS case, so the report prints the ERR interrupt status rather\nthan the RAS interrupt status.\n\nUse nix_af_rvu_ras for the NIX_AF_RVU_RAS report.\n\nFixes: 5ed66306eab6 (\"octeontx2-af: Add devlink health reporters for NIX\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nLink: https://patch.msgid.link/20260310184824.1183651-2-alok.a.tiwari@oracle.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "dc26ca99b835e21e76a58b1463b84adb0ca34f58",
      "tree": "8c554d0fbe07634c3a1ee3ec432c624cd74e6cde",
      "parents": [
        "840c9d13cb1ca96683a5307ee8e221be163a2c1e"
      ],
      "author": {
        "name": "Alok Tiwari",
        "email": "alok.a.tiwari@oracle.com",
        "time": "Tue Mar 10 11:48:16 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 20:39:19 2026 -0700"
      },
      "message": "octeontx2-af: devlink: fix NIX RAS reporter recovery condition\n\nThe NIX RAS health reporter recovery routine checks nix_af_rvu_int to\ndecide whether to re-enable NIX_AF_RAS interrupts. This is the RVU\ninterrupt status field and is unrelated to RAS events, so the recovery\nflow may incorrectly skip re-enabling NIX_AF_RAS interrupts.\n\nCheck nix_af_rvu_ras instead before writing NIX_AF_RAS_ENA_W1S.\n\nFixes: 5ed66306eab6 (\"octeontx2-af: Add devlink health reporters for NIX\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nLink: https://patch.msgid.link/20260310184824.1183651-1-alok.a.tiwari@oracle.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "840c9d13cb1ca96683a5307ee8e221be163a2c1e",
      "tree": "a438b7e70304bae22660e12776c5d7d0c32f6739",
      "parents": [
        "87c2302813abc55c46485711a678e3c312b00666"
      ],
      "author": {
        "name": "Chintan Vankar",
        "email": "c-vankar@ti.com",
        "time": "Tue Mar 10 21:39:40 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 20:28:37 2026 -0700"
      },
      "message": "net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support\n\nThe \"rx_filter\" member of \"hwtstamp_config\" structure is an enum field and\ndoes not support bitwise OR combination of multiple filter values. It\ncauses error while linuxptp application tries to match rx filter version.\nFix this by storing the requested filter type in a new port field.\n\nFixes: 97248adb5a3b (\"net: ti: am65-cpsw: Update hw timestamping filter for PTPv1 RX packets\")\nSigned-off-by: Chintan Vankar \u003cc-vankar@ti.com\u003e\nLink: https://patch.msgid.link/20260310160940.109822-1-c-vankar@ti.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "87c2302813abc55c46485711a678e3c312b00666",
      "tree": "6e053ef56cbbaa147636ff89b722c5bdb97e5052",
      "parents": [
        "ead054054874d7de4c1724e18c1adf90fdb5d7db"
      ],
      "author": {
        "name": "Shiraz Saleem",
        "email": "shirazsaleem@microsoft.com",
        "time": "Mon Mar 09 10:24:43 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 20:21:45 2026 -0700"
      },
      "message": "net/mana: Null service_wq on setup error to prevent double destroy\n\nIn mana_gd_setup() error path, set gc-\u003eservice_wq to NULL after\ndestroy_workqueue() to match the cleanup in mana_gd_cleanup().\nThis prevents a use-after-free if the workqueue pointer is checked\nafter a failed setup.\n\nFixes: f975a0955276 (\"net: mana: Fix double destroy_workqueue on service rescan PCI path\")\nSigned-off-by: Shiraz Saleem \u003cshirazsaleem@microsoft.com\u003e\nSigned-off-by: Konstantin Taranov \u003ckotaranov@microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260309172443.688392-1-kotaranov@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "ead054054874d7de4c1724e18c1adf90fdb5d7db",
      "tree": "e772db4c1e48add264d80da5c9249f62cf36e176",
      "parents": [
        "14ad51036c57e91e85b83f61df1d27e347912c32",
        "329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:12:59 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:12:59 2026 -0700"
      },
      "message": "Merge tag \u0027nf-26-03-10\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nDue to large volume of backlogged patches its unlikely I will make the\n2nd planned PR this week, so several legit fixes will be pushed back\nto next week.  Sorry for the inconvenience but I am out of ideas and\nalternatives.\n\n1) syzbot managed to add/remove devices to a flowtable, due to a bug in\n   the flowtable netdevice notifier this gets us a double-add and\n   eventually UaF when device is removed again (we only expect one\n   entry, duplicate remains past net_device end-of-life).\n   From Phil Sutter, bug added in 6.16.\n\n2) Yiming Qian reports another nf_tables transaction handling bug:\n   in some cases error unwind misses to undo certain set elements,\n   resulting in refcount underflow and use-after-free, bug added in 6.4.\n\n3) Jenny Guanni Qu found out-of-bounds read in pipapo set type.\n   While the value is never used, it still rightfully triggers KASAN\n   splats.  Bug exists since this set type was added in 5.6.\n\n4) a few x_tables modules contain copypastry tcp option parsing code which\n    can read 1 byte past the option area.  This bug is ancient, fix from\n    David Dull.\n\n5) nfnetlink_queue leaks kernel memory if userspace provides bad\n   NFQA_VLAN/NFQA_L2HDR attributes.  From Hyunwoo Kim, bug stems from\n   from 4.7 days.\n\n6) nfnetlink_cthelper has incorrect loop restart logic which may result\n   in reading one pointer past end of array. From 3.6 days, fix also from\n   Hyunwoo Kim.\n\n7) xt_IDLETIMER v0 extension must reject working with timers added\n   by revision v1, else we get list corruption. Bug added in v5.7.\n   From Yifan Wu, Juefei Pu and Yuan Tan via Xin Lu.\n\n* tag \u0027nf-26-03-10\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n  netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels\n  netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n  netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path\n  netfilter: x_tables: guard option walkers against 1-byte tail reads\n  netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n  netfilter: nf_tables: always walk all pending catchall elements\n  netfilter: nf_tables: Fix for duplicate device in netdev hooks\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260310132050.630-1-fw@strlen.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "14ad51036c57e91e85b83f61df1d27e347912c32",
      "tree": "f4b7af0cccd83b15c064301451190c8dda7a1cc7",
      "parents": [
        "e62a22f43475624ea466fd9b766f62e8458f4cd9",
        "e94eaef11142b01f77bf8ba4d0b59720b7858109"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:08:15 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:08:16 2026 -0700"
      },
      "message": "Merge branch \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-03-10 (ice, iavf, i40e, e1000e, e1000)\n\nNikolay Aleksandrov changes return code of RDMA related ice devlink get\nparameters when irdma is not enabled to -EOPNOTSUPP as current return\nof -ENODEV causes issues with devlink output.\n\nPetr Oros resolves a couple of issues in iavf; freeing PTP resources\nbefore reset and disable. Fixing contention issues with the netdev lock\nbetween reset and some ethtool operations.\n\nAlok Tiwari corrects an incorrect comparison of cloud filter values and\nadjust some passed arguments to sizeof() for consistency on i40e.\n\nMatt Vollrath removes an incorrect decrement for DMA error on e1000 and\ne1000e drivers.\n\n* \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n  e1000/e1000e: Fix leak in DMA error cleanup\n  i40e: fix src IP mask checks and memcpy argument names in cloud filter\n  iavf: fix incorrect reset handling in callbacks\n  iavf: fix PTP use-after-free during reset\n  drivers: net: ice: fix devlink parameters get without irdma\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260310205654.4109072-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "e62a22f43475624ea466fd9b766f62e8458f4cd9",
      "tree": "6e111b4fad09f0afa1691679259dd77df0e32fef",
      "parents": [
        "e8f0dc024ce55451ebd54bad975134ba802e4fcc",
        "68e76fc12df091b04ede5f6244385a35abae0a80"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:04:58 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:04:58 2026 -0700"
      },
      "message": "Merge branch \u0027neighbour-fix-update-of-proxy-neighbour\u0027\n\nSabrina Dubroca says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nneighbour: fix update of proxy neighbour\n\nWhile re-reading some \"old\" patches I ran into a small change of\nbehavior in commit dc2a27e524ac (\"neighbour: Update pneigh_entry in\npneigh_create().\").\n\nThe old behavior was not consistent between -\u003eprotocol and -\u003eflags,\nand didn\u0027t offer a way to clear protocol, so maybe it\u0027s better to\nchange that (7-years-old [1]) behavior. But then we should change\nnon-proxy neighbours as well to keep neigh/pneigh consistent.\n\n[1] df9b0e30d44c (\"neighbor: Add protocol attribute\")\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1772894876.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "68e76fc12df091b04ede5f6244385a35abae0a80",
      "tree": "6e111b4fad09f0afa1691679259dd77df0e32fef",
      "parents": [
        "cbada1048847a348797aec63a1d8056621cbe653"
      ],
      "author": {
        "name": "Sabrina Dubroca",
        "email": "sd@queasysnail.net",
        "time": "Tue Mar 10 22:59:17 2026 +0100"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:04:55 2026 -0700"
      },
      "message": "selftests: rtnetlink: add neighbour update test\n\nCheck that protocol and flags are updated correctly for\nneighbour and pneigh entries.\n\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/d28f72b5b4ff4c9ecbbbde06146a938dcc4c264a.1772894876.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "cbada1048847a348797aec63a1d8056621cbe653",
      "tree": "96b6a23f094f693d841c73a59d177dbd7e289283",
      "parents": [
        "e8f0dc024ce55451ebd54bad975134ba802e4fcc"
      ],
      "author": {
        "name": "Sabrina Dubroca",
        "email": "sd@queasysnail.net",
        "time": "Tue Mar 10 22:59:16 2026 +0100"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:04:55 2026 -0700"
      },
      "message": "neighbour: restore protocol !\u003d 0 check in pneigh update\n\nPrior to commit dc2a27e524ac (\"neighbour: Update pneigh_entry in\npneigh_create().\"), a pneigh\u0027s protocol was updated only when the\nvalue of the NDA_PROTOCOL attribute was non-0. While moving the code,\nthat check was removed. This is a small change of user-visible\nbehavior, and inconsistent with the (non-proxy) neighbour behavior.\n\nFixes: dc2a27e524ac (\"neighbour: Update pneigh_entry in pneigh_create().\")\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/38c61de1bb032871a886aff9b9b52fe1cdd4cada.1772894876.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "e8f0dc024ce55451ebd54bad975134ba802e4fcc",
      "tree": "6006f774cc4cac984adea67bf1a7aa0decf12519",
      "parents": [
        "6c5a9baa15de240e747263aba435a0951da8d8d2"
      ],
      "author": {
        "name": "Marek Behún",
        "email": "kabel@kernel.org",
        "time": "Wed Mar 11 12:12:37 2026 +0100"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 19:03:21 2026 -0700"
      },
      "message": "net: dsa: realtek: Fix LED group port bit for non-zero LED group\n\nThe rtl8366rb_led_group_port_mask() function always returns LED port\nbit in LED group 0; the switch statement returns the same thing in all\nnon-default cases.\n\nThis means that the driver does not currently support configuring LEDs\nin non-zero LED groups.\n\nFix this.\n\nFixes: 32d617005475a71e (\"net: dsa: realtek: add LED drivers for rtl8366rb\")\nSigned-off-by: Marek Behún \u003ckabel@kernel.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260311111237.29002-1-kabel@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "6c5a9baa15de240e747263aba435a0951da8d8d2",
      "tree": "cc179222c8fed20e8773be04c7380852f74cfb66",
      "parents": [
        "99c8c16a4aad0b37293cae213e15957c573cf79b"
      ],
      "author": {
        "name": "Mehul Rao",
        "email": "mehulrao@gmail.com",
        "time": "Tue Mar 10 13:07:30 2026 -0400"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 18:56:28 2026 -0700"
      },
      "message": "tipc: fix divide-by-zero in tipc_sk_filter_connect()\n\nA user can set conn_timeout to any value via\nsetsockopt(TIPC_CONN_TIMEOUT), including values less than 4.  When a\nSYN is rejected with TIPC_ERR_OVERLOAD and the retry path in\ntipc_sk_filter_connect() executes:\n\n    delay %\u003d (tsk-\u003econn_timeout / 4);\n\nIf conn_timeout is in the range [0, 3], the integer division yields 0,\nand the modulo operation triggers a divide-by-zero exception, causing a\nkernel oops/panic.\n\nFix this by clamping conn_timeout to a minimum of 4 at the point of use\nin tipc_sk_filter_connect().\n\nOops: divide error: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+\nRIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)\nCall Trace:\n tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)\n __release_sock (include/net/sock.h:1185 net/core/sock.c:3213)\n release_sock (net/core/sock.c:3797)\n tipc_connect (net/tipc/socket.c:2570)\n __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)\n\nFixes: 6787927475e5 (\"tipc: buffer overflow handling in listener socket\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mehul Rao \u003cmehulrao@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260310170730.28841-1-mehulrao@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "99c8c16a4aad0b37293cae213e15957c573cf79b",
      "tree": "dd5087d3f5ab616b200d18927b7812dc9c5e556f",
      "parents": [
        "20c1be4cc86fa34bd68496a1b8168f1af0a2ee72"
      ],
      "author": {
        "name": "Bastien Curutchet (Schneider Electric)",
        "email": "bastien.curutchet@bootlin.com",
        "time": "Mon Mar 09 14:15:43 2026 +0100"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 18:06:22 2026 -0700"
      },
      "message": "net: dsa: microchip: Fix error path in PTP IRQ setup\n\nIf request_threaded_irq() fails during the PTP message IRQ setup, the\nnewly created IRQ mapping is never disposed. Indeed, the\nksz_ptp_irq_setup()\u0027s error path only frees the mappings that were\nsuccessfully set up.\n\nDispose the newly created mapping if the associated\nrequest_threaded_irq() fails at setup.\n\nCc: stable@vger.kernel.org\nFixes: d0b8fec8ae505 (\"net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()\")\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nLink: https://patch.msgid.link/20260309-ksz-ptp-irq-fix-v1-1-757b3b985955@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "20c1be4cc86fa34bd68496a1b8168f1af0a2ee72",
      "tree": "03864ff6b9d721b605319cb1c19f6aa77154e40b",
      "parents": [
        "908c344d5cfac4160f49715da9efacdf5b6a28bd",
        "d56b5d163458c45ab8fa1f00bd875af01b3ce28c"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 17:53:40 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 17:53:41 2026 -0700"
      },
      "message": "Merge branch \u0027net-bpf-nd_tbl-fixes-for-when-ipv6-disable-1\u0027\n\nRicardo B. Marlière says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n{net,bpf}: nd_tbl fixes for when ipv6.disable\u003d1\n\nPlease consider merging these four patches to fix three crashes that were\nfound after this report:\n\nhttps://lore.kernel.org/all/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp\u003dutE2H2VTX5nqfgs7LDxQ@mail.gmail.com\n\nThe first patch from Jakub Kicinski is a preparation in order to enable\nthe use ipv6_mod_enabled() even when CONFIG_IPV6\u003dn.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-0-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "d56b5d163458c45ab8fa1f00bd875af01b3ce28c",
      "tree": "03864ff6b9d721b605319cb1c19f6aa77154e40b",
      "parents": [
        "dcb4e2231469523d20cf0a2477d68245795c205d"
      ],
      "author": {
        "name": "Ricardo B. Marlière",
        "email": "rbm@suse.com",
        "time": "Sat Mar 07 17:50:56 2026 -0300"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 17:53:38 2026 -0700"
      },
      "message": "bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called which\ninitializes it. If bpf_redirect_neigh() is called with explicit AF_INET6\nnexthop parameters, __bpf_redirect_neigh_v6() can skip the IPv6 FIB lookup\nand call bpf_out_neigh_v6() directly. bpf_out_neigh_v6() then calls\nip_neigh_gw6(), which uses ipv6_stub-\u003end_tbl.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000248\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:skb_do_redirect+0x44f/0xf40\n Call Trace:\n  \u003cTASK\u003e\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? __tcf_classify.constprop.0+0x83/0x160\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? tcf_classify+0x2b/0x50\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? tc_run+0xb8/0x120\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  __dev_queue_xmit+0x6fa/0x1000\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  packet_sendmsg+0x10da/0x1700\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  __sys_sendto+0x1f3/0x220\n  __x64_sys_sendto+0x24/0x30\n  do_syscall_64+0x101/0xf80\n  ? exc_page_fault+0x6e/0x170\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  \u003c/TASK\u003e\n\nFix this by adding an early check in bpf_out_neigh_v6(). If IPv6 is\ndisabled, drop the packet before neighbor lookup.\n\nSuggested-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nFixes: ba452c9e996d (\"bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop\")\nSigned-off-by: Ricardo B. Marlière \u003crbm@suse.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-4-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "dcb4e2231469523d20cf0a2477d68245795c205d",
      "tree": "0e325e88bb88bac5311a29dc195757028adfe9cb",
      "parents": [
        "30021e969d48e5819d5ae56936c2f34c0f7ce997"
      ],
      "author": {
        "name": "Ricardo B. Marlière",
        "email": "rbm@suse.com",
        "time": "Sat Mar 07 17:50:55 2026 -0300"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 17:53:38 2026 -0700"
      },
      "message": "bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called which\ninitializes it. If bpf_redirect_neigh() is called from tc with an explicit\nnexthop of nh_family \u003d\u003d AF_INET6, bpf_out_neigh_v4() takes the AF_INET6\nbranch and calls ip_neigh_gw6(), which relies on ipv6_stub-\u003end_tbl.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000248\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:skb_do_redirect+0xb93/0xf00\n Call Trace:\n  \u003cTASK\u003e\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? __tcf_classify.constprop.0+0x83/0x160\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? tcf_classify+0x2b/0x50\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? tc_run+0xb8/0x120\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  __dev_queue_xmit+0x6fa/0x1000\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? alloc_skb_with_frags+0x58/0x200\n  packet_sendmsg+0x10da/0x1700\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  __sys_sendto+0x1f3/0x220\n  __x64_sys_sendto+0x24/0x30\n  do_syscall_64+0x101/0xf80\n  ? exc_page_fault+0x6e/0x170\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  \u003c/TASK\u003e\n\nFix this by adding an early check in the AF_INET6 branch of\nbpf_out_neigh_v4(). If IPv6 is disabled, unlock RCU and drop the packet.\n\nSuggested-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nFixes: ba452c9e996d (\"bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop\")\nSigned-off-by: Ricardo B. Marlière \u003crbm@suse.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-3-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "30021e969d48e5819d5ae56936c2f34c0f7ce997",
      "tree": "24a31220d95130049f2bd2f69d27b52186f3b4a9",
      "parents": [
        "94a4b1f959989de9c54d43c3a102fb1ee92e1414"
      ],
      "author": {
        "name": "Ricardo B. Marlière",
        "email": "rbm@suse.com",
        "time": "Sat Mar 07 17:50:54 2026 -0300"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 17:53:37 2026 -0700"
      },
      "message": "net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If bonding ARP/NS validation is enabled, an IPv6\nNS/NA packet received on a slave can reach bond_validate_na(), which\ncalls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can\ncrash in __ipv6_chk_addr_and_flags().\n\n BUG: kernel NULL pointer dereference, address: 00000000000005d8\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170\n Call Trace:\n  \u003cIRQ\u003e\n  ipv6_chk_addr+0x1f/0x30\n  bond_validate_na+0x12e/0x1d0 [bonding]\n  ? __pfx_bond_handle_frame+0x10/0x10 [bonding]\n  bond_rcv_validate+0x1a0/0x450 [bonding]\n  bond_handle_frame+0x5e/0x290 [bonding]\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  __netif_receive_skb_core.constprop.0+0x3e8/0xe50\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? update_cfs_rq_load_avg+0x1a/0x240\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? __enqueue_entity+0x5e/0x240\n  __netif_receive_skb_one_core+0x39/0xa0\n  process_backlog+0x9c/0x150\n  __napi_poll+0x30/0x200\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  net_rx_action+0x338/0x3b0\n  handle_softirqs+0xc9/0x2a0\n  do_softirq+0x42/0x60\n  \u003c/IRQ\u003e\n  \u003cTASK\u003e\n  __local_bh_enable_ip+0x62/0x70\n  __dev_queue_xmit+0x2d3/0x1000\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? packet_parse_headers+0x10a/0x1a0\n  packet_sendmsg+0x10da/0x1700\n  ? kick_pool+0x5f/0x140\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? __queue_work+0x12d/0x4f0\n  __sys_sendto+0x1f3/0x220\n  __x64_sys_sendto+0x24/0x30\n  do_syscall_64+0x101/0xf80\n  ? exc_page_fault+0x6e/0x170\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  \u003c/TASK\u003e\n\nFix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to\nbond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate()\nand avoid the path to ipv6_chk_addr().\n\nSuggested-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nFixes: 4e24be018eb9 (\"bonding: add new parameter ns_targets\")\nSigned-off-by: Ricardo B. Marlière \u003crbm@suse.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-2-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "94a4b1f959989de9c54d43c3a102fb1ee92e1414",
      "tree": "2c9d33898362608986b5b7044df674641f0ca8b5",
      "parents": [
        "908c344d5cfac4160f49715da9efacdf5b6a28bd"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Mar 07 17:50:53 2026 -0300"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 11 17:53:37 2026 -0700"
      },
      "message": "ipv6: move the disable_ipv6_mod knob to core code\n\nFrom: Jakub Kicinski \u003ckuba@kernel.org\u003e\n\nMake sure disable_ipv6_mod itself is not part of the IPv6 module,\nin case core code wants to refer to it. We will remove support\nfor IPv6\u003dm soon, this change helps make fixes we commit before\nthat less messy.\n\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-1-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "e3beefd3af09f8e460ddaf39063d3d7664d7ab59",
      "tree": "d9ef258aff215d753402468017acdec2c8478b41",
      "parents": [
        "40e75e42f49ca54b4ff41f3edb94f5ef0299140c"
      ],
      "author": {
        "name": "Shyam Prasad N",
        "email": "sprasad@microsoft.com",
        "time": "Wed Mar 11 10:48:54 2026 +0530"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Wed Mar 11 18:46:42 2026 -0500"
      },
      "message": "cifs: make default value of retrans as zero\n\nWhen retrans mount option was introduced, the default value was set\nas 1. However, in the light of some bugs that this has exposed recently\nwe should change it to 0 and retain the old behaviour before this option\nwas introduced.\n\nCc: \u003cstable@vger.kernel.org\u003e\nReviewed-by: Bharath SM \u003cbharathsm@microsoft.com\u003e\nSigned-off-by: Shyam Prasad N \u003csprasad@microsoft.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "40e75e42f49ca54b4ff41f3edb94f5ef0299140c",
      "tree": "b6e12e468920c29bb1914d3b40b1e39485f5c856",
      "parents": [
        "d4c7210d2f3ea481a6481f03040a64d9077a6172"
      ],
      "author": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Wed Mar 11 15:00:52 2026 -0300"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Wed Mar 11 18:46:40 2026 -0500"
      },
      "message": "smb: client: fix open handle lookup in cifs_open()\n\nWhen looking up open handles to be re-used in cifs_open(), calling\ncifs_get_{writable,readable}_path() is wrong as it will look up for\nthe first matching open handle, and if @file-\u003ef_flags doesn\u0027t match,\nit will ignore the remaining open handles in\ncifsInodeInfo::openFileList that might potentially match\n@file-\u003ef_flags.\n\nFor writable and readable handles, fix this by calling\n__cifs_get_writable_file() and __find_readable_file(), respectively,\nwith FIND_OPEN_FLAGS set.\n\nWith the patch, the following program ends up with two opens instead\nof three sent over the wire.\n\n```\n  #define _GNU_SOURCE\n  #include \u003cunistd.h\u003e\n  #include \u003cstring.h\u003e\n  #include \u003cfcntl.h\u003e\n\n  int main(int argc, char *argv[])\n  {\n          int fd;\n\n          fd \u003d open(\"/mnt/1/foo\", O_CREAT | O_WRONLY | O_TRUNC, 0664);\n          close(fd);\n          fd \u003d open(\"/mnt/1/foo\", O_DIRECT | O_WRONLY);\n          close(fd);\n          fd \u003d open(\"/mnt/1/foo\", O_WRONLY);\n          close(fd);\n          fd \u003d open(\"/mnt/1/foo\", O_DIRECT | O_WRONLY);\n          close(fd);\n          return 0;\n  }\n```\n\n```\n$ mount.cifs //srv/share /mnt/1 -o ...\n$ gcc test.c \u0026\u0026 ./a.out\n```\n\nSigned-off-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: linux-cifs@vger.kernel.org\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "d4c7210d2f3ea481a6481f03040a64d9077a6172",
      "tree": "5a870c3034a913e85fea7b7c89a78cebe81820bb",
      "parents": [
        "88d37abb366be95d772ceb4c7f26772e78447252"
      ],
      "author": {
        "name": "Henrique Carvalho",
        "email": "henrique.carvalho@suse.com",
        "time": "Wed Mar 11 20:17:23 2026 -0300"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Wed Mar 11 18:46:28 2026 -0500"
      },
      "message": "smb: client: fix iface port assignment in parse_server_interfaces\n\nparse_server_interfaces() initializes interface socket addresses with\nCIFS_PORT. When the mount uses a non-default port this overwrites the\nconfigured destination port.\n\nLater, cifs_chan_update_iface() copies this sockaddr into server-\u003edstaddr,\ncausing reconnect attempts to use the wrong port after server interface\nupdates.\n\nUse the existing port from server-\u003edstaddr instead.\n\nCc: stable@vger.kernel.org\nFixes: fe856be475f7 (\"CIFS: parse and store info on iface queries\")\nTested-by: Dr. Thomas Orgis \u003cthomas.orgis@uni-hamburg.de\u003e\nReviewed-by: Enzo Matsumiya \u003cematsumiya@suse.de\u003e\nSigned-off-by: Henrique Carvalho \u003chenrique.carvalho@suse.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "6f02c6b196036dbb6defb4647d8707d29b7fe95b",
      "tree": "0758a3cd563b45231e2484e8b294dd11218396b2",
      "parents": [
        "177c69432161f6e4bab07ccacf8a1748a6898a6b"
      ],
      "author": {
        "name": "Tom Ryan",
        "email": "ryan36005@gmail.com",
        "time": "Mon Mar 09 22:20:02 2026 -0700"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Wed Mar 11 14:35:19 2026 -0600"
      },
      "message": "io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops\n\nWhen IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY,\nthe boundary check for 128-byte SQE operations in io_init_req()\nvalidated the logical SQ head position rather than the physical SQE\nindex.\n\nThe existing check:\n\n  !(ctx-\u003ecached_sq_head \u0026 (ctx-\u003esq_entries - 1))\n\nensures the logical position isn\u0027t at the end of the ring, which is\ncorrect for NO_SQARRAY rings where physical \u003d\u003d logical. However, when\nsq_array is present, an unprivileged user can remap any logical\nposition to an arbitrary physical index via sq_array. Setting\nsq_array[N] \u003d sq_entries - 1 places a 128-byte operation at the last\nphysical SQE slot, causing the 128-byte memcpy in\nio_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE\narray.\n\nReplace the cached_sq_head alignment check with a direct validation\nof the physical SQE index, which correctly handles both sq_array and\nNO_SQARRAY cases.\n\nFixes: 1cba30bf9fdd (\"io_uring: add support for IORING_SETUP_SQE_MIXED\")\nSigned-off-by: Tom Ryan \u003cryan36005@gmail.com\u003e\nLink: https://patch.msgid.link/20260310052003.72871-1-ryan36005@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "177c69432161f6e4bab07ccacf8a1748a6898a6b",
      "tree": "3876666f26a48ace76bf5b17dcaf19853a3cf34b",
      "parents": [
        "96189080265e6bb5dde3a4afbaf947af493e3f82"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Mon Mar 09 14:35:49 2026 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Wed Mar 11 14:35:19 2026 -0600"
      },
      "message": "io_uring/eventfd: use ctx-\u003erings_rcu for flags checking\n\nSimilarly to what commit e78f7b70e837 did for local task work additions,\nuse -\u003erings_rcu under RCU rather than dereference -\u003erings directly. See\nthat commit for more details.\n\nCc: stable@vger.kernel.org\nFixes: 79cfe9e59c2a (\"io_uring/register: add IORING_REGISTER_RESIZE_RINGS\")\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "96189080265e6bb5dde3a4afbaf947af493e3f82",
      "tree": "9b2bea89a60857d5b2de2081ccf0d41561348654",
      "parents": [
        "785d4625d3e05bb0ac536ff4fd74d096cfe51714"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Mon Mar 09 14:21:37 2026 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Wed Mar 11 14:35:16 2026 -0600"
      },
      "message": "io_uring: ensure ctx-\u003erings is stable for task work flags manipulation\n\nIf DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while\nthe ring is being resized, it\u0027s possible for the OR\u0027ing of\nIORING_SQ_TASKRUN to happen in the small window of swapping into the\nnew rings and the old rings being freed.\n\nPrevent this by adding a 2nd -\u003erings pointer, -\u003erings_rcu, which is\nprotected by RCU. The task work flags manipulation is inside RCU\nalready, and if the resize ring freeing is done post an RCU synchronize,\nthen there\u0027s no need to add locking to the fast path of task work\nadditions.\n\nNote: this is only done for DEFER_TASKRUN, as that\u0027s the only setup mode\nthat supports ring resizing. If this ever changes, then they too need to\nuse the io_ctx_mark_taskrun() helper.\n\nLink: https://lore.kernel.org/io-uring/20260309062759.482210-1-naup96721@gmail.com/\nCc: stable@vger.kernel.org\nFixes: 79cfe9e59c2a (\"io_uring/register: add IORING_REGISTER_RESIZE_RINGS\")\nReported-by: Hao-Yu Yang \u003cnaup96721@gmail.com\u003e\nSuggested-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "30c64fb9839949f085c8eb55b979cbd8a4c51f00",
      "tree": "9307e413bf3d2bffac151efe73c45f74fb374f3f",
      "parents": [
        "a9683730e8b1d632674f81844ed03ddfbe4821c0"
      ],
      "author": {
        "name": "Chen Ni",
        "email": "nichen@iscas.ac.cn",
        "time": "Tue Mar 10 12:43:27 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Mar 11 19:18:17 2026 +0000"
      },
      "message": "ASoC: amd: acp-mach-common: Add missing error check for clock acquisition\n\nThe acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not\ncheck the return values of clk_get(). This could lead to a kernel crash\nwhen the invalid pointers are later dereferenced by clock core\nfunctions.\n\nFix this by:\n1. Changing clk_get() to the device-managed devm_clk_get().\n2. Adding IS_ERR() checks immediately after each clock acquisition.\n\nFixes: 8b7256266848 (\"ASoC: amd: acp: Add support for RT5682-VS codec\")\nFixes: d4c750f2c7d4 (\"ASoC: amd: acp: Add generic machine driver support for ACP cards\")\nSigned-off-by: Chen Ni \u003cnichen@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260310044327.2582018-1-nichen@iscas.ac.cn\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "f879365c5bb210ed0d0b0aae1a0202d0c0b4b9d0",
      "tree": "ec0250a441ce37bd864a0b4e909b462585b4312f",
      "parents": [
        "743956bb9990214ff1dac66ef59e27221dc3c2d8"
      ],
      "author": {
        "name": "CL Wang",
        "email": "cl634@andestech.com",
        "time": "Tue Mar 03 10:47:37 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Mar 11 19:08:43 2026 +0000"
      },
      "message": "spi: atcspi200: Handle invalid buswidth and fix compiler warning\n\nThe kernel test robot reported a compile-time error regarding the\nFIELD_PREP() value being too large for the TRANS_DUAL_QUAD field:\n\n  error: FIELD_PREP: value too large for the field\n  note: in expansion of macro \u0027TRANS_DUAL_QUAD\u0027\n  tc |\u003d TRANS_DUAL_QUAD(ffs(op-\u003edata.buswidth) - 1);\n\nThis occurs because TRANS_DUAL_QUAD is defined as a 2-bit field, and\nGCC\u0027s static analysis cannot deduce that `ffs(op-\u003edata.buswidth) - 1`\nwill strictly fall within the 0~3 range. Although the SPI framework\nguarantees that `op-\u003edata.buswidth` is valid at runtime (e.g., 1, 2,\n4, 8), an explicit bounds check is necessary to satisfy the compiler.\n\nTo resolve the build warning, introduce a safe fallback mechanism.\nIf an unexpected buswidth is encountered, the driver will trigger\na WARN_ON_ONCE to leave a trace and fall back to width_code \u003d 0\n(standard 1-bit SPI mode). This approach guarantees predictable\nhardware behavior.\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202602140738.P7ZozxzI-lkp@intel.com/\nSuggested-by: Pei Xiao \u003cxiaopei01@kylinos.cn\u003e\nSigned-off-by: CL Wang \u003ccl634@andestech.com\u003e\nLink: https://patch.msgid.link/20260303024737.1791196-1-cl634@andestech.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "464b1c115852fe025635ae2065e00caced184d92",
      "tree": "292286c18d96dd518c310d96769da6542eb4d4ab",
      "parents": [
        "8dafa9f5900c4855a65dbfee51e3bd00636deee1"
      ],
      "author": {
        "name": "Qing Wang",
        "email": "wangqing7171@gmail.com",
        "time": "Wed Mar 11 17:36:17 2026 +0800"
      },
      "committer": {
        "name": "Vlastimil Babka (SUSE)",
        "email": "vbabka@kernel.org",
        "time": "Wed Mar 11 17:55:26 2026 +0100"
      },
      "message": "slab: fix memory leak when refill_sheaf() fails\n\nWhen refill_sheaf() partially fills one sheaf (e.g., fills 5 objects\nbut need to fill 10), it will update sheaf-\u003esize and return -ENOMEM.\nHowever, the callers (alloc_full_sheaf() and __pcs_replace_empty_main())\ndirectly call free_empty_sheaf() on failure, which only does kfree(sheaf),\ncausing the partially allocated objects memory in sheaf-\u003eobjects[] leaked.\n\nFix this by calling sheaf_flush_unused() before free_empty_sheaf() to\nfree objects of sheaf-\u003eobjects[]. And also add a WARN_ON() in\nfree_empty_sheaf() to catch any future cases where a non-empty sheaf is\nbeing freed.\n\nFixes: ed30c4adfc2b (\"slab: add optimized sheaf refill from partial list\")\nSigned-off-by: Qing Wang \u003cwangqing7171@gmail.com\u003e\nLink: https://patch.msgid.link/20260311093617.4155965-1-wangqing7171@gmail.com\nReviewed-by: Harry Yoo \u003charry.yoo@oracle.com\u003e\nReviewed-by: Hao Li \u003chao.li@linux.dev\u003e\nSigned-off-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\n"
    },
    {
      "commit": "80234b5ab240f52fa45d201e899e207b9265ef91",
      "tree": "30befa628b780a2b18a8061e097e4b39eb4dc61d",
      "parents": [
        "2b8e3fac9bac1f2bb67571a00bb58851826fe705",
        "97e4567d39941248579da34b7fbb568e6659511e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Mar 11 09:30:20 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Mar 11 09:30:20 2026 -0700"
      },
      "message": "Merge tag \u0027rproc-v7.0-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux\n\nPull remoteproc fixes from Bjorn Andersson:\n\n - Correct the early return from the i.MX remoteproc prepare\n   operation, which prevented the platform-specific prepare\n   function from being reached\n\n - Ensure that the Mediatek SCP clock is released during system\n   suspend after the recent refactoring to avoid issues with the\n   clock framework\u0027s prepare lock.\n\n - Correct the type of the subsys_name_len field in the sysmon\n   event QMI message, as the recent introduction of big endian\n   support in the QMI encoder highlighted the type mismatch and\n   resulted in a failure to encode the message\n\n - Roll back the devm_ioremap_resource_wc() to a devm_ioremap_wc()\n   in the Qualcomm WCNSS remoteproc driver, after reports that\n   requesting this resource fails on some platforms\n\n* tag \u0027rproc-v7.0-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:\n  remoteproc: imx_rproc: Fix unreachable platform prepare_ops\n  remoteproc: mediatek: Unprepare SCP clock during system suspend\n  remoteproc: sysmon: Correct subsys_name_len type in QMI request\n  remoteproc: qcom_wcnss: Fix reserved region mapping failure\n"
    },
    {
      "commit": "2b8e3fac9bac1f2bb67571a00bb58851826fe705",
      "tree": "d1a9de8355e2efc2e9a94c1c8672cdf65685ca41",
      "parents": [
        "b29fb8829bff243512bb8c8908fd39406f9fd4c3",
        "35e4f2a17eb40288f9bcdb09549fa04a63a96279"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Mar 11 08:35:31 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Mar 11 08:35:31 2026 -0700"
      },
      "message": "Merge tag \u0027powerpc-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n - Correct MSI allocation tracking\n - Always use 64 bits PTE for powerpc/e500\n - Fix inline assembly for clang build on PPC32\n - Fixes for clang build issues in powerpc64/ftrace\n - Fixes for powerpc64/bpf JIT and tailcall support\n - Cleanup MPC83XX devicetrees\n - Fix keymile vendor prefix\n - Fix to use big-endian types for crash variables\n\nThanks to Abhishek Dubey, Christophe Leroy (CS GROUP), Hari Bathini,\nHeiko Schocher, J. Neuschäfer, Mahesh Salgaonkar, Nam Cao, Nilay Shroff,\nRob Herring (Arm), Saket Kumar Bhaskar, Sourabh Jain, Stan Johnson, and\nVenkat Rao Bagalkote.\n\n* tag \u0027powerpc-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (23 commits)\n  powerpc/pseries: Correct MSI allocation tracking\n  powerpc: dts: mpc83xx: Add unit addresses to /memory\n  powerpc: dts: mpc8315erdb: Add missing #cells properties to SPI bus\n  powerpc: dts: mpc8315erdb: Rename LED nodes to comply with schema\n  powerpc: dts: mpc8315erdb: Use IRQ_TYPE_* macros\n  powerpc: dts: mpc8313erdb: Use IRQ_TYPE_* macros\n  powerpc: 83xx: km83xx: Fix keymile vendor prefix\n  dt-bindings: powerpc: Add Freescale/NXP MPC83xx SoCs\n  powerpc64/bpf: fix kfunc call support\n  powerpc64/bpf: fix handling of BPF stack in exception callback\n  powerpc64/bpf: remove BPF redzone protection in trampoline stack\n  powerpc64/bpf: use consistent tailcall offset in trampoline\n  powerpc64/bpf: fix the address returned by bpf_get_func_ip\n  powerpc64/bpf: do not increment tailcall count when prog is NULL\n  powerpc64/ftrace: workaround clang recording GEP in __patchable_function_entries\n  powerpc64/ftrace: fix OOL stub count with clang\n  powerpc64: make clang cross-build friendly\n  powerpc/crash: adjust the elfcorehdr size\n  powerpc/kexec/core: use big-endian types for crash variables\n  powerpc/prom_init: Fixup missing #size-cells on PowerMac media-bay nodes\n  ...\n"
    },
    {
      "commit": "a9683730e8b1d632674f81844ed03ddfbe4821c0",
      "tree": "45e0f39fd481f09aee0591141c0aed652db44996",
      "parents": [
        "53f3a900e9a383d47af7253076e19f510c5708d0"
      ],
      "author": {
        "name": "Casey Connolly",
        "email": "casey.connolly@linaro.org",
        "time": "Fri Mar 06 18:47:07 2026 +0100"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Mar 11 15:28:35 2026 +0000"
      },
      "message": "ASoC: detect empty DMI strings\n\nSome bootloaders like recent versions of U-Boot may install some DMI\nproperties with empty values rather than not populate them. This manages\nto make its way through the validator and cleanup resulting in a rogue\nhyphen being appended to the card longname.\n\nFixes: 4e01e5dbba96 (\"ASoC: improve the DMI long card code in asoc-core\")\nSigned-off-by: Casey Connolly \u003ccasey.connolly@linaro.org\u003e\nLink: https://patch.msgid.link/20260306174707.283071-2-casey.connolly@linaro.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "53f3a900e9a383d47af7253076e19f510c5708d0",
      "tree": "65d58e9a5aba4304cdc0c4773f38b1d27ff35d9d",
      "parents": [
        "30e4b2290cc2a8d1b9ddb9dcb9c981df1f2a7399"
      ],
      "author": {
        "name": "Chen Ni",
        "email": "nichen@iscas.ac.cn",
        "time": "Tue Mar 10 10:42:46 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Mar 11 13:21:01 2026 +0000"
      },
      "message": "ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition\n\nThe acp3x_5682_init() function did not check the return value of\nclk_get(), which could lead to dereferencing error pointers in\nrt5682_clk_enable().\n\nFix this by:\n1. Changing clk_get() to the device-managed devm_clk_get().\n2. Adding proper IS_ERR() checks for both clock acquisitions.\n\nFixes: 6b8e4e7db3cd (\"ASoC: amd: Add machine driver for Raven based platform\")\nSigned-off-by: Chen Ni \u003cnichen@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260310024246.2153827-1-nichen@iscas.ac.cn\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "362c490980867930a098b99f421268fbd7ca05fd",
      "tree": "7d6c8019e64f3408d3439a9260ea9643697f8262",
      "parents": [
        "52a8a1ba883defbfe3200baa22cf4cd21985d51a"
      ],
      "author": {
        "name": "Long Li",
        "email": "leo.lilong@huawei.com",
        "time": "Tue Mar 10 20:32:33 2026 +0800"
      },
      "committer": {
        "name": "Carlos Maiolino",
        "email": "cem@kernel.org",
        "time": "Wed Mar 11 13:21:42 2026 +0100"
      },
      "message": "xfs: fix integer overflow in bmap intent sort comparator\n\nxfs_bmap_update_diff_items() sorts bmap intents by inode number using\na subtraction of two xfs_ino_t (uint64_t) values, with the result\ntruncated to int. This is incorrect when two inode numbers differ by\nmore than INT_MAX (2^31 - 1), which is entirely possible on large XFS\nfilesystems.\n\nFix this by replacing the subtraction with cmp_int().\n\nCc: \u003cstable@vger.kernel.org\u003e # v4.9\nFixes: 9f3afb57d5f1 (\"xfs: implement deferred bmbt map/unmap operations\")\nSigned-off-by: Long Li \u003cleo.lilong@huawei.com\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n"
    },
    {
      "commit": "743956bb9990214ff1dac66ef59e27221dc3c2d8",
      "tree": "1ed8fab93c00311af2f47927502c16aa2bf0e1b5",
      "parents": [
        "85b731ad4bbf6eb3fedf267ab00be3596f148432"
      ],
      "author": {
        "name": "Chen-Yu Tsai",
        "email": "wens@kernel.org",
        "time": "Mon Mar 02 23:35:56 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Mar 11 11:34:10 2026 +0000"
      },
      "message": "spi: dt-bindings: sun6i: Allow Dual SPI and Quad SPI for newer SoCs\n\nSupport for Dual SPI and Quad SPI was added to the Linux driver in\ncommit 0605d9fb411f (\"spi: sun6i: add quirk for dual and quad SPI modes\nsupport\") and commit 25453d797d7a (\"spi: sun6i: add dual and quad SPI\nmodes support for R329/D1/R528/T113s\").\n\nHowever the binding was never updated to allow these modes. Allow them\nby adding 2 and 4 to the allowed bus widths for the newer variants.\n\nWhile at it, also add 0 to the allowed bus widths. This signals that\nRX or TX is not available, i.e. the MISO or MOSI pin is disconnected.\n\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nSigned-off-by: Chen-Yu Tsai \u003cwens@kernel.org\u003e\nLink: https://patch.msgid.link/20260302153559.3199783-2-wens@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "393815f57651101f1590632092986d1d5a3a41bd",
      "tree": "2a96b100c4eec619195e86ecb0e1df050f9d6fc4",
      "parents": [
        "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681"
      ],
      "author": {
        "name": "Ben Dooks",
        "email": "ben.dooks@codethink.co.uk",
        "time": "Wed Mar 11 10:58:35 2026 +0000"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Wed Mar 11 12:30:45 2026 +0100"
      },
      "message": "ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()\n\nThe pointer returned from acpi_os_map_generic_address() is\ntagged with __iomem, so make the rv it is returned to also\nof void __iomem * type.\n\nFixes the following sparse warning:\n\ndrivers/acpi/osl.c:1686:20: warning: incorrect type in assignment (different address spaces)\ndrivers/acpi/osl.c:1686:20:    expected void *rv\ndrivers/acpi/osl.c:1686:20:    got void [noderef] __iomem *\n\nFixes: 6915564dc5a8 (\"ACPI: OSL: Change the type of acpi_os_map_generic_address() return value\")\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\n[ rjw: Subject tweak, added Fixes tag ]\nLink: https://patch.msgid.link/20260311105835.463030-1-ben.dooks@codethink.co.uk\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n"
    },
    {
      "commit": "5182e5ec4355dd690307f5d5c28cbfc5b2c06a97",
      "tree": "9e6b2893e6a6b1cfcf239d0dc7528b55f1e7701c",
      "parents": [
        "df1d8abf36ca3681c21a6809eaa9a1e01ef897a6"
      ],
      "author": {
        "name": "Lianqin Hu",
        "email": "hulianqin@vivo.com",
        "time": "Wed Mar 11 07:22:38 2026 +0000"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Mar 11 09:05:27 2026 +0100"
      },
      "message": "ALSA: usb-audio: Add iface reset and delay quirk for SPACETOUCH USB Audio\n\nSetting up the interface when suspended/resumeing fail on this card.\nAdding a reset and delay quirk will eliminate this problem.\n\nusb 1-1: New USB device found, idVendor\u003d0666, idProduct\u003d0880\nusb 1-1: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\nusb 1-1: Product: USB Audio\nusb 1-1: Manufacturer: SPACETOUCH\nusb 1-1: SerialNumber: 000000000\n\nSigned-off-by: Lianqin Hu \u003chulianqin@vivo.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/TYUPR06MB6217ACC80B70BE25D87456B0D247A@TYUPR06MB6217.apcprd06.prod.outlook.com\n"
    },
    {
      "commit": "b29fb8829bff243512bb8c8908fd39406f9fd4c3",
      "tree": "b856b54d51c23dc50266b2193fb2ed94337032bd",
      "parents": [
        "b4f0dd314b39ea154f62f3bd3115ed0470f9f71e",
        "441336115df26b966575de56daf7107ed474faed"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Mar 10 20:30:52 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Mar 10 20:30:52 2026 -0700"
      },
      "message": "Merge tag \u0027v7.0-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix potential use after free errors\n\n - Fix refcount leak in smb2 open error path\n\n - Prevent allowing logging signing or encryption keys\n\n* tag \u0027v7.0-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n  ksmbd: Don\u0027t log keys in SMB3 signing and encryption key generation\n  smb: server: fix use-after-free in smb2_open()\n  ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()\n  ksmbd: fix use-after-free by using call_rcu() for oplock_info\n  ksmbd: fix use-after-free in proc_show_files due to early rcu_read_unlock\n  smb/server: Fix another refcount leak in smb2_open()\n"
    },
    {
      "commit": "908c344d5cfac4160f49715da9efacdf5b6a28bd",
      "tree": "38930218b8d7a7da234327bb944418ef77cae621",
      "parents": [
        "57885276cc16a2e2b76282c808a4e84cbecb3aae"
      ],
      "author": {
        "name": "Nicolai Buchwitz",
        "email": "nb@tipi-net.de",
        "time": "Tue Mar 10 06:49:35 2026 +0100"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 10 19:41:13 2026 -0700"
      },
      "message": "net: bcmgenet: fix broken EEE by converting to phylib-managed state\n\nThe bcmgenet EEE implementation is broken in several ways.\nphy_support_eee() is never called, so the PHY never advertises EEE\nand phylib never sets phydev-\u003eenable_tx_lpi.  bcmgenet_mac_config()\nchecks priv-\u003eeee.eee_enabled to decide whether to enable the MAC\nLPI logic, but that field is never initialised to true, so the MAC\nnever enters Low Power Idle even when EEE is negotiated - wasting\nthe power savings EEE is designed to provide.  The only way to get\nEEE working at all is a manual \u0027ethtool --set-eee eth0 eee on\u0027 after\nevery link-up, and even then bcmgenet_get_eee() immediately clobbers\nthe reported state because phy_ethtool_get_eee() overwrites\neee_enabled and tx_lpi_enabled with the uninitialised PHY eee_cfg\nvalues.  Finally, bcmgenet_mac_config() is only called on link-up,\nso EEE is never disabled in hardware on link-down.\n\nFix all of this by removing the MAC-side EEE state tracking\n(priv-\u003eeee) and aligning with the pattern used by other non-phylink\nMAC drivers such as FEC.\n\nCall phy_support_eee() in bcmgenet_mii_probe() so the PHY advertises\nEEE link modes and phylib tracks negotiation state.  Move the EEE\nhardware control to bcmgenet_mii_setup(), which is called on every\nlink event, and drive it directly from phydev-\u003eenable_tx_lpi - the\nflag phylib sets when EEE is negotiated and the user has not disabled\nit.  This enables EEE automatically once the link partner agrees and\ndisables it cleanly on link-down.\n\nMake bcmgenet_get_eee() and bcmgenet_set_eee() pure passthroughs to\nphy_ethtool_get_eee() and phy_ethtool_set_eee(), with the MAC\nhardware register read/written for tx_lpi_timer.  Drop struct\nethtool_keee eee from struct bcmgenet_priv.\n\nFixes: fe0d4fd9285e (\"net: phy: Keep track of EEE configuration\")\nLink: https://lore.kernel.org/netdev/d352039f-4cbb-41e6-9aeb-0b4f3941b54c@lunn.ch/\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nTested-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260310054935.1238594-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "57885276cc16a2e2b76282c808a4e84cbecb3aae",
      "tree": "6873473c9f85e684a4f05b40db89b16d756a130d",
      "parents": [
        "f441b489cc66fbc44d78b6c123e74283b8077431"
      ],
      "author": {
        "name": "Paul Moses",
        "email": "p@1g4.org",
        "time": "Mon Mar 09 17:35:10 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 10 19:29:09 2026 -0700"
      },
      "message": "net-shapers: don\u0027t free reply skb after genlmsg_reply()\n\ngenlmsg_reply() hands the reply skb to netlink, and\nnetlink_unicast() consumes it on all return paths, whether the\nskb is queued successfully or freed on an error path.\n\nnet_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit()\ncurrently jump to free_msg after genlmsg_reply() fails and call\nnlmsg_free(msg), which can hit the same skb twice.\n\nReturn the genlmsg_reply() error directly and keep free_msg\nonly for pre-reply failures.\n\nFixes: 4b623f9f0f59 (\"net-shapers: implement NL get operation\")\nFixes: 553ea9f1efd6 (\"net: shaper: implement introspection support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Moses \u003cp@1g4.org\u003e\nLink: https://patch.msgid.link/20260309173450.538026-2-p@1g4.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "f441b489cc66fbc44d78b6c123e74283b8077431",
      "tree": "da1c4d168cc9d4d9cf642cded692e550aa7b03e7",
      "parents": [
        "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c"
      ],
      "author": {
        "name": "Daniel Golle",
        "email": "daniel@makrotopia.org",
        "time": "Tue Mar 10 00:41:56 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 10 19:18:13 2026 -0700"
      },
      "message": "net: dsa: mxl862xx: don\u0027t set user_mii_bus\n\nThe PHY addresses in the MII bus are not equal to the port addresses,\nso the bus cannot be assigned as user_mii_bus. Falling back on the\nuser_mii_bus in case a PHY isn\u0027t declared in device tree will result in\nusing the wrong (in this case: off-by-+1) PHY.\nRemove the wrong assignment.\n\nFixes: 23794bec1cb60 (\"net: dsa: add basic initial driver for MxL862xx switches\")\nSuggested-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nLink: https://patch.msgid.link/0f0df310fd8cab57e0e5e3d0831dd057fd05bcd5.1773103271.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c",
      "tree": "e3c1f3cce6350e85c1aef166888fd5e1cb2bdbfc",
      "parents": [
        "28b225282d44e2ef40e7f46cfdbd5d1b20b8874f"
      ],
      "author": {
        "name": "Fan Wu",
        "email": "fanwu01@zju.edu.cn",
        "time": "Mon Mar 09 13:24:09 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 10 19:05:12 2026 -0700"
      },
      "message": "net: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n\nNormal RX/TX interrupts are enabled later, in arc_emac_open(), so probe\nshould not see interrupt delivery in the usual case. However, hardware may\nstill present stale or latched interrupt status left by firmware or the\nbootloader.\n\nIf probe later unwinds after devm_request_irq() has installed the handler,\nsuch a stale interrupt can still reach arc_emac_intr() during teardown and\nrace with release of the associated net_device.\n\nAvoid that window by putting the device into a known quiescent state before\nrequesting the IRQ: disable all EMAC interrupt sources and clear any\npending EMAC interrupt status bits. This keeps the change hardware-focused\nand minimal, while preventing spurious IRQ delivery from leftover state.\n\nFixes: e4f2379db6c6 (\"ethernet/arc/arc_emac - Add new driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Fan Wu \u003cfanwu01@zju.edu.cn\u003e\nLink: https://patch.msgid.link/20260309132409.584966-1-fanwu01@zju.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "28b225282d44e2ef40e7f46cfdbd5d1b20b8874f",
      "tree": "b9e2f912c7986b48a2ca7489c17015a5320725db",
      "parents": [
        "881a0263d502e1a93ebc13a78254e9ad19520232"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Mar 09 17:39:07 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 10 19:03:34 2026 -0700"
      },
      "message": "page_pool: store detach_time as ktime_t to avoid false-negatives\n\nWhile testing other changes in vng I noticed that\nnl_netdev.page_pool_check flakes. This never happens in real CI.\n\nTurns out vng may boot and get to that test in less than a second.\npage_pool_detached() records the detach time in seconds, so if\nvng is fast enough detach time is set to 0. Other code treats\n0 as \"not detached\". detach_time is only used to report the state\nto the user, so it\u0027s not a huge deal in practice but let\u0027s fix it.\nStore the raw ktime_t (nanoseconds) instead. A nanosecond value\nof 0 is practically impossible.\n\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nFixes: 69cb4952b6f6 (\"net: page_pool: report when page pool was destroyed\")\nLink: https://patch.msgid.link/20260310003907.3540019-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "881a0263d502e1a93ebc13a78254e9ad19520232",
      "tree": "c41b36b8fecebea6171efb2e4c07e15def6ffaaa",
      "parents": [
        "73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d"
      ],
      "author": {
        "name": "Kevin Hao",
        "email": "haokexin@gmail.com",
        "time": "Sat Mar 07 15:08:54 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 10 17:36:44 2026 -0700"
      },
      "message": "net: macb: Shuffle the tx ring before enabling tx\n\nQuanyang observed that when using an NFS rootfs on an AMD ZynqMp board,\nthe rootfs may take an extended time to recover after a suspend.\nUpon investigation, it was determined that the issue originates from a\nproblem in the macb driver.\n\nAccording to the Zynq UltraScale TRM [1], when transmit is disabled,\nthe transmit buffer queue pointer resets to point to the address\nspecified by the transmit buffer queue base address register.\n\nIn the current implementation, the code merely resets `queue-\u003etx_head`\nand `queue-\u003etx_tail` to \u00270\u0027. This approach presents several issues:\n\n- Packets already queued in the tx ring are silently lost,\n  leading to memory leaks since the associated skbs cannot be released.\n\n- Concurrent write access to `queue-\u003etx_head` and `queue-\u003etx_tail` may\n  occur from `macb_tx_poll()` or `macb_start_xmit()` when these values\n  are reset to \u00270\u0027.\n\n- The transmission may become stuck on a packet that has already been sent\n  out, with its \u0027TX_USED\u0027 bit set, but has not yet been processed. However,\n  due to the manipulation of \u0027queue-\u003etx_head\u0027 and \u0027queue-\u003etx_tail\u0027,\n  `macb_tx_poll()` incorrectly assumes there are no packets to handle\n  because `queue-\u003etx_head \u003d\u003d queue-\u003etx_tail`. This issue is only resolved\n  when a new packet is placed at this position. This is the root cause of\n  the prolonged recovery time observed for the NFS root filesystem.\n\nTo resolve this issue, shuffle the tx ring and tx skb array so that\nthe first unsent packet is positioned at the start of the tx ring.\nAdditionally, ensure that updates to `queue-\u003etx_head` and\n`queue-\u003etx_tail` are properly protected with the appropriate lock.\n\n[1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm\n\nFixes: bf9cf80cab81 (\"net: macb: Fix tx/rx malfunction after phy link down and up\")\nReported-by: Quanyang Wang \u003cquanyang.wang@windriver.com\u003e\nSigned-off-by: Kevin Hao \u003chaokexin@gmail.com\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260307-zynqmp-v2-1-6ef98a70e1d0@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "85b731ad4bbf6eb3fedf267ab00be3596f148432",
      "tree": "039bf6220f7f729dcc99691968d878888f826216",
      "parents": [
        "e53c0e99fd93da200c413deb57875f9f5fdb314a"
      ],
      "author": {
        "name": "Alan Borzeszkowski",
        "email": "alan.borzeszkowski@linux.intel.com",
        "time": "Mon Mar 09 16:37:03 2026 +0100"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Mar 11 00:07:54 2026 +0000"
      },
      "message": "spi: intel-pci: Add support for Nova Lake mobile SPI flash\n\nAdd Intel Nova Lake PCD-H SPI serial flash PCI ID to the list of\nsupported devices.\n\nSigned-off-by: Alan Borzeszkowski \u003calan.borzeszkowski@linux.intel.com\u003e\nAcked-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260309153703.74282-1-alan.borzeszkowski@linux.intel.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "88d37abb366be95d772ceb4c7f26772e78447252",
      "tree": "f6efde7ee6a90bfa66ac68b55094bc2b336eb44d",
      "parents": [
        "d78840a6a38d312dc1a51a65317bb67e46f0b929"
      ],
      "author": {
        "name": "Ye Bin",
        "email": "yebin10@huawei.com",
        "time": "Tue Mar 10 21:08:47 2026 +0800"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Tue Mar 10 17:22:04 2026 -0500"
      },
      "message": "smb/client: only export symbol for \u0027smb2maperror-test\u0027 module\n\nOnly export smb2_get_err_map_test smb2_error_map_table_test and\nsmb2_error_map_num symbol for \u0027smb2maperror-test\u0027 module.\n\nFixes: 7d0bf050a587 (\"smb/client: make SMB2 maperror KUnit tests a separate module\")\nSigned-off-by: Ye Bin \u003cyebin10@huawei.com\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "d78840a6a38d312dc1a51a65317bb67e46f0b929",
      "tree": "3bdc32610f6df5ab6dec694f9a564e51729166e9",
      "parents": [
        "fae11330dc0642065568d6c0045322293fe59bc6"
      ],
      "author": {
        "name": "Bharath SM",
        "email": "bharathsm@microsoft.com",
        "time": "Mon Mar 09 16:00:49 2026 +0530"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Tue Mar 10 17:22:03 2026 -0500"
      },
      "message": "smb: client: fix in-place encryption corruption in SMB2_write()\n\nSMB2_write() places write payload in iov[1..n] as part of rq_iov.\nsmb3_init_transform_rq() pointer-shares rq_iov, so crypt_message()\nencrypts iov[1] in-place, replacing the original plaintext with\nciphertext. On a replayable error, the retry sends the same iov[1]\nwhich now contains ciphertext instead of the original data,\nresulting in corruption.\n\nThe corruption is most likely to be observed when connections are\nunstable, as reconnects trigger write retries that re-send the\nalready-encrypted data.\n\nThis affects SFU mknod, MF symlinks, etc. On kernels before\n6.10 (prior to the netfs conversion), sync writes also used\nthis path and were similarly affected. The async write path\nwasn\u0027t unaffected as it uses rq_iter which gets deep-copied.\n\nFix by moving the write payload into rq_iter via iov_iter_kvec(),\nso smb3_init_transform_rq() deep-copies it before encryption.\n\nCc: stable@vger.kernel.org #6.3+\nAcked-by: Henrique Carvalho \u003chenrique.carvalho@suse.com\u003e\nAcked-by: Shyam Prasad N \u003csprasad@microsoft.com\u003e\nAcked-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nSigned-off-by: Bharath SM \u003cbharathsm@microsoft.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "fae11330dc0642065568d6c0045322293fe59bc6",
      "tree": "c9d14021b1a5d6bbe07b252b3a0ce06b08b93f23",
      "parents": [
        "4a7d2729dc99437dbb880a64c47828c0d191b308"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Mar 06 16:07:13 2026 +0100"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Tue Mar 10 17:22:03 2026 -0500"
      },
      "message": "smb: client: fix sbflags initialization\n\nThe newly introduced variable is initialized in an #ifdef block\nbut used outside of it, leading to undefined behavior when\nCONFIG_CIFS_ALLOW_INSECURE_LEGACY is disabled:\n\nfs/smb/client/dir.c:417:9: error: variable \u0027sbflags\u0027 is uninitialized when used here [-Werror,-Wuninitialized]\n  417 |                                 if (sbflags \u0026 CIFS_MOUNT_DYNPERM)\n      |                                     ^~~~~~~\n\nMove the initialization into the declaration, the same way as the\nother similar function do it.\n\nFixes: 4fc3a433c139 (\"smb: client: use atomic_t for mnt_cifs_flags\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nReviewed-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "4a7d2729dc99437dbb880a64c47828c0d191b308",
      "tree": "a8d36e71b3217c384a24c5bcd0d353ba32c7be57",
      "parents": [
        "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681"
      ],
      "author": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Sat Mar 07 18:20:16 2026 -0300"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Tue Mar 10 17:21:42 2026 -0500"
      },
      "message": "smb: client: fix atomic open with O_DIRECT \u0026 O_SYNC\n\nWhen user application requests O_DIRECT|O_SYNC along with O_CREAT on\nopen(2), CREATE_NO_BUFFER and CREATE_WRITE_THROUGH bits were missed in\nCREATE request when performing an atomic open, thus leading to\npotentially data integrity issues.\n\nFix this by setting those missing bits in CREATE request when\nO_DIRECT|O_SYNC has been specified in cifs_do_create().\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Henrique Carvalho \u003chenrique.carvalho@suse.com\u003e\nCc: Tom Talpey \u003ctom@talpey.com\u003e\nCc: linux-cifs@vger.kernel.org\nCc: stable@vger.kernel.org\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "e94eaef11142b01f77bf8ba4d0b59720b7858109",
      "tree": "facc2b6a7fd72c512ae0dcfb30444a05ade8ac8e",
      "parents": [
        "e809085f492842ce7a519c9ef72d40f4bca89c13"
      ],
      "author": {
        "name": "Matt Vollrath",
        "email": "tactii@gmail.com",
        "time": "Tue Feb 24 18:28:33 2026 -0500"
      },
      "committer": {
        "name": "Tony Nguyen",
        "email": "anthony.l.nguyen@intel.com",
        "time": "Tue Mar 10 13:02:54 2026 -0700"
      },
      "message": "e1000/e1000e: Fix leak in DMA error cleanup\n\nIf an error is encountered while mapping TX buffers, the driver should\nunmap any buffers already mapped for that skb.\n\nBecause count is incremented after a successful mapping, it will always\nmatch the correct number of unmappings needed when dma_error is reached.\nDecrementing count before the while loop in dma_error causes an\noff-by-one error. If any mapping was successful before an unsuccessful\nmapping, exactly one DMA mapping would leak.\n\nIn these commits, a faulty while condition caused an infinite loop in\ndma_error:\nCommit 03b1320dfcee (\"e1000e: remove use of skb_dma_map from e1000e\ndriver\")\nCommit 602c0554d7b0 (\"e1000: remove use of skb_dma_map from e1000 driver\")\n\nCommit c1fa347f20f1 (\"e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of\nunsigned in *_tx_map()\") fixed the infinite loop, but introduced the\noff-by-one error.\n\nThis issue may still exist in the igbvf driver, but I did not address it\nin this patch.\n\nFixes: c1fa347f20f1 (\"e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()\")\nAssisted-by: Claude:claude-4.6-opus\nSigned-off-by: Matt Vollrath \u003ctactii@gmail.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n"
    },
    {
      "commit": "e809085f492842ce7a519c9ef72d40f4bca89c13",
      "tree": "2e1babb630c12f05929cec8875a00987ccb0cc5b",
      "parents": [
        "fdadbf6e84c44df8dbb85cfdd38bc10e4431501d"
      ],
      "author": {
        "name": "Alok Tiwari",
        "email": "alok.a.tiwari@oracle.com",
        "time": "Mon Nov 10 11:13:38 2025 -0800"
      },
      "committer": {
        "name": "Tony Nguyen",
        "email": "anthony.l.nguyen@intel.com",
        "time": "Tue Mar 10 13:02:45 2026 -0700"
      },
      "message": "i40e: fix src IP mask checks and memcpy argument names in cloud filter\n\nFix following issues in the IPv4 and IPv6 cloud filter handling logic in\nboth the add and delete paths:\n\n- The source-IP mask check incorrectly compares mask.src_ip[0] against\n  tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely\n  goes unnoticed because the check is in an \"else if\" path that only\n  executes when dst_ip is not set, most cloud filter use cases focus on\n  destination-IP matching, and the buggy condition can accidentally\n  evaluate true in some cases.\n\n- memcpy() for the IPv4 source address incorrectly uses\n  ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although\n  both arrays are the same size.\n\n- The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE\n  (tcf.src_ip), Update these to use sizeof(cfilter-\u003eip.v4.dst_ip) and\n  sizeof(cfilter-\u003eip.v4.src_ip) to ensure correct and explicit copy size.\n\n- In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing\n  dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent\n  explicit, even though both fields are struct in6_addr.\n\nFixes: e284fc280473 (\"i40e: Add and delete cloud filter\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n"
    },
    {
      "commit": "b4f0dd314b39ea154f62f3bd3115ed0470f9f71e",
      "tree": "b8eda2f2e4e59a84f9f6f0d220daa3f769e6ad85",
      "parents": [
        "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681",
        "b12bbe35c7c1e431f2fa01fe9291daa52fb7ab43"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Mar 10 12:47:56 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Mar 10 12:47:56 2026 -0700"
      },
      "message": "Merge tag \u0027mm-hotfixes-stable-2026-03-09-16-36\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"15 hotfixes. 6 are cc:stable. 14 are for MM.\n\n  Singletons, with one doubleton - please see the changelogs for details\"\n\n* tag \u0027mm-hotfixes-stable-2026-03-09-16-36\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n  MAINTAINERS, mailmap: update email address for Lorenzo Stoakes\n  mm/mmu_notifier: clean up mmu_notifier.h kernel-doc\n  uaccess: correct kernel-doc parameter format\n  mm/huge_memory: fix a folio_split() race condition with folio_try_get()\n  MAINTAINERS: add co-maintainer and reviewer for SLAB ALLOCATOR\n  MAINTAINERS: add RELAY entry\n  memcg: fix slab accounting in refill_obj_stock() trylock path\n  mm/hugetlb.c: use __pa() instead of virt_to_phys() in early bootmem alloc code\n  zram: rename writeback_compressed device attr\n  tools/testing: fix testing/vma and testing/radix-tree build\n  Revert \"ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()\"\n  mm/cma: move put_page_testzero() out of VM_WARN_ON in cma_release()\n  mm/damon/core: clear walk_control on inactive context in damos_walk()\n  mm: memfd_luo: always dirty all folios\n  mm: memfd_luo: always make all folios uptodate\n"
    },
    {
      "commit": "30e4b2290cc2a8d1b9ddb9dcb9c981df1f2a7399",
      "tree": "a2e5f74e5d0c20be9aa8a965fa6431cf9ddf7acf",
      "parents": [
        "4185b95f8a42d92d68c49289b4644546b51e252b"
      ],
      "author": {
        "name": "Peter Ujfalusi",
        "email": "peter.ujfalusi@linux.intel.com",
        "time": "Tue Mar 10 08:53:50 2026 +0200"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Tue Mar 10 19:32:56 2026 +0000"
      },
      "message": "ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put\n\nThe correct helper to use in rt1011_recv_spk_mode_put() to retrieve the\nDAPM context is snd_soc_component_to_dapm(), from kcontrol we will\nreceive NULL pointer.\n\nCloses: https://github.com/thesofproject/linux/issues/5691\nFixes: 5b35bb517f27 (\"ASoC: codecs: rt1011: convert to snd_soc_dapm_xxx()\")\nSigned-off-by: Peter Ujfalusi \u003cpeter.ujfalusi@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260310065350.18921-1-peter.ujfalusi@linux.intel.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "fdadbf6e84c44df8dbb85cfdd38bc10e4431501d",
      "tree": "012d0fb634a48208e20ebf65bdb4c872b71d9bbc",
      "parents": [
        "efc54fb13d79117a825fef17364315a58682c7ec"
      ],
      "author": {
        "name": "Petr Oros",
        "email": "poros@redhat.com",
        "time": "Wed Feb 11 20:18:55 2026 +0100"
      },
      "committer": {
        "name": "Tony Nguyen",
        "email": "anthony.l.nguyen@intel.com",
        "time": "Tue Mar 10 09:08:31 2026 -0700"
      },
      "message": "iavf: fix incorrect reset handling in callbacks\n\nThree driver callbacks schedule a reset and wait for its completion:\nndo_change_mtu(), ethtool set_ringparam(), and ethtool set_channels().\n\nWaiting for reset in ndo_change_mtu() and set_ringparam() was added by\ncommit c2ed2403f12c (\"iavf: Wait for reset in callbacks which trigger\nit\") to fix a race condition where adding an interface to bonding\nimmediately after MTU or ring parameter change failed because the\ninterface was still in __RESETTING state. The same commit also added\nwaiting in iavf_set_priv_flags(), which was later removed by commit\n53844673d555 (\"iavf: kill \"legacy-rx\" for good\").\n\nWaiting in set_channels() was introduced earlier by commit 4e5e6b5d9d13\n(\"iavf: Fix return of set the new channel count\") to ensure the PF has\nenough time to complete the VF reset when changing channel count, and to\nreturn correct error codes to userspace.\n\nCommit ef490bbb2267 (\"iavf: Add net_shaper_ops support\") added\nnet_shaper_ops to iavf, which required reset_task to use _locked NAPI\nvariants (napi_enable_locked, napi_disable_locked) that need the netdev\ninstance lock.\n\nLater, commit 7e4d784f5810 (\"net: hold netdev instance lock during\nrtnetlink operations\") and commit 2bcf4772e45a (\"net: ethtool: try to\nprotect all callback with netdev instance lock\") started holding the\nnetdev instance lock during ndo and ethtool callbacks for drivers with\nnet_shaper_ops.\n\nFinally, commit 120f28a6f314 (\"iavf: get rid of the crit lock\")\nreplaced the driver\u0027s crit_lock with netdev_lock in reset_task, causing\nincorrect behavior: the callback holds netdev_lock and waits for\nreset_task, but reset_task needs the same lock:\n\n  Thread 1 (callback)               Thread 2 (reset_task)\n  -------------------               ---------------------\n  netdev_lock()                     [blocked on workqueue]\n  ndo_change_mtu() or ethtool op\n    iavf_schedule_reset()\n    iavf_wait_for_reset()           iavf_reset_task()\n      waiting...                      netdev_lock() \u003c- blocked\n\nThis does not strictly deadlock because iavf_wait_for_reset() uses\nwait_event_interruptible_timeout() with a 5-second timeout. The wait\neventually times out, the callback returns an error to userspace, and\nafter the lock is released reset_task completes the reset. This leads to\nincorrect behavior: userspace sees an error even though the configuration\nchange silently takes effect after the timeout.\n\nFix this by extracting the reset logic from iavf_reset_task() into a new\niavf_reset_step() function that expects netdev_lock to be already held.\nThe three callbacks now call iavf_reset_step() directly instead of\nscheduling the work and waiting, performing the reset synchronously in\nthe caller\u0027s context which already holds netdev_lock. This eliminates\nboth the incorrect error reporting and the need for\niavf_wait_for_reset(), which is removed along with the now-unused\nreset_waitqueue.\n\nThe workqueue-based iavf_reset_task() becomes a thin wrapper that\nacquires netdev_lock and calls iavf_reset_step(), preserving its use\nfor PF-initiated resets.\n\nThe callbacks may block for several seconds while iavf_reset_step()\npolls hardware registers, but this is acceptable since netdev_lock is a\nper-device mutex and only serializes operations on the same interface.\n\nv3:\n- Remove netif_running() guard from iavf_set_channels(). Unlike\n  set_ringparam where descriptor counts are picked up by iavf_open()\n  directly, num_req_queues is only consumed during\n  iavf_reinit_interrupt_scheme() in the reset path. Skipping the reset\n  on a down device would silently discard the channel count change.\n- Remove dead reset_waitqueue code (struct field, init, and all\n  wake_up calls) since iavf_wait_for_reset() was the only consumer.\n\nFixes: 120f28a6f314 (\"iavf: get rid of the crit lock\")\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n"
    },
    {
      "commit": "efc54fb13d79117a825fef17364315a58682c7ec",
      "tree": "aa0e9a81d3d8f0e35c80498fdcc8eebd5fc1bcea",
      "parents": [
        "bd98c6204d1195973b1760fe45860863deb6200c"
      ],
      "author": {
        "name": "Petr Oros",
        "email": "poros@redhat.com",
        "time": "Thu Jan 29 10:57:23 2026 +0100"
      },
      "committer": {
        "name": "Tony Nguyen",
        "email": "anthony.l.nguyen@intel.com",
        "time": "Tue Mar 10 09:08:31 2026 -0700"
      },
      "message": "iavf: fix PTP use-after-free during reset\n\nCommit 7c01dbfc8a1c5f (\"iavf: periodically cache PHC time\") introduced a\nworker to cache PHC time, but failed to stop it during reset or disable.\n\nThis creates a race condition where `iavf_reset_task()` or\n`iavf_disable_vf()` free adapter resources (AQ) while the worker is still\nrunning. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it\naccesses freed memory/locks, leading to a crash.\n\nFix this by calling `iavf_ptp_release()` before tearing down the adapter.\nThis ensures `ptp_clock_unregister()` synchronously cancels the worker and\ncleans up the chardev before the backing resources are destroyed.\n\nFixes: 7c01dbfc8a1c5f (\"iavf: periodically cache PHC time\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nAcked-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n"
    },
    {
      "commit": "bd98c6204d1195973b1760fe45860863deb6200c",
      "tree": "b7cd6c596801b94789327c143c18d6ae2539f48c",
      "parents": [
        "73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d"
      ],
      "author": {
        "name": "Nikolay Aleksandrov",
        "email": "nikolay@nvidia.com",
        "time": "Fri Feb 13 10:48:41 2026 +0200"
      },
      "committer": {
        "name": "Tony Nguyen",
        "email": "anthony.l.nguyen@intel.com",
        "time": "Tue Mar 10 09:08:31 2026 -0700"
      },
      "message": "drivers: net: ice: fix devlink parameters get without irdma\n\nIf CONFIG_IRDMA isn\u0027t enabled but there are ice NICs in the system, the\ndriver will prevent full devlink dev param show dump because its rdma get\ncallbacks return ENODEV and stop the dump. For example:\n $ devlink dev param show\n pci/0000:82:00.0:\n   name msix_vec_per_pf_max type generic\n     values:\n       cmode driverinit value 2\n   name msix_vec_per_pf_min type generic\n     values:\n       cmode driverinit value 2\n kernel answers: No such device\n\nReturning EOPNOTSUPP allows the dump to continue so we can see all devices\u0027\ndevlink parameters.\n\nFixes: c24a65b6a27c (\"iidc/ice/irdma: Update IDC to support multiple consumers\")\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@nvidia.com\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n"
    },
    {
      "commit": "fa655a9ca73f7df32b8ca4d14ce11742f9578288",
      "tree": "c41a10b87d1870a2d82bb2490c82cf20953ed132",
      "parents": [
        "0375c81eb2256366cd9602441d48b8b937e79635"
      ],
      "author": {
        "name": "Thorsten Blum",
        "email": "thorsten.blum@linux.dev",
        "time": "Tue Mar 03 22:31:01 2026 +0100"
      },
      "committer": {
        "name": "Keith Busch",
        "email": "kbusch@kernel.org",
        "time": "Tue Mar 10 08:20:29 2026 -0700"
      },
      "message": "nvme: Annotate struct nvme_dhchap_key with __counted_by\n\nAdd the __counted_by() compiler attribute to the flexible array member\n\u0027key\u0027 to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and\nCONFIG_FORTIFY_SOURCE.\n\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n"
    },
    {
      "commit": "0375c81eb2256366cd9602441d48b8b937e79635",
      "tree": "0eaa80e675403dd15d6facb598659ea406e8319e",
      "parents": [
        "fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e"
      ],
      "author": {
        "name": "Maurizio Lombardi",
        "email": "mlombard@redhat.com",
        "time": "Fri Feb 20 14:30:16 2026 +0100"
      },
      "committer": {
        "name": "Keith Busch",
        "email": "kbusch@kernel.org",
        "time": "Tue Mar 10 08:20:29 2026 -0700"
      },
      "message": "nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue()\n\nIn nvme_alloc_admin_tag_set(), an empty queue_limits struct is\ncurrently allocated on the stack and passed by reference to\nblk_mq_alloc_queue().\n\nThis is redundant because blk_mq_alloc_queue() already handles\na NULL limits pointer by internally substituting it with a default\nempty queue_limits struct.\nRemove the unnecessary local variable and pass a NULL value.\n\nReviewed-by: Kanchan Joshi \u003cjoshi.k@samsung.com\u003e\nSigned-off-by: Maurizio Lombardi \u003cmlombard@redhat.com\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n"
    },
    {
      "commit": "fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e",
      "tree": "7666404a7d7bfaa77cd40d12608e5639cad9e64c",
      "parents": [
        "2922e3507f6d5caa7f1d07f145e186fc6f317a4e"
      ],
      "author": {
        "name": "Sungwoo Kim",
        "email": "iam@sung-woo.kim",
        "time": "Sat Mar 07 14:46:36 2026 -0500"
      },
      "committer": {
        "name": "Keith Busch",
        "email": "kbusch@kernel.org",
        "time": "Tue Mar 10 08:20:29 2026 -0700"
      },
      "message": "nvme-pci: Fix race bug in nvme_poll_irqdisable()\n\nIn the following scenario, pdev can be disabled between (1) and (3) by\n(2). This sets pdev-\u003emsix_enabled \u003d 0. Then, pci_irq_vector() will\nreturn MSI-X IRQ(\u003e15) for (1) whereas return INTx IRQ(\u003c\u003d15) for (2).\nThis causes IRQ warning because it tries to enable INTx IRQ that has\nnever been disabled before.\n\nTo fix this, save IRQ number into a local variable and ensure\ndisable_irq() and enable_irq() operate on the same IRQ number.  Even if\npci_free_irq_vectors() frees the IRQ concurrently, disable_irq() and\nenable_irq() on a stale IRQ number is still valid and safe, and the\ndepth accounting reamins balanced.\n\ntask 1:\nnvme_poll_irqdisable()\n  disable_irq(pci_irq_vector(pdev, nvmeq-\u003ecq_vector)) ...(1)\n  enable_irq(pci_irq_vector(pdev, nvmeq-\u003ecq_vector))  ...(3)\n\ntask 2:\nnvme_reset_work()\n  nvme_dev_disable()\n    pdev-\u003emsix_enable \u003d 0;  ...(2)\n\ncrash log:\n\n------------[ cut here ]------------\nUnbalanced enable for IRQ 10\nWARNING: kernel/irq/manage.c:753 at __enable_irq+0x102/0x190 kernel/irq/manage.c:753, CPU#1: kworker/1:0H/26\nModules linked in:\nCPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted 6.19.0-dirty #9 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: kblockd blk_mq_timeout_work\nRIP: 0010:__enable_irq+0x107/0x190 kernel/irq/manage.c:753\nCode: ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 79 48 8d 3d 2e 7a 3f 05 41 8b 74 24 2c \u003c67\u003e 48 0f b9 3a e8 ef b9 21 00 5b 41 5c 5d e9 46 54 66 03 e8 e1 b9\nRSP: 0018:ffffc900001bf550 EFLAGS: 00010046\nRAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffffb20c0e90\nRDX: 0000000000000000 RSI: 000000000000000a RDI: ffffffffb74b88f0\nRBP: ffffc900001bf560 R08: ffff88800197cf00 R09: 0000000000000001\nR10: 0000000000000003 R11: 0000000000000003 R12: ffff8880012a6000\nR13: 1ffff92000037eae R14: 000000000000000a R15: 0000000000000293\nFS:  0000000000000000(0000) GS:ffff8880b49f7000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000555da4a25fa8 CR3: 00000000208e8000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n enable_irq+0x121/0x1e0 kernel/irq/manage.c:797\n nvme_poll_irqdisable+0x162/0x1c0 drivers/nvme/host/pci.c:1494\n nvme_timeout+0x965/0x14b0 drivers/nvme/host/pci.c:1744\n blk_mq_rq_timed_out block/blk-mq.c:1653 [inline]\n blk_mq_handle_expired+0x227/0x2d0 block/blk-mq.c:1721\n bt_iter+0x2fc/0x3a0 block/blk-mq-tag.c:292\n __sbitmap_for_each_set include/linux/sbitmap.h:269 [inline]\n sbitmap_for_each_set include/linux/sbitmap.h:290 [inline]\n bt_for_each block/blk-mq-tag.c:324 [inline]\n blk_mq_queue_tag_busy_iter+0x969/0x1e80 block/blk-mq-tag.c:536\n blk_mq_timeout_work+0x627/0x870 block/blk-mq.c:1763\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n \u003c/TASK\u003e\nirq event stamp: 74478\nhardirqs last  enabled at (74477): [\u003cffffffffb5720a9c\u003e] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]\nhardirqs last  enabled at (74477): [\u003cffffffffb5720a9c\u003e] _raw_spin_unlock_irq+0x2c/0x60 kernel/locking/spinlock.c:202\nhardirqs last disabled at (74478): [\u003cffffffffb57207b5\u003e] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]\nhardirqs last disabled at (74478): [\u003cffffffffb57207b5\u003e] _raw_spin_lock_irqsave+0x85/0xa0 kernel/locking/spinlock.c:162\nsoftirqs last  enabled at (74304): [\u003cffffffffb1e9466c\u003e] __do_softirq kernel/softirq.c:656 [inline]\nsoftirqs last  enabled at (74304): [\u003cffffffffb1e9466c\u003e] invoke_softirq kernel/softirq.c:496 [inline]\nsoftirqs last  enabled at (74304): [\u003cffffffffb1e9466c\u003e] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723\nsoftirqs last disabled at (74287): [\u003cffffffffb1e9466c\u003e] __do_softirq kernel/softirq.c:656 [inline]\nsoftirqs last disabled at (74287): [\u003cffffffffb1e9466c\u003e] invoke_softirq kernel/softirq.c:496 [inline]\nsoftirqs last disabled at (74287): [\u003cffffffffb1e9466c\u003e] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723\n---[ end trace 0000000000000000 ]---\n\nFixes: fa059b856a59 (nvme-pci: Simplify nvme_poll_irqdisable)\nAcked-by: Chao Shi \u003ccshi008@fiu.edu\u003e\nAcked-by: Weidong Zhu \u003cweizhu@fiu.edu\u003e\nAcked-by: Dave Tian \u003cdaveti@purdue.edu\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Sungwoo Kim \u003ciam@sung-woo.kim\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n"
    },
    {
      "commit": "2922e3507f6d5caa7f1d07f145e186fc6f317a4e",
      "tree": "881cbbd99fc94359f79c1698bf2bc85219646042",
      "parents": [
        "b4e78f1427c7d6859229ae9616df54e1fc05a516"
      ],
      "author": {
        "name": "Chaitanya Kulkarni",
        "email": "kch@nvidia.com",
        "time": "Wed Feb 25 20:30:03 2026 -0800"
      },
      "committer": {
        "name": "Keith Busch",
        "email": "kbusch@kernel.org",
        "time": "Tue Mar 10 08:20:28 2026 -0700"
      },
      "message": "nvmet: move async event work off nvmet-wq\n\nFor target nvmet_ctrl_free() flushes ctrl-\u003easync_event_work.\nIf nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue\ncompletion for the same worker:-\n\nA. Async event work queued on nvmet-wq (prior to disconnect):\n  nvmet_execute_async_event()\n     queue_work(nvmet_wq, \u0026ctrl-\u003easync_event_work)\n\n  nvmet_add_async_event()\n     queue_work(nvmet_wq, \u0026ctrl-\u003easync_event_work)\n\nB. Full pre-work chain (RDMA CM path):\n  nvmet_rdma_cm_handler()\n     nvmet_rdma_queue_disconnect()\n       __nvmet_rdma_queue_disconnect()\n         queue_work(nvmet_wq, \u0026queue-\u003erelease_work)\n           process_one_work()\n             lock((wq_completion)nvmet-wq)  \u003c--------- 1st\n             nvmet_rdma_release_queue_work()\n\nC. Recursive path (same worker):\n  nvmet_rdma_release_queue_work()\n     nvmet_rdma_free_queue()\n       nvmet_sq_destroy()\n         nvmet_ctrl_put()\n           nvmet_ctrl_free()\n             flush_work(\u0026ctrl-\u003easync_event_work)\n               __flush_work()\n                 touch_wq_lockdep_map()\n                 lock((wq_completion)nvmet-wq) \u003c--------- 2nd\n\nLockdep splat:\n\n  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n  WARNING: possible recursive locking detected\n  6.19.0-rc3nvme+ #14 Tainted: G                 N\n  --------------------------------------------\n  kworker/u192:42/44933 is trying to acquire lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n\n  but task is already holding lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n\n  3 locks held by kworker/u192:42/44933:\n   #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n   #1: ffffc9000e6cbe28 ((work_completion)(\u0026queue-\u003erelease_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660\n   #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530\n\n  Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]\n  Call Trace:\n   __flush_work+0x268/0x530\n   nvmet_ctrl_free+0x140/0x310 [nvmet]\n   nvmet_cq_put+0x74/0x90 [nvmet]\n   nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]\n   nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]\n   process_one_work+0x206/0x660\n   worker_thread+0x184/0x320\n   kthread+0x10c/0x240\n   ret_from_fork+0x319/0x390\n\nMove async event work to a dedicated nvmet-aen-wq to avoid reentrant\nflush on nvmet-wq.\n\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Chaitanya Kulkarni \u003ckch@nvidia.com\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n"
    },
    {
      "commit": "b4e78f1427c7d6859229ae9616df54e1fc05a516",
      "tree": "94d041fd280997592d6b07db1b806ec44b15f3b3",
      "parents": [
        "155a3bedccaf57c69aa0b590ba3fb579debf3a4d"
      ],
      "author": {
        "name": "Sungwoo Kim",
        "email": "iam@sung-woo.kim",
        "time": "Sun Mar 08 14:20:59 2026 -0400"
      },
      "committer": {
        "name": "Keith Busch",
        "email": "kbusch@kernel.org",
        "time": "Tue Mar 10 08:19:53 2026 -0700"
      },
      "message": "nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set\n\ndev-\u003eonline_queues is a count incremented in nvme_init_queue. Thus,\nvalid indices are 0 through dev-\u003eonline_queues − 1.\n\nThis patch fixes the loop condition to ensure the index stays within the\nvalid range. Index 0 is excluded because it is the admin queue.\n\nKASAN splat:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\nRead of size 2 at addr ffff88800592a574 by task kworker/u8:5/74\n\nCPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: nvme-reset-wq nvme_reset_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x5d0 mm/kasan/report.c:482\n kasan_report+0xdc/0x110 mm/kasan/report.c:595\n __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379\n nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\n nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\n nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n \u003c/TASK\u003e\n\nAllocated by task 34 on cpu 1 at 4.241550s:\n kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57\n kasan_save_track+0x1c/0x70 mm/kasan/common.c:78\n kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5657 [inline]\n __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663\n kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]\n nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]\n nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534\n local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324\n pci_call_probe drivers/pci/pci-driver.c:392 [inline]\n __pci_device_probe drivers/pci/pci-driver.c:417 [inline]\n pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451\n call_driver_probe drivers/base/dd.c:583 [inline]\n really_probe+0x29b/0xb70 drivers/base/dd.c:661\n __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803\n driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833\n __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159\n async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n\nThe buggy address belongs to the object at ffff88800592a000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 244 bytes to the right of\n allocated 1152-byte region [ffff88800592a000, ffff88800592a480)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928\nhead: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nanon flags: 0xfffffc0000040(head|node\u003d0|zone\u003d1|lastcpupid\u003d0x1fffff)\npage_type: f5(slab)\nraw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001\nraw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000\nhead: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001\nhead: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000\nhead: 000fffffc0000003 ffffea0000164a01 00000000ffffffff 00000000ffffffff\nhead: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff88800592a400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff88800592a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003effff88800592a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                                                             ^\n ffff88800592a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88800592a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: 0f0d2c876c96 (nvme: free sq/cq dbbuf pointers when dbbuf set fails)\nAcked-by: Chao Shi \u003ccshi008@fiu.edu\u003e\nAcked-by: Weidong Zhu \u003cweizhu@fiu.edu\u003e\nAcked-by: Dave Tian \u003cdaveti@purdue.edu\u003e\nSigned-off-by: Sungwoo Kim \u003ciam@sung-woo.kim\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n"
    },
    {
      "commit": "52a8a1ba883defbfe3200baa22cf4cd21985d51a",
      "tree": "e3893c9c632b0272333be752effac605c23580ef",
      "parents": [
        "186ac39b8a7d3ec7ce9c5dd45e5c2730177f375c"
      ],
      "author": {
        "name": "Darrick J. Wong",
        "email": "djwong@kernel.org",
        "time": "Wed Mar 04 20:26:20 2026 -0800"
      },
      "committer": {
        "name": "Carlos Maiolino",
        "email": "cem@kernel.org",
        "time": "Tue Mar 10 16:19:31 2026 +0100"
      },
      "message": "xfs: fix undersized l_iclog_roundoff values\n\nIf the superblock doesn\u0027t list a log stripe unit, we set the incore log\nroundoff value to 512.  This leads to corrupt logs and unmountable\nfilesystems in generic/617 on a disk with 4k physical sectors...\n\nXFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c\nXFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197.\nXFS (sda1): failed to locate log tail\nXFS (sda1): log mount/recovery failed: error -74\nXFS (sda1): log mount failed\nXFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c\nXFS (sda1): Ending clean mount\n\n...on the current xfsprogs for-next which has a broken mkfs.  xfs_info\nshows this...\n\nmeta-data\u003d/dev/sda1              isize\u003d512    agcount\u003d4, agsize\u003d644992 blks\n         \u003d                       sectsz\u003d4096  attr\u003d2, projid32bit\u003d1\n         \u003d                       crc\u003d1        finobt\u003d1, sparse\u003d1, rmapbt\u003d1\n         \u003d                       reflink\u003d1    bigtime\u003d1 inobtcount\u003d1 nrext64\u003d1\n         \u003d                       exchange\u003d1   metadir\u003d1\ndata     \u003d                       bsize\u003d4096   blocks\u003d2579968, imaxpct\u003d25\n         \u003d                       sunit\u003d0      swidth\u003d0 blks\nnaming   \u003dversion 2              bsize\u003d4096   ascii-ci\u003d0, ftype\u003d1, parent\u003d1\nlog      \u003dinternal log           bsize\u003d4096   blocks\u003d16384, version\u003d2\n         \u003d                       sectsz\u003d4096  sunit\u003d0 blks, lazy-count\u003d1\nrealtime \u003dnone                   extsz\u003d4096   blocks\u003d0, rtextents\u003d0\n         \u003d                       rgcount\u003d0    rgsize\u003d268435456 extents\n         \u003d                       zoned\u003d0      start\u003d0 reserved\u003d0\n\n...observe that the log section has sectsz\u003d4096 sunit\u003d0, which means\nthat the roundoff factor is 512, not 4096 as you\u0027d expect.  We should\nfix mkfs not to generate broken filesystems, but anyone can fuzz the\nondisk superblock so we should be more cautious.  I think the inadequate\nlogic predates commit a6a65fef5ef8d0, but that\u0027s clearly going to\nrequire a different backport.\n\nCc: stable@vger.kernel.org # v5.14\nFixes: a6a65fef5ef8d0 (\"xfs: log stripe roundoff is a property of the log\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n"
    },
    {
      "commit": "d557640e4ce589a24dca5ca7ce3b9680f471325f",
      "tree": "8f5f170843815a83aefba3b33b0437946e42bcd6",
      "parents": [
        "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Sat Mar 07 17:12:05 2026 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Tue Mar 10 16:03:02 2026 +0100"
      },
      "message": "sched: idle: Make skipping governor callbacks more consistent\n\nIf the cpuidle governor .select() callback is skipped because there\nis only one idle state in the cpuidle driver, the .reflect() callback\nshould be skipped as well, at least for consistency (if not for\ncorrectness), so do it.\n\nFixes: e5c9ffc6ae1b (\"cpuidle: Skip governor when only one idle state is available\")\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nReviewed-by: Christian Loehle \u003cchristian.loehle@arm.com\u003e\nReviewed-by: Aboorva Devarajan \u003caboorvad@linux.ibm.com\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nLink: https://patch.msgid.link/12857700.O9o76ZdvQC@rafael.j.wysocki\n"
    },
    {
      "commit": "4c527c7e030672efd788d0806d7a68972a7ba3c1",
      "tree": "860099f97cd591c539603402d9d9e26c5cf0f736",
      "parents": [
        "40e9cd4ae8ec43b107ed2bff422a8fa39dcf4e4b"
      ],
      "author": {
        "name": "Stefan Haberland",
        "email": "sth@linux.ibm.com",
        "time": "Tue Mar 10 15:23:30 2026 +0100"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Tue Mar 10 08:58:38 2026 -0600"
      },
      "message": "s390/dasd: Copy detected format information to secondary device\n\nDuring online processing for a DASD device an IO operation is started to\ndetermine the format of the device. CDL format contains specifically\nsized blocks at the beginning of the disk.\n\nFor a PPRC secondary device no real IO operation is possible therefore\nthis IO request can not be started and this step is skipped for online\nprocessing of secondary devices. This is generally fine since the\nsecondary is a copy of the primary device.\n\nIn case of an additional partition detection that is run after a swap\noperation the format information is needed to properly drive partition\ndetection IO.\n\nCurrently the information is not passed leading to IO errors during\npartition detection and a wrongly detected partition table which in turn\nmight lead to data corruption on the disk with the wrong partition table.\n\nFix by passing the format information from primary to secondary device.\n\nFixes: 413862caad6f (\"s390/dasd: add copy pair swap capability\")\nCc: stable@vger.kernel.org #6.1\nReviewed-by: Jan Hoeppner \u003choeppner@linux.ibm.com\u003e\nAcked-by: Eduard Shishkin \u003cedward6@linux.ibm.com\u003e\nSigned-off-by: Stefan Haberland \u003csth@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260310142330.4080106-3-sth@linux.ibm.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "40e9cd4ae8ec43b107ed2bff422a8fa39dcf4e4b",
      "tree": "d1f536aefdfa988eb9669e0a90bda925246267bd",
      "parents": [
        "155a3bedccaf57c69aa0b590ba3fb579debf3a4d"
      ],
      "author": {
        "name": "Stefan Haberland",
        "email": "sth@linux.ibm.com",
        "time": "Tue Mar 10 15:23:29 2026 +0100"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Tue Mar 10 08:58:38 2026 -0600"
      },
      "message": "s390/dasd: Move quiesce state with pprc swap\n\nQuiesce and resume is a mechanism to suspend operations on DASD devices.\nIn the context of a controlled copy pair swap operation, the quiesce\noperation is usually issued before the actual swap and a resume\nafterwards.\n\nDuring the swap operation, the underlying device is exchanged. Therefore,\nthe quiesce flag must be moved to the secondary device to ensure a\nconsistent quiesce state after the swap.\n\nThe secondary device itself cannot be suspended separately because there\nis no separate block device representation for it.\n\nFixes: 413862caad6f (\"s390/dasd: add copy pair swap capability\")\nCc: stable@vger.kernel.org #6.1\nReviewed-by: Jan Hoeppner \u003choeppner@linux.ibm.com\u003e\nSigned-off-by: Stefan Haberland \u003csth@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260310142330.4080106-2-sth@linux.ibm.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "21b3fb7dc19caa488d285e3c47999f7f1a179334",
      "tree": "4faea239bb57bb0687f1ea25a709e781dfddf614",
      "parents": [
        "5d0efaf47ee90ac60efae790acee3a3ed99ebf80"
      ],
      "author": {
        "name": "Peng Fan",
        "email": "peng.fan@nxp.com",
        "time": "Tue Mar 10 12:25:53 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Tue Mar 10 14:52:42 2026 +0000"
      },
      "message": "regulator: pca9450: Correct probed name for PCA9452\n\nAn incorrect device name was logged for PCA9452 because the dev_info()\nternary omitted PCA9452 and fell through to \"pca9450bc\". Introduce a\ntype_name and set it per device type so the probed message matches the\nactual PMIC. While here, make the PCA9451A case explicit.\n\nNo functional changes.\n\nFixes: 017b76fb8e5b6 (\"regulator: pca9450: Add PMIC pca9452 support\")\nSigned-off-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nLink: https://patch.msgid.link/20260310-pca9450-irq-v1-2-36adf52c2c55@nxp.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "5d0efaf47ee90ac60efae790acee3a3ed99ebf80",
      "tree": "de1db39ecb37acae9545e2c74e7dc59dfd429888",
      "parents": [
        "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681"
      ],
      "author": {
        "name": "Peng Fan",
        "email": "peng.fan@nxp.com",
        "time": "Tue Mar 10 12:25:52 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Tue Mar 10 14:52:42 2026 +0000"
      },
      "message": "regulator: pca9450: Correct interrupt type\n\nKernel warning on i.MX8MP-EVK when doing module test:\nirq: type mismatch, failed to map hwirq-3 for gpio@30200000!\n\nPer PCA945[X] specification: The IRQ_B pin is pulled low when any unmasked\ninterrupt bit status is changed and it is released high once application\nprocessor read INT1 register.\n\nSo the interrupt should be configured as IRQF_TRIGGER_LOW, not\nIRQF_TRIGGER_FALLING.\n\nFixes: 0935ff5f1f0a4 (\"regulator: pca9450: add pca9450 pmic driver\")\nSigned-off-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nLink: https://patch.msgid.link/20260310-pca9450-irq-v1-1-36adf52c2c55@nxp.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "e53c0e99fd93da200c413deb57875f9f5fdb314a",
      "tree": "cca54e75206bd75073dac9cbb6c49f568675cd17",
      "parents": [
        "111e2863372c322e836e0c896f6dd9cf4ee08c71"
      ],
      "author": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Sat Mar 07 09:50:35 2026 +0000"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Tue Mar 10 14:32:38 2026 +0000"
      },
      "message": "spi: cadence-qspi: Fix requesting of APB and AHB clocks on JH7110\n\nThe move of the AHB and APB clocks from a JH7110 specific quirk to the\nmain clock init dropped the specification of the clock names to request\nfor the AHB and APB clocks, resulting in the clock framework requesting\na clock with a NULL name three times.  On most platforms where the\nclocks are physically the same or some are always on this makes no\ndifference but the reason we had the specific quirk for JH7110 is that\nit does actually have separate, controllable clocks.  Update the new\ncode to request the AHB and APB clocks by name to restore the original\nbehaviour on JH7110.\n\nFixes: 324ecc7788c2 (\"spi: cadence-qspi: Kill cqspi_jh7110_clk_init\")\nReported-by: Ron Economos \u003cre@w6rz.net\u003e\nCloses: https://lore.kernel.org/r/a3ca5e9b-7446-497e-8df2-7ef2b42a02e9@w6rz.net\nTested-by: Ron Economos \u003cre@w6rz.net\u003e\nLink: https://patch.msgid.link/20260307-spi-cadence-qspi-fix-jh7110-v1-1-c9f37b8c58b1@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nLink: https://patch.msgid.link/20260307-spi-cadence-qspi-fix-jh7110-v1-1-c9f37b8c58b1@kernel.org\n"
    },
    {
      "commit": "73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d",
      "tree": "b717727f76315700db5acabe7910161ff039f147",
      "parents": [
        "6f1a9140ecda3baba3d945b9a6155af4268aafc4",
        "47bba09b14fa21712398febf36cb14fd4fc3bded"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 15:13:55 2026 +0100"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 15:13:55 2026 +0100"
      },
      "message": "Merge tag \u0027linux-can-fixes-for-7.0-20260310\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2026-03-10\n\nthis is a pull request of 2 patches for net/main.\n\nHaibo Chen\u0027s patch fixes the maximum allowed bit rate error, which was\nbroken in v6.19.\n\nWenyuan Li contributes a patch for the hi311x driver that adds missing\nerror checking in the caller of the hi3110_power_enable() function,\nhi3110_open().\n\nlinux-can-fixes-for-7.0-20260310\n\n* tag \u0027linux-can-fixes-for-7.0-20260310\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n  can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value\n  can: dev: keep the max bitrate error at 5%\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260310103547.2299403-1-mkl@pengutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "6ab3532b4c98f4e51969f0e5f3fc919c535f3ce1",
      "tree": "a925dd40a1c89be2418755022bc77d9c93208772",
      "parents": [
        "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Mon Mar 09 21:54:17 2026 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Tue Mar 10 15:08:21 2026 +0100"
      },
      "message": "ACPI: video: Switch over to auxiliary bus type\n\nCommit 02c057ddefef (\"ACPI: video: Convert the driver to a platform one\")\nswitched over the ACPI video bus driver from an ACPI driver to a platform\ndriver, but that change introduced an unwanted and unexpected side effect.\nNamely, on some systems, the ACPI device object of the ACPI video bus\ndevice is an ACPI companion of multiple platform devices and, after\nadding video_device_ids[] as an acpi_match_table to the acpi_video_bus\nplatform driver, all of those devices started to match that driver and\nits probe callback is invoked for all of them (it fails, but it leaves\na confusing message in the log).  Moreover, the MODULE_DEVICE_TABLE()\nof the ACPI video driver module matches all of the devices sharing the\nACPI companion with the ACPI video bus device.\n\nTo address this, make the core ACPI device enumeration code create an\nauxiliary device for the ACPI video bus device object instead of a\nplatform device and switch over the ACPI video bus driver (once more)\nto an auxiliary driver.\n\nAuxiliary driver generally is a better match for ACPI video bus than\nplatform driver, among other things because the ACPI video bus device\ndoes not require any resources to be allocated for it during\nenumeration.  It also allows the ACPI video bus driver to stop abusing\ndevice matching based on ACPI device IDs and it allows a special case\nto be dropped from acpi_create_platform_device() because that function\nneed not worry about the ACPI video bus device any more.\n\nFixes: 02c057ddefef (\"ACPI: video: Convert the driver to a platform one\")\nReported-by: Pratap Nirujogi \u003cpratap.nirujogi@amd.com\u003e\nCloses: https://lore.kernel.org/linux-acpi/007e3390-6b2b-457e-83c7-c794c5952018@amd.com/\nTested-by: Pratap Nirujogi \u003cpratap.nirujogi@amd.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\n[ rjw: Added AUXILIARY_BUS selection to CONFIG_ACPI to fix build issue ]\n[ rjw: Fixed error path in acpi_create_video_bus_device() ]\nLink: https://patch.msgid.link/5986516.DvuYhMxLoT@rafael.j.wysocki\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n"
    },
    {
      "commit": "329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf",
      "tree": "de73cfae04359fba41bbb3f04e17969986b9a781",
      "parents": [
        "6dcee8496d53165b2d8a5909b3050b62ae71fe89"
      ],
      "author": {
        "name": "Yuan Tan",
        "email": "tanyuan98@outlook.com",
        "time": "Mon Mar 09 03:41:46 2026 -0700"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 10 14:10:43 2026 +0100"
      },
      "message": "netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels\n\nIDLETIMER revision 0 rules reuse existing timers by label and always call\nmod_timer() on timer-\u003etimer.\n\nIf the label was created first by revision 1 with XT_IDLETIMER_ALARM,\nthe object uses alarm timer semantics and timer-\u003etimer is never initialized.\nReusing that object from revision 0 causes mod_timer() on an uninitialized\ntimer_list, triggering debugobjects warnings and possible panic when\npanic_on_warn\u003d1.\n\nFix this by rejecting revision 0 rule insertion when an existing timer with\nthe same label is of ALARM type.\n\nFixes: 68983a354a65 (\"netfilter: xtables: Add snapshot of hardidletimer target\")\nCo-developed-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nSigned-off-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nCo-developed-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nSigned-off-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003ctanyuan98@outlook.com\u003e\nSigned-off-by: Xin Liu \u003cdstsmallbird@foxmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "6dcee8496d53165b2d8a5909b3050b62ae71fe89",
      "tree": "155ce8e2886bc797e5c4d22823e48c4217b5d2ce",
      "parents": [
        "f1ba83755d81c6fc66ac7acd723d238f974091e9"
      ],
      "author": {
        "name": "Hyunwoo Kim",
        "email": "imv4bel@gmail.com",
        "time": "Sun Mar 08 02:23:34 2026 +0900"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 10 14:10:42 2026 +0100"
      },
      "message": "netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a \u0027goto restart\u0027 that jumps to a label\ninside the for loop body.  When the \"last\" helper saved in cb-\u003eargs[1]\nis deleted between dump rounds, every entry fails the (cur !\u003d last)\ncheck, so cb-\u003eargs[1] is never cleared.  The for loop finishes with\ncb-\u003eargs[0] \u003d\u003d nf_ct_helper_hsize, and the \u0027goto restart\u0027 jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe \u0027goto restart\u0027 block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it.  Move the block into the for loop body so that\nthe restart only occurs while cb-\u003eargs[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n  nfnl_cthelper_dump_table+0x9f/0x1b0\n  netlink_dump+0x333/0x880\n  netlink_recvmsg+0x3e2/0x4b0\n  sock_recvmsg+0xde/0xf0\n  __sys_recvfrom+0x150/0x200\n  __x64_sys_recvfrom+0x76/0x90\n  do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n  __kvmalloc_node_noprof+0x21b/0x700\n  nf_ct_alloc_hashtable+0x65/0xd0\n  nf_conntrack_helper_init+0x21/0x60\n  nf_conntrack_init_start+0x18d/0x300\n  nf_conntrack_standalone_init+0x12/0xc0\n\nFixes: 12f7a505331e (\"netfilter: add user-space connection tracking helper infrastructure\")\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "f1ba83755d81c6fc66ac7acd723d238f974091e9",
      "tree": "002ea99ecd2257cee892d699202da0ddb9b0ac3e",
      "parents": [
        "cfe770220ac2dbd3e104c6b45094037455da81d4"
      ],
      "author": {
        "name": "Hyunwoo Kim",
        "email": "imv4bel@gmail.com",
        "time": "Sun Mar 08 02:24:06 2026 +0900"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 10 14:10:42 2026 +0100"
      },
      "message": "netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path\n\nnfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue\nentry from the queue data structures, taking ownership of the entry.\nFor PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN\nattributes.  If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN\npresent but NFQA_VLAN_TCI missing), the function returns immediately\nwithout freeing the dequeued entry or its sk_buff.\n\nThis leaks the nf_queue_entry, its associated sk_buff, and all held\nreferences (net_device refcounts, struct net refcount).  Repeated\ntriggering exhausts kernel memory.\n\nFix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict\non the error path, consistent with other error handling in this file.\n\nFixes: 8d45ff22f1b4 (\"netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR\")\nReviewed-by: David Dull \u003cmonderasdor@gmail.com\u003e\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "cfe770220ac2dbd3e104c6b45094037455da81d4",
      "tree": "b49b7c5c4f34bea55f5d1fab58914cc71ea086d6",
      "parents": [
        "d6d8cd2db236a9dd13dbc2d05843b3445cc964b5"
      ],
      "author": {
        "name": "David Dull",
        "email": "monderasdor@gmail.com",
        "time": "Sat Mar 07 20:26:21 2026 +0200"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 10 14:10:42 2026 +0100"
      },
      "message": "netfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i +\u003d op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i \u003d\u003d optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers.\n\nFixes: 2e4e6a17af35 (\"[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables\")\nSigned-off-by: David Dull \u003cmonderasdor@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "d6d8cd2db236a9dd13dbc2d05843b3445cc964b5",
      "tree": "9cdd996de61081870d9a828d37de6aab282b6f62",
      "parents": [
        "7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9"
      ],
      "author": {
        "name": "Jenny Guanni Qu",
        "email": "qguanni@gmail.com",
        "time": "Fri Mar 06 19:12:38 2026 +0000"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 10 14:10:42 2026 +0100"
      },
      "message": "netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n\npipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the\nto_offset argument on every iteration, including the last one where\ni \u003d\u003d m-\u003efield_count - 1. This reads one element past the end of the\nstack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]\nwith NFT_PIPAPO_MAX_FIELDS \u003d\u003d 16).\n\nAlthough pipapo_unmap() returns early when is_last is true without\nusing the to_offset value, the argument is evaluated at the call site\nbefore the function body executes, making this a genuine out-of-bounds\nstack read confirmed by KASAN:\n\n  BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]\n  Read of size 4 at addr ffff8000810e71a4\n\n  This frame has 1 object:\n   [32, 160) \u0027rulemap\u0027\n\n  The buggy address is at offset 164 -- exactly 4 bytes past the end\n  of the rulemap array.\n\nPass 0 instead of rulemap[i + 1].n on the last iteration to avoid\nthe out-of-bounds read.\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nSigned-off-by: Jenny Guanni Qu \u003cqguanni@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9",
      "tree": "96d632cfd44de719cf721fdee7d9ddd7be641d7c",
      "parents": [
        "b7cdc5a97d02c943f4bdde4d5767ad0c13cad92b"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Thu Mar 05 21:32:00 2026 +0100"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 10 14:10:42 2026 +0100"
      },
      "message": "netfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]\n\nFixes: 628bd3e49cba (\"netfilter: nf_tables: drop map element references from preparation phase\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "b7cdc5a97d02c943f4bdde4d5767ad0c13cad92b",
      "tree": "75f1ebddf9cedf2ce7b72a213b56252dd6e12d10",
      "parents": [
        "6f1a9140ecda3baba3d945b9a6155af4268aafc4"
      ],
      "author": {
        "name": "Phil Sutter",
        "email": "phil@nwl.cc",
        "time": "Thu Mar 05 13:01:44 2026 +0100"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 10 14:10:42 2026 +0100"
      },
      "message": "netfilter: nf_tables: Fix for duplicate device in netdev hooks\n\nWhen handling NETDEV_REGISTER notification, duplicate device\nregistration must be avoided since the device may have been added by\nnft_netdev_hook_alloc() already when creating the hook.\n\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nReported-by: syzbot+bb9127e278fa198e110c@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dbb9127e278fa198e110c\nFixes: a331b78a5525 (\"netfilter: nf_tables: Respect NETDEV_REGISTER events\")\nTested-by: Helen Koike \u003ckoike@igalia.com\u003e\nSigned-off-by: Phil Sutter \u003cphil@nwl.cc\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "6f1a9140ecda3baba3d945b9a6155af4268aafc4",
      "tree": "2affe41ab2fcd984dce31458e08eca3dacca0e7c",
      "parents": [
        "3228835877e77200a8c16f26b22017f850f8b0c3"
      ],
      "author": {
        "name": "Weiming Shi",
        "email": "bestswngs@gmail.com",
        "time": "Sat Mar 07 00:01:34 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 13:30:30 2026 +0100"
      },
      "message": "net: add xmit recursion limit to tunnel xmit functions\n\nTunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own\nrecursion limit. When a bond device in broadcast mode has GRE tap\ninterfaces as slaves, and those GRE tunnels route back through the\nbond, multicast/broadcast traffic triggers infinite recursion between\nbond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing\nkernel stack overflow.\n\nThe existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not\nsufficient because tunnel recursion involves route lookups and full IP\noutput, consuming much more stack per level. Use a lower limit of 4\n(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.\n\nAdd recursion detection using dev_xmit_recursion helpers directly in\niptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel\npaths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).\n\nMove dev_xmit_recursion helpers from net/core/dev.h to public header\ninclude/linux/netdevice.h so they can be used by tunnel code.\n\n BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160\n Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11\n Workqueue: mld mld_ifc_work\n Call Trace:\n  \u003cTASK\u003e\n  __build_flow_key.constprop.0 (net/ipv4/route.c:515)\n  ip_rt_update_pmtu (net/ipv4/route.c:1073)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\n  ip_output (net/ipv4/ip_output.c:438)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\n  ip_output (net/ipv4/ip_output.c:438)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  mld_sendpack\n  mld_ifc_work\n  process_one_work\n  worker_thread\n  \u003c/TASK\u003e\n\nFixes: 745e20f1b626 (\"net: add a recursion limit in xmit path\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20260306160133.3852900-2-bestswngs@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "3228835877e77200a8c16f26b22017f850f8b0c3",
      "tree": "87764fc8618b73e6e0a2c5e537f9349788104a62",
      "parents": [
        "7d86aa41c073c4e7eb75fd2e674f1fd8f289728a",
        "a8ba129af46856112981c124850ec6a85a1c1ab6"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 12:07:08 2026 +0100"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 12:07:09 2026 +0100"
      },
      "message": "Merge branch \u0027amd-xgbe-rx-adaptation-and-phy-handling-fixes\u0027\n\nRaju Rangoju says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\namd-xgbe: RX adaptation and PHY handling fixes\n\nThis series fixes several issues in the amd-xgbe driver related to RX\nadaptation and PHY handling in 10GBASE-KR mode, particularly when\nauto-negotiation is disabled.\n\nPatch 1 fixes link status handling during RX adaptation by correctly\nreading the latched link status bit so transient link drops are\ndetected without losing the current state.\n\nPatch 2 prevents CRC errors that can occur when performing RX\nadaptation with auto-negotiation turned off. The driver now stops\nTX/RX before re-triggering RX adaptation and only re-enables traffic\nonce adaptation completes and the link is confirmed up, ensuring\npackets are not corrupted during the adaptation window.\n\nPatch 3 restores the intended ordering of PHY reset relative to\nphy_start(), making sure PHY settings are reset before the PHY is\nstarted instead of afterwards.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260306111629.1515676-1-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "a8ba129af46856112981c124850ec6a85a1c1ab6",
      "tree": "87764fc8618b73e6e0a2c5e537f9349788104a62",
      "parents": [
        "27a4dd0c702b3b2b9cf2c045d100cc2fe8720b81"
      ],
      "author": {
        "name": "Raju Rangoju",
        "email": "Raju.Rangoju@amd.com",
        "time": "Fri Mar 06 16:46:29 2026 +0530"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 12:07:07 2026 +0100"
      },
      "message": "amd-xgbe: reset PHY settings before starting PHY\n\ncommit f93505f35745 (\"amd-xgbe: let the MAC manage PHY PM\") moved\nxgbe_phy_reset() from xgbe_open() to xgbe_start(), placing it after\nphy_start(). As a result, the PHY settings were being reset after the\nPHY had already started.\n\nReorder the calls so that the PHY settings are reset before\nphy_start() is invoked.\n\nFixes: f93505f35745 (\"amd-xgbe: let the MAC manage PHY PM\")\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260306111629.1515676-4-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "27a4dd0c702b3b2b9cf2c045d100cc2fe8720b81",
      "tree": "05afcff144a9384d724c570ca37456c2069f006b",
      "parents": [
        "6485cb96be5cd0f4bf39554737ba11322cc9b053"
      ],
      "author": {
        "name": "Raju Rangoju",
        "email": "Raju.Rangoju@amd.com",
        "time": "Fri Mar 06 16:46:28 2026 +0530"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 12:07:07 2026 +0100"
      },
      "message": "amd-xgbe: prevent CRC errors during RX adaptation with AN disabled\n\nWhen operating in 10GBASE-KR mode with auto-negotiation disabled and RX\nadaptation enabled, CRC errors can occur during the RX adaptation\nprocess. This happens because the driver continues transmitting and\nreceiving packets while adaptation is in progress.\n\nFix this by stopping TX/RX immediately when the link goes down and RX\nadaptation needs to be re-triggered, and only re-enabling TX/RX after\nadaptation completes and the link is confirmed up. Introduce a flag to\ntrack whether TX/RX was disabled for adaptation so it can be restored\ncorrectly.\n\nThis prevents packets from being transmitted or received during the RX\nadaptation window and avoids CRC errors from corrupted frames.\n\nThe flag tracking the data path state is synchronized with hardware\nstate in xgbe_start() to prevent stale state after device restarts.\nThis ensures that after a restart cycle (where xgbe_stop disables\nTX/RX and xgbe_start re-enables them), the flag correctly reflects\nthat the data path is active.\n\nFixes: 4f3b20bfbb75 (\"amd-xgbe: add support for rx-adaptation\")\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260306111629.1515676-3-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "6485cb96be5cd0f4bf39554737ba11322cc9b053",
      "tree": "be0bfca63ffe637b219c6ab2dba6c80f1d6edf03",
      "parents": [
        "7d86aa41c073c4e7eb75fd2e674f1fd8f289728a"
      ],
      "author": {
        "name": "Raju Rangoju",
        "email": "Raju.Rangoju@amd.com",
        "time": "Fri Mar 06 16:46:27 2026 +0530"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Mar 10 12:07:06 2026 +0100"
      },
      "message": "amd-xgbe: fix link status handling in xgbe_rx_adaptation\n\nThe link status bit is latched low to allow detection of momentary\nlink drops. If the status indicates that the link is already down,\nread it again to obtain the current state.\n\nFixes: 4f3b20bfbb75 (\"amd-xgbe: add support for rx-adaptation\")\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260306111629.1515676-2-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    }
  ],
  "next": "7d86aa41c073c4e7eb75fd2e674f1fd8f289728a"
}