mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-09-18 21:19:30 +02:00
master
100
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Linus Torvalds
|
238650ef6c |
Merge tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan:
"KVM:
- fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
- fix secure device page leak on uv_page_in() failure
iommu:
- Fix the overflow validation in iommu_tce_check_ioba
Thanks to Amit Machhiwal, Gautam Menghani, Ritesh Harjani (IBM), R
Nageswara Sastry, and Shivaprasad G Bhat"
* tag 'powerpc-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
|
||
|
Linus Torvalds
|
9b87fdc9af |
Merge tag 'sched_ext-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext fixes from Tejun Heo: - An error raised by a BPF program before the scheduler finished enabling was consumed by the disable path's pre-enable shortcut, leaving a running scheduler that couldn't be disabled and was later freed while in use. - Two compat kfuncs dereferenced a NULL scheduler when handed an exited or idle task, oopsing the kernel. - Keep-running decisions in the dispatch path used the root scheduler's flags for tasks belonging to a sub-scheduler, causing warnings and stalls. - Schedulers with their own CPU ID mapping had no way to learn which IDs are online. Add a kernel-maintained online mask to plug the hole. - Cgroup idle state: the initial cpu.idle state wasn't passed on cgroup init and same-value rewrites delivered spurious callbacks. - Example scheduler fixes for a reenqueue loop on attach, placements on CPUs without effective grants, stalled partition work and stale idle tracking. * tag 'sched_ext-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Maintain an online cid mask in the scheduler arena sched_ext: scx_qmap: Restore unused idle claims from ops.dispatch() sched_ext: Close the pre-enable ops error claim window sched_ext: scx_qmap: Fix pending partition work handoff sched_ext: scx_qmap: Place only on cids whose caps are in effect sched_ext: scx_qmap: Do not add IMMED to rescue inserts sched_ext: Use @prev's scheduler for the keep decisions in dispatch_one() sched_ext: Rename sch to root_sch in dispatch_one() sched_ext: Fix NULL sched deref in kfunc sub-sched error paths sched_ext: Don't deliver duplicate ops.cgroup_set_idle() for same value sched_ext: Pass the initial cpu.idle state in scx_cgroup_init_args |
||
|
Linus Torvalds
|
6fb20c0271 |
Merge tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fix from Tejun Heo: - The task iterator could pick up a dying task whose refcount had already dropped to zero and resurrect it, leading to a use-after-free when reading cgroup.procs. Skip such tasks. * tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Avoid iteration of dying tasks with zero refcount |
||
|
Linus Torvalds
|
f6e7b42bf0 |
Merge tag 'sysctl-7.03-fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl
Pull sysctl fixes from Joel Granados: - Re-add the range check for millisecond to jiffy conversion in sysctl They where removed in |
||
|
Linus Torvalds
|
5878583675 |
Merge tag 'nfsd-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
Pull nfsd fix from Chuck Lever: - Fix handling of NFSEXP_PNFS in the netlink codepath * tag 'nfsd-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: fix handling of NFSEXP_PNFS in the netlink codepath |
||
|
Linus Torvalds
|
59826bc5a4 |
Merge tag '9p-for-7.3-rc4' of https://github.com/martinetd/linux
Pull 9pfs fix from Dominique Martinet: "This is a single fix for a 9p/netfs regression that got in 7.1 (and was backported to 7.0) We need to rework how cached attributes, and in particular i_size, are handled in 9p more thoroughly but that will take more time and this appears to be enough for the most obvious problems" * tag '9p-for-7.3-rc4' of https://github.com/martinetd/linux: 9p: Fix v9fs_issue_write() to update i_size and remote_i_size |
||
|
Linus Torvalds
|
01414b70cb |
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe:
"Lots of bug fixes from the last weeks:
- Various error unwind bugs
- Several more races and bugs in siw and rxe, including remote
triggerable
- HFI1 corruption with its credit scheme
- Remove a bogus user triggerable dev_warn
- Lock __ethtool_get_link_ksettings() properly
- Fix a lockdep loop with diassociation
- Several storage related bugs, some triggerable remotely
- Do no leak physical addresses to userspace in bnxt_re
- Fix wrong irq context for the xarrays in erdma
- User triggerable race in ucma with multicast
- Race in ipoib with multicast flushing and destruction"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits)
RDMA/siw: Bound fragmented header copies by the remaining length
RDMA/efa: Keep EQ resources alive while IRQ is registered
RDMA/efa: Keep admin queues alive while IRQ is registered
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
RDMA/ucma: Serialize join and leave on copy_to_user failure
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
RDMA/irdma: Enforce local fence for IB_WR_REG_MR
RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc()
RDMA/bnxt_re: Avoid exposing umdbr to userspace
RDMA/rtrs: guard against null kobj name
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
IB/isert: wait for deferred control PDU completions before releasing the connection
IB/iser: reject a remote invalidation of an unregistered direction
RDMA/srp: Fix srp_remove_target()
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
...
|
||
|
Linus Torvalds
|
ebb58ec7f8 |
Merge tag 'fixes-2026-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock
Pull memblock fixes from Mike Rapoport:
"Fix for regions display in debugfs and MAINTAINERS update:
- Make sure that multiple flags on a memblock region are all
displayed in debugfs
- Update memblock tree tags in MAINTAINERS"
* tag 'fixes-2026-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock:
MAINTAINERS: update memblock tree URLs
mm: memblock: show all region flags in debugfs
|
||
|
Linus Torvalds
|
164f652b6e |
Merge tag 'mm-hotfixes-stable-2026-09-13-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton: "14 hotfixes. 10 are cc:stable. 11 are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-09-13-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/folio: EXPORT_SYMBOL_FOR_KVM(lru_cache_drain_for_folio) mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem mm/vma: correctly unaccount on mmap_prepare() failure mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() remove old lib/alloc_tag.c fs/dax: check zero or empty entry before converting xarray entry fs: fix missed removal of super_fs_objects_eligible() mm: filemap: retain mapped dropbehind folios mailmap: update entry for Christopher Obbard memcg: avoid charging the root memcg from obj_cgroup_charge_pages() mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count mailmap: map Coiby Xu's address mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP mm/huge_memory: bypass THP tuneables for huge pfnmap mappings |
||
|
Linus Torvalds
|
704340f1cd |
Merge tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Dave Hansen: "The most notable fix is THP not silently losing user data and having been around for a couple of years. The main explanation I'd have for its longevity is that it requires a few different things to align at the same time: MADV_FREE, THP and heavy reclaim. - Fix user-space data loss with THP - Fix set_memory oopses - Fix addition of large constants in mul_u64_add_u64_div_u64() - Fix FineIBT hash offset in cfi_get_func_hash() - Fix PCI device reference counting in amd_smn_init()" * tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/amd_node: Fix PCI device reference counting in amd_smn_init() x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() x86/mm: Fix user-space data loss with MADV_FREE and THP x86/mm/pat: Allocate split page tables as kernel page tables x86/alternatives: Exclude text poking against change_page_attr() x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF |
||
|
Linus Torvalds
|
fd73f4a665 | Linux 7.3-rc3 | ||
|
Linus Torvalds
|
22098763a1 |
Merge tag 'trace-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Don't destroy user event fields when removal fails
User event fields are destroyed before the event is removed from
visibility. But that can fail leaving the still visible event with no
fields. Move the destroying of the fields to after the event is
successfully removed from visibility.
- Initialize function graph state is fork before calling
copy_exec_state()
For non-CLONE_VM forks, copy_exec_state() allocates a new
task_exec_state. If that allocation fails, ftrace_graph_exit_task()
will free the tasks ret_stack pointer. Since that pointer is still
using the parent's ret_stack, it mistakenly frees the parent's
pointer too.
Call ftrace_graph_init() on the task first which will NULL out the
new tasks's ret_stack and if the copy fails, it will not free
anything.
- Remove FGRAPH_MAX_INDEX
The macro FGRAPH_MAX_INDEX was added but never used. Remove it.
- Save ent_size in function graph printing of nested functions
The function graph tracer needs to look at the next event to see if
the next event is the return of the current function entry. If it is,
it prints a single line:
ktime_get();
Otherwise it prints it like a nested function:
tick_nohz_irq_exit() {
ktime_get();
kcpustat_irq_exit();
}
In order to look at the next event, it must save the current event so
that it has the information to print from it. It saves the event in
the iterator descriptor called "ent". What it doesn't save is the
ent_size of the event which is now used to know if the function graph
arguments are to be printed. The peek doesn't save the size so the
size used happens to be that of the size of the last event that was
seen.
Save the entry event size in the iterator descriptor so that the
correct size is used.
- Fix several errors with freeing data in the histogram code
The histogram code had a lot of leaked or or incorrect accounting
when failures happen. Correct them.
- Fix histogram regression of .percent and .graph modifiers
Up until 6.3 histogram values could have "percent" or "graph"
modifiers that changed how they were printed. But a change that added
restricting histograms values from being strings, stack traces and
other modifiers inadvertently prevented them from using the percent
and graph modifiers, which were legal use cases for values.
Put back the percent and graph modifiers.
- Fix various typos in the comments
- Set the trace_clock before initializing a histogram with clock
argument
The histogram API allows the user to specific which trace clock to
use via a "clock=" string. The histogram is set up first before the
clock is checked. If the passed in clock is not valid, it exits
without fully fixing up the histogram leaving it on the list and a
use-after-free can trigger.
Update the clock argument first and if it fails then exit gracefully
before the histogram trigger is placed on any lists.
- Restore :mod: trailer after parsing in ftrace_set_clr_event
The function ftrace_set_clr_event() modifies the parse string and
needs to put it back to what was passed in. It searches for ":mod:"
via a strsep() but fails to put back the first ':' in the string.
Add back the ':' in the passed in string.
- Take trace_array reference when opening a tracer options file
The options files are dynamically created and some tracers add their
own options. When a tracer adds their own list of options, the
trace_array holding them has an array to hold the list of options for
each tracer. This array increases in size via a krealloc(), and the
new entry gets a newly allocated array to hold the options of the new
tracer being added.
The element in each entry of the tracer's option array holds a
pointer back to the trace_array, a pointer to the tracer it is
associated to, a pointer to the flags of the option.
The issue is that these arrays are freed when the trace_array is
freed when its instance it represents is removed from the instances
directory. There's a race that an open of one of these options files
can happen when the instance is being removed.
Add a new helper function to be called by the open function of the
options file to iterate all existing trace_arrays under a lock and
find the one that has the given option element in one of it's tracer
arrays. If found, then update the associated trace_array's reference
counter to keep it from being freed. If not found, have the open call
return -ENODEV.
- Disable interrupts when acquiring the lock in rb_wake_up_waiters()
The function rb_wake_up_waiters() assumes it will be called in
interrupt context and does not disable irqs when taking
cpu_buffer->reader_lock, which can be called in hard interrupt
context. The issue is in PREEMPT_RT, this function is called in
thread context leaving this lock open to a deadlock.
Take the lock with interrupts disabled.
- Use rcu_assign_pointer() for tmp_ops filter hash
The tmp_ops used in update_ftrace_direct_mod() assigns its
filter_hash field directly, but that field is annotated as __rcu and
sparse complains. Assign it with rcu_assign_pointer()
- Fix use-after-free in enable_trigger_private_data_free()
The trace_event_call is accessed through the event_trigger_data's
trace_event_file pointer to put the trace_event_call on freeing. The
issue is that the trace_event_file data may have been freed already
causing a use-after-free. Add a field to the event_trigger_data that
points directly to the trace_event_call so that it can decrement its
reference directly without needing to go through the
trace_event_file.
- Fix accounting of buffer data remote headers
trace_buffer_desc_size() and trace_remote_alloc_buffer() undercount
the number of pages is needed for the asked for size as it doesn't
take into account the meta data on each page. Add a helper function
to do the calculation properly and use that in these functions.
- Catch nr_page_va overflow in ring_buffer_desc sizing
The number of pages per remote ring buffer is capped by
ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to
overflow that field would silently allocate a descriptor smaller than
what was asked for.
- Do not resize the subbuf order if any per_cpu buffer is disabled
The mmapping of ring buffers disables resizing the subbuffers, but it
is done per-cpu whereas the subbuf size change is done for all the
per_cpu buffers under the buffer->mutex. It could change the size of
some while the mapping is happening on others. Have the resize of the
subbuf order check all the per_cpu buffers under the lock to see if
any of them is disabled before starting and causing an inconsistency
between buffers that are being mapped.
* tag 'trace-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (25 commits)
ring-buffer: Check resize_disabled before publishing the new subbuf order
tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing
tracing/remotes: Account for ring buffer page header in size calculation
tracing: Don't dereference trace_event_file in deferred trigger free
ftrace: Use rcu_assign_pointer() for tmp_ops filter hash
ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
tracing: Take trace_array reference when opening a tracer options file
tracing: Fix ring_buffer_read_page_size() kernel-doc
tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event()
tracing: Fix memory corruption from a "STACKTRACE" histogram key
tracing: Fix memory corruption from the histogram stacktrace modifier
tracing: Undo the registration when enabling the histogram trigger fails
tracing: Take the reference before publishing the named histogram trigger
tracing: Set the trace clock before registering the histogram trigger
tracing: Fix typo "preceeded" in comment
tracing: Fix typo "availabe" in comment
tracing: Let histogram values keep the percent and graph modifiers
tracing: Keep the entry count when the histogram stats allocation fails
tracing: Free histogram the field rejected for a bad modifier
tracing: Free histogram the var ref when its initialization fails
...
|
||
|
Linus Torvalds
|
d681d7ef61 |
Merge misc regression fixes that seem to have fallen through the cracks
Thorsten continues to track regressions, and reporting on known issues with fixes that don't seem to make any progress. I'm going to do an rc3 release later today - let's not keep these known issues pending for yet another rc for no obvious reason. Reported-by: Thorsten Leemhuis <regressions@leemhuis.info> Link: https://lore.kernel.org/all/46403cf8-9a81-4596-87eb-dde58ae4c5db@leemhuis.info/ * regressions: media: ipu-bridge: do not use the CVS device lookup for IVSC wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe wifi: mt76: mt7921: skip unknown CLC firmware records |
||
|
Linus Torvalds
|
180534c09b |
Merge tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Work around a 'bindgen' 0.73.2 bug that emits an 'allow' attribute
for 'unnecessary_transmutes', which is unknown in older compilers
- Clean 'clippy::as_underscore' lints in generated code by the new
'bindgen' 0.73.0+ releases
- Clean new 'clippy::needless_range_loop' lint for the upcoming Rust
1.100.0 (expected 2026-11-12)
'kernel' crate:
- 'num' module: fix soundness issue in 'Bounded' by sealing the
'Integer' trait
'pin-init' crate:
- Fix unreachable warning for the upcoming Rust 1.100.0 (expected
2026-11-12) due to 'Infallible' becoming an alias of '!'
Samples:
- Add missing newlines in 'pr_*!'s macro calls"
* tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: allow `unknown_lints` in generated bindings for Rust < 1.88
rust: allow `clippy::as_underscore` in the generated bindings
rust: num: seal Integer
drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0
rust: samples: add missing newlines in rust_print_main
rust: pin-init: use irrefutable pattern for `stack_pin_init`
|
||
|
Linus Torvalds
|
6a0b3fb48d |
Merge tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig fixes from Masami Hiramatsu:
"Fix integer overflow and truncation in size checks.
- Fix size check bypasses caused by integer overflow and truncation
when parsing initrd or standalone bootconfig files, preventing
buffer overflow and out-of-bounds writes in the userspace tool.
- Fix pointer arithmetic wrap-around in get_boot_config_from_initrd()
when handling crafted huge size values, preventing fatal kernel
page faults during early boot"
* tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
bootconfig: Fix integer overflow in initrd size check
tools/bootconfig: Fix integer overflow and truncation in size checks
|
||
|
Linus Torvalds
|
c874ace034 |
Merge tag 'timers-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar: - Fix clockevents replacement race when a broadcast device is replaced which may trigger a BUG() crash (朱恺乾 - Zhu Kaiqian) - Fix potential timerqueue ordering bug when rearming a queued timer with nonzero slack (Andrea Parri) * tag 'timers-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: hrtimer: Use hard expiry when updating timers on the same base tick/broadcast: Plug clockevents replacement race |
||
|
Linus Torvalds
|
b2a8a7669e |
Merge tag 'sched-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar: - Fix EEVDF se->max_slice value on enqueueing (Vincent Guittot) - Fix EEVDF augmented rb-trees re-balancing with multiple fields (Vincent Guittot) - In proxy scheduling, account cgroup CPU time to the execution context, not the scheduling context (Hui Su) - Likewise, call wq_worker_tick() for the execution context, not the scheduling context (Hui Su) * tag 'sched-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Call wq_worker_tick() for the execution context sched: Account cgroup CPU time to the execution context sched/eevdf: Fix rb augmented with multi fields sched/eevdf: Fix augmented max_slice |
||
|
Linus Torvalds
|
85855f85de |
Merge tag 'perf-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar - Fix sched_cb_list corruption on PMU callbacks that invoke list_del() during perf_event_overflow() calls (Thomas Richter) - Fix PEBS pt_regs->flags snapshot data that regressed with the introduction of adaptive PEBS v4 support (Dapeng Mi) - Fix possible drain_pebs() re-entry bug when intel_pmu_drain_pebs_buffer() is called from process context (Dapeng Mi) * tag 'perf-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Prevent drain_pebs() reentry perf/x86/intel: Correct pt_regs->flags update for PEBS path perf/core: Allow list_del during perf_event_overflow() |
||
|
Linus Torvalds
|
feb66eea6b |
Merge tag 'objtool-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull objtool fixes from Ingo Molnar: - Fix potential klp-build allocation leak in cleanup functionality handling kzalloc() failure (Yafang Shao) - Fix KLP checksum false positives triggering with GCC, caused by quirks in string literal symbol generation (Josh Poimboeuf) * tag 'objtool-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool/klp: Fix checksums for constant pool references klp-build: Fix wrong index in funcs cleanup error path |
||
|
Linus Torvalds
|
f10ae89f3d |
Merge tag 'irq-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fix from Ingo Molnar: - Fix ARM gic-v5 irqchip driver regression, where its enable/disable functions may corrupt unrelated ICC_CR0_EL1 hardware state (Sascha Bischoff) * tag 'irq-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v5: Preserve ICC_CR0_EL1 state |
||
|
Linus Torvalds
|
086fd27ee9 |
Merge tag 'core-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull entry code fix from Ingo Molnar: - Fix generic entry code cross-build failure on !CONFIG_AUDITSYSCALL kernels using older RISCV64 and S390 cross-compilers (Thomas Gleixner) * tag 'core-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Guard syscall_enter_audit() invocation with CONFIG_AUDITSYSCALL |
||
|
Linus Torvalds
|
ff4b61e3b7 |
Merge tag 'edac_urgent_for_v7.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras
Pull EDAC fix from Borislav Petkov: - A single fix to altera_edac to use the proper objects when performing managed device operations instead of using temporary shallow struct copies which can cause dangling list pointers and havoc eventually * tag 'edac_urgent_for_v7.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Use parent device for devres in altr_portb_setup() |
||
|
Linus Torvalds
|
2f0c1cf72f |
Merge tag 's390-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik: - Fix NULL pointer dereferences in s390dbf when setting debug levels or resizing debug areas while logging events. Remove duplicate messages about kernel parameter overrides - Fix PAI perf crashes when per task events move to newly onlined CPUs. Add CPU hotplug callbacks to allocate and free the per-CPU data - Fix mutex use in atomic context in AES and PAES CTR code by using semaphore trylocks instead. Remove conditional locking and enable Clang CONTEXT_ANALYSIS for the crypto code - Fix scatterlist walk error handling in AES and PAES and avoid freeing PAES walk resources twice - Fix missing scrubbing of temporary AES and PAES buffers, including AES GCM error paths - Set missing CRYPTO_ALG_ASYNC and CRYPTO_ALG_NO_FALLBACK flags for PAES - Fix -EBUSY handling in PAES and PHMAC to avoid cleaning up requests already queued to the crypto engine - Fix PAES and PHMAC requests being completed twice on errors - Fix PAES and PHMAC hangs when key conversion keeps returning -EBUSY by returning -EIO after the last retry * tag 's390-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/crypto: Enable CONTEXT_ANALYSIS s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly s390/crypto: Fix wrong return code to engine in asynch callbacks s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine s390/crypto: Fix handling of EBUSY in PAES when req is pushed to crypto engine s390/crypto: Fix missing cra_flags in paes_s390 s390/crypto: Fix use of mutex in atomic context in PAES s390/crypto: Fix missing scrub of temp buffers with PAES algorithm s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms s390/crypto: Fix use of mutex in atomic context s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm s390/crypto: Fix skcipher_walk return code handling in aes_s390 s390/debug: Fix race between debug area resize and event logging s390/debug: Do not repeat parameter override notice on debug_set_level() s390/debug: Fix NULL pointer dereference in debug_set_level() s390/pai: Support CPU hotplug for PMU PAI s390/pai: Move locking to event init and delete s390/pai: Use PAI PMU index as parameter replacing event |
||
|
Linus Torvalds
|
3ce99a68f7 |
Merge tag 'kbuild-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fixes from Nicolas Schier:
"Fix a build race and builds on stable branches.
The other two are low-hanging fruits from Lorenzo's recent kbuild
speed-up patch set that fix older symbol leakages.
- don't delete in-flight filechk temporaries in asm-headers
A rule for generating header files was changed from using make
$(wildcard) fnglob to 'find' instead; as 'find' finds "hidden"
files by default, temporary files from Kbuild's 'filechk', used for
generating asm header files, may get deleted and break header file
generating.
- scripts/sorttable: Mark long_size as __maybe_unused
Fix builds with clang-23 or newer on trees w/o commit
|
||
|
Linus Torvalds
|
cba2348ab1 |
Merge tag 'xfs-fixes-7.3-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Pull xfs fixes from Carlos Maiolino: "More than the usual amount of fixes. The highlights here are a block under reservation fix which caused an assert to be triggered in non-default configurations. The assert, initially added on 7.3-rc2 just makes the problem explicit but is not the cause. Another highlight is a missed lock/unlock mutex in the xfs healthmonitor which was causing lockdeps warnings. Besides those two, this also contains a myriad of fixes for random bugs found by LLM tools in the healthmon, scrub and online repair. A few bug fixes for zoned xfs are also included. This also includes an accounting fix for our buffer slab cache where the memory payload associated to each object was not being properly accounted for. The remaining of the patches are a few lock context annotations added and/or fixed. They are mostly disabled by now, but still worth fixing before we get them enabled. And last but not least, a few clean ups" * tag 'xfs-fixes-7.3-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (75 commits) xfs: advance the findparent inode scan cursor while holding ILOCK xfs: reset parent pointer args before each dir tree unlink repair xfs: fix replaying dirent removals into the temporary directory xfs: fix termination logic in xchk_bmap xfs: fix rtrmap cross-referencing elision logic xfs: actually check internal-rtdev fields in the superblock xfs: fix under-reservation of blocks when repairing sf directories xfs: take hm->lock in xfs_ioc_health_monitor() before insert xfs: set IOMAP_F_INTEGRITY for zoned writes on integrity devices xfs: avoid extra cache flushes for multi-device file systems in xfs_fsync xfs: don't continue on error in xfs_fsync xfs: also flush the RT device cache in xlog_write_iclog xfs: bail out on bitmap errors in xrep_agfl_fill xfs: snapshot old AGFL before rewriting it xfs: remove redundant function declaration xfs: report runtime failures in scrub xfs: report healthy filesystem events in scrub stats xfs: snapshot scrub stats when rendering them xfs: remove several unused and never-implemented declarations xfs: count escaped corruption errors in scrub stats ... |
||
|
Linus Torvalds
|
95deca8dd9 |
Merge tag 'for-7.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba: - tree-checker updates, validate values in b-tree item keys, other item length checks - don't do unnecessary transaction commit fallback when logging parent directories - in zoned mode, initialize space info of a block group early enough so it does not lead to NULL pointer dereference * tag 'for-7.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: tree-checker: validate name length for extref items btrfs: tree-checker: validate parent field for inode extref items btrfs: tree-checker: validate key offset for inode ref keys btrfs: fix unnecessary transaction commit fallback from btrfs_log_all_parents() btrfs: set space_info before adding new free space in btrfs_make_block_group() |
||
|
Linus Torvalds
|
4d85a45df0 |
Merge tag 'erofs-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs updates from Gao Xiang:
"The most impactful fix here is to disable LZ4 rolling decompression
for now.
AWS folks recently found their systems could get corrupted data with
some rare, specific LZ4 datasets, and after a deeper analysis, I found
the root cause is that there could be uncontrolled backward memory
copies in the current LZ4 implementation and it breaks the assumption
of the rolling decompression optimization, since the kernel LZ4
codebase is out of our control and it needs more time to plan how to
do next, so disable LZ4 rolling decompression for now to ensure data
correctness for real production on these rare cases first. The
technical details also see the corresponding commit.
Other changes are random minor fixes.
Summary:
- Disable LZ4 rolling decompression for now due to the uncontrolled
LZ4 implementation
- Fix missing sysfs feature entry for xattr prefixes
- Fix invalid LZMA decoders on resize failure
- Rearrange the inode_share cache key to avoid potential collisions
- Fix erofs_bread() when fsoffset is used on sub-page-block EROFS
filesystems"
* tag 'erofs-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: add missing buf->off in erofs_bread()
erofs: delimit inode_share cache key components
erofs: disable LZ4 rolling decompression for now
erofs: preserve LZMA decoders on resize failure
erofs: add sysfs feature entry for xattr prefixes
|
||
|
Linus Torvalds
|
31a4327ffe |
Merge tag 'fbdev-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev fixes from Helge Deller: "Two patches for VT core code and fbcon prevent potential out-of-bounds reads on font or screen size changes, one fix limits the Superblitter in atafb to supported modes only, and some minor fixes for vfb, ssd1307fb and omapfb" * tag 'fbdev-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: vfb: defer cleanup until the last reference fbdev: atafb: Restrict SuperBlitter to supported formats fbdev: ssd1307fb: fix NULL pointer dereference on missing match data fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo fbdev: omapfb: Fix __be32 sparse warning in panel_enabled() vt: hide cursor prior to font changes to avoid out-of-bound reads |
||
|
Linus Torvalds
|
f6e213d5a2 |
Merge tag 'iommu-fixes-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull IOMMU fixes from Joerg Roedel:
"RISC-V:
- Serialize command queue publication to prevent concurrent producers
from exposing incomplete or out-of-order commands to hardware
- Wait for queue space outside the command queue lock
- Avoid waiting for IOFENCE completion when command enqueue failed
AMD:
- Prevent GA log buffers from being reallocated and leaked during
resume, where allocation also occurs in an unsuitable syscore
callback context
- Fix a regression on older systems whose firmware advertises
incorrect IOMMU features
- Preserve allocation errors when assigning host domain IDs to nested
domains
s390:
- Prevent a NULL dereference when translating an unmapped IOVA with
five-level ZPCI translation tables
Misc:
- Remove a stale MAINTAINERS entry and clean up unused or redundant
AMD IOMMU declarations, macros, and checks"
* tag 'iommu-fixes-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
iommu/amd: Remove unused macro
iommu/amd: Remove redundant checks from interrupt handler path
iommu/amd: Remove redundant check in irq_remapping_select()
iommu/amd: Make iommu_sva_set_dev_pasid as static
MAINTAINERS: Drop the nonexistent vsi-iommu.h file entry
iommu/amd: Fix ineffective error check in nested domain allocation
iommu/amd: Fix premature break in init_iommu_one() again
iommu/amd: Do not reallocate GA log buffers on resume
iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
iommu/riscv: Avoid waiting on failed command enqueue
iommu/riscv: Serialize command queue publishing
iommu/riscv: Add command queue lock
|
||
|
Linus Torvalds
|
52311be52f |
Merge tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan: - powerpc/entry: Fix double accounting of user time on interrupt entry - Fix leak in htmdump_init_debugfs - KVM: PPC: Book3S HV: Set irqfd->producer only on success - powerpc/kexec_file: print configured kernel command line - Remove redundant early_init_dt_scan_root() call - misc fixes and cleanup Thanks to Aboorva Devarajan, Amit Machhiwal, Athira Rajeev, Christophe Leroy, Christophe Leroy (CS GROUP), Kunwu Chan, leixiang, longlong yan, Michail Tatas, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM), Shivang Upadhyay, Sourabh Jain, Thibault Ferrante, Vaibhav Jain, and Venkat Rao Bagalkote * tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs powerpc/prom: Remove redundant early_init_dt_scan_root() call selftests/powerpc: use MAP_FAILED instead of (void *)-1 in tm-signal-context-force-tm powerpc/kexec_file: print configured kernel command line KVM: PPC: Book3S HV: Set irqfd->producer only on success powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value selftests/powerpc/pmu/ebb: fix lost_exception_test hang with sched yield change powerpc/entry: Fix double accounting of user time on interrupt entry |
||
|
Linus Torvalds
|
114f73092b |
Merge tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown: "One fix for pf1550 which checked for errors on multiple regulators but always notified via one of them regardless of which one had the problem, plus one device ID addition in the fan53555 DT bindings" * tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: pf1550: fix which regulator is notified regulator: dt-bindings: fan53555: add tcs,tcs4526 |
||
|
Linus Torvalds
|
0fb234ce37 |
Merge tag 'spi-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fix from Mark Brown: "New device ID for v7.3: update the DesignWare DT binding to say how to describe the UltraRISC DP1000 instance of the controller" * tag 'spi-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: snps,dw-apb-ssi: Add compatible for UltraRISC DP1000 SoC |
||
|
Linus Torvalds
|
525f0f99a4 |
Merge tag 'drm-fixes-2026-09-12' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie: "Weekly fixes pull, this seems relatively quiet for the new world, scattered fixes, mostly amdgpu leading the way, but lots of minor fixes in other drivers. drm_exec: - fix 0 object handling sched: - null ptr deref fix in kunit tests amdgpu: - Freesync fix - GPUVM fix - Debugfs fixes - HDMI fixes - IPS fix - GPU reset fix - RGB quantization fixes - SMU 13.0.x fixes xe: - runtime PM guard fix - cache flushing fix i915: - Fix a memleak on perf config query error path - Fix UHBR SST SDP splitting when sink doesn't support it bridge: - fix ti-sn65dsi83 error handling - tc358768: Enforce input bus flags via atomic_check ast: - fix blend mode property on cursor plane qxl: - fix blend mode property on primary/cursor planes virtio: - fix blend mode property on cursor plane vboxvideo: - fix blend mode property on planes rockchip: - fix endpoint name length - fix Kconfig issues ivpu: - limit firmware log prints to field size - validate buffer range in ivpu address translation - validate fw log buffers ethosu: - ensure SRAM sizing - ensure cmd stream formatting - drop IRQF_SHARED - fix open return value adp: - fix Kconfig logicvc: - fix Kconfig" * tag 'drm-fixes-2026-09-12' of https://gitlab.freedesktop.org/drm/kernel: (38 commits) drm/amd/pm: report energy accumulator for smu 13.0.0 drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 drm/amd/display: Rebuild InfoFrames on output color space changes drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output drm/amd/display: Propagate HDMI RGB quantization selectability Revert "drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_info" drm/amdgpu: skip gfx switch_power_profile during GPU reset drm/amd/display: Fix HF-VSDB DSC bpc detection to be cumulative drm/amd/display: Exit IPS before connector detection on resume drm/amd/display: Shorten hdmi_frl_status_polling_workqueue dm/amdgpu: fix malformed link_settings debugfs output drm/amdgpu: skip the VMID 0 flush for VRAM drm/amd/display: Consult MCCS FreeSync cap only if requested & supported drm/i915: Fix memory leak in query_perf_config_list() drm/i915/dp: Gate UHBR SST SDP splitting on sink capability drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches drm/xe: Guard page-fault worker with runtime PM check drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work() drm/bridge: tc358768: Enforce input bus flags via atomic_check drm/drm_exec: fix up contended obj when num_objects is 0 ... |
||
|
Linus Torvalds
|
827751b699 |
Merge tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"From a RISC-V point of view, there's one notable fix here, reverting
an earlier bogus fix to the pointer masking code. Fortunately the
practical impact appears to be small.
- Revert a bad fix, likely LLM-generated, in the pointer masking code
that confused the RISC-V hardware pointer masking implementation
with the Linux kernel tagged address feature
- Fix unexpected faults caused by kprobe instruction slot writes when
!CONFIG_STRICT_MODULE_RWX
- Fix unexpected faults on minimal configurations during runtime code
patching on !CONFIG_STRICT_MODULE_RWX systems
- Fix a misplaced variable clear causing incorrect reuse of previous
values in the RISC-V hardware feature probing code
- Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
than BIT on 64-bit masks; and use a bitmap rather than an unsigned
long on a quantity that can exceed 32 bits
And a few miscellaneous cleanups:
- Avoid a potential dereference-before-NULL-pointer-check bug in the
PMU SBI perf driver
- Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug
table code (like x86 and PPC)
- Report the RISC-V standard ISA extensions Z[v]fhmin when support is
claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
simplify our FPU test code to only check for the presence of the D
extension
- Use an existing kernel string helper in place of some open-coded
code in kernel/usercfi.c
- Fix some yamllint issues in the RISC-V DT bindings for CPUs
- Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into
the RISC-V CFI selftest code
- Update the translation for the simplified Chinese translation of
the RISC-V kernel patch acceptance policy"
* tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__
docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation
dt-bindings: riscv: cpus: Fix yamllint style issues
riscv: hwprobe: simplify has_fpu() to check D extension only
perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
perf: RISC-V: store available counter mask as bitmap
perf: RISC-V: use BIT_ULL for u64 overflow masks
riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
riscv: use string helper in setup_global_riscv_enable()
Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
riscv: patch: skip fixmap mapping when kernel text is already writable
riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
|
||
|
Linus Torvalds
|
1235ff3299 |
Merge tag 'platform-drivers-x86-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver fixes from Ilpo Järvinen: - amd/pmf: Fix build on !CONFIG_AMD_PMF_DEBUG - asus-laptop: Fix ACPI event handling - hp-wmi: Fix board_params typo for 8DD6 board - x86-android-tablets: Fix Arizona and Crystal Cove GPIO lookups * tag 'platform-drivers-x86-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: MAINTAINERS: fix sysfs-platform-ayaneo-ec documentation path platform/x86: x86-android-tablets: fix gpio_secondary_fwnode_init() not working platform/x86: x86-android-tablets: use shared battery swnode group on Yoga Tab 2 platform/x86: x86-android-tablets: drop redundant swnode group on YT3 platform/x86: x86-android-tablets: add Crystal Cove GPIO swnode support platform/x86: x86-android-tablets: pass node group to gpio_secondary_fwnode_init() platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown platform/x86: x86-android-tablets: fix Arizona GPIO swnode references platform/x86/amd/pmf: fix build on !CONFIG_AMD_PMF_DEBUG platform/x86: asus-laptop: Fix ACPI event handling platform/x86: hp-wmi: Fix board_params typo for 8DD6 board |
||
|
Linus Torvalds
|
707662b40a |
Merge tag 'ata-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fix from Niklas Cassel: - Drop documentation for no longer existing pata_legacy kernel parameters (Ethan) * tag 'ata-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: pata_legacy: remove documentation for removed module parameters |
||
|
Linus Torvalds
|
35ef102063 |
Merge tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe: - Fix the start and length check added to iov_iter_extract_bvecs(), which used iter_iov_addr()/iter_iov_len() helpers that aren't safe for the ITER_BVEC/FOLIOQ/etc iterator types passed - sunvdc fixes for an -EIO issue from lack of retries, and unmapping LDC cookies when the descriptor send fails - Clear force_abort in ublk_queue_reset_io_flags() - ublk selftest install fix * tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: selftests: ublk: add batch IO cases to recover_03 ublk: clear force_abort in ublk_queue_reset_io_flags() sunvdc: fix -EIO issue due to lack of retries sunvdc: unmap LDC cookies when the descriptor send fails block: Fix start and length check added to iov_iter_extract_bvecs() selftests: ublk: install test_common.sh and trace/ scripts |
||
|
Linus Torvalds
|
42f961c42b |
Merge tag 'io_uring-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe: - Fix a deadlock in the write path with superblock freezing - Fix an issue where a provided buffer ring would overconsume when using MSG_TRUNC - Keep the CQE flags on iopoll requests when adding kbuf flags * tag 'io_uring-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/rw: keep CQE flags on iopoll requests when adding kbuf flags io_uring/net: don't overconsume buffers when using MSG_TRUNC io_uring/net: let io_recv_buf_select return the length of the buffer region io_uring/rw: end write accounting from ->ki_complete |
||
|
Linus Torvalds
|
3026c6e4f2 |
Merge tag 'slab-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab
Pull slab fixes from Vlastimil Babka: - Stable fix for an ABA issue causing slab list corruption introduced in 7.2 (Harry Yoo, with big thanks to Hyunwoo Kim for the thorough report and initial version of the fix) - Fix for 7.3 regression of kvfree_rcu() on PREEMPT_RT which can cause a deadlock from the set_cpus_allowed_force() caller (Vlastimil Babka) * tag 'slab-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race mm/slab: disallow kfree_rcu_sheaf() on PREEMPT_RT again |
||
|
Linus Torvalds
|
576da3462c |
Merge tag 'sound-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of device-specific small fixes. At this time, the
majority of changes are about ASoC while we have usual suspects like
HD- and USB-audio quirks. Some highlights below.
ASoC Intel / SoundWire:
- Fix bus and stream resource leaks at error path in avs and hda-ext
- More fixes and refactoring in avs for constraining MSBs, async
handling D0ix
- Add support for TAC5xx2 SoundWire family and NVL MAX98360A RT5682
machines
- Fix uninitialized stream configurations in Realtek SoundWire codecs
- Adjust latency control to fix no-sound issue on RT721-SDCA
ASoC AMD:
- Avoid binding for the acp-da7219-max98357a machine driver
- Add quirks for Acer Nitro AN17-41 and HP 255R G10
- Fix memory leaks in ACP6x
ASoC Codecs & Platforms:
- Fixes for cs35l56 to avoid deadlock, kexec race, and runtime PM
imbalances
- Split stereo streams across mono amps on tas2783-sdw
- Fix pop noise on es8326 and enable_count underflow on es8389
- Various fixes for fsl_micfil, sprd, sti, and publish OF module
aliases
- Fixes & cleanups for Ux500 (MSP/I2S) and AB8500 codecs
HD-audio:
- Fix for channel status notification changes
- Quirks for HP laptops
USB-audio:
- Fix embedded URBs in caiaq, 6fire, hiface, and ua101 drivers
- More hardening in usx2y and us122l drivers
- Quirks for Behringer devices
Misc:
- Add PCI ID for RME HDSPe AIO PCI Express audio card in hdspm
- Fix S/PDIF passthrough on CA20K2 in ctxfi"
* tag 'sound-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (65 commits)
ALSA: hdspm: Add a new PCI device ID (1d18:3fc6) for RME HDSPe AIO PCI express audio
ASoC: amd: acp-da7219-max98357a: don't bind on Raven/Picasso boards
ALSA: hda: Report a change when only the channel status bytes move
ALSA: us122l: Prevent write upgrades for read mappings
ALSA: hda/realtek: Add quirk for HP Elite Dragonfly Max G2 speaker
ASoC: cs35l56: Fix race between kexec and snd_soc_register_component()
ASoC: amd: yc: add quirk for Acer Nitro AN17-41 internal mic
ASoC: mt6351: Publish the OF module alias
ASoC: Intel: SST: Publish the PCI module aliases
ASoC: bcm: bcm63xx: Publish the OF module aliases
ALSA: usb-audio: Add quirk flags for Behringer UV1
ALSA: usb-audio: Add boot quirk for Behringer CM1A
ALSA: hda/realtek: Add quirk for HP Omen 16-wd0xxx mute LED
ALSA: usbusx2y: validate URB actual_length in interrupt callback
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
ALSA: usb: 6fire: Avoid embedded URBs
ALSA: usb: hiface: Avoid embedded URBs
ALSA: usb: ua101: Avoid embedded URBs
ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
...
|
||
|
Linus Torvalds
|
d5d6c9d244 |
Merge tag 'media/v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
"Core:
- add bounded tile-count helpers for HEVC stateless decoders
- validate AV1 tile counts fits in array size
- validate HEVC tile counts fits in array size
- fix memcmp() size in B1 reference list comparison
mediatek:
- bound AV1 tile-start copy to fit in array size
rockchip:
- reject AV1 frames exceeding the tile size
- guard VPU981 AV1 divisor and tile buffer
hantro and rkvdec:
- bound G2 HEVC tile loops and PPS id to the buffer size
rppx1:
- read the raw pattern from the PRE2 acquisition module
- describe the MAIN_POST white balance gains block"
* tag 'media/v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
media: hevc: add bounded tile-count helpers
media: v4l2-ctrls: validate AV1 tile counts
media: v4l2-ctrls: validate HEVC tile counts
media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
media: rppx1: bls: read the raw pattern from the PRE2 acquisition module
media: rppx1: describe the MAIN_POST white balance gains block
|
||
|
Linus Torvalds
|
08df884136 |
Merge tag 'thermal-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fix from Rafael Wysocki: "Replace snprintf() with scnprintf() in the thermal core sysfs code to avoid compiler warnings about potential truncation of the names of the sysfs attributes (Andy Shevchenko)" * tag 'thermal-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: sysfs: switch to use scnprintf() to suppress truncation warning |
||
|
Linus Torvalds
|
5897d0546f |
Merge tag 'pm-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These harden the cpufreq core against races with sysfs during policy
creation, fix two issues in the OPP (Operating Performance Points)
library, and make OPP print symbolic error names:
- Zero-initialize the policy cpumask and initialize the policy rwsem
before exposing the policy sysfs interface (Runyu Xiao and Zhongqiu
Han)
- Fix potential multiplication overflow when calculating freq in OPP
core (Colin Ian King)
- Fix use after free in _update_opp_table_clk() (Peter Griffin)
- Use %pe to print symbolic error name in OPP (Sumeet Pawnikar)"
* tag 'pm-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
opp: fix use after free in _update_opp_table_clk()
cpufreq: zero-initialize policy cpumask before sysfs publication
cpufreq: initialize policy rwsem before sysfs publication
opp: Use %pe to print symbolic error name
OPP: of: Fix potential multiplication overflow when calculating freq
|
||
|
Linus Torvalds
|
aa416593f3 |
Merge tag 'hwmon-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- Core
- Fix potential UAF in pec_store
- Ensure that 'dev' passed to hwmon_notify_event() is a hwmon device
- Document hwmon_notify_event()
- applesmc: Fix key backlight workqueue leak on register failure
- aspeed-pwm-tacho: Propagate reset deassert errors
- asus_rog_ryujin: HID report fixes
- chipcap2: Fix channels in humidity alarm notifications
- corsair-cpro: debugfs fixes
- gpd-fan: Documentation: replace full-width colon by a standard ASCII
colon
- gpio-fan: Take fan_data->lock in gpio_fan_shutdown(), and fix
use-after-free in alarm work
- ina2xx: Fix in0 and curr1 alarm handling, and acquire hwmon_lock in
shunt_resistor_show()
- ltc4282: Fully initializeclk_init_data
- mcp9982: Propagate one-shot polling errors
- nct6694: Do not expose enable on DTIN temperature channels
- PMBus core: Clear generic status alarms with CLEAR_FAULTS
- sht4x: Fix return value from heater_enable_store(), and add missing
locks
* tag 'hwmon-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (24 commits)
hwmon: (nct6694) do not expose enable on DTIN temperature channels
hwmon: (asus_rog_ryujin) Synchronize HID command and report handling
hwmon: (asus_rog_ryujin) Validate HID report lengths
hwmon: (corsair-cpro) Remove debugfs entries when probe fails
hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
hwmon: (corsair-cpro) Create debugfs entries after hwmon registration
hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
hwmon: (chipcap2) fix channels in humidity alarm notifications
hwmon: (applesmc) fix key backlight workqueue leak on register failure
hwmon: (sht4x) Fix return value from heater_enable_store()
hwmon: (sht4x) Add missing locks
hwmon: (yogafan) fix non-kernel-doc comment
Documentation: hwmon: replace full-width colon by a standard ASCII colon
hwmon: (ina2xx) Decouple in0 and curr1 alarms
hwmon: (ina2xx) Replace masks with enum in alert functions
hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()
hwmon: Ensure that 'dev' passed to hwmon_notify_event() is a hwmon device
hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show()
hwmon: Fix potential UAF in pec_store
...
|
||
|
Linus Torvalds
|
7844502343 |
Merge tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Nothing too exciting, usual stream of fixes. Including fixes from
Netfilter, Bluetooth and WPAN.
Current release - new code bugs:
- Bluetooth: hci_sync: fix not setting CE length properly
- eth: enic: match mailbox replies to request numbers
Previous releases - regressions:
- tunnels: drop stale dst when building an ICMP error for PMTUD
- ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
(bug in the rtnl_lock -> RCU conversion)
- eth: bnxt_en:
- fix crashes on Thor2 due to OOB coalescing buffer accesses
- prevent queue stop with deferred completions
Previous releases - always broken:
- eth:
- ice: don't dereference pointers from TP_printk()
- fix OOB writes on ethtool flow rule dump in 3 drivers
- mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD
- dsa: tag_brcm: legacy FCS: request needed tailroom
Misc:
- net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc
- ipv6: flowlabel: cap duplicate leases per socket"
* tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits)
selftests: tc-testing: test action batch failure cleanup
net/sched: act_api: release all action references on NEWACTION failure
openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
ipmr: account multicast table and route memory
net: phy: dp83td510: handle the active-high LED polarity mode
net: macb: initialize PTP state before registering clock
net: hsr: enable promiscuous mode on interlink port with fwd offload
ipv6: fix fib6 walker UAF on seq stop
net: stmmac: fix TX descriptor availability check for TSO traffic
net/rds: fix tcp stream corruption with large pages
net: mana: restore the XDP program pointer when pre-allocation fails
net: phy: dp83867: handle the active-high LED polarity mode
octeontx2-af: fix PF/CGX debugfs PCI bus lookup
net: net_failover: Fix the deadlock in net_failover_slave_name_change()
net: phy: mediatek-ge: disable EEE on the MT7530 PHY
tcp: reject non zerocopy devmem tx
net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support
net: dsa: mt7530: populate lpi_interfaces to fix EEE support
net: hinic: fix mailbox segment buffer overflow
net: sun4i-emac: fix missing of_node_put() for phy_node
...
|
||
|
Linus Torvalds
|
0a96d0d726 |
Merge tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara: - File type corruption fixes in reparse point handling: setting S_IFMT bits without clearing the existing type first corrupted the file mode (e.g. S_IFREG | S_IFCHR == S_IFLNK). Fixed in the WSL, POSIX and native symlink reparse parsers. Also fixes an uninitialized SID structure in the POSIX readdir path when parsing fails. - Ownership mapping fixes: forceuid/forcegid mount options were ignored in several code paths (SID-to-id mapping, WSL extended attributes, POSIX extensions getattr), allowing an untrusted server to dictate local file ownership despite explicit mount overrides. - Heap overflow and overflow fixes in DACL rewriting: replacing short SIDs with long ones could overflow the DACL buffer, and the u16 accumulator for DACL size could wrap around with enough ACEs. - Reference count leak fixes in oplock break and deferred close: duplicate oplock breaks on a queued work item leaked a cifsFileInfo reference, and deferred close had a similar leak when requeueing a running work item. Both cause busy-inode oopses on unmount. - DFS superblock use-after-free fix: the iterator callback stored a raw superblock pointer without pinning it, racing with automount expiry. - One-byte slab OOB read in the native symlink parser when handling share-root relative paths. - Hardening of legacy SMB1 input: reject userspace-crafted cifs.idmap key descriptions that bypass kernel origin checks, and validate DataOffset in CIFSSMBRead() to prevent heap info disclosure from a malicious server. - DFS cache fix: defer metadata updates until target copying succeeds to prevent partial-state cache entries on allocation failure. * tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux: smb: client: fix one-byte OOB read in smb2_parse_native_symlink() smb: client: fail DACL rewrite when the new DACL exceeds 64K smb: client: fix heap overflow in DACL owner/group rewrite smb: client: fix file type corruption in cifs_reparse_point_to_fattr() smb: client: fix file type corruption in posix_reparse_to_fattr() smb: client: fix file type corruption in wsl_to_fattr() smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() smb: client: fix WSL reparse point uid/gid override smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid smb: client: fix uid/gid override in getattr with posix extensions smb: client: fix cifsFileInfo reference leak in deferred close smb: client: avoid leaking refcount when cifs_sb_tlink() fails smb: client: avoid leaking refcount in cifs_queue_oplock_break() smb: client: fill cache fields after populating cache in copy_ref_data() smb: client: pin DFS superblock in iterator callback smb: client: reject userspace cifs.idmap descriptions smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() smb: client: reject short READ responses in CIFSSMBRead() |
||
|
Linus Torvalds
|
ad724d319c |
Merge tag 'sysctl-7.03-fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl
Pull sysctl fix from Joel Granados:
"This fell through the cracks during the latest merge window. There are
no more CONFIG_PROC_SYSCTL uses after this fix:
- Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL
CONFIG_SYSCTL is the config string that controls sysctl subsys"
* tag 'sysctl-7.03-fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
syscall_user_dispatch: Use CONFIG_SYSCTL for sysctl guard
|
||
|
Linus Torvalds
|
c9a8c0e393 |
Merge tag 'watchdog-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog fixes from Guenter Roeck: - core: Do not start hrtimer when pretimeout is zero - msc313e: Various fixes for issues reported by Sashiko - MAINTAINERS: Update URI for watchdog tree - sunxi_wdt: preserve boot-enabled watchdog * tag 'watchdog-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: watchdog: msc313e: Sync timeout value if WDT was running at boot watchdog: msc313e: Fix undefined behavior watchdog: msc313e: Fix spurious reset on suspend watchdog: msc313e: Enable clock before accessing hardware registers watchdog: msc313e: Fix clock leak and spurious timer in settimeout() watchdog: msc313e: Avoid division by zero watchdog: fix hrtimer start when pretimeout is zero MAINTAINERS: Update URI for watchdog tree watchdog: msc313e: Fix NULL pointer dereference in PM callbacks watchdog: sunxi_wdt: preserve boot-enabled watchdog |
||
|
Linus Torvalds
|
50d05c7c76 |
Merge tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux
Pull Landlock fixes from Mickaël Salaün: "This fixes a use-after-free and a lockdep assert NULL dereferencing, and properly truncates too-long strings printed by a Landlock tracepoint. Most of the changes are brought by new tests" * tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Test trace path output boundaries landlock: Bound escaped trace path output landlock: Clean up ruleset validation checks selftests/landlock: Test abstract socket trace name limits landlock: Fix use-after-free of the source's parent directory |
||
|
Linus Torvalds
|
5e1287972b |
Merge tag 'vfs-7.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- netfs:
- Fix an uninitialized return value in netfs_unbuffered_write()
when preparing the first subrequest fails
- For partial unbuffered/DIO writes return the amount transferred
rather than an error
- Update i_size with the amount actually written when a partial
transfer ends in an error
- Fix a subrequest reference leak when the io_iter ends up empty
- Handle netfs_alloc_subrequest() failure during unbuffered writes
- Load all readahead folios into the rolling buffer upfront and
drop the readahead references once the first subrequest is
dispatched
- Mark folios for copy-to-cache while issuing subrequests
- Fix read progress reporting
- afs:
- Add the missing kunmap in the error path of afs_dir_search_bucket()
- Fix a double kunmap in afs_edit_dir_remove()
- Don't free an existing server's endpoint state when cleaning up a
candidate server in afs_lookup_server()
- Unbind peers removed from a server's address list
- ufs:
- Load the cylinder group metadata before creating the root dentry
- Validate the cylinder group index and rotor positions before
caching them
- Treat an unreadable directory block as not empty
- exec:
- Close the close-on-exec files before taking exec_update_lock
Closing a file can block on the filesystem, so a hung filesystem
blocked everything that takes exec_update_lock and a FUSE server
inspecting the calling process could deadlock
- Drop the bprm loader before closing bprm->file in free_bprm()
- exit: Hold a reference to thread_pid across proc_flush_pid()
- reboot: Fix a use-after-free on cad_pid
- nsfs: Keep the namespace tree fields out of the rcu_head used by
kfree_rcu()
- nstree: Check listing permission before taking a namespace
reference in listns()
- super: Return 0 when a nested thaw drops its hold while other
freezers remain
- ext4: Don't set I_METADATA_WRITEBACK during fastcommit replay
- adfs: Free s_fs_info in ->kill_sb()
- autofs: Free the inode info allocated in autofs_fill_super() when
the root inode allocation fails
- ovl: Return EINVAL instead of EIO on a user namespace mismatch now
that it's a plain refusal and not an internal error
- cachefiles: Don't cast the variable-length coherency data to a
__be64 in the coherency tracepoint
* tag 'vfs-7.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
nstree: check listing permission before taking a namespace reference
exec: do_close_on_exec() before taking exec_update_lock
exit: hold a reference to thread_pid across proc_flush_pid
fs: autofs: fix memory leak in autofs_fill_super()
exec: Drop bprm loader before closing bprm->file
afs: Clear stale peer app data after address list changes
afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
afs: Fix double-unmap of directory block
afs: Fix missing kunmap in afs_dir_search_bucket()
ovl: return EINVAL instead of EIO in case of mismatched user_ns
reboot: fix cad_pid use-after-free race
cachefiles: Fix potential UAF/KASAN warning
netfs: Fix read progress reporting
netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs
netfs: Fix readahead synchronisation issues by loading all folios upfront
netfs: break unbuffered write when netfs_alloc_subrequest() fails
netfs: Fix subreq ref leak
netfs: Fix i_size update for partial transfer
netfs: Fix error vs transferred passed to ->ki_complete()
netfs: Fix unbuffered/DIO write partial transfer error return
...
|
||
|
Linus Torvalds
|
4f3989d75d |
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull virtio fixes from Michael Tsirkin: "Just a ton of small fixes all over the place. Also includes virtio and virtio-rng MAINTAINERS updates" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (27 commits) vduse: return compat ioctl results directly virtio_input: stop callbacks before unregistering input device virtio_input: reset device if input_register_device() fails vhost: invalidate vring access on IOTLB transitions vduse: validate virtqueue alignment vduse: do not take dev->rwsem in the virtqueue kick path vhost-scsi: clamp max_io_vqs module parameter vhost-scsi: use kvzalloc for vq array allocation virtio-pci: return IRQ_HANDLED after non-zero ISR virtio: add Eugenio Pérez as Maintainer vhost: limit outstanding IOTLB misses per virtqueue MAINTAINERS: Add a section for virtio-rng vdpa_sim_net: check TX pull result before RX copy vdpa_sim_blk: reject out-of-range sector starts virtio-vdpa: Use queue id when setting vq affinity vdpa: octeon_ep: Check dev_set_name() in dev add vdpa: ifcvf: Put device on unsupported feature error vdpa: solidrun: Free IRQs after request failure vdpa: alibaba: Keep DRIVER_OK clear if IRQ setup fails vdpa/pds: check virtqueue notify mapping ... |
||
|
Linus Torvalds
|
3f8b8c94a7 |
Merge tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk fixes from Petr Mladek: - Use lazy irq_work for waking printk kthreads - Flush pending irq_work before destroying printk kthreads - Remove redundant WARN() when a printk kthread can't be created - Typo fix * tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY printk/nbcon: Flush nbcon_irq_work in nbcon_free() console: fix /dev/kmsg reference in flags kernel doc printk: Don't WARN on kthread_run failure. |
||
|
Linus Torvalds
|
893e11787f |
Merge tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Dave Hansen: "These are fixes for some older AMD device topology and machine check issues. But, they are issues that are affecting real users and aren't just cleaning up AI drive-by reports. These is coming a wee bit later than the usual Sundays because of a late breaking issue with one of the patches which is now temporarily kicked out" * tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/MCE/AMD: Fix inverted interrupt enablement during storm handling x86/amd_node: Fix potential NULL pointer dereference x86/amd_node: Avoid divide by zero on virtualized systems |
||
|
Linus Torvalds
|
5acbae5f7e |
Merge tag 'powerpc-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan: - Clear TIF_SYSCALL_RET before syscall error return - Don't drop _TIF_RESTOREALL on syscall restart - Do not restore KUAP in arch_exit_to_user_mode_prepare() - pci-ioda: Fix the stale irq chip reference - Use inclusive range checks in add_usable_mem() and excluded memory - Fix irq_soft_mask corruption on replayed interrupt exit - MAINTAINERS: powerpc: Add Ritesh and Shrikanth - Misc fixes and cleanups Thanks to Amit Machhiwal, Christophe Leroy (CS GROUP), Gautam Menghani, Harsh Prateek Bora, Jiangshan Yi, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM), Shivaprasad G Bhat, Shrikanth Hegde, Sourabh Jain, Tasmiya Nalatwad, Thorsten Blum, and Venkat Rao Bagalkote. * tag 'powerpc-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: MAINTAINERS: powerpc: Add Ritesh and Shrikanth powerpc/ps3: Fix repository.c build failure powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit powerpc/pseries/pci: Fix misleading VF limit error message powerpc/kexec_file: Use inclusive range checks for excluded memory powerpc/kexec: Simplify kdump_extra_elfcorehdr_size() powerpc/kexec_file: Use inclusive range checks in add_usable_mem() powerpc/rtas_pci: No hotplug on permanently removed device on pSeries powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver powerpc: pci-ioda: Fix the stale irq chip reference powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() powerpc: Don't drop _TIF_RESTOREALL on syscall restart powerpc/entry: Clear TIF_SYSCALL_RET before syscall error return |
||
|
Linus Torvalds
|
7daadf5131 |
Merge tag 'v7.3-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu: "This adds missing vzeroupper instructions to x86/aria" * tag 'v7.3-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: x86/aria - add missing vzeroupper in AVX-512 code crypto: x86/aria - add missing vzeroupper in AVX2 code |
||
|
Linus Torvalds
|
28924df2a0 |
Merge tag 'perf-tools-fixes-for-v7.3-2026-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools
Pull perf tools fixes from Namhyung Kim: "Two simple fixes for this cycle: - Do not use separate debug files for Intel PT decoding - Fix size of raw data in the PowerPC VPA DTL samples" * tag 'perf-tools-fixes-for-v7.3-2026-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf powerpc-vpadtl: Fix raw_size of DTL samples perf symbol: Do not use debug file as the binary type |
||
|
Linus Torvalds
|
c297ed90fb |
Merge tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux
Pull configfs fixes from Breno Leitao: - A symlink racing with rmdir of its target could reach a freed ->ci_dentry. The reference that get_target() takes pins the config_item, not its dentry; the dentry is pinned by DCACHE_PERSISTENT, which configfs_remove_dir() drops while the item is still alive. Take the target's configfs_dirent under ->d_lock instead of chasing ->ci_dentry. - configfs_rmdir() left the dentry hashed across the final put of the item, and configfs_get_config_item() treats a hashed dentry as proof of a live item. A concurrent symlink could therefore resurrect a dying item and hit a use-after-free. Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. Both issues were found by syzbot. * tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux: configfs: unhash the dentry before dropping the item in rmdir configfs: pin the symlink target's dirent instead of chasing ->ci_dentry |
||
|
Linus Torvalds
|
df2908090c | Linux 7.3-rc2 | ||
|
Linus Torvalds
|
b1e00ffaf9 |
Merge tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt: - Fix several tracefs files that did not take the trace_array reference A trace instance can be created and destroyed in the tracefs "instances" directory via mkdir and rmdir respectively. The instance is represented by a trace_array descriptor. Most tracefs files pass the trace_array as the private data of the inode to the open/read/write functions. Since there is no locking between the time a task opens a file and the deletion of the instance (and the freeing of the trace_array), each open needs to get a reference to the trace_array and each close must remove it. An instance can't be removed if there's any reference taken on its trace_array. The open function uses trace_array_get() that takes a lock (preventing removal of instances) and iterates the list of all existing trace_arrays and if it finds a match, it takes the reference and releases the lock. If it doesn't find a match, it causes the open to return -ENODEV. There were some added files that did not take the trace_array reference on open that needed to be fixed. Sashiko also correctly pointed out that there were some files that took an address of an field or element of the trace_array which had a pointer back to the trace_array to take its reference on open. But this leaves a slight race between referencing this element to get the trace_array as the element itself could be freed. To solve this, some helper functions were created to look for trace_arrays with this field or element in the search so that the element did not have to be dereferenced before the trace_array's reference was taken. - Add a lock around ftrace_ops initialization When a ftrace_ops is first used by ftrace, some internal initialization is performed on the ops. But if multiple tasks were calling functions that did this initialization, it could race and perform doing the initialization more than once, corrupting the internal data. Add a lock in the initialization code to prevent this from happening. - Fix splice reads on mmapped buffers The logic in the ring buffer splice code for mmapped buffers is supposed to do a copy of the memory as the mapped buffers can't be given to splice. But there was an if statement within the copy code that would return a -1 if a request for a full page was done and it wasn't a partial read. This is because this logic was written before mmapped buffers existed and this case didn't make sense at the time. For mmapped buffers it makes perfect sense and by returning early can drop a lot of pages unnecessarily. - Have the persistent ring buffer validation check nr_subbufs Sashiko reported that the validation code was relying on the saved nr_subbufs to match the calculated nr_pages + 1 and if they were off, that the code could cause corruption. Sashiko is correct, and the saved nr_subbufs should be validated before assuming it is correct. - Do not allow more than one instance with the same name on cmdline If an admin were to add more than one trace instances with the same name they all would be created, but only the first one would be accessible via tracefs. This used to not be allowed but some restructuring of code has since made it possible. - Fix the race between subbuf resize and trace_pipe_raw readers If a task was reading trace_pipe_raw while another task was changing the ring buffer subbuf size, it could crash the reader. The trace_pipe_raw readers do get their own copy of the page from the buffer, but the code needs some restructuring to not have the resize of the subbuffers cause issues. - Cap the size of the mapped (static) ring buffer nr_pages The meta data used for ring buffer mapped buffers is 32 bit in size. A normal ring buffer could (in theory) have more than 4 billion pages. But this is not allowed by mapped buffers, so enforce it. * tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Use a macro for static buffer bits tracing: Fix comment in tracing_buffers_splice_read() ring-buffer: Prevent truncation of nr_pages / nr_subbufs ring-buffer: Cap static ring buffer nr_pages tracing: Fix subbuf resize races with trace_pipe_raw readers tracing: Fix to avoid creating trace instances with duplicate names ring-buffer: Add checking nr_subbufs to persistent ring buffer validation ring-buffer: Allow splice reads on static buffers tracing: Take trace_array reference when opening options file ftrace: Synchronize the initialization of ftrace_ops ftrace: Take trace_array reference before accessing its ftrace_ops tracing: Have show_event_filters/triggers files take trace array ref |
||
|
Linus Torvalds
|
2beb1b31a1 |
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
"This mainly contains verifier fixes that address bugs reported by
Nicholas Carlini.
- Fix incorrect non-NULL inference in pointer comparisons: pointer
types that may be NULL at runtime, pointers with unbounded offsets,
JMP32 comparisons with zero, and imprecise zero registers (Eduard
Zingerman)
- Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
NULL call arguments (Eduard Zingerman)
- Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
patterns entered by a jump (Eduard Zingerman)
- Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
(Hui Su)
- Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
and reject key-less BTF for hash maps (Jiayuan Chen)
- Various fixes (Kumar Kartikeya Dwivedi):
- Fix out-of-bounds access in disassembler on invalid LDSX
instruction
- mark siginfo of signal tracepoints as scalar and
sched_process_wait argument as nullable
- mark faultable stack helpers as sleepable
- reject tail calls and legacy packet loads from callbacks
- enforce rbtree callback lock restrictions for resilient locks
- require MEM_PERCPU for percpu kptr stores
- clear NON_OWN_REF after RCU protection ends
- mark NULL kptr stores precise
- preserve inner map identity in callback frames
- reject non-scalar bpf_loop() iteration counts
- Fix trampoline allocation slowdown on x86 by using
EXECMEM_MODULE_DATA (Mike Rapoport)
- Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
reject untrusted allocated-object pointers (Ning Ding)
- Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
Yuan Chen)"
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
bpf, riscv: Make arena support depend on ZACAS
selftests/bpf: Test pointer bpf_loop iteration count rejection
bpf: Reject non-scalar bpf_loop iteration counts
bpf: use mark_arg_precision() in check_mem_size_reg()
bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
selftests/bpf: precision of a NULL global subprogram BTF_ID argument
bpf: mark a NULL BTF_ID argument of a global subprogram precise
selftests/bpf: precision of a NULL kfunc argument
bpf: mark a NULL kfunc argument precise
selftests/bpf: precision of a NULL global subprogram memory argument
bpf: mark a NULL memory argument of a call precise
selftests/bpf: precision of a NULL helper argument
bpf: mark a NULL call argument precise
selftests/bpf: Test inner map identities in callbacks
bpf: Preserve inner map identity in callback frames
selftests/bpf: Test imprecise scalar kptr stores
bpf: Mark NULL kptr stores precise
selftests/bpf: Test rhtab kptr cancellation semantics
bpf: Cancel special fields when recycling rhtab elements
selftests/bpf: Test timer field on recycled rhtab element
...
|
||
|
Linus Torvalds
|
88405f0ad1 |
Merge tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar: - Fix a timestamping bug in pick_task_fair() and yield_task_fair() (Zhan Xusheng) - Skip migrate-disabled tasks when picking a push candidate in the RT and DL schedulers (Seiji Nishikawa) - Skip rq->avg_idle update without a valid idle_stamp (Shubhang Kaushik) - Fix throttling bug in throttle_cfs_rq(), caused by the recent single-runqueue conversion (Wanwu Li) - Fix bandwidth calculation bug in distribute_cfs_runtime(), caused by the single-runqueue conversion (Wanwu Li) - Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello) - Avoid creating misfits during cache-aware load-balancing on hybrid systems (Tim Chen) * tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Avoid creating misfits during cache-aware balancing x86/itmt: Don't make ITMT enablement depend on debugfs sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime() sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq() sched/core: Skip rq->avg_idle update without a valid idle_stamp sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers |
||
|
Linus Torvalds
|
c4a3928e7d |
Merge tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar: - Skip empty AUX records with only format flags (Leo Yan) - Fix use-after-free when perf mmap() revival races with the last munmap() (Yilin Zhang, Weiming Shi) * tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix use-after-free when perf mmap() revival races with the last munmap() perf/core: Skip empty AUX records with only format flags |
||
|
Linus Torvalds
|
c8990f3179 |
Merge tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar: - Fix a softirq processing delay bug in local_interrupt_disable(), which should mostly only affect the Rust runtime (Boqun Feng) - Remove the hardirq_disable_count() function which caused the previous bug and is now unused & unnecessary (Boqun Feng) - lockdep: Invalidate stale class_cache entries for zapped classes (Eric Dumazet) - Fix rt_mutex specific futex scheduling helpers (Sebastian Andrzej Siewior) - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai) * tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Prevent rcuwait use-after-free during requeue PI futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling locking/lockdep: Invalidate stale class_cache entries for zapped classes preempt: Remove hardirq_disable_count() interrupt: Disable interrupt before modifying hardirq_disable counter |
||
|
Linus Torvalds
|
b485131995 |
Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull IRQ subsystem fixes from Ingo Molnar: - Revert a commit to the mbigen irqchip driver that caused a regression on two-port Hi1616 chips (Caina) - Fix a too-long-preemption-off bug in the stm32mp-exti irqchip driver, caused by a time unit ambiguity & mismatch (Ju Nan) - Remove the now completely unused irq_domain_add_linear() inline function (Jiri Slaby) * tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Revert "irqchip/mbigen: Fix mbigen node address layout" irqdomain: Delete irq_domain_add_linear() |
||
|
Linus Torvalds
|
d3cbb9af72 |
Merge tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull virtio console fix from Greg KH: "Here is a single virtio console fix for 7.3-rc2 to fix a much reported regression in 7.3-rc1, sorry about that. It's not been in linux-next, but it has been sent by many different developers to resolve the issue and is 'obviously' correct" * tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: virtio_console: allocate the port_buffer with the caller's gfp |
||
|
Linus Torvalds
|
bf979ab8f2 |
Merge tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes to resolve some reported bugs that have been found, and tested, in a few staging drivers in 7.3-rc1. Included in here are: - OOB read problem fixes in the rtl8723bs driver - fbtft driver fix - sm750fb driver fix All of these have been in linux-next this week with no reported problems" * tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() staging: fbtft: make dirty_lock IRQ-safe |
||
|
Linus Torvalds
|
65538a8f02 |
Merge tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH: "Here are some small USB driver fixes for reported problems and regressions. Include in here are: - xhci driver fixes - cdns3 driver fixes - usb gadget driver fixes for syzbot found problems - typec driver fixes for broken hardware and other bugs found - kernel data leaks in mdc800 driver - usb storage driver fixes - other small USB driver fixes All of these have been in linux-next this week with no reported issues" * tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits) usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop usb: gadget: fix null pointer dereference in usb_put_function_instance() usb: typec: qcom-pmic: cancel reset_work on stop usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() usb: storage: realtek_cr: fix use-after-free on disconnect usb: cdnsp: fix wakeup from S3 after controller context loss usb-storage: ene_ub6250: fix race between scan work and probe USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() usb: gadget: f_midi: initialize work in f_midi_alloc() usb: gadget: f_midi2: fix use-after-free in string attribute show path usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs usb: typec: hd3ss3220: track VBUS enable state per consumer usb: dwc3: clear forceRM when issuing EndTransfer usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES usb: typec: mux: avoid duplicated mux switches usb: typec: mux: Fix typec_switch_match() usb: image: mdc800: change kmalloc() to kzalloc() ... |
||
|
Linus Torvalds
|
1fc5a74b10 |
Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull kmalloc_obj conversions from Kees Cook: "Another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci" * tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: treewide: refresh kmalloc_obj() conversions drm/amd/display: Fix harmless type mismatch in allocation |
||
|
Linus Torvalds
|
9f0346dcbe |
Merge tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core fixes from Danilo Krummrich: - Fix kernfs listxattr() not returning security xattr names (e.g. SELinux labels) when the kernfs node has no allocated kernfs_iattrs - Fix silent truncation of IRQ vector indices in the Rust PCI abstractions - Don't select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is disabled instead of silently enabling extra kernel functionality - Russ Weight is retiring from kernel development; update the Firmware Loader sysfs contact to the driver-core mailing list, add a CREDITS entry for Firmware Upload, and update MAINTAINERS accordingly * tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: MAINTAINERS: Remove Russ Weight from Firmware Loader CREDITS: Add CREDITS entry for Firmware Upload firmware_loader: Change contact for sysfs nodes rust: pci: reject IRQ vector indices that do not fit in u32 kernfs: preserve security xattrs without allocating iattrs drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF |
||
|
Linus Torvalds
|
214f4aeb22 |
Merge tag 'loongarch-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch fixes from Huacai Chen: - Fix build errors when RUST and KASAN enabled - fix a typo in comment of vmlinux.lds.S - fix several bugs in Kprobes, BPF JIT and KVM support * tag 'loongarch-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: perf build: Add clang and rust target flags for LoongArch LoongArch: KVM: Fix TOCTOU race on pv_features LoongArch: KVM: Validate MSI data before routing it to EIOINTC LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY LoongArch: KVM: Remove unused function kvm_arch_flush_remote_tlbs_memslot() LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path LoongArch: KVM: Add unregister helpers for the KVM interrupt devices LoongArch: KVM: Free init resources if kvm_init() fails LoongArch: BPF: Fix off-by-one error for insn_is_cast_user() LoongArch: Avoid preempt count underflow without probe LoongArch: Do not save/restore percpu base register in rethook trampoline LoongArch: Remove unused setup_profiling_timer() function LoongArch: Fix typo "avaliable" in comment of vmlinux.lds.S LoongArch: Do not select HAVE_RUST when KASAN is enabled |
||
|
Linus Torvalds
|
d9d80a859b |
Merge tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
- preserve inode compression level when changing attributes
- fix lost wakeup when waiting for a zstd workspace
- fix bio context leaks after ordered extent processing errors
- in send, handle unexpected extents for non-regular inodes
- handle edge case in creation of reloc tree with enabled quotas
- in scrub report the exact failing offset, not the stripe base
- error handling fixes
- error code propagation in send, zoned mode and raid-stripe-tree
- restore active device pointer after seeding device addition error
- transaction abort fixups
- update Chris' email address
* tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
MAINTAINERS: update Chris Mason's email address
btrfs: tests: do not touch page cache if root/inode allocation failed
btrfs: zstd: fix lost wakeup when waiting for a workspace
btrfs: do not force reloc root creation during qgroup_account_snapshot()
btrfs: send: fix lost error return value in will_overwrite_ref()
btrfs: abort transaction before releasing tree_log_mutex on commit failure
btrfs: zoned: propagate do_zone_finish() error in btrfs_zone_finish_endio()
btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
btrfs: send: reject extents for non-regular inodes
btrfs: return proper negative error code for update_raid_extent_item()
btrfs: fix the possible bioc_list memory leak during error
btrfs: fix transaction use-after-free in raid stripe insertion
btrfs: scrub: report the failing sector's address, not the stripe base
btrfs: preserve the compression property when other inode flags change
btrfs: restore active device pointers after failed sprout
btrfs: detach failed sprout device from transaction update list
btrfs: clean up target device if block group marking fails
|
||
|
Linus Torvalds
|
0d9ff90a54 |
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley: "Two enhancements to add support and MCQ for additional Intel 4.0 controller types. The rest are all driver fixes, the largest of which is the mpi3mr target use after free fix, follwed by a similar TOCTOU fix for io_uring passthrough in bsg" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame scsi: bsg: Fix TOCTOU in io_uring passthrough command setup scsi: bsg: Cap io_uring sense copy to max_response_len scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() scsi: mpi3mr: Fix use-after-free on tgt_dev->starget during target device refresh/update scsi: target: iscsi: Reserve a terminator byte for the login payload scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5 scsi: sg: Report request-table problems when any status is set scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() scsi: ufs: ufs-qcom: Fix sequential read variance scsi: ufs: ufs-qcom: Restore HS/LS link startup mode for Qualcomm UFS controller v6.2+ scsi: ibmvfc: Document protocol parameter of ibmvfc_alloc_target() scsi: ibmvfc: Fix kernel-doc name for ibmvfc_scsi_relogin() scsi: pm8001: Use rollback index when freeing MSI-X vectors scsi: fnic: Initialize the NVMe local port info before registering |
||
|
Linus Torvalds
|
d0fc310b4d |
Merge tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- nvme-tcp fixes for an out-of-bounds write on an over-long PDU
- nvmet-tcp, nvmet-rdma and nvme-rdma leak and cleanup-ordering
fixes
- FDP placement id array racy access fix
- nvme-fc double free of fabrics options on nvme_add_ctrl()
failure, and a secret leak failure
- Fault injection opcode filtering
- stale namespace removal during scan
- Various other smaller fixes and cleanups
- Flag zoned disks with GENHD_FL_NO_PART
- Save the page offset gaps in a cloned bio
- Fix dma_alignment for large or unreported limits in loop and zloop
- Clear VM_MAYWRITE on a read-only ublk char device mmap
* tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (25 commits)
nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
nvmet: reject namespace enable without device path
nvmet-auth: Synchronize timeout work during SQ teardown
MAINTAINERS: update nvme entry
nvmet-tcp: reject unsolicited H2CData PDUs
nvme-tcp: defer TLS inline send to io_work
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
nvme-tcp: return -EPROTO for a C2HData on a write
nvmet: print namespace IDs as unsigned 32bit value
nvme: print namespace IDs as unsigned 32bit value
nvme: remove stale namespaces by NSID range during scan
nvme: add missing SRCU grace period in error path
nvme-fabrics: fix DHCHAP secret leak on parse failure
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
loop, zloop: fix dma_alignment for large or unreported limits
block: save page offset gaps in cloned bio
block: flag zoned disks with GENHD_FL_NO_PART
nvmet-rdma: fix queue leak when connect backlog is exceeded
nvme: add opcode filtering for fault injection
...
|
||
|
Linus Torvalds
|
4d7d9486c0 |
Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull IMA fixes from Mimi Zohar: - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks resulted in configfs locking issues. configfs files should not be measured, appraised, or audited in the first place, so the builtin policies are updated to exclude them. - IMA audit messages include the filename, which could result in a page fault when the filename doesn't exist - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt * tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() ima: don't measure/appraise files on configfs configfs: move CONFIGFS_MAGIC definition to magic.h |
||
|
Linus Torvalds
|
654ae5d73c |
Merge tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Lots of scattered fixes: nouveau has a bunch of display fixes for
blackwell GPUs that should mean we light up monitors properly and fix
some desktop rendering problems, amdgpu and intel display changes as
usual.
There also changes to the core pagemap, then the usual amouny of AI
inspired validation fixes.
core:
- Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used
dma-buf:
- Publish the dma-buf only after copy_to_user succeeds
- fix some kernel-doc warnings
atomic-state-helpers:
- set pixel_blend_mode to prop default on reset
sysfb:
- Fix integer overflow
- fix constant comparison bug
pagemap:
- Prevent double migration of device pages
- Reset migration page count on eviction retry
- dma-unmap pages before handling migration errors
- use after free fixes
prime:
- fix prime exports tracing
amdgpu:
- Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit
userspace
- plane blend mode fixes
- SR-IOV fix
- GFX8 fix
- MES queue reset fix
- GPUVM fixes
- DCN 6 warning fix
- DCN 3.5/3.6 fix
- DML fix
- Backlight fix
- Colorop fix
- DC get_estimated_bw() fix
- devcoredump fix
- Userq fixes
- APU PSP fix
- Cursor fix
amdkfd:
- MES queue eviction fix
- MQD debugfs fix
xe:
- oa uapi error handling fix
- drm info message to report FLAT_CSS base misalignment
i915:
- Drop an accidentally duplicated panel fitter call in DP MST
- Fix DDI clock programming for Cx0 and LT PHY
- Fix PTL CDCLK handling at probe, causing a glitch
- Fix dg2_power_well_count() return type
- Fix a NULL pointer deref at forced probe
- Fix selective fetch disable
amdxdna:
- out-of-bounds access fix
- reject commands chains with no commands
- handle chained mapping BO failures
- refuse to flush an imported BO
ethosu:
- handle mmio mapping failures
- handle storage modes only on hardware that supports it
- fix job completion fence cleanup
fastrpc:
- Publish the dma-buf only after copy_to_user succeeds
gud:
- Improve TV modes and rotation handling
nouveau:
- use-after-free fixes
- add missing scanline position support
- HDMI and DP fixes
- null pointer dereference fix
- dmem accounting fixes for large folios
- use write-combined maps for coherent
qaic:
- out-of-bounds access fix
tegra:
- Add blend mode properties
virtio:
- exit path and error handling fixes
* tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel: (83 commits)
drm/xe/vram: report FLAT_CCS base misalignment
MAINTAINERS, mailmap: use Aditya Garg's linux.dev account
drm/amd/display: use plane color_mgmt_changed to track colorop changes
drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile
drm/amd/display: Fix cursor disable with horizontally split planes
drm/amdgpu/userq: dont overwrite the error of subsequent map call
drm/amdgpu: Skip accessing psp rum time db for APUs
drm/amdgpu: update the fw version for gfx12 userqueues
drm/amdgpu: update the fw version for gfx11 userqueues
drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump
drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
drm/amd/display: fix division by zero in get_estimated_bw()
drm/amd/display: use halving distribution for all encode-to-linear curves
drm/amd/display: Fix backlight control for luminance-capable OLED
drm/amd/display: Remove const Qualifier From Non-Pointer Fields
drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
drm/amd/display: Fix DCN5/6 DML2 compilation warnings
drm/amdgpu: fix Idle BOs list in VM debugfs status info
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
drm/amdgpu: Update queue reset support version
...
|
||
|
Linus Torvalds
|
3f17a52d47 |
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"Nothing Earth-shattering, but worthwhile fixes nonetheless:
- Disable interrupts during page-table walk in show_pte()
- Fix kexec_file_load() with 52-bit capable kernels on machines
without 52-bit addressing
- Fix MIDR matching in CPU errata handling for KVM guests
- Avoid reading MTE-specific ID registers when MTE support is
disabled"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: Don't read GMID_EL1 when MTE is disabled
arm64: errata: pass REVIDR when matching target implementation CPUs
arm64: trans_pgd: clone only the linear map that exists at runtime
arm64: mm: Fix the lockless page-table walk in show_pte()
|
||
|
Linus Torvalds
|
408802f1e6 |
Merge tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client
Pull ceph fixes from Ilya Dryomov: "A small fixup for the new nearfull_sync mount option, a potential use-after-free fix (marked for stable) and a patch that eliminates the last use of PageWriteback macro in the tree" * tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client: ceph: apply nearfull_sync option on remount libceph: remove pinning assertion in ceph_msg_data_iter_next() ceph: lock mutex in ceph_mds_check_access() |
||
|
Linus Torvalds
|
986c24e0fe |
Merge tag 'hid-for-linus-2026090401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID fixes from Benjamin Tissoires: - hid-hyperv build fixes on certain configs (Jiri Kosina) - HID-BPF fix and selftests now that the bpf verifier is more restrictive (Benjamin Tissoires) - Some AI detected fixes for OOB, errors and validation (Ibrahim Hashimov, Shen Yongchao, Wei Jie Law) - various device fixes (Dave Carey and Vadim Klishko) * tag 'hid-for-linus-2026090401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: bpf: serialize device reference release in struct_ops destroy path HID: rmi: fix OOB access with undersized RMI reports selftests/hid: prepare test_rdesc_fixup_get_data_overflow for the new verifier selftests/hid: Add a test to ensure we can write fields in hid_device HID: bpf: mark struct hid_device as safe BPF pointer HID: wacom: validate report length in wacom_intuos_pro2_bt_irq HID: multitouch: Fix stale MT slots when contact count drops to zero HID: i2c-hid: Add a quirk for a Cirque I2C device. HID: hyperv: make pointer arithmetics understandable for FORTIFY_SOURCE HID: hyperv: fix build breakage with certain configs |
||
|
Linus Torvalds
|
36ec09e263 |
Merge tag 'sound-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of small fixes since 7.3-rc1.
Quite a few fixes are for ALSA core for issues that have been detected
by the things you know well. Additionally a series of hardening for
runtime PM, and usual quirk updates, and some other misc driver fixes
are included.
Core:
- Fixes for PCM races
- UMP parser NULL dereference fix
- Fix error handling in rawmidi ioctl
USB- and HD-audio:
- Implement missing runtime PM guards across multiple interfaces
- Fix for OOB access in US-122L MIDI driver
- Double-free fix for CAIAQ driver
- Quirks for HD-audio Realtek & Cirrus codecs, Conexant S3-resume,
USB Audient devices
Others:
- Fix of logical mistakes in dummy driver mixer and selftest code
- Lock init fix in the legacy harmony driver"
* tag 'sound-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits)
ALSA: caiaq: Fix potential double-free at error path
selftests/alsa: Fix the step check for INTEGER controls
ALSA: hda/realtek: Fix cold-boot headset misdetection on Acer Aspire A515-57G
ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
ALSA: ump: do not touch legacy_rmidi before it exists
ALSA: hda/cs420x: Add CS4208 fixup for MacBookAir 7,2
ALSA: dummy: Report a change when one capture switch channel moves
ALSA: usb-audio: Add mixer map quirk for Audient iD24
ALSA: hda: restore MFG widget enumeration after core split
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
ALSA: harmony: initialize locks before requesting IRQ
ALSA: hda/realtek: Add quirk for VAIO VJS131
ALSA: pcm: Fix race between non-atomic ops and trigger-start
ALSA: hda/realtek: Add quirk for Acer Predator PHN16-72
ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 9 14ILL10
ALSA: hda/conexant:Fix abnormal Mic/Speaker functionality on SN6140 after S3 wake-up
ALSA: usb-audio: Guard FCP protocol transfers
ALSA: usb-audio: Add PM guards to RME Digiface controls
ALSA: usb-audio: Guard Scarlett2 protocol transfers
...
|
||
|
Linus Torvalds
|
3e66602704 |
Merge tag 'ata-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Niklas Cassel: - Work around lost interrupts on Marvell 88SE61xx The Marvell AHCI controller requires you to clear interrupts in the opposite order from what is specified in the AHCI specification in order to not lose interrupts (Hajo) - Do not raise UNIT ATTENTION for depopulation commands The libata completion function unconditionally sets sense data with sense key UNIT ATTENTION (UA) for depopulation commands. The SCSI layer will fail a command when seeing this sense data. UA is only supposed to be raised if the capacity actually changed. Since these commands are currently only supported as passthrough commands, the user is expected to revalidate the device, which will detect a capacity change anyway. Thus drop the unconditional UA until a better solution has been implemented (Damien) * tag 'ata-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-scsi: do not raise UA for storage element depopulation and restoration ata: ahci: work around lost interrupts on Marvell 88SE61xx |
||
|
Linus Torvalds
|
58f93a4b73 |
Merge tag 'ksmbd-for-7.3-rc2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server fixes from Namjae Jeon: - Fix a tree connection use-after-free in smb2_tree_connect() by balancing references across concurrent connect, disconnect, and session logoff paths. - Validate source and target ranges in COPYCHUNK requests before range locking and copy operations. - Fix an oplock break notification UAF by acquiring a connection reference under ksmbd_inode lock and releasing it after the notification work completes. - Fix the sparc build by using an unsigned int for the atomic work state, ensuring xchg() uses a supported four-byte operation. * tag 'ksmbd-for-7.3-rc2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd: validate COPYCHUNK source and target ranges ksmbd: fix use-after-free in oplock break notification ksmbd: fix sparc build with atomic work state |
||
|
Linus Torvalds
|
421066905c |
Merge tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes fixes from Masami Hiramatsu: - Protect kprobe_blacklist with RCU RCU-protect kprobe_blacklist and use kfree_rcu() to prevent UAF races during module unloading and enable safe atomic lookups. - Fix multi-probe field use-after-free Duplicate field and type strings on trace_probe_event to prevent UAF when freeing primary probe - Fix probe BTF member lookup: Check the containing inner struct/union kflag when resolving anonymous members to ensure correct bitfield offset calculation Prevent unnamed bitfields from being pushed to anon_stack in btf_find_struct_member(), avoiding false lookup errors Fix code block indentation in get_bitoffset_of_field() - uprobes error pointer safety Guard free_trace_uprobe() with IS_ERR_OR_NULL() to avoid crashing during automatic cleanup when an error pointer is returned * tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Protect kprobe_blacklist with RCU tracing/probes: Fix use-after-free on field name/type of events with multiple probes tracing/probes: Fix code indent in get_bitoffset_of_field() tracing/probes: Fix BTF kflag check for anonymous struct member access tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member uprobes: guard trace cleanup against error pointers |
||
|
Linus Torvalds
|
65119e86fe |
Merge tag 'pmdomain-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
Pull pmdomain and cpuidle fixes from Ulf Hansson: "pmdomain providers: - mediatek: Fix Kconfig for Airoha power domains - qcom: Revert adding the missing power domains for Eliza cpuidle: - psci: Fix support for probe deferral by dropping the faux device - dt_idle_genpd: Free the original name allocation" * tag 'pmdomain-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: cpuidle: dt_idle_genpd: kfree() the original name allocation pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig cpuidle: psci: Fix support for probe deferral by dropping the faux device Revert "pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza" |
||
|
Linus Torvalds
|
bc35965f69 |
Merge tag 'mm-hotfixes-stable-2026-09-03-17-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton: "18 hotfixes. 13 are cc:stable. 15 are for MM. All are singletons - please see the changelogs for details. There are no fixes (yet) for all the stuff we added in the most recent merge window. Hopefully a good sign" * tag 'mm-hotfixes-stable-2026-09-03-17-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/secretmem: properly account locked pages mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP MAINTAINERS: add Kiryl as a THP reviewer MAINTAINERS: cover all of RAID MAINTAINERS: mailmap: update entries for Thorsten Blum MAINTAINERS: remove Lorenzo as THP co-maintainer Revert "once: don't use a work queue to reset sleepable static key" mm/hugetlb: fix missing migratable flag on same-node hugetlb migration mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() mm/huge_memory: transfer the pmd dirty bit to the folio on zap MAINTAINERS: add Lance Yang as a hung task detector co-maintainer userfaultfd: reset err to be 0 when move_pages_ptes succeeded mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs mm/hugetlb: keep max_huge_pages when dissolving surplus folios mm/migrate_device: avoid out-of-bounds writes for compound folios mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() memcg: make the v1 soft limit knob inert mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio |
||
|
Linus Torvalds
|
a500db7819 |
Merge tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull SELinux fixes from Paul Moore: "Two SELinux fixes: one to fix how we lookup a BPF token's creator label to prevent a possible TOCTOU, and one to update Ondrej's email address" * tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: MAINTAINERS, mailmap: update email address for Ondrej Mosnáček selinux: fix BPF token permission checks |
||
|
Linus Torvalds
|
36b03c3e27 |
Merge tag 'acpi-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI fix from Rafael Wysocki: "Drop two structure fields that have no more users after recent changes" * tag 'acpi-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: bus: Drop two fields from struct acpi_device_pnp |
||
|
Linus Torvalds
|
841e384b84 |
Merge tag 's390-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Heiko Carstens: - Use jiffies instead of jiffies_64 to address a data-race reported by KCSAN - Unpoison cpacf instruction results to address KMSAN reports - Drop unused member from ap_device_id - Fix potential NULL pointer dereferences in IPL code - Add missing length check to SCLP error report handling - Add missing length check to zcrypt CCA code - Fix return code handling in diag324 code - Handle multiple PMU stop callback invocations in perf pai code correctly - Reduce excessive debug feature size in perf pai code from 32 MiB to 4KiB - Switch to common CPU capacity code in topology code to get rid of few lines of code - Address various bugs in corner cases in boot code - Simplify/Rework crst_table_upgrade() to address a potential NULL pointer dereference in case of an allocation failure - Initialize padding bytes in CRT key structure in zcrypt code * tag 's390-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Fix uninitialized padding in CRT key structure s390/mm: Simplify crst_table_upgrade() s390/boot: Bound command line facility ranges s390/boot: Avoid IPL parameter append past command line s390/boot: Fix physical memory search range s390/topology: Switch to common cpu capacity code s390/pai: Reduce excessive debug feature size s390/pai: Handle multiple PMU stop callback invocations s390/diag324: Preserve -EBUSY return code s390/zcrypt: Validate length in reply before using it s390/pci: Fix leak of uninitialized kernel data in SCLP report s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block s390/ipl: Fix NULL deref in kdump without re-IPL parm block s390/ap: Drop unused member from ap_device_id s390/cpacf: Unpoison instruction results s390/time: Use jiffies instead of jiffies_64 |
||
|
Linus Torvalds
|
adf50c47a4 |
Merge tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from bluetooth.
Previous releases - regressions:
- page_pool: keep frag_offset aligned for odd-sized requests
- sched: fix u32 duplicate handle when node ID pool is exhausted
- udp: create exceptions before socket matching
- igmp: convert struct ip_sf_list to RCU
- ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
- rds: acquire the fastpath locks in rds_conn_shutdown()
- tipc:
- protect node reset trace dump with node lock
- fix NULL deref in tipc_named_node_up() on empty publication
list
- bluetooth:
- L2CAP: fix out-of-bounds write in l2cap_ecred_connect
- hci_core: fix race condition during device registration
- eth:
- mlx5e: prevent stale XSK buffer release on refill retries
- bridge: don't truncate the port group walk on teardown
Previous releases - always broken:
- gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()
- sched: fix skb sizing and action leak on reoffload delete
- tcp: fix use-after-free in do_tcp_getsockopt()
- af_packet: don't cast tpacket_hdr.tp_len to int in
tpacket_parse_header()
- sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
- iptunnel: fix stale transport header during tunnel decapsulation
- eth:
- vxlan: fix use-after-free in vxlan_mdb_remote_src_del()
- bonding: fix uninitialized transport header access in
alb_determine_nd()"
* tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)
net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
net: airoha: enable RX_DONE interrupt for RX queue 31
net/rds: don't let rds_conn_shutdown() consume a concurrent drop
net/rds: acquire the fastpath locks in rds_conn_shutdown()
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
net/rds: clear cp_flags bits individually in rds_conn_path_reset()
net/rds: use clear_bit_unlock() in release_refill()
net/rds: use wq_has_sleeper() in release_in_xmit()
net: usb: qmi_wwan: add Compal EXM-G1x support
net: macb: exclude software FCS from TX byte statistics
net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
net: bridge: mcast: don't truncate the port group walk on teardown
bonding: do not clear curr_active_slave prematurely when releasing all slaves
net: qrtr: Send HELLO message on endpoint register
octeontx2-af: Fix limiting SRIOV VF count logic
bonding: alb: fix uninitialized transport header access in alb_determine_nd()
s390/ctcm: Prevent XID null dereference
net: psp: do not inherit the Rx association on clone
...
|
||
|
Linus Torvalds
|
8ab1afb2eb |
Merge tag 'for-7.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper fixes from Mikulas Patocka:
- fix a dm-crypt race condition that could make errors not being reported
- dm-cache:
- fix rwsem being locked and unlocked from different processes
- fix demotion statistics
- dm-integrity:
- set the 'stable writes' flag
- fix a buffer overflow introduced in this merge window
- fix an infinite loop if tag size is greater than 64
- fix NULL pointer dereference in dm-integrity data-recovery mode
- remove a bogus restriction on the dm-ebs starting sector offset
* tag 'for-7.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm-ebs: fix incorrect device offset check in ebs_ctr()
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
dm cache: fix demotion stats in passthrough mode
dm-integrity: fix infinite loop on discard with large tag size
dm-integrity: fix buffer overflow with keyed discard
dm-integrity: require stable writes for internal hash modes
dm cache: fix issue with background work locking
dm-crypt: fix a tiny race condition in crypt_dec_pending
|
||
|
Linus Torvalds
|
97be98b94d |
Merge tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon: - Serialize truncate, fallocate, and mmap fault paths with invalidate_lock, avoiding mmap failures during concurrent size changes and exposure of uninitialized data during allocation - Correct fallocate signal and zeroing error handling - Fix FITRIM range alignment to prevent discard requests from extending into allocated clusters - Fix free-cluster accounting when cluster-freeing rollback or bitmap clearing fails - Keep volumes marked dirty when ntfs errors have been recorded - Compute bi_sector in 512-byte units, preventing silent corruption on 4Kn devices - Validate sectors_per_cluster values and prevent undefined shifts when parsing MFT and index record sizes - Bound $AttrDef traversal to the loaded table size - Fix MFT record resizing, memmove overlap, and kmap_local cleanup issues - Improve error propagation across attribute, EA, and reparse operations, including returning -ERANGE for undersized xattr buffers - Avoid modifying the HasEA flag when setxattr fails and return DT_UNKNOWN when directory inode lookup fails - Reduce contention in WOF decompression by performing block reads outside the decompression lock * tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (23 commits) ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs: take invalidate_lock in ntfs_setattr_size() ntfs: handle signal interruption in fallocate ntfs: fix FITRIM range alignment ntfs: read WOF chunks outside the decompression lock ntfs: leave HasEA flag untouched on setxattr failure ntfs: fix race between fallocate and mmap reads ntfs: fix memmove overlap in ntfs_new_attr_flags ntfs: compute bi_sector in 512-byte units ntfs: reject invalid sectors_per_cluster in the boot sector ntfs: bound $AttrDef table walk to the loaded table size ntfs: fix undefined behavior in mft/index record size calculation ntfs: treat any nonzero dio zero-range return as an error ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs: do not mark the volume clean in sync_fs when errors were recorded ntfs: skip free cluster decrement when rollback fails ntfs: only count successfully cleared runs when freeing clusters ntfs: fix kmap_local leak in write_mft_record_nolock() error paths ntfs: return real error from ntfs_non_resident_attr_record_add() ntfs: preserve error code in ntfs_resident_attr_record_add() ... |
||
|
Linus Torvalds
|
940de590b8 |
Merge tag 'hardening-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening fix from Kees Cook: - Default randstruct off with rust for better allmodconfig coverage (Mark Brown) * tag 'hardening-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: hardening: Default randstruct off with rust for better allmodconfig support |
||
|
Linus Torvalds
|
89a312991d |
Merge tag 'cifs-fixes-7.3-rc2' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara: - Fixes for fallocate range operations (insert, collapse, zero, punch hole) The insert range implementation copied overlapping chunks in the wrong direction, corrupting file data on every server except Windows. Several related issues in the same area are also addressed — stale page cache and FS-Cache readback, an integer truncation on large files, missing RLIMIT_FSIZE validation and missing sparse file marking. - Data corruption fixes in the O_TRUNC open path: one where i_size was zeroed before the server confirmed the truncate and another where the lack of locking allowed concurrent buffered writes to be silently discarded - Heap overflow fixes in legacy SMB1 paths: one in extended attribute writes and one in POSIX ACL handling, both exploitable via unprivileged setxattr(2) - Fix for multiuser mount with krb5 failing because the username option was not propagated to new per-user connections - Fix for split debug message in __release_mid() after a printk conversion * tag 'cifs-fixes-7.3-rc2' of https://git.manguebit.org/linux: smb: client: reject SetEA requests that do not fit the request buffer smb: client: fix data corruption with concurrent writes and O_TRUNC cifs: don't update i_size in cifs_do_truncate without a cached handle smb: client: fix heap overflow in cifs_do_set_acl() smb: client: fix multiuser mount with krb5 smb: client: transport: Fix debug printing in __release_mid() smb/client: invalidate fscache for fallocate range operations smb/client: fix stale page cache in insert/collapse range smb/client: fix integer truncation in collapse range smb/client: fix data corruption in emulated insert range smb/client: mark file sparse before emulating insert range smb/client: validate new EOF for zero range smb/client: validate new EOF for insert range cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() |
||
|
Linus Torvalds
|
9a58da8005 |
Merge tag 'ksmbd-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server fixes from Namjae Jeon: - Prevent unintended data exposure by clearing pipe compound padding and the response buffer - Initialize missing fields in FS_OBJECT_ID_INFORMATION, FS_CONTROL_INFORMATION, and FS_POSIX_INFORMATION - Propagate DACL parsing and allocation failures so malformed security descriptors are rejected - Rate-limit errors for unmapped SIDs to prevent kernel log flooding - Drain multichannel sessions during LOGOFF, wake deferred locks and cancellable requests, and ensure cancellation callbacks run only once - Fix listener kthread reference handling and teardown ordering during netdevice events - Validate normalized-name and IPC share configuration response lengths - Update the KSMBD MAINTAINERS entry and add Paulo Alcantara as an SMBDIRECT co-maintainer * tag 'ksmbd-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb: ksmbd: validate normalized name response length ksmbd: fix listener task lifetime on netdev events ksmbd: prevent out-of-bounds reads in share config responses ksmbd: rate limit unmapped SID errors ksmbd: propagate DACL parsing errors ksmbd: zero pipe read compound padding ksmbd: safely drain sessions during logoff MAINTAINERS: Update the KSMBD entry MAINTAINERS: Add Paulo Alcantara as an SMBDIRECT co-maintainer ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in |
||
|
Linus Torvalds
|
786262be60 |
Merge tag 'edac_updates_for_v7.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras
Pull forgotten EDAC updates from Borislav Petkov:
"Somewhat belated (and forgotten :-\) EDAC updates lineup for v7.3:
- Mark the mpc85xx and ThunderX EDAC drivers as orphaned due to lack
of access to hardware
- Remove the unused fake error injection interface from the EDAC
debugfs code due to potential races between logging a fake and a
real hw error
- edac_mc_sysfs: Use sysfs_emit_at() for proper bounds checking
- Remove Mark Gross from maintainer entries and move him to CREDITS
- Load the AMD address translation library only on systems which can
actually make use of it (have ECC memory) instead of on every AMD
Zen system out there
- In edac_altera, detect the SoC variant using the ECC manager's
compatible string instead of the build architecture to select the
correct interrupt layout, and remove leftover architecture-specific
ifdeffery from the double-bit error handling path
- Add a new reviewer for the Xilinx EDAC drivers
- Unify address translation logic in Intel client EDAC drivers igen6
and ie31200 along with detecting memory controller counts at boot
time instead of relying on hardcoded, platform specific numbers.
Also, fix a bunch of issues in them; work by Qiuxu Zhuo
- Add support for a new Intel processor platform Starfire which is a
derivative of Panther Lake SoCs
- The usual cleanups and fixlets all over"
* tag 'edac_updates_for_v7.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: (24 commits)
EDAC/thunderx: Orphan it
EDAC/device_sysfs: Cleanup around edac_device_ctl_poll_msec_store()
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
EDAC/igen6: Add Intel Starfire SoCs support
EDAC/igen6: Refactor address translation logic
EDAC/igen6: Remove redundant resource configuration tables
EDAC/igen6: Detect present memory controllers at runtime
EDAC/igen6: Simplify compute die ID comments
EDAC/igen6: Remove unnecessary XOR on the zero-valued interleave bit
EDAC/igen6: Fix Raptor Lake-P logged error address
EDAC/igen6: Fix channel address decode for non-hash mode
EDAC/igen6: Fix channel selection hash
EDAC/igen6: Fix interleave boundary condition
EDAC/ie31200: Decouple DIMM width decoding from enum order
RAS/AMD/ATL: Remove conditional return with no effect
EDAC: Remove redundant dev_err()
MAINTAINERS: Add Radhey Shyam Pandey as Xilinx EDAC reviewer
EDAC/altera: Remove remaining CONFIG_64BIT ifdefs in the DB-error path
EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed
...
|
||
|
Linus Torvalds
|
abdf623ddb |
Merge tag 'wq-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
Pull workqueue fixes from Tejun Heo: - An unbound worker pool could be freed while still reachable through the pending-activation list, leading to a use-after-free. Unlink before dropping the reference - On PREEMPT_RT, the BH workqueue kick raised softirqs from preemptible context, tripping a lockdep assertion and possibly losing concurrently raised softirq bits - Draining BH work off a dead CPU nests two pools' callback locks, which lockdep misreported as recursive locking. The nesting cannot deadlock. Annotate it - Reject watchdog thresholds that overflow the conversion to jiffies - Make the drgn workqueue dump script work again on kernels and vmcores from before the workqueue attrs field rename * tag 'wq-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: tools/workqueue/wq_dump.py: Support backward compatibility for wq->attrs rename workqueue: reject watchdog thresholds that overflow jiffies workqueue: Fix unbound pool lifetime for pending pwqs workqueue: Use raise_softirq() to trigger softirq in irq_work handler workqueue: Annotate cb_lock nesting when draining a dead BH pool |
||
|
Linus Torvalds
|
c3b510de42 |
Merge tag 'cgroup-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo: - After cgroup.kill was written to a cgroup, every child cloned into it with CLONE_INTO_CGROUP was spuriously killed because the fork path snapshotted the kill counter before resolving the target cgroup - Releasing an isolated cpuset partition dropped the isolation of CPUs isolated on the kernel command line - Selftest and documentation fixes * tag 'cgroup-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: selftests/cgroup: test clone3() into a previously killed cgroup cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children selftests/cgroup: Add test for preserving boot-isolated CPUs cgroup/cpuset: Preserve boot-isolated CPUs on partition release selftests/cgroup: Drop invalid boot isolation comparison docs: cgroup-v2: fix misc.events key format description selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter selftests/cgroup: set the test plan after the setup checks |
||
|
Linus Torvalds
|
bf1079577a |
Merge tag 'sched_ext-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext fixes from Tejun Heo: - The task ownership check in the dispatch queue move operation raced against the task exiting or moving to a different sub-scheduler, spuriously triggering scheduler aborts. Fix by moving the check under the queue lock - The cgroup bandwidth change callback runs in a sleepable context but sleepable implementations were rejected at load time. Allow them and add a marker so userspace can detect the capability - Sync tooling headers with the scx repo for accumulated compatibility improvements - Example scheduler fixes: ignored timer re-arm failures and vtime credit loss on cgroup migration - Documentation and comment fixes * tag 'sched_ext-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Fix missing @slice and @vtime descriptions in finish_dispatch() kernel-doc sched_ext: Fix several comment issues sched_ext: Check bpf_timer_start return values in scx_qmap sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration sched_ext: Fix timer pinning and return value in scx_central docs/sched_ext: document that cgroup CPU knobs are scheduler-dependent sched_ext: Fix spurious aborts in scx_bpf_dsq_move() on ownership change races sched_ext: Sync common and compat headers from the scx repo sched_ext: Sync tools autogen enum headers from the scx repo Docs/admin-guide/cgroup-v2: document BPF scheduler callbacks for cpu.max and cpu.idle sched_ext: Fix nonexistent field in sched-ext.rst example sched_ext: Allow ops.cgroup_set_bandwidth() to be sleepable |
||
|
Linus Torvalds
|
a7f25dc23f |
Merge tag 'xfs-fixes-7.3-rc2' of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux
Pull xfs fixes from Carlos Maiolino: "This contains a few fixes for the zoned storage support, a possible deadlock vector fix, some code refactoring patches and a quota evasion fix on XFS while exporting it via NFS. Please note that for the quota evasion fix, a couple patches for the capability subsystem are included in the pull request. Those have been ack'ed by the respective maintainer which also agreed to have them going through the xfs tree. This also includes a patch for the quota subsystem to stop issuing audit messages during quota enforcing. Quota maintainer also ack'ed and agreed with this going through xfs tree" * tag 'xfs-fixes-7.3-rc2' of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux: capability: unexport has_capability_noaudit xfs: replace ns_capable_noaudit quota: Don't issue audit messages on quota enforcing capability: Add new capable_noaudit xfs: fix capability check in xfs xfs: restore bi_bdev in xfs_zone_gc_write_chunk xfs: split ioend handling into a separate source file xfs: factor out a xfs_iomap_set_anon_write helper xfs: fix zoned write iomap flags assignments xfs: fix racy open zone caching xfs: handle NULL open_zone for merged ioends in xfs_ioend_put_open_zones xfs: use inode_init_always_gfp with __GFP_NOFAIL in xfs_inode_alloc xfs: remove kmem_to_page() xfs: don't flush and invalidate internal RT device twice in xfs_shutdown_devices xfs: split an assert in xfs_trans_log_buf xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf |
||
|
Linus Torvalds
|
cee9395acd | Linux 7.3-rc1 | ||
|
Linus Torvalds
|
78bb208b99 |
Merge tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c fixes from Andi Shyti: "Fixes mainly for teardown and resource handling, runtime PM and hardware-specific controller issues: - fix debugfs use-after-free when removing the adapter - designware: apply interrupt mask quirk for HJMC3001 - imx-lpi2c: avoid target accesses on master-only controllers - mux: release channel node when adapter registration fails - qcom-cci: fix autosuspend and runtime PM cleanup on removal - qcom-geni: fix timing parameters for 32 MHz clock" * tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: core: fix debugfs UAF on adapter removal i2c: imx-lpi2c: avoid accessing target registers on master-only controllers i2c: qcom-cci: fix autosuspend cleanup i2c: designware: Enable interrupt mask workaround for HJMC3001 i2c: qcom-geni: update frequency table to fix timing parameters i2c: mux: Fix channel node leak on adapter add failure |