Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:19:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
1,482,865 Commits 1 Branch 946 Tags
164f652b6ef9209437ca016beedfcab626ff4f02
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Torvalds 164f652b6e Merge tag 'mm-hotfixes-stable-2026-09-13-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm 
Pull misc fixes from Andrew Morton:
 "14 hotfixes.  10 are cc:stable.  11 are for MM.

  All are singletons - please see the changelogs for details"

* tag 'mm-hotfixes-stable-2026-09-13-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/folio: EXPORT_SYMBOL_FOR_KVM(lru_cache_drain_for_folio)
  mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem
  mm/vma: correctly unaccount on mmap_prepare() failure
  mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
  remove old lib/alloc_tag.c
  fs/dax: check zero or empty entry before converting xarray entry
  fs: fix missed removal of super_fs_objects_eligible()
  mm: filemap: retain mapped dropbehind folios
  mailmap: update entry for Christopher Obbard
  memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
  mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
  mailmap: map Coiby Xu's address
  mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP
  mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
 2026-09-14 08:59:09 -07:00
Linus Torvalds 704340f1cd Merge tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull x86 fixes from Dave Hansen:
 "The most notable fix is THP not silently losing user data and having
  been around for a couple of years. The main explanation I'd have for
  its longevity is that it requires a few different things to align at
  the same time: MADV_FREE, THP and heavy reclaim.

   - Fix user-space data loss with THP

   - Fix set_memory oopses

   - Fix addition of large constants in mul_u64_add_u64_div_u64()

   - Fix FineIBT hash offset in cfi_get_func_hash()

   - Fix PCI device reference counting in amd_smn_init()"

* tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/amd_node: Fix PCI device reference counting in amd_smn_init()
  x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64()
  x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
  x86/mm: Fix user-space data loss with MADV_FREE and THP
  x86/mm/pat: Allocate split page tables as kernel page tables
  x86/alternatives: Exclude text poking against change_page_attr()
  x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
  x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
 2026-09-13 17:50:28 -07:00
Linus Torvalds fd73f4a665 Linux 7.3-rc3 2026-09-13 14:38:02 -07:00
Linus Torvalds 22098763a1 Merge tag 'trace-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 
Pull tracing fixes from Steven Rostedt:

 - Don't destroy user event fields when removal fails

   User event fields are destroyed before the event is removed from
   visibility. But that can fail leaving the still visible event with no
   fields. Move the destroying of the fields to after the event is
   successfully removed from visibility.

 - Initialize function graph state is fork before calling
   copy_exec_state()

   For non-CLONE_VM forks, copy_exec_state() allocates a new
   task_exec_state. If that allocation fails, ftrace_graph_exit_task()
   will free the tasks ret_stack pointer. Since that pointer is still
   using the parent's ret_stack, it mistakenly frees the parent's
   pointer too.

   Call ftrace_graph_init() on the task first which will NULL out the
   new tasks's ret_stack and if the copy fails, it will not free
   anything.

 - Remove FGRAPH_MAX_INDEX

   The macro FGRAPH_MAX_INDEX was added but never used. Remove it.

 - Save ent_size in function graph printing of nested functions

   The function graph tracer needs to look at the next event to see if
   the next event is the return of the current function entry. If it is,
   it prints a single line:

	ktime_get();

   Otherwise it prints it like a nested function:

	tick_nohz_irq_exit() {
	    ktime_get();
	    kcpustat_irq_exit();
	}

   In order to look at the next event, it must save the current event so
   that it has the information to print from it. It saves the event in
   the iterator descriptor called "ent". What it doesn't save is the
   ent_size of the event which is now used to know if the function graph
   arguments are to be printed. The peek doesn't save the size so the
   size used happens to be that of the size of the last event that was
   seen.

   Save the entry event size in the iterator descriptor so that the
   correct size is used.

 - Fix several errors with freeing data in the histogram code

   The histogram code had a lot of leaked or or incorrect accounting
   when failures happen. Correct them.

 - Fix histogram regression of .percent and .graph modifiers

   Up until 6.3 histogram values could have "percent" or "graph"
   modifiers that changed how they were printed. But a change that added
   restricting histograms values from being strings, stack traces and
   other modifiers inadvertently prevented them from using the percent
   and graph modifiers, which were legal use cases for values.

   Put back the percent and graph modifiers.

 - Fix various typos in the comments

 - Set the trace_clock before initializing a histogram with clock
   argument

   The histogram API allows the user to specific which trace clock to
   use via a "clock=" string. The histogram is set up first before the
   clock is checked. If the passed in clock is not valid, it exits
   without fully fixing up the histogram leaving it on the list and a
   use-after-free can trigger.

   Update the clock argument first and if it fails then exit gracefully
   before the histogram trigger is placed on any lists.

 - Restore :mod: trailer after parsing in ftrace_set_clr_event

   The function ftrace_set_clr_event() modifies the parse string and
   needs to put it back to what was passed in. It searches for ":mod:"
   via a strsep() but fails to put back the first ':' in the string.

   Add back the ':' in the passed in string.

 - Take trace_array reference when opening a tracer options file

   The options files are dynamically created and some tracers add their
   own options. When a tracer adds their own list of options, the
   trace_array holding them has an array to hold the list of options for
   each tracer. This array increases in size via a krealloc(), and the
   new entry gets a newly allocated array to hold the options of the new
   tracer being added.

   The element in each entry of the tracer's option array holds a
   pointer back to the trace_array, a pointer to the tracer it is
   associated to, a pointer to the flags of the option.

   The issue is that these arrays are freed when the trace_array is
   freed when its instance it represents is removed from the instances
   directory. There's a race that an open of one of these options files
   can happen when the instance is being removed.

   Add a new helper function to be called by the open function of the
   options file to iterate all existing trace_arrays under a lock and
   find the one that has the given option element in one of it's tracer
   arrays. If found, then update the associated trace_array's reference
   counter to keep it from being freed. If not found, have the open call
   return -ENODEV.

 - Disable interrupts when acquiring the lock in rb_wake_up_waiters()

   The function rb_wake_up_waiters() assumes it will be called in
   interrupt context and does not disable irqs when taking
   cpu_buffer->reader_lock, which can be called in hard interrupt
   context. The issue is in PREEMPT_RT, this function is called in
   thread context leaving this lock open to a deadlock.

   Take the lock with interrupts disabled.

 - Use rcu_assign_pointer() for tmp_ops filter hash

   The tmp_ops used in update_ftrace_direct_mod() assigns its
   filter_hash field directly, but that field is annotated as __rcu and
   sparse complains. Assign it with rcu_assign_pointer()

 - Fix use-after-free in enable_trigger_private_data_free()

   The trace_event_call is accessed through the event_trigger_data's
   trace_event_file pointer to put the trace_event_call on freeing. The
   issue is that the trace_event_file data may have been freed already
   causing a use-after-free. Add a field to the event_trigger_data that
   points directly to the trace_event_call so that it can decrement its
   reference directly without needing to go through the
   trace_event_file.

 - Fix accounting of buffer data remote headers

   trace_buffer_desc_size() and trace_remote_alloc_buffer() undercount
   the number of pages is needed for the asked for size as it doesn't
   take into account the meta data on each page. Add a helper function
   to do the calculation properly and use that in these functions.

 - Catch nr_page_va overflow in ring_buffer_desc sizing

   The number of pages per remote ring buffer is capped by
   ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to
   overflow that field would silently allocate a descriptor smaller than
   what was asked for.

 - Do not resize the subbuf order if any per_cpu buffer is disabled

   The mmapping of ring buffers disables resizing the subbuffers, but it
   is done per-cpu whereas the subbuf size change is done for all the
   per_cpu buffers under the buffer->mutex. It could change the size of
   some while the mapping is happening on others. Have the resize of the
   subbuf order check all the per_cpu buffers under the lock to see if
   any of them is disabled before starting and causing an inconsistency
   between buffers that are being mapped.

* tag 'trace-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (25 commits)
  ring-buffer: Check resize_disabled before publishing the new subbuf order
  tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing
  tracing/remotes: Account for ring buffer page header in size calculation
  tracing: Don't dereference trace_event_file in deferred trigger free
  ftrace: Use rcu_assign_pointer() for tmp_ops filter hash
  ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
  tracing: Take trace_array reference when opening a tracer options file
  tracing: Fix ring_buffer_read_page_size() kernel-doc
  tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event()
  tracing: Fix memory corruption from a "STACKTRACE" histogram key
  tracing: Fix memory corruption from the histogram stacktrace modifier
  tracing: Undo the registration when enabling the histogram trigger fails
  tracing: Take the reference before publishing the named histogram trigger
  tracing: Set the trace clock before registering the histogram trigger
  tracing: Fix typo "preceeded" in comment
  tracing: Fix typo "availabe" in comment
  tracing: Let histogram values keep the percent and graph modifiers
  tracing: Keep the entry count when the histogram stats allocation fails
  tracing: Free histogram the field rejected for a bad modifier
  tracing: Free histogram the var ref when its initialization fails
  ...
 2026-09-13 12:27:00 -07:00
Linus Torvalds d681d7ef61 Merge misc regression fixes that seem to have fallen through the cracks 
Thorsten continues to track regressions, and reporting on known issues
with fixes that don't seem to make any progress.

I'm going to do an rc3 release later today - let's not keep these known
issues pending for yet another rc for no obvious reason.

Reported-by: Thorsten Leemhuis <regressions@leemhuis.info>
Link: https://lore.kernel.org/all/46403cf8-9a81-4596-87eb-dde58ae4c5db@leemhuis.info/

* regressions:
  media: ipu-bridge: do not use the CVS device lookup for IVSC
  wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe
  wifi: mt76: mt7921: skip unknown CLC firmware records
 2026-09-13 10:18:23 -07:00
Linus Torvalds 180534c09b Merge tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux 
Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Work around a 'bindgen' 0.73.2 bug that emits an 'allow' attribute
     for 'unnecessary_transmutes', which is unknown in older compilers

   - Clean 'clippy::as_underscore' lints in generated code by the new
     'bindgen' 0.73.0+ releases

   - Clean new 'clippy::needless_range_loop' lint for the upcoming Rust
     1.100.0 (expected 2026-11-12)

  'kernel' crate:

   - 'num' module: fix soundness issue in 'Bounded' by sealing the
     'Integer' trait

  'pin-init' crate:

   - Fix unreachable warning for the upcoming Rust 1.100.0 (expected
     2026-11-12) due to 'Infallible' becoming an alias of '!'

  Samples:

   - Add missing newlines in 'pr_*!'s macro calls"

* tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: allow `unknown_lints` in generated bindings for Rust < 1.88
  rust: allow `clippy::as_underscore` in the generated bindings
  rust: num: seal Integer
  drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0
  rust: samples: add missing newlines in rust_print_main
  rust: pin-init: use irrefutable pattern for `stack_pin_init`
 2026-09-13 09:28:28 -07:00
Linus Torvalds 6a0b3fb48d Merge tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 
Pull bootconfig fixes from Masami Hiramatsu:
 "Fix integer overflow and truncation in size checks.

   - Fix size check bypasses caused by integer overflow and truncation
     when parsing initrd or standalone bootconfig files, preventing
     buffer overflow and out-of-bounds writes in the userspace tool.

   - Fix pointer arithmetic wrap-around in get_boot_config_from_initrd()
     when handling crafted huge size values, preventing fatal kernel
     page faults during early boot"

* tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  bootconfig: Fix integer overflow in initrd size check
  tools/bootconfig: Fix integer overflow and truncation in size checks
 2026-09-13 09:16:36 -07:00
Linus Torvalds c874ace034 Merge tag 'timers-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull timer fixes from Ingo Molnar:

 - Fix clockevents replacement race when a broadcast
   device is replaced which may trigger a BUG() crash
   (朱恺乾 - Zhu Kaiqian)

 - Fix potential timerqueue ordering bug when rearming
   a queued timer with nonzero slack (Andrea Parri)

* tag 'timers-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  hrtimer: Use hard expiry when updating timers on the same base
  tick/broadcast: Plug clockevents replacement race
 2026-09-13 09:10:38 -07:00
Linus Torvalds b2a8a7669e Merge tag 'sched-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull scheduler fixes from Ingo Molnar:

 - Fix EEVDF se->max_slice value on enqueueing (Vincent Guittot)

 - Fix EEVDF augmented rb-trees re-balancing with multiple
   fields (Vincent Guittot)

 - In proxy scheduling, account cgroup CPU time to the execution
   context, not the scheduling context (Hui Su)

 - Likewise, call wq_worker_tick() for the execution context,
   not the scheduling context (Hui Su)

* tag 'sched-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/core: Call wq_worker_tick() for the execution context
  sched: Account cgroup CPU time to the execution context
  sched/eevdf: Fix rb augmented with multi fields
  sched/eevdf: Fix augmented max_slice
 2026-09-13 09:03:22 -07:00
Linus Torvalds 85855f85de Merge tag 'perf-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull perf events fixes from Ingo Molnar

 - Fix sched_cb_list corruption on PMU callbacks that
   invoke list_del() during perf_event_overflow()
   calls (Thomas Richter)

 - Fix PEBS pt_regs->flags snapshot data that
   regressed with the introduction of adaptive
   PEBS v4 support (Dapeng Mi)

 - Fix possible drain_pebs() re-entry bug when
   intel_pmu_drain_pebs_buffer() is called from
   process context (Dapeng Mi)

* tag 'perf-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/intel: Prevent drain_pebs() reentry
  perf/x86/intel: Correct pt_regs->flags update for PEBS path
  perf/core: Allow list_del during perf_event_overflow()
 2026-09-13 08:44:54 -07:00
Linus Torvalds feb66eea6b Merge tag 'objtool-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull objtool fixes from Ingo Molnar:

 - Fix potential klp-build allocation leak in cleanup
   functionality handling kzalloc() failure (Yafang Shao)

 - Fix KLP checksum false positives triggering with GCC, caused
   by quirks in string literal symbol generation (Josh Poimboeuf)

* tag 'objtool-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  objtool/klp: Fix checksums for constant pool references
  klp-build: Fix wrong index in funcs cleanup error path
 2026-09-13 08:37:11 -07:00
Linus Torvalds f10ae89f3d Merge tag 'irq-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull irq fix from Ingo Molnar:

 - Fix ARM gic-v5 irqchip driver regression, where its
   enable/disable functions may corrupt unrelated
   ICC_CR0_EL1 hardware state (Sascha Bischoff)

* tag 'irq-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/gic-v5: Preserve ICC_CR0_EL1 state
 2026-09-13 08:28:08 -07:00
Linus Torvalds 086fd27ee9 Merge tag 'core-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull entry code fix from Ingo Molnar:

 - Fix generic entry code cross-build failure on
   !CONFIG_AUDITSYSCALL kernels using older
   RISCV64 and S390 cross-compilers (Thomas Gleixner)

* tag 'core-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  entry: Guard syscall_enter_audit() invocation with CONFIG_AUDITSYSCALL
 2026-09-13 08:23:41 -07:00
Linus Torvalds ff4b61e3b7 Merge tag 'edac_urgent_for_v7.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras 
Pull EDAC fix from Borislav Petkov:

 - A single fix to altera_edac to use the proper objects when performing
   managed device operations instead of using temporary shallow struct
   copies which can cause dangling list pointers and havoc eventually

* tag 'edac_urgent_for_v7.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/altera: Use parent device for devres in altr_portb_setup()
 2026-09-12 17:32:14 -07:00
Linus Torvalds 2f0c1cf72f Merge tag 's390-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 
Pull s390 fixes from Vasily Gorbik:

 - Fix NULL pointer dereferences in s390dbf when setting debug levels or
   resizing debug areas while logging events. Remove duplicate messages
   about kernel parameter overrides

 - Fix PAI perf crashes when per task events move to newly onlined CPUs.
   Add CPU hotplug callbacks to allocate and free the per-CPU data

 - Fix mutex use in atomic context in AES and PAES CTR code by using
   semaphore trylocks instead. Remove conditional locking and enable
   Clang CONTEXT_ANALYSIS for the crypto code

 - Fix scatterlist walk error handling in AES and PAES and avoid freeing
   PAES walk resources twice

 - Fix missing scrubbing of temporary AES and PAES buffers, including
   AES GCM error paths

 - Set missing CRYPTO_ALG_ASYNC and CRYPTO_ALG_NO_FALLBACK flags for
   PAES

 - Fix -EBUSY handling in PAES and PHMAC to avoid cleaning up requests
   already queued to the crypto engine

 - Fix PAES and PHMAC requests being completed twice on errors

 - Fix PAES and PHMAC hangs when key conversion keeps returning -EBUSY
   by returning -EIO after the last retry

* tag 's390-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/crypto: Enable CONTEXT_ANALYSIS
  s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly
  s390/crypto: Fix wrong return code to engine in asynch callbacks
  s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine
  s390/crypto: Fix handling of EBUSY in PAES when req is pushed to crypto engine
  s390/crypto: Fix missing cra_flags in paes_s390
  s390/crypto: Fix use of mutex in atomic context in PAES
  s390/crypto: Fix missing scrub of temp buffers with PAES algorithm
  s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms
  s390/crypto: Fix use of mutex in atomic context
  s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
  s390/crypto: Fix skcipher_walk return code handling in aes_s390
  s390/debug: Fix race between debug area resize and event logging
  s390/debug: Do not repeat parameter override notice on debug_set_level()
  s390/debug: Fix NULL pointer dereference in debug_set_level()
  s390/pai: Support CPU hotplug for PMU PAI
  s390/pai: Move locking to event init and delete
  s390/pai: Use PAI PMU index as parameter replacing event
 2026-09-12 16:22:25 -07:00
Linus Torvalds 3ce99a68f7 Merge tag 'kbuild-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux 
Pull Kbuild fixes from Nicolas Schier:
 "Fix a build race and builds on stable branches.

  The other two are low-hanging fruits from Lorenzo's recent kbuild
  speed-up patch set that fix older symbol leakages.

   - don't delete in-flight filechk temporaries in asm-headers

     A rule for generating header files was changed from using make
     $(wildcard) fnglob to 'find' instead; as 'find' finds "hidden"
     files by default, temporary files from Kbuild's 'filechk', used for
     generating asm header files, may get deleted and break header file
     generating.

   - scripts/sorttable: Mark long_size as __maybe_unused

     Fix builds with clang-23 or newer on trees w/o commit b055f4c431
     ("sorttable: Move ELF parsing into scripts/elf-parse.[ch]");
     targetting for backport to stable kernels < 6.19.

   - scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms

     Update regexp to remove kallsyms entries from kernel binary, saves
     about 32 KiB of bzImage.

   - scripts/mksysmap: fix escape of '$' in the __pi_ pattern

     Prevent arm64 PIE namespace local symbols from appearing System.map
     and /proc/kallsyms"

* tag 'kbuild-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
  scripts/mksysmap: fix escape of '$' in the __pi_ pattern
  scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms
  scripts/sorttable: Mark long_size as __maybe_unused
  kbuild: don't delete in-flight filechk temporaries in asm-headers
 2026-09-12 11:29:20 -07:00
Linus Torvalds cba2348ab1 Merge tag 'xfs-fixes-7.3-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux 
Pull xfs fixes from Carlos Maiolino:
 "More than the usual amount of fixes.

  The highlights here are a block under reservation fix which caused an
  assert to be triggered in non-default configurations. The assert,
  initially added on 7.3-rc2 just makes the problem explicit but is not
  the cause. Another highlight is a missed lock/unlock mutex in the xfs
  healthmonitor which was causing lockdeps warnings.

  Besides those two, this also contains a myriad of fixes for random
  bugs found by LLM tools in the healthmon, scrub and online repair.

  A few bug fixes for zoned xfs are also included.

  This also includes an accounting fix for our buffer slab cache where
  the memory payload associated to each object was not being properly
  accounted for.

  The remaining of the patches are a few lock context annotations added
  and/or fixed. They are mostly disabled by now, but still worth fixing
  before we get them enabled.

  And last but not least, a few clean ups"

* tag 'xfs-fixes-7.3-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (75 commits)
  xfs: advance the findparent inode scan cursor while holding ILOCK
  xfs: reset parent pointer args before each dir tree unlink repair
  xfs: fix replaying dirent removals into the temporary directory
  xfs: fix termination logic in xchk_bmap
  xfs: fix rtrmap cross-referencing elision logic
  xfs: actually check internal-rtdev fields in the superblock
  xfs: fix under-reservation of blocks when repairing sf directories
  xfs: take hm->lock in xfs_ioc_health_monitor() before insert
  xfs: set IOMAP_F_INTEGRITY for zoned writes on integrity devices
  xfs: avoid extra cache flushes for multi-device file systems in xfs_fsync
  xfs: don't continue on error in xfs_fsync
  xfs: also flush the RT device cache in xlog_write_iclog
  xfs: bail out on bitmap errors in xrep_agfl_fill
  xfs: snapshot old AGFL before rewriting it
  xfs: remove redundant function declaration
  xfs: report runtime failures in scrub
  xfs: report healthy filesystem events in scrub stats
  xfs: snapshot scrub stats when rendering them
  xfs: remove several unused and never-implemented declarations
  xfs: count escaped corruption errors in scrub stats
  ...
 2026-09-12 08:44:12 -07:00
Linus Torvalds 95deca8dd9 Merge tag 'for-7.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 
Pull btrfs fixes from David Sterba:

 - tree-checker updates, validate values in b-tree item keys, other item
   length checks

 - don't do unnecessary transaction commit fallback when logging parent
   directories

 - in zoned mode, initialize space info of a block group early enough so
   it does not lead to NULL pointer dereference

* tag 'for-7.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: tree-checker: validate name length for extref items
  btrfs: tree-checker: validate parent field for inode extref items
  btrfs: tree-checker: validate key offset for inode ref keys
  btrfs: fix unnecessary transaction commit fallback from btrfs_log_all_parents()
  btrfs: set space_info before adding new free space in btrfs_make_block_group()
 2026-09-12 08:31:48 -07:00
Linus Torvalds 4d85a45df0 Merge tag 'erofs-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs 
Pull erofs updates from Gao Xiang:
 "The most impactful fix here is to disable LZ4 rolling decompression
  for now.

  AWS folks recently found their systems could get corrupted data with
  some rare, specific LZ4 datasets, and after a deeper analysis, I found
  the root cause is that there could be uncontrolled backward memory
  copies in the current LZ4 implementation and it breaks the assumption
  of the rolling decompression optimization, since the kernel LZ4
  codebase is out of our control and it needs more time to plan how to
  do next, so disable LZ4 rolling decompression for now to ensure data
  correctness for real production on these rare cases first. The
  technical details also see the corresponding commit.

  Other changes are random minor fixes.

  Summary:

   - Disable LZ4 rolling decompression for now due to the uncontrolled
     LZ4 implementation

   - Fix missing sysfs feature entry for xattr prefixes

   - Fix invalid LZMA decoders on resize failure

   - Rearrange the inode_share cache key to avoid potential collisions

   - Fix erofs_bread() when fsoffset is used on sub-page-block EROFS
     filesystems"

* tag 'erofs-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: add missing buf->off in erofs_bread()
  erofs: delimit inode_share cache key components
  erofs: disable LZ4 rolling decompression for now
  erofs: preserve LZMA decoders on resize failure
  erofs: add sysfs feature entry for xattr prefixes
 2026-09-12 08:18:50 -07:00
Linus Torvalds 31a4327ffe Merge tag 'fbdev-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev 
Pull fbdev fixes from Helge Deller:
 "Two patches for VT core code and fbcon prevent potential out-of-bounds
  reads on font or screen size changes, one fix limits the Superblitter
  in atafb to supported modes only, and some minor fixes for vfb,
  ssd1307fb and omapfb"

* tag 'fbdev-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: vfb: defer cleanup until the last reference
  fbdev: atafb: Restrict SuperBlitter to supported formats
  fbdev: ssd1307fb: fix NULL pointer dereference on missing match data
  fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo
  fbdev: omapfb: Fix __be32 sparse warning in panel_enabled()
  vt: hide cursor prior to font changes to avoid out-of-bound reads
 2026-09-12 08:06:04 -07:00
Linus Torvalds f6e213d5a2 Merge tag 'iommu-fixes-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux 
Pull IOMMU fixes from Joerg Roedel:
 "RISC-V:

   - Serialize command queue publication to prevent concurrent producers
     from exposing incomplete or out-of-order commands to hardware

   - Wait for queue space outside the command queue lock

   - Avoid waiting for IOFENCE completion when command enqueue failed

  AMD:

   - Prevent GA log buffers from being reallocated and leaked during
     resume, where allocation also occurs in an unsuitable syscore
     callback context

   - Fix a regression on older systems whose firmware advertises
     incorrect IOMMU features

   - Preserve allocation errors when assigning host domain IDs to nested
     domains

  s390:

   - Prevent a NULL dereference when translating an unmapped IOVA with
     five-level ZPCI translation tables

  Misc:

   - Remove a stale MAINTAINERS entry and clean up unused or redundant
     AMD IOMMU declarations, macros, and checks"

* tag 'iommu-fixes-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  iommu/amd: Remove unused macro
  iommu/amd: Remove redundant checks from interrupt handler path
  iommu/amd: Remove redundant check in irq_remapping_select()
  iommu/amd: Make iommu_sva_set_dev_pasid as static
  MAINTAINERS: Drop the nonexistent vsi-iommu.h file entry
  iommu/amd: Fix ineffective error check in nested domain allocation
  iommu/amd: Fix premature break in init_iommu_one() again
  iommu/amd: Do not reallocate GA log buffers on resume
  iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
  iommu/riscv: Avoid waiting on failed command enqueue
  iommu/riscv: Serialize command queue publishing
  iommu/riscv: Add command queue lock
 2026-09-12 07:55:52 -07:00
Linus Torvalds 52311be52f Merge tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux 
Pull powerpc fixes from Madhavan Srinivasan:

 - powerpc/entry: Fix double accounting of user time on interrupt entry

 - Fix leak in htmdump_init_debugfs

 - KVM: PPC: Book3S HV: Set irqfd->producer only on success

 - powerpc/kexec_file: print configured kernel command line

 - Remove redundant early_init_dt_scan_root() call

 - misc fixes and cleanup

Thanks to Aboorva Devarajan, Amit Machhiwal, Athira Rajeev, Christophe
Leroy, Christophe Leroy (CS GROUP), Kunwu Chan, leixiang, longlong yan,
Michail Tatas, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM),
Shivang Upadhyay, Sourabh Jain, Thibault Ferrante, Vaibhav Jain, and
Venkat Rao Bagalkote

* tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs
  powerpc/prom: Remove redundant early_init_dt_scan_root() call
  selftests/powerpc: use MAP_FAILED instead of (void *)-1 in tm-signal-context-force-tm
  powerpc/kexec_file: print configured kernel command line
  KVM: PPC: Book3S HV: Set irqfd->producer only on success
  powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs
  selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
  selftests/powerpc/pmu/ebb: fix lost_exception_test hang with sched yield change
  powerpc/entry: Fix double accounting of user time on interrupt entry
 2026-09-12 07:45:01 -07:00
Linus Torvalds 114f73092b Merge tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator 
Pull regulator fixes from Mark Brown:
 "One fix for pf1550 which checked for errors on multiple regulators
  but always notified via one of them regardless of which one had the
  problem, plus one device ID addition in the fan53555 DT bindings"

* tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: pf1550: fix which regulator is notified
  regulator: dt-bindings: fan53555: add tcs,tcs4526
 2026-09-11 15:24:21 -07:00
Linus Torvalds 0fb234ce37 Merge tag 'spi-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi 
Pull spi fix from Mark Brown:
 "New device ID for v7.3: update the DesignWare DT binding to say how to
  describe the UltraRISC DP1000 instance of the controller"

* tag 'spi-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: snps,dw-apb-ssi: Add compatible for UltraRISC DP1000 SoC
 2026-09-11 15:10:31 -07:00
Linus Torvalds 525f0f99a4 Merge tag 'drm-fixes-2026-09-12' of https://gitlab.freedesktop.org/drm/kernel 
Pull drm fixes from Dave Airlie:
 "Weekly fixes pull, this seems relatively quiet for the new world,
  scattered fixes, mostly amdgpu leading the way, but lots of minor
  fixes in other drivers.

  drm_exec:
   - fix 0 object handling

  sched:
   - null ptr deref fix in kunit tests

  amdgpu:
   - Freesync fix
   - GPUVM fix
   - Debugfs fixes
   - HDMI fixes
   - IPS fix
   - GPU reset fix
   - RGB quantization fixes
   - SMU 13.0.x fixes

  xe:
   - runtime PM guard fix
   - cache flushing fix

  i915:
   - Fix a memleak on perf config query error path
   - Fix UHBR SST SDP splitting when sink doesn't support it

  bridge:
   - fix ti-sn65dsi83 error handling
   - tc358768: Enforce input bus flags via atomic_check

  ast:
   - fix blend mode property on cursor plane

  qxl:
   - fix blend mode property on primary/cursor planes

  virtio:
   - fix blend mode property on cursor plane

  vboxvideo:
   - fix blend mode property on planes

  rockchip:
   - fix endpoint name length
   - fix Kconfig issues

  ivpu:
   - limit firmware log prints to field size
   - validate buffer range in ivpu address translation
   - validate fw log buffers

  ethosu:
   - ensure SRAM sizing
   - ensure cmd stream formatting
   - drop IRQF_SHARED
   - fix open return value

  adp:
   - fix Kconfig

  logicvc:
   - fix Kconfig"

* tag 'drm-fixes-2026-09-12' of https://gitlab.freedesktop.org/drm/kernel: (38 commits)
  drm/amd/pm: report energy accumulator for smu 13.0.0
  drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7
  drm/amd/display: Rebuild InfoFrames on output color space changes
  drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output
  drm/amd/display: Propagate HDMI RGB quantization selectability
  Revert "drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_info"
  drm/amdgpu: skip gfx switch_power_profile during GPU reset
  drm/amd/display: Fix HF-VSDB DSC bpc detection to be cumulative
  drm/amd/display: Exit IPS before connector detection on resume
  drm/amd/display: Shorten hdmi_frl_status_polling_workqueue
  dm/amdgpu: fix malformed link_settings debugfs output
  drm/amdgpu: skip the VMID 0 flush for VRAM
  drm/amd/display: Consult MCCS FreeSync cap only if requested & supported
  drm/i915: Fix memory leak in query_perf_config_list()
  drm/i915/dp: Gate UHBR SST SDP splitting on sink capability
  drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
  drm/xe: Guard page-fault worker with runtime PM check
  drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()
  drm/bridge: tc358768: Enforce input bus flags via atomic_check
  drm/drm_exec: fix up contended obj when num_objects is 0
  ...
 2026-09-11 13:50:47 -07:00
Linus Torvalds 827751b699 Merge tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux 
Pull RISC-V fixes from Paul Walmsley:
 "From a RISC-V point of view, there's one notable fix here, reverting
  an earlier bogus fix to the pointer masking code. Fortunately the
  practical impact appears to be small.

   - Revert a bad fix, likely LLM-generated, in the pointer masking code
     that confused the RISC-V hardware pointer masking implementation
     with the Linux kernel tagged address feature

   - Fix unexpected faults caused by kprobe instruction slot writes when
     !CONFIG_STRICT_MODULE_RWX

   - Fix unexpected faults on minimal configurations during runtime code
     patching on !CONFIG_STRICT_MODULE_RWX systems

   - Fix a misplaced variable clear causing incorrect reuse of previous
     values in the RISC-V hardware feature probing code

   - Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
     than BIT on 64-bit masks; and use a bitmap rather than an unsigned
     long on a quantity that can exceed 32 bits

  And a few miscellaneous cleanups:

   - Avoid a potential dereference-before-NULL-pointer-check bug in the
     PMU SBI perf driver

   - Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug
     table code (like x86 and PPC)

   - Report the RISC-V standard ISA extensions Z[v]fhmin when support is
     claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
     simplify our FPU test code to only check for the presence of the D
     extension

   - Use an existing kernel string helper in place of some open-coded
     code in kernel/usercfi.c

   - Fix some yamllint issues in the RISC-V DT bindings for CPUs

   - Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into
     the RISC-V CFI selftest code

   - Update the translation for the simplified Chinese translation of
     the RISC-V kernel patch acceptance policy"

* tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
  kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__
  docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation
  dt-bindings: riscv: cpus: Fix yamllint style issues
  riscv: hwprobe: simplify has_fpu() to check D extension only
  perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
  riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
  perf: RISC-V: store available counter mask as bitmap
  perf: RISC-V: use BIT_ULL for u64 overflow masks
  riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
  riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
  riscv: use string helper in setup_global_riscv_enable()
  Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
  riscv: patch: skip fixmap mapping when kernel text is already writable
  riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
 2026-09-11 13:15:13 -07:00
Linus Torvalds 1235ff3299 Merge tag 'platform-drivers-x86-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 
Pull x86 platform driver fixes from Ilpo Järvinen:

 - amd/pmf: Fix build on !CONFIG_AMD_PMF_DEBUG

 - asus-laptop: Fix ACPI event handling

 - hp-wmi: Fix board_params typo for 8DD6 board

 - x86-android-tablets: Fix Arizona and Crystal Cove GPIO lookups

* tag 'platform-drivers-x86-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
  MAINTAINERS: fix sysfs-platform-ayaneo-ec documentation path
  platform/x86: x86-android-tablets: fix gpio_secondary_fwnode_init() not working
  platform/x86: x86-android-tablets: use shared battery swnode group on Yoga Tab 2
  platform/x86: x86-android-tablets: drop redundant swnode group on YT3
  platform/x86: x86-android-tablets: add Crystal Cove GPIO swnode support
  platform/x86: x86-android-tablets: pass node group to gpio_secondary_fwnode_init()
  platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
  platform/x86: x86-android-tablets: fix Arizona GPIO swnode references
  platform/x86/amd/pmf: fix build on !CONFIG_AMD_PMF_DEBUG
  platform/x86: asus-laptop: Fix ACPI event handling
  platform/x86: hp-wmi: Fix board_params typo for 8DD6 board
 2026-09-11 12:52:48 -07:00
Linus Torvalds 707662b40a Merge tag 'ata-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux 
Pull ata fix from Niklas Cassel:

 - Drop documentation for no longer existing pata_legacy kernel
   parameters (Ethan)

* tag 'ata-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: pata_legacy: remove documentation for removed module parameters
 2026-09-11 12:44:11 -07:00
Linus Torvalds 35ef102063 Merge tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 
Pull block fixes from Jens Axboe:

 - Fix the start and length check added to iov_iter_extract_bvecs(),
   which used iter_iov_addr()/iter_iov_len() helpers that aren't safe
   for the ITER_BVEC/FOLIOQ/etc iterator types passed

 - sunvdc fixes for an -EIO issue from lack of retries, and unmapping
   LDC cookies when the descriptor send fails

 - Clear force_abort in ublk_queue_reset_io_flags()

 - ublk selftest install fix

* tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  selftests: ublk: add batch IO cases to recover_03
  ublk: clear force_abort in ublk_queue_reset_io_flags()
  sunvdc: fix -EIO issue due to lack of retries
  sunvdc: unmap LDC cookies when the descriptor send fails
  block: Fix start and length check added to iov_iter_extract_bvecs()
  selftests: ublk: install test_common.sh and trace/ scripts
 2026-09-11 12:38:44 -07:00
Linus Torvalds 42f961c42b Merge tag 'io_uring-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 
Pull io_uring fixes from Jens Axboe:

 - Fix a deadlock in the write path with superblock freezing

 - Fix an issue where a provided buffer ring would overconsume when
   using MSG_TRUNC

 - Keep the CQE flags on iopoll requests when adding kbuf flags

* tag 'io_uring-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/rw: keep CQE flags on iopoll requests when adding kbuf flags
  io_uring/net: don't overconsume buffers when using MSG_TRUNC
  io_uring/net: let io_recv_buf_select return the length of the buffer region
  io_uring/rw: end write accounting from ->ki_complete
 2026-09-11 12:36:13 -07:00
Linus Torvalds 3026c6e4f2 Merge tag 'slab-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab 
Pull slab fixes from Vlastimil Babka:

 - Stable fix for an ABA issue causing slab list corruption introduced
   in 7.2 (Harry Yoo, with big thanks to Hyunwoo Kim for the thorough
   report and initial version of the fix)

 - Fix for 7.3 regression of kvfree_rcu() on PREEMPT_RT which can cause
   a deadlock from the set_cpus_allowed_force() caller (Vlastimil Babka)

* tag 'slab-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab:
  mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
  mm/slab: disallow kfree_rcu_sheaf() on PREEMPT_RT again
 2026-09-11 11:56:33 -07:00
Linus Torvalds 576da3462c Merge tag 'sound-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 
Pull sound fixes from Takashi Iwai:
 "A collection of device-specific small fixes. At this time, the
  majority of changes are about ASoC while we have usual suspects like
  HD- and USB-audio quirks. Some highlights below.

  ASoC Intel / SoundWire:
   - Fix bus and stream resource leaks at error path in avs and hda-ext
   - More fixes and refactoring in avs for constraining MSBs, async
     handling D0ix
   - Add support for TAC5xx2 SoundWire family and NVL MAX98360A RT5682
     machines
   - Fix uninitialized stream configurations in Realtek SoundWire codecs
   - Adjust latency control to fix no-sound issue on RT721-SDCA

  ASoC AMD:
   - Avoid binding for the acp-da7219-max98357a machine driver
   - Add quirks for Acer Nitro AN17-41 and HP 255R G10
   - Fix memory leaks in ACP6x

  ASoC Codecs & Platforms:
   - Fixes for cs35l56 to avoid deadlock, kexec race, and runtime PM
     imbalances
   - Split stereo streams across mono amps on tas2783-sdw
   - Fix pop noise on es8326 and enable_count underflow on es8389
   - Various fixes for fsl_micfil, sprd, sti, and publish OF module
     aliases
   - Fixes & cleanups for Ux500 (MSP/I2S) and AB8500 codecs

  HD-audio:
   - Fix for channel status notification changes
   - Quirks for HP laptops

  USB-audio:
   - Fix embedded URBs in caiaq, 6fire, hiface, and ua101 drivers
   - More hardening in usx2y and us122l drivers
   - Quirks for Behringer devices

  Misc:
   - Add PCI ID for RME HDSPe AIO PCI Express audio card in hdspm
   - Fix S/PDIF passthrough on CA20K2 in ctxfi"

* tag 'sound-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (65 commits)
  ALSA: hdspm: Add a new PCI device ID (1d18:3fc6) for RME HDSPe AIO PCI express audio
  ASoC: amd: acp-da7219-max98357a: don't bind on Raven/Picasso boards
  ALSA: hda: Report a change when only the channel status bytes move
  ALSA: us122l: Prevent write upgrades for read mappings
  ALSA: hda/realtek: Add quirk for HP Elite Dragonfly Max G2 speaker
  ASoC: cs35l56: Fix race between kexec and snd_soc_register_component()
  ASoC: amd: yc: add quirk for Acer Nitro AN17-41 internal mic
  ASoC: mt6351: Publish the OF module alias
  ASoC: Intel: SST: Publish the PCI module aliases
  ASoC: bcm: bcm63xx: Publish the OF module aliases
  ALSA: usb-audio: Add quirk flags for Behringer UV1
  ALSA: usb-audio: Add boot quirk for Behringer CM1A
  ALSA: hda/realtek: Add quirk for HP Omen 16-wd0xxx mute LED
  ALSA: usbusx2y: validate URB actual_length in interrupt callback
  ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
  ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
  ALSA: usb: 6fire: Avoid embedded URBs
  ALSA: usb: hiface: Avoid embedded URBs
  ALSA: usb: ua101: Avoid embedded URBs
  ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
  ...
 2026-09-11 10:00:07 -07:00
Linus Torvalds d5d6c9d244 Merge tag 'media/v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 
Pull media fixes from Mauro Carvalho Chehab:
 "Core:
   - add bounded tile-count helpers for HEVC stateless decoders
   - validate AV1 tile counts fits in array size
   - validate HEVC tile counts fits in array size
   - fix memcmp() size in B1 reference list comparison

  mediatek:
   - bound AV1 tile-start copy to fit in array size

  rockchip:
   - reject AV1 frames exceeding the tile size
   - guard VPU981 AV1 divisor and tile buffer

  hantro and rkvdec:
    - bound G2 HEVC tile loops and PPS id to the buffer size

  rppx1:
   - read the raw pattern from the PRE2 acquisition module
   - describe the MAIN_POST white balance gains block"

* tag 'media/v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
  media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
  media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
  media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
  media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
  media: hevc: add bounded tile-count helpers
  media: v4l2-ctrls: validate AV1 tile counts
  media: v4l2-ctrls: validate HEVC tile counts
  media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
  media: rppx1: bls: read the raw pattern from the PRE2 acquisition module
  media: rppx1: describe the MAIN_POST white balance gains block
 2026-09-11 09:49:40 -07:00
Linus Torvalds 08df884136 Merge tag 'thermal-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 
Pull thermal control fix from Rafael Wysocki:
 "Replace snprintf() with scnprintf() in the thermal core sysfs code to
  avoid compiler warnings about potential truncation of the names of the
  sysfs attributes (Andy Shevchenko)"

* tag 'thermal-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: sysfs: switch to use scnprintf() to suppress truncation warning
 2026-09-10 14:45:25 -07:00
Linus Torvalds 5897d0546f Merge tag 'pm-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 
Pull power management fixes from Rafael Wysocki:
 "These harden the cpufreq core against races with sysfs during policy
  creation, fix two issues in the OPP (Operating Performance Points)
  library, and make OPP print symbolic error names:

   - Zero-initialize the policy cpumask and initialize the policy rwsem
     before exposing the policy sysfs interface (Runyu Xiao and Zhongqiu
     Han)

   - Fix potential multiplication overflow when calculating freq in OPP
     core (Colin Ian King)

   - Fix use after free in _update_opp_table_clk() (Peter Griffin)

   - Use %pe to print symbolic error name in OPP (Sumeet Pawnikar)"

* tag 'pm-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  opp: fix use after free in _update_opp_table_clk()
  cpufreq: zero-initialize policy cpumask before sysfs publication
  cpufreq: initialize policy rwsem before sysfs publication
  opp: Use %pe to print symbolic error name
  OPP: of: Fix potential multiplication overflow when calculating freq
 2026-09-10 14:42:46 -07:00
Linus Torvalds aa416593f3 Merge tag 'hwmon-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging 
Pull hwmon fixes from Guenter Roeck:

 - Core
     - Fix potential UAF in pec_store
     - Ensure that 'dev' passed to hwmon_notify_event() is a hwmon device
     - Document hwmon_notify_event()

 - applesmc: Fix key backlight workqueue leak on register failure

 - aspeed-pwm-tacho: Propagate reset deassert errors

 - asus_rog_ryujin: HID report fixes

 - chipcap2: Fix channels in humidity alarm notifications

 - corsair-cpro: debugfs fixes

 - gpd-fan: Documentation: replace full-width colon by a standard ASCII
   colon

 - gpio-fan: Take fan_data->lock in gpio_fan_shutdown(), and fix
   use-after-free in alarm work

 - ina2xx: Fix in0 and curr1 alarm handling, and acquire hwmon_lock in
   shunt_resistor_show()

 - ltc4282: Fully initializeclk_init_data

 - mcp9982: Propagate one-shot polling errors

 - nct6694: Do not expose enable on DTIN temperature channels

 - PMBus core: Clear generic status alarms with CLEAR_FAULTS

 - sht4x: Fix return value from heater_enable_store(), and add missing
   locks

* tag 'hwmon-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (24 commits)
  hwmon: (nct6694) do not expose enable on DTIN temperature channels
  hwmon: (asus_rog_ryujin) Synchronize HID command and report handling
  hwmon: (asus_rog_ryujin) Validate HID report lengths
  hwmon: (corsair-cpro) Remove debugfs entries when probe fails
  hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
  hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
  hwmon: (corsair-cpro) Create debugfs entries after hwmon registration
  hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
  hwmon: (chipcap2) fix channels in humidity alarm notifications
  hwmon: (applesmc) fix key backlight workqueue leak on register failure
  hwmon: (sht4x) Fix return value from heater_enable_store()
  hwmon: (sht4x) Add missing locks
  hwmon: (yogafan) fix non-kernel-doc comment
  Documentation: hwmon: replace full-width colon by a standard ASCII colon
  hwmon: (ina2xx) Decouple in0 and curr1 alarms
  hwmon: (ina2xx) Replace masks with enum in alert functions
  hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()
  hwmon: Ensure that 'dev' passed to hwmon_notify_event() is a hwmon device
  hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show()
  hwmon: Fix potential UAF in pec_store
  ...
 2026-09-10 14:37:53 -07:00
Linus Torvalds 7844502343 Merge tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 
Pull networking fixes from Jakub Kicinski:
 "Nothing too exciting, usual stream of fixes. Including fixes from
  Netfilter, Bluetooth and WPAN.

  Current release - new code bugs:

   - Bluetooth: hci_sync: fix not setting CE length properly

   - eth: enic: match mailbox replies to request numbers

  Previous releases - regressions:

   - tunnels: drop stale dst when building an ICMP error for PMTUD

   - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
     (bug in the rtnl_lock -> RCU conversion)

   - eth: bnxt_en:
       - fix crashes on Thor2 due to OOB coalescing buffer accesses
       - prevent queue stop with deferred completions

  Previous releases - always broken:

   - eth:
       - ice: don't dereference pointers from TP_printk()
       - fix OOB writes on ethtool flow rule dump in 3 drivers
       - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD

   - dsa: tag_brcm: legacy FCS: request needed tailroom

  Misc:

   - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc

   - ipv6: flowlabel: cap duplicate leases per socket"

* tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits)
  selftests: tc-testing: test action batch failure cleanup
  net/sched: act_api: release all action references on NEWACTION failure
  openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
  ipmr: account multicast table and route memory
  net: phy: dp83td510: handle the active-high LED polarity mode
  net: macb: initialize PTP state before registering clock
  net: hsr: enable promiscuous mode on interlink port with fwd offload
  ipv6: fix fib6 walker UAF on seq stop
  net: stmmac: fix TX descriptor availability check for TSO traffic
  net/rds: fix tcp stream corruption with large pages
  net: mana: restore the XDP program pointer when pre-allocation fails
  net: phy: dp83867: handle the active-high LED polarity mode
  octeontx2-af: fix PF/CGX debugfs PCI bus lookup
  net: net_failover: Fix the deadlock in net_failover_slave_name_change()
  net: phy: mediatek-ge: disable EEE on the MT7530 PHY
  tcp: reject non zerocopy devmem tx
  net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support
  net: dsa: mt7530: populate lpi_interfaces to fix EEE support
  net: hinic: fix mailbox segment buffer overflow
  net: sun4i-emac: fix missing of_node_put() for phy_node
  ...
 2026-09-10 14:07:48 -07:00
Linus Torvalds 0a96d0d726 Merge tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux 
Pull smb client fixes from Paulo Alcantara:

 - File type corruption fixes in reparse point handling: setting S_IFMT
   bits without clearing the existing type first corrupted the file mode
   (e.g. S_IFREG | S_IFCHR == S_IFLNK). Fixed in the WSL, POSIX and
   native symlink reparse parsers. Also fixes an uninitialized SID
   structure in the POSIX readdir path when parsing fails.

 - Ownership mapping fixes: forceuid/forcegid mount options were
   ignored in several code paths (SID-to-id mapping, WSL extended
   attributes, POSIX extensions getattr), allowing an untrusted server
   to dictate local file ownership despite explicit mount overrides.

 - Heap overflow and overflow fixes in DACL rewriting: replacing short
   SIDs with long ones could overflow the DACL buffer, and the u16
   accumulator for DACL size could wrap around with enough ACEs.

 - Reference count leak fixes in oplock break and deferred close:
   duplicate oplock breaks on a queued work item leaked a
   cifsFileInfo reference, and deferred close had a similar leak when
   requeueing a running work item. Both cause busy-inode oopses on
   unmount.

 - DFS superblock use-after-free fix: the iterator callback stored a
   raw superblock pointer without pinning it, racing with automount
   expiry.

 - One-byte slab OOB read in the native symlink parser when handling
   share-root relative paths.

 - Hardening of legacy SMB1 input: reject userspace-crafted
   cifs.idmap key descriptions that bypass kernel origin checks, and
   validate DataOffset in CIFSSMBRead() to prevent heap info
   disclosure from a malicious server.

 - DFS cache fix: defer metadata updates until target copying
   succeeds to prevent partial-state cache entries on allocation
   failure.

* tag 'cifs-fixes-7.3-rc3' of https://git.manguebit.org/linux:
  smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
  smb: client: fail DACL rewrite when the new DACL exceeds 64K
  smb: client: fix heap overflow in DACL owner/group rewrite
  smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
  smb: client: fix file type corruption in posix_reparse_to_fattr()
  smb: client: fix file type corruption in wsl_to_fattr()
  smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
  smb: client: fix WSL reparse point uid/gid override
  smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
  smb: client: fix uid/gid override in getattr with posix extensions
  smb: client: fix cifsFileInfo reference leak in deferred close
  smb: client: avoid leaking refcount when cifs_sb_tlink() fails
  smb: client: avoid leaking refcount in cifs_queue_oplock_break()
  smb: client: fill cache fields after populating cache in copy_ref_data()
  smb: client: pin DFS superblock in iterator callback
  smb: client: reject userspace cifs.idmap descriptions
  smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
  smb: client: reject short READ responses in CIFSSMBRead()
 2026-09-10 14:03:48 -07:00
Linus Torvalds ad724d319c Merge tag 'sysctl-7.03-fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl 
Pull sysctl fix from Joel Granados:
 "This fell through the cracks during the latest merge window. There are
  no more CONFIG_PROC_SYSCTL uses after this fix:

   - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL

     CONFIG_SYSCTL is the config string that controls sysctl subsys"

* tag 'sysctl-7.03-fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  syscall_user_dispatch: Use CONFIG_SYSCTL for sysctl guard
 2026-09-10 09:36:56 -07:00
Linus Torvalds c9a8c0e393 Merge tag 'watchdog-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging 
Pull watchdog fixes from Guenter Roeck:

 - core: Do not start hrtimer when pretimeout is zero

 - msc313e: Various fixes for issues reported by Sashiko

 - MAINTAINERS: Update URI for watchdog tree

 - sunxi_wdt: preserve boot-enabled watchdog

* tag 'watchdog-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  watchdog: msc313e: Sync timeout value if WDT was running at boot
  watchdog: msc313e: Fix undefined behavior
  watchdog: msc313e: Fix spurious reset on suspend
  watchdog: msc313e: Enable clock before accessing hardware registers
  watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
  watchdog: msc313e: Avoid division by zero
  watchdog: fix hrtimer start when pretimeout is zero
  MAINTAINERS: Update URI for watchdog tree
  watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
  watchdog: sunxi_wdt: preserve boot-enabled watchdog
 2026-09-10 09:11:17 -07:00
Linus Torvalds 50d05c7c76 Merge tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux 
Pull Landlock fixes from Mickaël Salaün:
 "This fixes a use-after-free and a lockdep assert NULL dereferencing,
  and properly truncates too-long strings printed by a Landlock
  tracepoint. Most of the changes are brought by new tests"

* tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
  landlock: Test trace path output boundaries
  landlock: Bound escaped trace path output
  landlock: Clean up ruleset validation checks
  selftests/landlock: Test abstract socket trace name limits
  landlock: Fix use-after-free of the source's parent directory
 2026-09-09 11:00:35 -07:00
Linus Torvalds 5e1287972b Merge tag 'vfs-7.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 
Pull vfs fixes from Christian Brauner:

 - netfs:

     - Fix an uninitialized return value in netfs_unbuffered_write()
       when preparing the first subrequest fails

     - For partial unbuffered/DIO writes return the amount transferred
       rather than an error

     - Update i_size with the amount actually written when a partial
       transfer ends in an error

     - Fix a subrequest reference leak when the io_iter ends up empty

     - Handle netfs_alloc_subrequest() failure during unbuffered writes

     - Load all readahead folios into the rolling buffer upfront and
       drop the readahead references once the first subrequest is
       dispatched

     - Mark folios for copy-to-cache while issuing subrequests

     - Fix read progress reporting

 - afs:

     - Add the missing kunmap in the error path of afs_dir_search_bucket()

     - Fix a double kunmap in afs_edit_dir_remove()

     - Don't free an existing server's endpoint state when cleaning up a
       candidate server in afs_lookup_server()

     - Unbind peers removed from a server's address list

 - ufs:

     - Load the cylinder group metadata before creating the root dentry

     - Validate the cylinder group index and rotor positions before
       caching them

     - Treat an unreadable directory block as not empty

 - exec:

     - Close the close-on-exec files before taking exec_update_lock

       Closing a file can block on the filesystem, so a hung filesystem
       blocked everything that takes exec_update_lock and a FUSE server
       inspecting the calling process could deadlock

     - Drop the bprm loader before closing bprm->file in free_bprm()

 - exit: Hold a reference to thread_pid across proc_flush_pid()

 - reboot: Fix a use-after-free on cad_pid

 - nsfs: Keep the namespace tree fields out of the rcu_head used by
   kfree_rcu()

 - nstree: Check listing permission before taking a namespace
   reference in listns()

 - super: Return 0 when a nested thaw drops its hold while other
   freezers remain

 - ext4: Don't set I_METADATA_WRITEBACK during fastcommit replay

 - adfs: Free s_fs_info in ->kill_sb()

 - autofs: Free the inode info allocated in autofs_fill_super() when
   the root inode allocation fails

 - ovl: Return EINVAL instead of EIO on a user namespace mismatch now
   that it's a plain refusal and not an internal error

 - cachefiles: Don't cast the variable-length coherency data to a
   __be64 in the coherency tracepoint

* tag 'vfs-7.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)
  nstree: check listing permission before taking a namespace reference
  exec: do_close_on_exec() before taking exec_update_lock
  exit: hold a reference to thread_pid across proc_flush_pid
  fs: autofs: fix memory leak in autofs_fill_super()
  exec: Drop bprm loader before closing bprm->file
  afs: Clear stale peer app data after address list changes
  afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
  afs: Fix double-unmap of directory block
  afs: Fix missing kunmap in afs_dir_search_bucket()
  ovl: return EINVAL instead of EIO in case of mismatched user_ns
  reboot: fix cad_pid use-after-free race
  cachefiles: Fix potential UAF/KASAN warning
  netfs: Fix read progress reporting
  netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs
  netfs: Fix readahead synchronisation issues by loading all folios upfront
  netfs: break unbuffered write when netfs_alloc_subrequest() fails
  netfs: Fix subreq ref leak
  netfs: Fix i_size update for partial transfer
  netfs: Fix error vs transferred passed to ->ki_complete()
  netfs: Fix unbuffered/DIO write partial transfer error return
  ...
 2026-09-09 09:38:03 -07:00
Linus Torvalds 4f3989d75d Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost 
Pull virtio fixes from Michael Tsirkin:
 "Just a ton of small fixes all over the place.

  Also includes virtio and virtio-rng MAINTAINERS updates"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (27 commits)
  vduse: return compat ioctl results directly
  virtio_input: stop callbacks before unregistering input device
  virtio_input: reset device if input_register_device() fails
  vhost: invalidate vring access on IOTLB transitions
  vduse: validate virtqueue alignment
  vduse: do not take dev->rwsem in the virtqueue kick path
  vhost-scsi: clamp max_io_vqs module parameter
  vhost-scsi: use kvzalloc for vq array allocation
  virtio-pci: return IRQ_HANDLED after non-zero ISR
  virtio: add Eugenio Pérez as Maintainer
  vhost: limit outstanding IOTLB misses per virtqueue
  MAINTAINERS: Add a section for virtio-rng
  vdpa_sim_net: check TX pull result before RX copy
  vdpa_sim_blk: reject out-of-range sector starts
  virtio-vdpa: Use queue id when setting vq affinity
  vdpa: octeon_ep: Check dev_set_name() in dev add
  vdpa: ifcvf: Put device on unsupported feature error
  vdpa: solidrun: Free IRQs after request failure
  vdpa: alibaba: Keep DRIVER_OK clear if IRQ setup fails
  vdpa/pds: check virtqueue notify mapping
  ...
 2026-09-09 08:50:05 -07:00
Linus Torvalds 3f8b8c94a7 Merge tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux 
Pull printk fixes from Petr Mladek:

 - Use lazy irq_work for waking printk kthreads

 - Flush pending irq_work before destroying printk kthreads

 - Remove redundant WARN() when a printk kthread can't be created

 - Typo fix

* tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY
  printk/nbcon: Flush nbcon_irq_work in nbcon_free()
  console: fix /dev/kmsg reference in flags kernel doc
  printk: Don't WARN on kthread_run failure.
 2026-09-09 07:06:18 -07:00
Linus Torvalds 893e11787f Merge tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull x86 fixes from Dave Hansen:
 "These are fixes for some older AMD device topology and machine check
  issues. But, they are issues that are affecting real users and aren't
  just cleaning up AI drive-by reports.

  These is coming a wee bit later than the usual Sundays because of a
  late breaking issue with one of the patches which is now temporarily
  kicked out"

* tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/MCE/AMD: Fix inverted interrupt enablement during storm handling
  x86/amd_node: Fix potential NULL pointer dereference
  x86/amd_node: Avoid divide by zero on virtualized systems
 2026-09-08 12:54:56 -07:00
Linus Torvalds 5acbae5f7e Merge tag 'powerpc-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux 
Pull powerpc fixes from Madhavan Srinivasan:

 - Clear TIF_SYSCALL_RET before syscall error return

 - Don't drop _TIF_RESTOREALL on syscall restart

 - Do not restore KUAP in arch_exit_to_user_mode_prepare()

 - pci-ioda: Fix the stale irq chip reference

 - Use inclusive range checks in add_usable_mem() and excluded memory

 - Fix irq_soft_mask corruption on replayed interrupt exit

 - MAINTAINERS: powerpc: Add Ritesh and Shrikanth

 - Misc fixes and cleanups

Thanks to Amit Machhiwal, Christophe Leroy (CS GROUP), Gautam Menghani,
Harsh Prateek Bora, Jiangshan Yi, Mukesh Kumar Chaurasiya (IBM), Ritesh
Harjani (IBM), Shivaprasad G Bhat, Shrikanth Hegde, Sourabh Jain,
Tasmiya Nalatwad, Thorsten Blum, and Venkat Rao Bagalkote.

* tag 'powerpc-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  MAINTAINERS: powerpc: Add Ritesh and Shrikanth
  powerpc/ps3: Fix repository.c build failure
  powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
  powerpc/pseries/pci: Fix misleading VF limit error message
  powerpc/kexec_file: Use inclusive range checks for excluded memory
  powerpc/kexec: Simplify kdump_extra_elfcorehdr_size()
  powerpc/kexec_file: Use inclusive range checks in add_usable_mem()
  powerpc/rtas_pci: No hotplug on permanently removed device on pSeries
  powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
  powerpc: pci-ioda: Fix the stale irq chip reference
  powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
  powerpc: Don't drop _TIF_RESTOREALL on syscall restart
  powerpc/entry: Clear TIF_SYSCALL_RET before syscall error return
 2026-09-08 07:59:12 -07:00
Linus Torvalds 7daadf5131 Merge tag 'v7.3-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 
Pull crypto fixes from Herbert Xu:
 "This adds missing vzeroupper instructions to x86/aria"

* tag 'v7.3-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: x86/aria - add missing vzeroupper in AVX-512 code
  crypto: x86/aria - add missing vzeroupper in AVX2 code
 2026-09-08 07:55:40 -07:00
Linus Torvalds 28924df2a0 Merge tag 'perf-tools-fixes-for-v7.3-2026-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools 
Pull perf tools fixes from Namhyung Kim:
 "Two simple fixes for this cycle:

   - Do not use separate debug files for Intel PT decoding

   - Fix size of raw data in the PowerPC VPA DTL samples"

* tag 'perf-tools-fixes-for-v7.3-2026-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  perf powerpc-vpadtl: Fix raw_size of DTL samples
  perf symbol: Do not use debug file as the binary type
 2026-09-07 10:26:56 -07:00
Linus Torvalds c297ed90fb Merge tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux 
Pull configfs fixes from Breno Leitao:

 - A symlink racing with rmdir of its target could reach a freed
   ->ci_dentry.

   The reference that get_target() takes pins the config_item, not
   its dentry; the dentry is pinned by DCACHE_PERSISTENT, which
   configfs_remove_dir() drops while the item is still alive.

   Take the target's configfs_dirent under ->d_lock instead of chasing
   ->ci_dentry.

 - configfs_rmdir() left the dentry hashed across the final put of the
   item, and configfs_get_config_item() treats a hashed dentry as proof
   of a live item. A concurrent symlink could therefore resurrect a
   dying item and hit a use-after-free.

   Unhash in configfs_remove_dir(), while the item is still guaranteed
   to be there.

Both issues were found by syzbot.

* tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
  configfs: unhash the dentry before dropping the item in rmdir
  configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
 2026-09-07 10:01:38 -07:00
Linus Torvalds df2908090c Linux 7.3-rc2 2026-09-06 15:07:20 -07:00
Linus Torvalds b1e00ffaf9 Merge tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 
Pull tracing fixes from Steven Rostedt:

 - Fix several tracefs files that did not take the trace_array reference

   A trace instance can be created and destroyed in the tracefs
   "instances" directory via mkdir and rmdir respectively. The instance
   is represented by a trace_array descriptor.

   Most tracefs files pass the trace_array as the private data of the
   inode to the open/read/write functions. Since there is no locking
   between the time a task opens a file and the deletion of the instance
   (and the freeing of the trace_array), each open needs to get a
   reference to the trace_array and each close must remove it.

   An instance can't be removed if there's any reference taken on its
   trace_array. The open function uses trace_array_get() that takes a
   lock (preventing removal of instances) and iterates the list of all
   existing trace_arrays and if it finds a match, it takes the reference
   and releases the lock. If it doesn't find a match, it causes the open
   to return -ENODEV.

   There were some added files that did not take the trace_array
   reference on open that needed to be fixed. Sashiko also correctly
   pointed out that there were some files that took an address of an
   field or element of the trace_array which had a pointer back to the
   trace_array to take its reference on open. But this leaves a slight
   race between referencing this element to get the trace_array as the
   element itself could be freed. To solve this, some helper functions
   were created to look for trace_arrays with this field or element in
   the search so that the element did not have to be dereferenced before
   the trace_array's reference was taken.

 - Add a lock around ftrace_ops initialization

   When a ftrace_ops is first used by ftrace, some internal
   initialization is performed on the ops. But if multiple tasks were
   calling functions that did this initialization, it could race and
   perform doing the initialization more than once, corrupting the
   internal data. Add a lock in the initialization code to prevent this
   from happening.

 - Fix splice reads on mmapped buffers

   The logic in the ring buffer splice code for mmapped buffers is
   supposed to do a copy of the memory as the mapped buffers can't be
   given to splice. But there was an if statement within the copy code
   that would return a -1 if a request for a full page was done and it
   wasn't a partial read. This is because this logic was written before
   mmapped buffers existed and this case didn't make sense at the time.
   For mmapped buffers it makes perfect sense and by returning early can
   drop a lot of pages unnecessarily.

 - Have the persistent ring buffer validation check nr_subbufs

   Sashiko reported that the validation code was relying on the saved
   nr_subbufs to match the calculated nr_pages + 1 and if they were off,
   that the code could cause corruption. Sashiko is correct, and the
   saved nr_subbufs should be validated before assuming it is correct.

 - Do not allow more than one instance with the same name on cmdline

   If an admin were to add more than one trace instances with the same
   name they all would be created, but only the first one would be
   accessible via tracefs. This used to not be allowed but some
   restructuring of code has since made it possible.

 - Fix the race between subbuf resize and trace_pipe_raw readers

   If a task was reading trace_pipe_raw while another task was changing
   the ring buffer subbuf size, it could crash the reader. The
   trace_pipe_raw readers do get their own copy of the page from the
   buffer, but the code needs some restructuring to not have the resize
   of the subbuffers cause issues.

 - Cap the size of the mapped (static) ring buffer nr_pages

   The meta data used for ring buffer mapped buffers is 32 bit in size.
   A normal ring buffer could (in theory) have more than 4 billion
   pages. But this is not allowed by mapped buffers, so enforce it.

* tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Use a macro for static buffer bits
  tracing: Fix comment in tracing_buffers_splice_read()
  ring-buffer: Prevent truncation of nr_pages / nr_subbufs
  ring-buffer: Cap static ring buffer nr_pages
  tracing: Fix subbuf resize races with trace_pipe_raw readers
  tracing: Fix to avoid creating trace instances with duplicate names
  ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
  ring-buffer: Allow splice reads on static buffers
  tracing: Take trace_array reference when opening options file
  ftrace: Synchronize the initialization of ftrace_ops
  ftrace: Take trace_array reference before accessing its ftrace_ops
  tracing: Have show_event_filters/triggers files take trace array ref
 2026-09-06 14:21:24 -07:00
Linus Torvalds 2beb1b31a1 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 
Pull bpf fixes from Alexei Starovoitov:
 "This mainly contains verifier fixes that address bugs reported by
  Nicholas Carlini.

   - Fix incorrect non-NULL inference in pointer comparisons: pointer
     types that may be NULL at runtime, pointers with unbounded offsets,
     JMP32 comparisons with zero, and imprecise zero registers (Eduard
     Zingerman)

   - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
     implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
     NULL call arguments (Eduard Zingerman)

   - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
     extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
     patterns entered by a jump (Eduard Zingerman)

   - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
     (Hui Su)

   - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
     and reject key-less BTF for hash maps (Jiayuan Chen)

   - Various fixes (Kumar Kartikeya Dwivedi):
       - Fix out-of-bounds access in disassembler on invalid LDSX
         instruction
       - mark siginfo of signal tracepoints as scalar and
         sched_process_wait argument as nullable
       - mark faultable stack helpers as sleepable
       - reject tail calls and legacy packet loads from callbacks
       - enforce rbtree callback lock restrictions for resilient locks
       - require MEM_PERCPU for percpu kptr stores
       - clear NON_OWN_REF after RCU protection ends
       - mark NULL kptr stores precise
       - preserve inner map identity in callback frames
       - reject non-scalar bpf_loop() iteration counts

   - Fix trampoline allocation slowdown on x86 by using
     EXECMEM_MODULE_DATA (Mike Rapoport)

   - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
     reject untrusted allocated-object pointers (Ning Ding)

   - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
     Yuan Chen)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
  bpf, riscv: Make arena support depend on ZACAS
  selftests/bpf: Test pointer bpf_loop iteration count rejection
  bpf: Reject non-scalar bpf_loop iteration counts
  bpf: use mark_arg_precision() in check_mem_size_reg()
  bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
  selftests/bpf: precision of a NULL global subprogram BTF_ID argument
  bpf: mark a NULL BTF_ID argument of a global subprogram precise
  selftests/bpf: precision of a NULL kfunc argument
  bpf: mark a NULL kfunc argument precise
  selftests/bpf: precision of a NULL global subprogram memory argument
  bpf: mark a NULL memory argument of a call precise
  selftests/bpf: precision of a NULL helper argument
  bpf: mark a NULL call argument precise
  selftests/bpf: Test inner map identities in callbacks
  bpf: Preserve inner map identity in callback frames
  selftests/bpf: Test imprecise scalar kptr stores
  bpf: Mark NULL kptr stores precise
  selftests/bpf: Test rhtab kptr cancellation semantics
  bpf: Cancel special fields when recycling rhtab elements
  selftests/bpf: Test timer field on recycled rhtab element
  ...
 2026-09-06 13:49:44 -07:00
Linus Torvalds 88405f0ad1 Merge tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull scheduler fixes from Ingo Molnar:

 - Fix a timestamping bug in pick_task_fair() and yield_task_fair()
   (Zhan Xusheng)

 - Skip migrate-disabled tasks when picking a push candidate in the
   RT and DL schedulers (Seiji Nishikawa)

 - Skip rq->avg_idle update without a valid idle_stamp (Shubhang
   Kaushik)

 - Fix throttling bug in throttle_cfs_rq(), caused by the recent
   single-runqueue conversion (Wanwu Li)

 - Fix bandwidth calculation bug in distribute_cfs_runtime(),
   caused by the single-runqueue conversion (Wanwu Li)

 - Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello)

 - Avoid creating misfits during cache-aware load-balancing on hybrid
   systems (Tim Chen)

* tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Avoid creating misfits during cache-aware balancing
  x86/itmt: Don't make ITMT enablement depend on debugfs
  sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime()
  sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq()
  sched/core: Skip rq->avg_idle update without a valid idle_stamp
  sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
  sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers
 2026-09-06 11:08:44 -07:00
Linus Torvalds c4a3928e7d Merge tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull perf events fixes from Ingo Molnar:

 - Skip empty AUX records with only format flags (Leo Yan)

 - Fix use-after-free when perf mmap() revival races with the
   last munmap() (Yilin Zhang, Weiming Shi)

* tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix use-after-free when perf mmap() revival races with the last munmap()
  perf/core: Skip empty AUX records with only format flags
 2026-09-06 11:06:09 -07:00
Linus Torvalds c8990f3179 Merge tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull locking fixes from Ingo Molnar:

 - Fix a softirq processing delay bug in local_interrupt_disable(),
   which should mostly only affect the Rust runtime (Boqun Feng)

 - Remove the hardirq_disable_count() function which caused the
   previous bug and is now unused & unnecessary (Boqun Feng)

 - lockdep: Invalidate stale class_cache entries for zapped classes
   (Eric Dumazet)

 - Fix rt_mutex specific futex scheduling helpers
   (Sebastian Andrzej Siewior)

 - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)

* tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Prevent rcuwait use-after-free during requeue PI
  futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
  locking/lockdep: Invalidate stale class_cache entries for zapped classes
  preempt: Remove hardirq_disable_count()
  interrupt: Disable interrupt before modifying hardirq_disable counter
 2026-09-06 10:45:46 -07:00
Linus Torvalds b485131995 Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull IRQ subsystem fixes from Ingo Molnar:

 - Revert a commit to the mbigen irqchip driver that caused
   a regression on two-port Hi1616 chips (Caina)

 - Fix a too-long-preemption-off bug in the stm32mp-exti
   irqchip driver, caused by a time unit ambiguity & mismatch
   (Ju Nan)

 - Remove the now completely unused irq_domain_add_linear()
   inline function (Jiri Slaby)

* tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
  Revert "irqchip/mbigen: Fix mbigen node address layout"
  irqdomain: Delete irq_domain_add_linear()
 2026-09-06 10:35:24 -07:00
Linus Torvalds d3cbb9af72 Merge tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty 
Pull virtio console fix from Greg KH:
 "Here is a single virtio console fix for 7.3-rc2 to fix a much reported
  regression in 7.3-rc1, sorry about that. It's not been in linux-next,
  but it has been sent by many different developers to resolve the issue
  and is 'obviously' correct"

* tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  virtio_console: allocate the port_buffer with the caller's gfp
 2026-09-06 09:55:20 -07:00
Linus Torvalds bf979ab8f2 Merge tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging 
Pull staging driver fixes from Greg KH:
 "Here are some small staging driver fixes to resolve some reported bugs
  that have been found, and tested, in a few staging drivers in 7.3-rc1.
  Included in here are:

   - OOB read problem fixes in the rtl8723bs driver

   - fbtft driver fix

   - sm750fb driver fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
  staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
  staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
  staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
  staging: fbtft: make dirty_lock IRQ-safe
 2026-09-06 09:49:06 -07:00
Linus Torvalds 65538a8f02 Merge tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 
Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes for reported problems and
  regressions. Include in here are:

   - xhci driver fixes

   - cdns3 driver fixes

   - usb gadget driver fixes for syzbot found problems

   - typec driver fixes for broken hardware and other bugs found

   - kernel data leaks in mdc800 driver

   - usb storage driver fixes

   - other small USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
  usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
  usb: gadget: fix null pointer dereference in usb_put_function_instance()
  usb: typec: qcom-pmic: cancel reset_work on stop
  usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
  usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
  usb: storage: realtek_cr: fix use-after-free on disconnect
  usb: cdnsp: fix wakeup from S3 after controller context loss
  usb-storage: ene_ub6250: fix race between scan work and probe
  USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
  usb: gadget: f_midi: initialize work in f_midi_alloc()
  usb: gadget: f_midi2: fix use-after-free in string attribute show path
  usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
  usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
  usb: typec: hd3ss3220: track VBUS enable state per consumer
  usb: dwc3: clear forceRM when issuing EndTransfer
  usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
  usb: typec: mux: avoid duplicated mux switches
  usb: typec: mux: Fix typec_switch_match()
  usb: image: mdc800: change kmalloc() to kzalloc()
  ...
 2026-09-06 08:50:20 -07:00
Linus Torvalds 1fc5a74b10 Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 
Pull kmalloc_obj conversions from Kees Cook:
 "Another run of the Coccinelle script for converting kmalloc()
  family of allocations to kmalloc_obj() via the existing rules
  in scripts/coccinelle/api/kmalloc_objs.cocci"

* tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: refresh kmalloc_obj() conversions
  drm/amd/display: Fix harmless type mismatch in allocation
 2026-09-05 20:45:18 -07:00
Linus Torvalds 9f0346dcbe Merge tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core 
Pull driver core fixes from Danilo Krummrich:

 - Fix kernfs listxattr() not returning security xattr names (e.g.
   SELinux labels) when the kernfs node has no allocated kernfs_iattrs

 - Fix silent truncation of IRQ vector indices in the Rust PCI
   abstractions

 - Don't select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is
   disabled instead of silently enabling extra kernel functionality

 - Russ Weight is retiring from kernel development; update the Firmware
   Loader sysfs contact to the driver-core mailing list, add a CREDITS
   entry for Firmware Upload, and update MAINTAINERS accordingly

* tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  MAINTAINERS: Remove Russ Weight from Firmware Loader
  CREDITS: Add CREDITS entry for Firmware Upload
  firmware_loader: Change contact for sysfs nodes
  rust: pci: reject IRQ vector indices that do not fit in u32
  kernfs: preserve security xattrs without allocating iattrs
  drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF
 2026-09-05 11:59:05 -07:00
Linus Torvalds 214f4aeb22 Merge tag 'loongarch-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson 
Pull LoongArch fixes from Huacai Chen:

 - Fix build errors when RUST and KASAN enabled

 - fix a typo in comment of vmlinux.lds.S

 - fix several bugs in Kprobes, BPF JIT and KVM support

* tag 'loongarch-fixes-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  perf build: Add clang and rust target flags for LoongArch
  LoongArch: KVM: Fix TOCTOU race on pv_features
  LoongArch: KVM: Validate MSI data before routing it to EIOINTC
  LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
  LoongArch: KVM: Remove unused function kvm_arch_flush_remote_tlbs_memslot()
  LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path
  LoongArch: KVM: Add unregister helpers for the KVM interrupt devices
  LoongArch: KVM: Free init resources if kvm_init() fails
  LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()
  LoongArch: Avoid preempt count underflow without probe
  LoongArch: Do not save/restore percpu base register in rethook trampoline
  LoongArch: Remove unused setup_profiling_timer() function
  LoongArch: Fix typo "avaliable" in comment of vmlinux.lds.S
  LoongArch: Do not select HAVE_RUST when KASAN is enabled
 2026-09-05 10:45:51 -07:00
Linus Torvalds d9d80a859b Merge tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 
Pull btrfs fixes from David Sterba:

 - preserve inode compression level when changing attributes

 - fix lost wakeup when waiting for a zstd workspace

 - fix bio context leaks after ordered extent processing errors

 - in send, handle unexpected extents for non-regular inodes

 - handle edge case in creation of reloc tree with enabled quotas

 - in scrub report the exact failing offset, not the stripe base

 - error handling fixes
     - error code propagation in send, zoned mode and raid-stripe-tree
     - restore active device pointer after seeding device addition error
     - transaction abort fixups

 - update Chris' email address

* tag 'for-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  MAINTAINERS: update Chris Mason's email address
  btrfs: tests: do not touch page cache if root/inode allocation failed
  btrfs: zstd: fix lost wakeup when waiting for a workspace
  btrfs: do not force reloc root creation during qgroup_account_snapshot()
  btrfs: send: fix lost error return value in will_overwrite_ref()
  btrfs: abort transaction before releasing tree_log_mutex on commit failure
  btrfs: zoned: propagate do_zone_finish() error in btrfs_zone_finish_endio()
  btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
  btrfs: send: reject extents for non-regular inodes
  btrfs: return proper negative error code for update_raid_extent_item()
  btrfs: fix the possible bioc_list memory leak during error
  btrfs: fix transaction use-after-free in raid stripe insertion
  btrfs: scrub: report the failing sector's address, not the stripe base
  btrfs: preserve the compression property when other inode flags change
  btrfs: restore active device pointers after failed sprout
  btrfs: detach failed sprout device from transaction update list
  btrfs: clean up target device if block group marking fails
 2026-09-05 10:18:21 -07:00
Linus Torvalds 0d9ff90a54 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 
Pull SCSI fixes from James Bottomley:
 "Two enhancements to add support and MCQ for additional Intel 4.0
  controller types.

  The rest are all driver fixes, the largest of which is the mpi3mr
  target use after free fix, follwed by a similar TOCTOU fix for
  io_uring passthrough in bsg"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
  scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
  scsi: bsg: Cap io_uring sense copy to max_response_len
  scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
  scsi: mpi3mr: Fix use-after-free on tgt_dev->starget during target device refresh/update
  scsi: target: iscsi: Reserve a terminator byte for the login payload
  scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
  scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers
  scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5
  scsi: sg: Report request-table problems when any status is set
  scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
  scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
  scsi: ufs: ufs-qcom: Fix sequential read variance
  scsi: ufs: ufs-qcom: Restore HS/LS link startup mode for Qualcomm UFS controller v6.2+
  scsi: ibmvfc: Document protocol parameter of ibmvfc_alloc_target()
  scsi: ibmvfc: Fix kernel-doc name for ibmvfc_scsi_relogin()
  scsi: pm8001: Use rollback index when freeing MSI-X vectors
  scsi: fnic: Initialize the NVMe local port info before registering
 2026-09-05 09:25:50 -07:00
Linus Torvalds d0fc310b4d Merge tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 
Pull block fixes from Jens Axboe:

 - NVMe fixes via Keith:
     - nvme-tcp fixes for an out-of-bounds write on an over-long PDU
     - nvmet-tcp, nvmet-rdma and nvme-rdma leak and cleanup-ordering
       fixes
     - FDP placement id array racy access fix
     - nvme-fc double free of fabrics options on nvme_add_ctrl()
       failure, and a secret leak failure
     - Fault injection opcode filtering
     - stale namespace removal during scan
     - Various other smaller fixes and cleanups

 - Flag zoned disks with GENHD_FL_NO_PART

 - Save the page offset gaps in a cloned bio

 - Fix dma_alignment for large or unreported limits in loop and zloop

 - Clear VM_MAYWRITE on a read-only ublk char device mmap

* tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (25 commits)
  nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
  nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
  nvmet: reject namespace enable without device path
  nvmet-auth: Synchronize timeout work during SQ teardown
  MAINTAINERS: update nvme entry
  nvmet-tcp: reject unsolicited H2CData PDUs
  nvme-tcp: defer TLS inline send to io_work
  nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
  nvme-tcp: return -EPROTO for a C2HData on a write
  nvmet: print namespace IDs as unsigned 32bit value
  nvme: print namespace IDs as unsigned 32bit value
  nvme: remove stale namespaces by NSID range during scan
  nvme: add missing SRCU grace period in error path
  nvme-fabrics: fix DHCHAP secret leak on parse failure
  ublk: clear VM_MAYWRITE on read-only ublk char device mmap
  loop, zloop: fix dma_alignment for large or unreported limits
  block: save page offset gaps in cloned bio
  block: flag zoned disks with GENHD_FL_NO_PART
  nvmet-rdma: fix queue leak when connect backlog is exceeded
  nvme: add opcode filtering for fault injection
  ...
 2026-09-05 08:58:55 -07:00
Linus Torvalds 4d7d9486c0 Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity 
Pull IMA fixes from Mimi Zohar:

 - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks
   resulted in configfs locking issues.

   configfs files should not be measured, appraised, or audited in the
   first place, so the builtin policies are updated to exclude them.

 - IMA audit messages include the filename, which could result in a page
   fault when the filename doesn't exist

 - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt

* tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX
  ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
  ima: don't measure/appraise files on configfs
  configfs: move CONFIGFS_MAGIC definition to magic.h
 2026-09-04 19:36:11 -07:00
Linus Torvalds 654ae5d73c Merge tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel 
Pull drm fixes from Dave Airlie:
 "Lots of scattered fixes: nouveau has a bunch of display fixes for
  blackwell GPUs that should mean we light up monitors properly and fix
  some desktop rendering problems, amdgpu and intel display changes as
  usual.

  There also changes to the core pagemap, then the usual amouny of AI
  inspired validation fixes.

  core:
   - Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used

  dma-buf:
   - Publish the dma-buf only after copy_to_user succeeds
   - fix some kernel-doc warnings

  atomic-state-helpers:
   - set pixel_blend_mode to prop default on reset

  sysfb:
   - Fix integer overflow
   - fix constant comparison bug

  pagemap:
   - Prevent double migration of device pages
   - Reset migration page count on eviction retry
   - dma-unmap pages before handling migration errors
   - use after free fixes

  prime:
   - fix prime exports tracing

  amdgpu:
   - Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit
     userspace
   - plane blend mode fixes
   - SR-IOV fix
   - GFX8 fix
   - MES queue reset fix
   - GPUVM fixes
   - DCN 6 warning fix
   - DCN 3.5/3.6 fix
   - DML fix
   - Backlight fix
   - Colorop fix
   - DC get_estimated_bw() fix
   - devcoredump fix
   - Userq fixes
   - APU PSP fix
   - Cursor fix

  amdkfd:
   - MES queue eviction fix
   - MQD debugfs fix

  xe:
   - oa uapi error handling fix
   - drm info message to report FLAT_CSS base misalignment

  i915:
   - Drop an accidentally duplicated panel fitter call in DP MST
   - Fix DDI clock programming for Cx0 and LT PHY
   - Fix PTL CDCLK handling at probe, causing a glitch
   - Fix dg2_power_well_count() return type
   - Fix a NULL pointer deref at forced probe
   - Fix selective fetch disable

  amdxdna:
   - out-of-bounds access fix
   - reject commands chains with no commands
   - handle chained mapping BO failures
   - refuse to flush an imported BO

  ethosu:
   - handle mmio mapping failures
   - handle storage modes only on hardware that supports it
   - fix job completion fence cleanup

  fastrpc:
   - Publish the dma-buf only after copy_to_user succeeds

  gud:
   - Improve TV modes and rotation handling

  nouveau:
   - use-after-free fixes
   - add missing scanline position support
   - HDMI and DP fixes
   - null pointer dereference fix
   - dmem accounting fixes for large folios
   - use write-combined maps for coherent

  qaic:
   - out-of-bounds access fix

  tegra:
   - Add blend mode properties

  virtio:
   - exit path and error handling fixes

* tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel: (83 commits)
  drm/xe/vram: report FLAT_CCS base misalignment
  MAINTAINERS, mailmap: use Aditya Garg's linux.dev account
  drm/amd/display: use plane color_mgmt_changed to track colorop changes
  drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile
  drm/amd/display: Fix cursor disable with horizontally split planes
  drm/amdgpu/userq: dont overwrite the error of subsequent map call
  drm/amdgpu: Skip accessing psp rum time db for APUs
  drm/amdgpu: update the fw version for gfx12 userqueues
  drm/amdgpu: update the fw version for gfx11 userqueues
  drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump
  drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
  drm/amd/display: fix division by zero in get_estimated_bw()
  drm/amd/display: use halving distribution for all encode-to-linear curves
  drm/amd/display: Fix backlight control for luminance-capable OLED
  drm/amd/display: Remove const Qualifier From Non-Pointer Fields
  drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
  drm/amd/display: Fix DCN5/6 DML2 compilation warnings
  drm/amdgpu: fix Idle BOs list in VM debugfs status info
  drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
  drm/amdgpu: Update queue reset support version
  ...
 2026-09-04 13:42:16 -07:00
Linus Torvalds 3f17a52d47 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux 
Pull arm64 fixes from Will Deacon:
 "Nothing Earth-shattering, but worthwhile fixes nonetheless:

   - Disable interrupts during page-table walk in show_pte()

   - Fix kexec_file_load() with 52-bit capable kernels on machines
     without 52-bit addressing

   - Fix MIDR matching in CPU errata handling for KVM guests

   - Avoid reading MTE-specific ID registers when MTE support is
     disabled"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Don't read GMID_EL1 when MTE is disabled
  arm64: errata: pass REVIDR when matching target implementation CPUs
  arm64: trans_pgd: clone only the linear map that exists at runtime
  arm64: mm: Fix the lockless page-table walk in show_pte()
 2026-09-04 13:32:46 -07:00
Linus Torvalds 408802f1e6 Merge tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client 
Pull ceph fixes from Ilya Dryomov:
 "A small fixup for the new nearfull_sync mount option, a potential
  use-after-free fix (marked for stable) and a patch that eliminates
  the last use of PageWriteback macro in the tree"

* tag 'ceph-for-7.3-rc2' of https://github.com/ceph/ceph-client:
  ceph: apply nearfull_sync option on remount
  libceph: remove pinning assertion in ceph_msg_data_iter_next()
  ceph: lock mutex in ceph_mds_check_access()
 2026-09-04 13:27:58 -07:00
Linus Torvalds 986c24e0fe Merge tag 'hid-for-linus-2026090401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 
Pull HID fixes from Benjamin Tissoires:

 - hid-hyperv build fixes on certain configs (Jiri Kosina)

 - HID-BPF fix and selftests now that the bpf verifier is more
   restrictive (Benjamin Tissoires)

 - Some AI detected fixes for OOB, errors and validation (Ibrahim
   Hashimov, Shen Yongchao, Wei Jie Law)

 - various device fixes (Dave Carey and Vadim Klishko)

* tag 'hid-for-linus-2026090401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: bpf: serialize device reference release in struct_ops destroy path
  HID: rmi: fix OOB access with undersized RMI reports
  selftests/hid: prepare test_rdesc_fixup_get_data_overflow for the new verifier
  selftests/hid: Add a test to ensure we can write fields in hid_device
  HID: bpf: mark struct hid_device as safe BPF pointer
  HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
  HID: multitouch: Fix stale MT slots when contact count drops to zero
  HID: i2c-hid: Add a quirk for a Cirque I2C device.
  HID: hyperv: make pointer arithmetics understandable for FORTIFY_SOURCE
  HID: hyperv: fix build breakage with certain configs
 2026-09-04 09:25:38 -07:00
Linus Torvalds 36ec09e263 Merge tag 'sound-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 
Pull sound fixes from Takashi Iwai:
 "A collection of small fixes since 7.3-rc1.

  Quite a few fixes are for ALSA core for issues that have been detected
  by the things you know well. Additionally a series of hardening for
  runtime PM, and usual quirk updates, and some other misc driver fixes
  are included.

  Core:
   - Fixes for PCM races
   - UMP parser NULL dereference fix
   - Fix error handling in rawmidi ioctl

  USB- and HD-audio:
   - Implement missing runtime PM guards across multiple interfaces
   - Fix for OOB access in US-122L MIDI driver
   - Double-free fix for CAIAQ driver
   - Quirks for HD-audio Realtek & Cirrus codecs, Conexant S3-resume,
     USB Audient devices

  Others:
   - Fix of logical mistakes in dummy driver mixer and selftest code
   - Lock init fix in the legacy harmony driver"

* tag 'sound-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits)
  ALSA: caiaq: Fix potential double-free at error path
  selftests/alsa: Fix the step check for INTEGER controls
  ALSA: hda/realtek: Fix cold-boot headset misdetection on Acer Aspire A515-57G
  ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
  ALSA: ump: do not touch legacy_rmidi before it exists
  ALSA: hda/cs420x: Add CS4208 fixup for MacBookAir 7,2
  ALSA: dummy: Report a change when one capture switch channel moves
  ALSA: usb-audio: Add mixer map quirk for Audient iD24
  ALSA: hda: restore MFG widget enumeration after core split
  ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
  ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
  ALSA: harmony: initialize locks before requesting IRQ
  ALSA: hda/realtek: Add quirk for VAIO VJS131
  ALSA: pcm: Fix race between non-atomic ops and trigger-start
  ALSA: hda/realtek: Add quirk for Acer Predator PHN16-72
  ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 9 14ILL10
  ALSA: hda/conexant:Fix abnormal Mic/Speaker functionality on SN6140 after S3 wake-up
  ALSA: usb-audio: Guard FCP protocol transfers
  ALSA: usb-audio: Add PM guards to RME Digiface controls
  ALSA: usb-audio: Guard Scarlett2 protocol transfers
  ...
 2026-09-04 09:17:05 -07:00
Linus Torvalds 3e66602704 Merge tag 'ata-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux 
Pull ata fixes from Niklas Cassel:

 - Work around lost interrupts on Marvell 88SE61xx

   The Marvell AHCI controller requires you to clear interrupts in the
   opposite order from what is specified in the AHCI specification in
   order to not lose interrupts (Hajo)

 - Do not raise UNIT ATTENTION for depopulation commands

   The libata completion function unconditionally sets sense data with
   sense key UNIT ATTENTION (UA) for depopulation commands. The SCSI
   layer will fail a command when seeing this sense data. UA is only
   supposed to be raised if the capacity actually changed.

   Since these commands are currently only supported as passthrough
   commands, the user is expected to revalidate the device, which will
   detect a capacity change anyway. Thus drop the unconditional UA until
   a better solution has been implemented (Damien)

* tag 'ata-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-scsi: do not raise UA for storage element depopulation and restoration
  ata: ahci: work around lost interrupts on Marvell 88SE61xx
 2026-09-04 09:00:03 -07:00
Linus Torvalds 58f93a4b73 Merge tag 'ksmbd-for-7.3-rc2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb 
Pull smb server fixes from Namjae Jeon:

 - Fix a tree connection use-after-free in smb2_tree_connect() by
   balancing references across concurrent connect, disconnect, and
   session logoff paths.

 - Validate source and target ranges in COPYCHUNK requests before range
   locking and copy operations.

 - Fix an oplock break notification UAF by acquiring a connection
   reference under ksmbd_inode lock and releasing it after the
   notification work completes.

 - Fix the sparc build by using an unsigned int for the atomic work
   state, ensuring xchg() uses a supported four-byte operation.

* tag 'ksmbd-for-7.3-rc2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:
  ksmbd: fix tree connection use-after-free in smb2_tree_connect()
  ksmbd: validate COPYCHUNK source and target ranges
  ksmbd: fix use-after-free in oplock break notification
  ksmbd: fix sparc build with atomic work state
 2026-09-04 08:42:14 -07:00
Linus Torvalds 421066905c Merge tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 
Pull probes fixes from Masami Hiramatsu:

 - Protect kprobe_blacklist with RCU

   RCU-protect kprobe_blacklist and use kfree_rcu() to prevent UAF races
   during module unloading and enable safe atomic lookups.

 - Fix multi-probe field use-after-free

   Duplicate field and type strings on trace_probe_event to prevent UAF
   when freeing primary probe

 - Fix probe BTF member lookup:

   Check the containing inner struct/union kflag when resolving
   anonymous members to ensure correct bitfield offset calculation

   Prevent unnamed bitfields from being pushed to anon_stack in
   btf_find_struct_member(), avoiding false lookup errors

   Fix code block indentation in get_bitoffset_of_field()

 - uprobes error pointer safety

   Guard free_trace_uprobe() with IS_ERR_OR_NULL() to avoid crashing
   during automatic cleanup when an error pointer is returned

* tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  kprobes: Protect kprobe_blacklist with RCU
  tracing/probes: Fix use-after-free on field name/type of events with multiple probes
  tracing/probes: Fix code indent in get_bitoffset_of_field()
  tracing/probes: Fix BTF kflag check for anonymous struct member access
  tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
  uprobes: guard trace cleanup against error pointers
 2026-09-04 08:24:09 -07:00
Linus Torvalds 65119e86fe Merge tag 'pmdomain-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm 
Pull pmdomain and cpuidle fixes from Ulf Hansson:
 "pmdomain providers:
   - mediatek: Fix Kconfig for Airoha power domains
   - qcom: Revert adding the missing power domains for Eliza

  cpuidle:
   - psci: Fix support for probe deferral by dropping the faux device
   - dt_idle_genpd: Free the original name allocation"

* tag 'pmdomain-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  cpuidle: dt_idle_genpd: kfree() the original name allocation
  pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
  cpuidle: psci: Fix support for probe deferral by dropping the faux device
  Revert "pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza"
 2026-09-04 08:17:41 -07:00
Linus Torvalds bc35965f69 Merge tag 'mm-hotfixes-stable-2026-09-03-17-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm 
Pull misc fixes from Andrew Morton:
 "18 hotfixes.  13 are cc:stable.  15 are for MM.

  All are singletons - please see the changelogs for details.

  There are no fixes (yet) for all the stuff we added in the most recent
  merge window. Hopefully a good sign"

* tag 'mm-hotfixes-stable-2026-09-03-17-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/secretmem: properly account locked pages
  mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
  MAINTAINERS: add Kiryl as a THP reviewer
  MAINTAINERS: cover all of RAID
  MAINTAINERS: mailmap: update entries for Thorsten Blum
  MAINTAINERS: remove Lorenzo as THP co-maintainer
  Revert "once: don't use a work queue to reset sleepable static key"
  mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
  mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
  mm/huge_memory: transfer the pmd dirty bit to the folio on zap
  MAINTAINERS: add Lance Yang as a hung task detector co-maintainer
  userfaultfd: reset err to be 0 when move_pages_ptes succeeded
  mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
  mm/hugetlb: keep max_huge_pages when dissolving surplus folios
  mm/migrate_device: avoid out-of-bounds writes for compound folios
  mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
  memcg: make the v1 soft limit knob inert
  mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
 2026-09-03 17:59:19 -07:00
Linus Torvalds a500db7819 Merge tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 
Pull SELinux fixes from Paul Moore:
 "Two SELinux fixes: one to fix how we lookup a BPF token's creator
  label to prevent a possible TOCTOU, and one to update Ondrej's email
  address"

* tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  MAINTAINERS, mailmap: update email address for Ondrej Mosnáček
  selinux: fix BPF token permission checks
 2026-09-03 13:36:21 -07:00
Linus Torvalds 36b03c3e27 Merge tag 'acpi-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 
Pull ACPI fix from Rafael Wysocki:
 "Drop two structure fields that have no more users after recent
  changes"

* tag 'acpi-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: bus: Drop two fields from struct acpi_device_pnp
 2026-09-03 12:17:52 -07:00
Linus Torvalds 841e384b84 Merge tag 's390-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 
Pull s390 fixes from Heiko Carstens:

 - Use jiffies instead of jiffies_64 to address a data-race reported by
   KCSAN

 - Unpoison cpacf instruction results to address KMSAN reports

 - Drop unused member from ap_device_id

 - Fix potential NULL pointer dereferences in IPL code

 - Add missing length check to SCLP error report handling

 - Add missing length check to zcrypt CCA code

 - Fix return code handling in diag324 code

 - Handle multiple PMU stop callback invocations in perf pai code
   correctly

 - Reduce excessive debug feature size in perf pai code from 32 MiB to
   4KiB

 - Switch to common CPU capacity code in topology code to get rid of few
   lines of code

 - Address various bugs in corner cases in boot code

 - Simplify/Rework crst_table_upgrade() to address a potential NULL
   pointer dereference in case of an allocation failure

 - Initialize padding bytes in CRT key structure in zcrypt code

* tag 's390-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/zcrypt: Fix uninitialized padding in CRT key structure
  s390/mm: Simplify crst_table_upgrade()
  s390/boot: Bound command line facility ranges
  s390/boot: Avoid IPL parameter append past command line
  s390/boot: Fix physical memory search range
  s390/topology: Switch to common cpu capacity code
  s390/pai: Reduce excessive debug feature size
  s390/pai: Handle multiple PMU stop callback invocations
  s390/diag324: Preserve -EBUSY return code
  s390/zcrypt: Validate length in reply before using it
  s390/pci: Fix leak of uninitialized kernel data in SCLP report
  s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
  s390/ipl: Fix NULL deref in kdump without re-IPL parm block
  s390/ap: Drop unused member from ap_device_id
  s390/cpacf: Unpoison instruction results
  s390/time: Use jiffies instead of jiffies_64
 2026-09-03 10:28:27 -07:00
Linus Torvalds adf50c47a4 Merge tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 
Pull networking fixes from Paolo Abeni:
 "Including fixes from bluetooth.

  Previous releases - regressions:

    - page_pool: keep frag_offset aligned for odd-sized requests

    - sched: fix u32 duplicate handle when node ID pool is exhausted

    - udp: create exceptions before socket matching

    - igmp: convert struct ip_sf_list to RCU

    - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

    - rds: acquire the fastpath locks in rds_conn_shutdown()

    - tipc:
        - protect node reset trace dump with node lock
        - fix NULL deref in tipc_named_node_up() on empty publication
          list

    - bluetooth:
        - L2CAP: fix out-of-bounds write in l2cap_ecred_connect
        - hci_core: fix race condition during device registration

    - eth:
        - mlx5e: prevent stale XSK buffer release on refill retries
        - bridge: don't truncate the port group walk on teardown

  Previous releases - always broken:

    - gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()

    - sched: fix skb sizing and action leak on reoffload delete

    - tcp: fix use-after-free in do_tcp_getsockopt()

    - af_packet: don't cast tpacket_hdr.tp_len to int in
      tpacket_parse_header()

    - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

    - iptunnel: fix stale transport header during tunnel decapsulation

    - eth:
        - vxlan: fix use-after-free in vxlan_mdb_remote_src_del()
        - bonding: fix uninitialized transport header access in
          alb_determine_nd()"

* tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)
  net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
  net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
  net: airoha: enable RX_DONE interrupt for RX queue 31
  net/rds: don't let rds_conn_shutdown() consume a concurrent drop
  net/rds: acquire the fastpath locks in rds_conn_shutdown()
  net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
  net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
  net/rds: clear cp_flags bits individually in rds_conn_path_reset()
  net/rds: use clear_bit_unlock() in release_refill()
  net/rds: use wq_has_sleeper() in release_in_xmit()
  net: usb: qmi_wwan: add Compal EXM-G1x support
  net: macb: exclude software FCS from TX byte statistics
  net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
  net: bridge: mcast: don't truncate the port group walk on teardown
  bonding: do not clear curr_active_slave prematurely when releasing all slaves
  net: qrtr: Send HELLO message on endpoint register
  octeontx2-af: Fix limiting SRIOV VF count logic
  bonding: alb: fix uninitialized transport header access in alb_determine_nd()
  s390/ctcm: Prevent XID null dereference
  net: psp: do not inherit the Rx association on clone
  ...
 2026-09-03 10:18:12 -07:00
Linus Torvalds 8ab1afb2eb Merge tag 'for-7.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm 
Pull device mapper fixes from Mikulas Patocka:

 - fix a dm-crypt race condition that could make errors not being reported

 - dm-cache:
    - fix rwsem being locked and unlocked from different processes
    - fix demotion statistics

 - dm-integrity:
    - set the 'stable writes' flag
    - fix a buffer overflow introduced in this merge window
    - fix an infinite loop if tag size is greater than 64

 - fix NULL pointer dereference in dm-integrity data-recovery mode

 - remove a bogus restriction on the dm-ebs starting sector offset

* tag 'for-7.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm-ebs: fix incorrect device offset check in ebs_ctr()
  dm-integrity: fix NULL pointer dereference when the 'R' flag is used
  dm cache: fix demotion stats in passthrough mode
  dm-integrity: fix infinite loop on discard with large tag size
  dm-integrity: fix buffer overflow with keyed discard
  dm-integrity: require stable writes for internal hash modes
  dm cache: fix issue with background work locking
  dm-crypt: fix a tiny race condition in crypt_dec_pending
 2026-09-03 08:30:45 -07:00
Linus Torvalds 97be98b94d Merge tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs 
Pull ntfs fixes from Namjae Jeon:

 - Serialize truncate, fallocate, and mmap fault paths with
   invalidate_lock, avoiding mmap failures during concurrent size
   changes and exposure of uninitialized data during allocation

 - Correct fallocate signal and zeroing error handling

 - Fix FITRIM range alignment to prevent discard requests from extending
   into allocated clusters

 - Fix free-cluster accounting when cluster-freeing rollback or bitmap
   clearing fails

 - Keep volumes marked dirty when ntfs errors have been recorded

 - Compute bi_sector in 512-byte units, preventing silent corruption on
   4Kn devices

 - Validate sectors_per_cluster values and prevent undefined shifts when
   parsing MFT and index record sizes

 - Bound $AttrDef traversal to the loaded table size

 - Fix MFT record resizing, memmove overlap, and kmap_local cleanup
   issues

 - Improve error propagation across attribute, EA, and reparse
   operations, including returning -ERANGE for undersized xattr buffers

 - Avoid modifying the HasEA flag when setxattr fails and return
   DT_UNKNOWN when directory inode lookup fails

 - Reduce contention in WOF decompression by performing block reads
   outside the decompression lock

* tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (23 commits)
  ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
  ntfs: take invalidate_lock in ntfs_setattr_size()
  ntfs: handle signal interruption in fallocate
  ntfs: fix FITRIM range alignment
  ntfs: read WOF chunks outside the decompression lock
  ntfs: leave HasEA flag untouched on setxattr failure
  ntfs: fix race between fallocate and mmap reads
  ntfs: fix memmove overlap in ntfs_new_attr_flags
  ntfs: compute bi_sector in 512-byte units
  ntfs: reject invalid sectors_per_cluster in the boot sector
  ntfs: bound $AttrDef table walk to the loaded table size
  ntfs: fix undefined behavior in mft/index record size calculation
  ntfs: treat any nonzero dio zero-range return as an error
  ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
  ntfs: do not mark the volume clean in sync_fs when errors were recorded
  ntfs: skip free cluster decrement when rollback fails
  ntfs: only count successfully cleared runs when freeing clusters
  ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
  ntfs: return real error from ntfs_non_resident_attr_record_add()
  ntfs: preserve error code in ntfs_resident_attr_record_add()
  ...
 2026-09-03 08:10:04 -07:00
Linus Torvalds 940de590b8 Merge tag 'hardening-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 
Pull hardening fix from Kees Cook:

 - Default randstruct off with rust for better allmodconfig coverage
   (Mark Brown)

* tag 'hardening-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  hardening: Default randstruct off with rust for better allmodconfig support
 2026-09-02 16:02:02 -07:00
Linus Torvalds 89a312991d Merge tag 'cifs-fixes-7.3-rc2' of https://git.manguebit.org/linux 
Pull smb client fixes from Paulo Alcantara:

 - Fixes for fallocate range operations (insert, collapse, zero, punch
   hole)

   The insert range implementation copied overlapping chunks in the
   wrong direction, corrupting file data on every server except Windows.

   Several related issues in the same area are also addressed — stale
   page cache and FS-Cache readback, an integer truncation on large
   files, missing RLIMIT_FSIZE validation and missing sparse file
   marking.

 - Data corruption fixes in the O_TRUNC open path: one where i_size was
   zeroed before the server confirmed the truncate and another where the
   lack of locking allowed concurrent buffered writes to be silently
   discarded

 - Heap overflow fixes in legacy SMB1 paths: one in extended attribute
   writes and one in POSIX ACL handling, both exploitable via
   unprivileged setxattr(2)

 - Fix for multiuser mount with krb5 failing because the username option
   was not propagated to new per-user connections

 - Fix for split debug message in __release_mid() after a printk
   conversion

* tag 'cifs-fixes-7.3-rc2' of https://git.manguebit.org/linux:
  smb: client: reject SetEA requests that do not fit the request buffer
  smb: client: fix data corruption with concurrent writes and O_TRUNC
  cifs: don't update i_size in cifs_do_truncate without a cached handle
  smb: client: fix heap overflow in cifs_do_set_acl()
  smb: client: fix multiuser mount with krb5
  smb: client: transport: Fix debug printing in __release_mid()
  smb/client: invalidate fscache for fallocate range operations
  smb/client: fix stale page cache in insert/collapse range
  smb/client: fix integer truncation in collapse range
  smb/client: fix data corruption in emulated insert range
  smb/client: mark file sparse before emulating insert range
  smb/client: validate new EOF for zero range
  smb/client: validate new EOF for insert range
  cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
 2026-09-01 13:37:14 -07:00
Linus Torvalds 9a58da8005 Merge tag 'ksmbd-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb 
Pull smb server fixes from Namjae Jeon:

 - Prevent unintended data exposure by clearing pipe compound padding
   and the response buffer

 - Initialize missing fields in FS_OBJECT_ID_INFORMATION,
   FS_CONTROL_INFORMATION, and FS_POSIX_INFORMATION

 - Propagate DACL parsing and allocation failures so malformed security
   descriptors are rejected

 - Rate-limit errors for unmapped SIDs to prevent kernel log flooding

 - Drain multichannel sessions during LOGOFF, wake deferred locks and
   cancellable requests, and ensure cancellation callbacks run only once

 - Fix listener kthread reference handling and teardown ordering during
   netdevice events

 - Validate normalized-name and IPC share configuration response lengths

 - Update the KSMBD MAINTAINERS entry and add Paulo Alcantara as an
   SMBDIRECT co-maintainer

* tag 'ksmbd-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:
  ksmbd: validate normalized name response length
  ksmbd: fix listener task lifetime on netdev events
  ksmbd: prevent out-of-bounds reads in share config responses
  ksmbd: rate limit unmapped SID errors
  ksmbd: propagate DACL parsing errors
  ksmbd: zero pipe read compound padding
  ksmbd: safely drain sessions during logoff
  MAINTAINERS: Update the KSMBD entry
  MAINTAINERS: Add Paulo Alcantara as an SMBDIRECT co-maintainer
  ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
  ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
  ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
 2026-09-01 08:17:01 -07:00
Linus Torvalds 786262be60 Merge tag 'edac_updates_for_v7.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras 
Pull forgotten EDAC updates from Borislav Petkov:
 "Somewhat belated (and forgotten :-\) EDAC updates lineup for v7.3:

   - Mark the mpc85xx and ThunderX EDAC drivers as orphaned due to lack
     of access to hardware

   - Remove the unused fake error injection interface from the EDAC
     debugfs code due to potential races between logging a fake and a
     real hw error

   - edac_mc_sysfs: Use sysfs_emit_at() for proper bounds checking

   - Remove Mark Gross from maintainer entries and move him to CREDITS

   - Load the AMD address translation library only on systems which can
     actually make use of it (have ECC memory) instead of on every AMD
     Zen system out there

   - In edac_altera, detect the SoC variant using the ECC manager's
     compatible string instead of the build architecture to select the
     correct interrupt layout, and remove leftover architecture-specific
     ifdeffery from the double-bit error handling path

   - Add a new reviewer for the Xilinx EDAC drivers

   - Unify address translation logic in Intel client EDAC drivers igen6
     and ie31200 along with detecting memory controller counts at boot
     time instead of relying on hardcoded, platform specific numbers.
     Also, fix a bunch of issues in them; work by Qiuxu Zhuo

   - Add support for a new Intel processor platform Starfire which is a
     derivative of Panther Lake SoCs

   - The usual cleanups and fixlets all over"

* tag 'edac_updates_for_v7.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: (24 commits)
  EDAC/thunderx: Orphan it
  EDAC/device_sysfs: Cleanup around edac_device_ctl_poll_msec_store()
  EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
  EDAC/igen6: Add Intel Starfire SoCs support
  EDAC/igen6: Refactor address translation logic
  EDAC/igen6: Remove redundant resource configuration tables
  EDAC/igen6: Detect present memory controllers at runtime
  EDAC/igen6: Simplify compute die ID comments
  EDAC/igen6: Remove unnecessary XOR on the zero-valued interleave bit
  EDAC/igen6: Fix Raptor Lake-P logged error address
  EDAC/igen6: Fix channel address decode for non-hash mode
  EDAC/igen6: Fix channel selection hash
  EDAC/igen6: Fix interleave boundary condition
  EDAC/ie31200: Decouple DIMM width decoding from enum order
  RAS/AMD/ATL: Remove conditional return with no effect
  EDAC: Remove redundant dev_err()
  MAINTAINERS: Add Radhey Shyam Pandey as Xilinx EDAC reviewer
  EDAC/altera: Remove remaining CONFIG_64BIT ifdefs in the DB-error path
  EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
  RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed
  ...
 2026-08-31 20:10:39 -07:00
Linus Torvalds abdf623ddb Merge tag 'wq-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq 
Pull workqueue fixes from Tejun Heo:

 - An unbound worker pool could be freed while still reachable through
   the pending-activation list, leading to a use-after-free. Unlink
   before dropping the reference

 - On PREEMPT_RT, the BH workqueue kick raised softirqs from preemptible
   context, tripping a lockdep assertion and possibly losing
   concurrently raised softirq bits

 - Draining BH work off a dead CPU nests two pools' callback locks,
   which lockdep misreported as recursive locking. The nesting cannot
   deadlock. Annotate it

 - Reject watchdog thresholds that overflow the conversion to jiffies

 - Make the drgn workqueue dump script work again on kernels and vmcores
   from before the workqueue attrs field rename

* tag 'wq-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  tools/workqueue/wq_dump.py: Support backward compatibility for wq->attrs rename
  workqueue: reject watchdog thresholds that overflow jiffies
  workqueue: Fix unbound pool lifetime for pending pwqs
  workqueue: Use raise_softirq() to trigger softirq in irq_work handler
  workqueue: Annotate cb_lock nesting when draining a dead BH pool
 2026-08-31 14:38:40 -07:00
Linus Torvalds c3b510de42 Merge tag 'cgroup-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 
Pull cgroup fixes from Tejun Heo:

 - After cgroup.kill was written to a cgroup, every child cloned into it
   with CLONE_INTO_CGROUP was spuriously killed because the fork path
   snapshotted the kill counter before resolving the target cgroup

 - Releasing an isolated cpuset partition dropped the isolation of CPUs
   isolated on the kernel command line

 - Selftest and documentation fixes

* tag 'cgroup-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  selftests/cgroup: test clone3() into a previously killed cgroup
  cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
  selftests/cgroup: Add test for preserving boot-isolated CPUs
  cgroup/cpuset: Preserve boot-isolated CPUs on partition release
  selftests/cgroup: Drop invalid boot isolation comparison
  docs: cgroup-v2: fix misc.events key format description
  selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
  selftests/cgroup: set the test plan after the setup checks
 2026-08-31 14:20:32 -07:00
Linus Torvalds bf1079577a Merge tag 'sched_ext-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext 
Pull sched_ext fixes from Tejun Heo:

 - The task ownership check in the dispatch queue move operation raced
   against the task exiting or moving to a different sub-scheduler,
   spuriously triggering scheduler aborts. Fix by moving the check under
   the queue lock

 - The cgroup bandwidth change callback runs in a sleepable context but
   sleepable implementations were rejected at load time. Allow them and
   add a marker so userspace can detect the capability

 - Sync tooling headers with the scx repo for accumulated compatibility
   improvements

 - Example scheduler fixes: ignored timer re-arm failures and vtime
   credit loss on cgroup migration

 - Documentation and comment fixes

* tag 'sched_ext-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Fix missing @slice and @vtime descriptions in finish_dispatch() kernel-doc
  sched_ext: Fix several comment issues
  sched_ext: Check bpf_timer_start return values in scx_qmap
  sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration
  sched_ext: Fix timer pinning and return value in scx_central
  docs/sched_ext: document that cgroup CPU knobs are scheduler-dependent
  sched_ext: Fix spurious aborts in scx_bpf_dsq_move() on ownership change races
  sched_ext: Sync common and compat headers from the scx repo
  sched_ext: Sync tools autogen enum headers from the scx repo
  Docs/admin-guide/cgroup-v2: document BPF scheduler callbacks for cpu.max and cpu.idle
  sched_ext: Fix nonexistent field in sched-ext.rst example
  sched_ext: Allow ops.cgroup_set_bandwidth() to be sleepable
 2026-08-31 13:13:35 -07:00
Linus Torvalds a7f25dc23f Merge tag 'xfs-fixes-7.3-rc2' of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux 
Pull xfs fixes from Carlos Maiolino:
 "This contains a few fixes for the zoned storage support, a possible
  deadlock vector fix, some code refactoring patches and a quota evasion
  fix on XFS while exporting it via NFS.

  Please note that for the quota evasion fix, a couple patches for the
  capability subsystem are included in the pull request. Those have been
  ack'ed by the respective maintainer which also agreed to have them
  going through the xfs tree.

  This also includes a patch for the quota subsystem to stop issuing
  audit messages during quota enforcing. Quota maintainer also ack'ed
  and agreed with this going through xfs tree"

* tag 'xfs-fixes-7.3-rc2' of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux:
  capability: unexport has_capability_noaudit
  xfs: replace ns_capable_noaudit
  quota: Don't issue audit messages on quota enforcing
  capability: Add new capable_noaudit
  xfs: fix capability check in xfs
  xfs: restore bi_bdev in xfs_zone_gc_write_chunk
  xfs: split ioend handling into a separate source file
  xfs: factor out a xfs_iomap_set_anon_write helper
  xfs: fix zoned write iomap flags assignments
  xfs: fix racy open zone caching
  xfs: handle NULL open_zone for merged ioends in xfs_ioend_put_open_zones
  xfs: use inode_init_always_gfp with __GFP_NOFAIL in xfs_inode_alloc
  xfs: remove kmem_to_page()
  xfs: don't flush and invalidate internal RT device twice in xfs_shutdown_devices
  xfs: split an assert in xfs_trans_log_buf
  xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
 2026-08-31 10:45:40 -07:00
Linus Torvalds cee9395acd Linux 7.3-rc1 2026-08-30 13:34:40 -07:00
Linus Torvalds 78bb208b99 Merge tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux 
Pull i2c fixes from Andi Shyti:
 "Fixes mainly for teardown and resource handling, runtime PM and
  hardware-specific controller issues:

   - fix debugfs use-after-free when removing the adapter

   - designware: apply interrupt mask quirk for HJMC3001

   - imx-lpi2c: avoid target accesses on master-only controllers

   - mux: release channel node when adapter registration fails

   - qcom-cci: fix autosuspend and runtime PM cleanup on removal

   - qcom-geni: fix timing parameters for 32 MHz clock"

* tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: core: fix debugfs UAF on adapter removal
  i2c: imx-lpi2c: avoid accessing target registers on master-only controllers
  i2c: qcom-cci: fix autosuspend cleanup
  i2c: designware: Enable interrupt mask workaround for HJMC3001
  i2c: qcom-geni: update frequency table to fix timing parameters
  i2c: mux: Fix channel node leak on adapter add failure
 2026-08-30 10:53:24 -07:00
Linus Torvalds eea8bdcb59 Merge tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux 
Pull Coccinelle updates from Julia Lawall:

 - Clean up a number of the semantic patches in the scripts/coccinelle
   directory, particularly with respect to functions that no longer
   exist in the kernel (Sang-Heon Jeon)

   He and I have also done some reorganizations that improve
   performance.

 - Eliminate some false positives (me)

 - Fix an out of date URL (相浦彰)

* tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
  coccinelle: ifnulldev_put: update error message
  coccinelle: ifnulldev_put: update outdated helper names
  coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
  coccinelle: kfree_mismatch: drop vmalloc_exec
  coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
  coccinelle: zalloc-simple: drop the kmem_alloc rules
  coccinelle: alloc_cast: drop removed allocators
  coccinelle: remove obsolete pci_free_consistent.cocci
  scripts: coccinelle: devm_free: reduce false positives
  coccinelle: misc: struct_size: drop unneeded parentheses
  coccinelle: mini_lock: improve performance when searching loops
  coccinelle: api: check for macro context
  coccinelle: update Coccinelle website URL
  coccinelle: misc: minmax: avoid unhelpful isomorphisms
  coccinelle: misc: minmax: check for the presence of if cases
  coccinelle: misc: minmax: drop unneeded parentheses
  coccinelle: misc: minmax: improve performance when no candidate exists
  coccinelle: double_lock: improve performance when no double lock exists
 2026-08-30 10:42:40 -07:00
Linus Torvalds a23cbb0574 Merge tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull timer fix from Ingo Molnar:

 - Fix UM build regression caused by the removal of the UM
   specific timex.h header (Thomas Weißschuh)

* tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  um: Use asm-generic/timex.h over the host architecture one
 2026-08-30 10:19:11 -07:00
Linus Torvalds 637836563d Merge tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull locking fix from Ingo Molnar:

 - Revert a commit to spinlock cleanup guards that got caught up
   in the subtle limitations & fragility of guards (again...) and
   caused a regression (Peter Zijlstra)

* tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking: Revert switching guards to _irq_{disable,enable}()
 2026-08-30 09:57:35 -07:00
Linus Torvalds f59c074e76 Merge tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux 
Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Fix KCFI failures, such as in Rust doctests, by disabling function
     merging when CFI is enabled. Gary reported the LLVM bug to upstream
     and it is now fixed in their mainline.

   - Fix 'objtool' fallthrough warnings under the experimental
     'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
     helpers code) the LLVM options needed to preserve the unreachable
     traps that 'rustc' normally emits.

     In addition, fix 'objtool' errors when LTO is enabled on top, by
     also filtering out the LTO flags (for the combined Rust and helpers
     code) so that the traps are kept in place.

   - Fix 'objtool' warnings by adding one more 'noreturn' function.

   - Fix 'make rusttest' target when the 'rustc-dev' component is
     installed and Rust >= 1.82.0, <= 1.87.0 is used.

  'kernel' crate:

   - 'num' module: fix soundness issue in the 'Bounded' conversion from
     'bool' by restricting the conversions to unsigned 'Bounded'.

   - 'jump_label' module: fix future 'make rusttest' target failures
     when 'ARCH=' is set to an arch different than the host's.

   - 'list' module: fix incorrect 'pop_back()' comment"

* tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
  rust: num: restrict bool conversion to unsigned Bounded
  kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
  kbuild: rust: preserve unreachable traps with inline helpers
  rust: cfi: disable function merging if CFI is enabled
  rust: jump_label: skip arch-specific asm in `testlib` builds
  objtool/rust: add one more `noreturn` Rust function
  rust: kernel: list: fix incorrect pop_back example comment
 2026-08-30 09:47:39 -07:00
Linus Torvalds 0fe792fa9b Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux 
Pull arm updates from Russell King:
 "Updates for 7.3:

   - add module description for kprobes testing module

   - remove references to CONFIG_CPU_ARM92x_CPU_IDLE options

   - expand comment in ARM's __switch_to()

  Also a number of fixes that missed 7.2:

   - disable broken eBPF on RiscPC

   - more BKPT fixes (guys, it's a *very* bad idea when everyone uses
     the BKPT instruction for their own differing purposes)

   - another preempt-rt fix, this time for siglock / CPU timers

   - fix another path where we try to send signals to processes with
     interrupts disabled

   - acquire mmap write lock for show_pte() with user faults"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
  ARM: 9480/1: entry: expand comment in __switch_to
  ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options
  ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
  ARM: 9484/1: enable interrupts when unhandled user faults are triggered
  ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
  ARM: 9481/2: breakpoint: CFI breakpoints only on demand
  ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
  ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION
 2026-08-30 09:43:01 -07:00
Linus Torvalds fb5b59a6a6 Merge tag 'for-linus' of https://github.com/openrisc/linux 
Pull OpenRISC updates from Stafford Horne:
 "One small trivial macro cleanup and one bug fix.

  The bug fix is to fix an unchecked access in our or1k_atomic syscall,
  I am debating if we should just deprecate this as there is minimal
  need for it"

* tag 'for-linus' of https://github.com/openrisc/linux:
  openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
  openrisc: drop unneeded semicolon
 2026-08-30 09:26:54 -07:00
Linus Torvalds 034dd340b0 Merge tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 
Pull tracing fixes from Steven Rostedt:

 - Fix error output of boot instance creation failure

   Currently if a boot instance creation fails, instead of printing out
   the name of the instance that failed, it prints "(null)". That is
   because it prints "cur_str" that had already been processed by
   strsep(). Print the saved name instead.

   While at it, print the error code of the failure.

 - Fix use-after-free for same named historgrams

   Histograms can be named so that they can be used in multiple events.
   But if the named histogram has a variable attached, the second event
   that uses the named histogram which duplicates it and needs to free
   the original after duplication leaves the old variable in place and
   still visible. If another histogram uses than variable, it will use
   the stale one which will try to reference the freed duplicate
   histogram and crash the kernel.

   Free the duplicate variables along with the duplicated histogram
   data.

 - Check return value of kthread_run() in event self test

   The events self tests uses a kthread for testing but does not check
   if it succeeded in creating a kthread. If the kthread creation were
   to fail, the code will still try to call kthread_stop() on the error
   returned.

 - Fix race between reading trace_pipe and updating subbuffer size

   If a user is reading the trace_pipe file at the same time they update
   the ring buffer sub-buffer size, can cause the trace_pipe read to
   read stale data. Add trace_access_lock() around updating the ring
   buffer sub-buffer size.

 - Fix eventfs_inode on failure path in creation of the events directory

   In the creation of the "events" directory, if after allocating the
   eventfs_inode a failure is detected, it calls cleanup_ei() which
   calls free_ei(). The free_ei() will test if eventfs_inode being freed
   has no children. It is a bug if it does. But on the failure case of
   the creation of the "events" directory, the children lists have not
   yet been initialized and the free will trigger a warning because
   list_empty() on an uninitialized list returns false.

   Move the initialization into init_ei() where it makes more sense and
   makes sure that a created eventfs_inode has its lists initialized
   upon creation.

 - Check return value of kthread_run() in ftrace direct sample code

   The sample code that shows how to use the ftrace direct calls does
   not test the return of kthread_run() to see if it succeeds. Return a
   failure if the kthread_run() doesn't succeed.

 - Clear user events state on fork in case of alloc failure

   On fork, the child gets a pointer to the parent's user events state.
   It makes a copy of it then updates the child's pointer to it. But if
   the allocation fails, the duplication function leaves the child with
   a pointer to its parent's descriptor. When the child cleans up its
   data, it will free the parent's descriptor while the parent is still
   using it.

   In the duplication function, set the child's user_event_mm to NULL
   before testing if the allocation succeeded, and when it exits it will
   not free the parent's descriptor.

 - Fix retry exhaustion in simple ring buffer reader swap

   simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
   post-decrements it only after a failed link replacement. On the final
   attempt, a successful replacement leaves retry at zero, while a
   failed replacement leaves it at -1.

   But the check for success expects the retry value to be non-zero and
   exits with an error on zero. This is the opposite result. Fix it.

 - Fail nicely when the remote swap_reader_page() returns an error

   Currently, if the swap_reader_page() of a remote buffer fails, it
   triggers a WARN_ON_ONCE() and continues normally. Instead, have it
   exit with an error and a pr_warn() print instead of a full WARNING.

* tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Stop remote reader update when page swap fails
  tracing: Fix retry exhaustion in simple ring buffer reader swap
  tracing/user_events: Clear copied tracing state before fork duplication
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
  eventfs: Initialize ei->children and ei->list in init_ei()
  tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
  tracing: Fix crash passing ERR_PTR to kthread_stop()
  tracing: Fix use-after-free with same-name named triggers
  tracing: Fix logged instance name on creation failure
 2026-08-30 09:22:00 -07:00
Linus Torvalds 08dbfad3f5 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi 
Pull more SCSI updates from Martin Petersen:
 "Remaining updates for the 7.3 merge window. The only core change is
  enabling context analysis for the SCSI layer and UFS.

  The remaining changes are either bug fixes or hardening"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits)
  scsi: snic: Fix SCSI host leak on workqueue allocation failure
  scsi: MAINTAINERS: Update my email address
  scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers
  scsi: leapraid: Standardize NCQ priority sysfs attributes
  scsi: leapraid: Serialize firmware log mmap with teardown
  scsi: leapraid: Balance host references for firmware log VMAs
  scsi: lpfc: Remove unnnecessary NULL check
  scsi: qla2xxx: Fix an loop timeout test
  scsi: qla2xxx: Fix an error code in qla_get_tmf()
  scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work()
  scsi: core: Enable context analysis for hosts.o
  scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions
  scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers
  scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report()
  scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name()
  scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info()
  scsi: core: Enable context analysis
  scsi: core: Protect host state changes with the host lock
  scsi: core: Add lock context annotations
  scsi: core: Pass the SCSI host pointer directly to scanning functions
  ...
 2026-08-29 11:55:36 -07:00