)]}' { "log": [ { "commit": "d271c243392d4c8cd868ac5c23a440971e14201f", "tree": "55a85e9ff3ded0747e366fe1144397fc24cc3a7e", "parents": [ "b26e879f6cc411c763756cd586f505e480950d19", "8cd9520d35a6c38db6567e97dd93b1f11f185dc6" ], "author": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Mon Jun 15 15:40:45 2026 +0000" }, "committer": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Mon Jun 15 15:40:45 2026 +0000" }, "message": "Merge tag \u0027v7.1\u0027 into android-mainline\n\nLinux 7.1\n\nChange-Id: I35c779fb5363b2baf3edfaacbee966118682885d\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\n" }, { "commit": "8cd9520d35a6c38db6567e97dd93b1f11f185dc6", "tree": "96667ed2997d7b49f3e9a36c4297b1faca4d87e3", "parents": [ "424280953322cf66314f3ba5e2d1ef345f21c770" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:58:38 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:58:38 2026 +0100" }, "message": "Linux 7.1\n" }, { "commit": "424280953322cf66314f3ba5e2d1ef345f21c770", "tree": "b60272675976be52c6ae25c2eb688f4f24f49b9d", "parents": [ "e21ee273e6fa3879aec9a27251cfce98156e07c4", "009b6c6486b94a3aff566b017256b598dc96bf18" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:37:39 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 14 15:37:39 2026 +0100" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull ARM fixes from Russell King:\n\n - Avoid KASAN instrumentation of half-word IO\n\n - Use a byte load for KASAN shadow stack\n\n - Fix kexec and hibernation with PAN\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN\n ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow\n ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O\n" }, { "commit": "b26e879f6cc411c763756cd586f505e480950d19", "tree": "e51c58688438f0d6213b686527712d65f120d2d9", "parents": [ "f3f901a4d4626452d29279b1fbc8e111391078cd", "e21ee273e6fa3879aec9a27251cfce98156e07c4" ], "author": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Sun Jun 14 13:38:39 2026 +0000" }, "committer": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Sun Jun 14 13:38:39 2026 +0000" }, "message": "Merge e21ee273e6fa (\"Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\") into android-mainline\n\nSteps on the way to v7.1-rc8\n\nChange-Id: Iaefbcf941f1ce64eba724011db6346bd4eb9f773\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\n" }, { "commit": "f3f901a4d4626452d29279b1fbc8e111391078cd", "tree": "9560df332727bc0932a90338458dda853f917341", "parents": [ "3ff3e5e77cc597d2967c3ab3f13ae3813a03959b", "4fa048ed72531d6c2a2147fa9b52b6a5451213a2" ], "author": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Sun Jun 14 13:28:57 2026 +0000" }, "committer": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Sun Jun 14 13:28:57 2026 +0000" }, "message": "Merge 4fa048ed7253 (\"Merge tag \u0027drm-fixes-2026-06-13\u0027 of https://gitlab.freedesktop.org/drm/kernel\") into android-mainline\n\nSteps on the way to v7.1-rc8\n\nChange-Id: I1d12c519bdbd58540dac9afc3dd8a5cd2b3ae0f5\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\n" }, { "commit": "3ff3e5e77cc597d2967c3ab3f13ae3813a03959b", "tree": "e68e91699acd05bffac28f9f16564df2fa7dca11", "parents": [ "4a8e51250625671e4a0175e18b4001cc03ac3971", "2b414a95b8f7307d42173ba9e580d6d3e2bcbfce" ], "author": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Fri Jun 12 14:52:06 2026 +0000" }, "committer": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Sun Jun 14 13:14:25 2026 +0000" }, "message": "Merge 2b414a95b8f7 (\"Merge tag \u0027s390-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\") into android-mainline\n\nSteps on the way to v7.1-rc8\n\nChange-Id: Ie5d3d5bb80cf42a89f8b40b7a22af4db31cf8255\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\n" }, { "commit": "e21ee273e6fa3879aec9a27251cfce98156e07c4", "tree": "167899ca1a5d226e750e3d8e943ff9b103d17944", "parents": [ "2b07ea76fd28989bde5993532d7a943a6f90e246", "f29a24c94705496254dd9ce7ea8a31efb6eb4358" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 18:21:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 18:21:44 2026 -0700" }, "message": "Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fixes from Stephen Boyd:\n \"Fixes for the Qualcomm and Google GS101 clk drivers:\n\n - Skip parking clks on some Qualcomm platforms so that the recovery\n console keeps working\n\n - Fix Google GS101 resume by using the correct div register\"\n\n* tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: qcom: dispcc-sc8280xp: Don\u0027t park mdp_clk_src at registration time\n clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs\n clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked\n" }, { "commit": "2b07ea76fd28989bde5993532d7a943a6f90e246", "tree": "914251a4bffac169d2efa16b3bffa7d9e4671daa", "parents": [ "a5e98d1679809cbad0f88f1b6b60e92134d8ee13", "0d046ae106255cba5eb83b23f78ee93f3620247d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:23:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:23:36 2026 -0700" }, "message": "Merge tag \u0027core-urgent-2026-06-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull debugobjects fix from Ingo Molnar:\n\n - Fix potential debugobjects deadlock on PREEMPT_RT kernels (Waiman\n Long)\n\n* tag \u0027core-urgent-2026-06-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n debugobjects: Don\u0027t call fill_pool() in early boot hardirq context\n" }, { "commit": "a5e98d1679809cbad0f88f1b6b60e92134d8ee13", "tree": "8620070459b18bf31ce5627366e2f44b9fb3442e", "parents": [ "062871f1371b2e02a272ff5279c6479aff0a37ef", "35ebcfcc9ef29afcf258db854ccf25572c75baef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:14:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 13 08:14:17 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"The biggest news here is that this is my last pull request as I2C\n maintainer after 13.5 years. Starting with the 7.2 cycle, Andi Shyti\n is taking over who helped me greatly maintaining the host drivers for\n a while now. Thank you, Andi, and good luck with the subsystem. I\u0027ll\n be around for help, of course.\n\n Technically, there are two patches which might be a tad large for this\n late cycle, but most of them is explaining comments, so I think they\n are suitable.\n\n - MAINTAINERS:\n - hand over I2C maintainership to Andi\n - minor updates\n\n - rust: fix I2cAdapter refcount double increment\n\n - imx: keep clock and pinctrl states consistent in runtime PM\n\n - imx-lpi2c: fix DMA resource leaks on PIO fallback\n\n - qcom-cci: fix NULL pointer dereference on remove\n\n - riic: fix reset refcount leak on resume_noirq error path\n\n - stm32f7: account for analog filter in timing computation\n\n - tegra:\n - fix suspend/resume handling in NOIRQ phase\n - update Tegra410 I2C timings to match hardware specs\"\n\n* tag \u0027i2c-for-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n dt-bindings: i2c: mux-gpio: name correct maintainer\n MAINTAINERS: hand over I2C to Andi Shyti\n i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()\n MAINTAINERS: i2c: designware: Remove inactive reviewer\n i2c: tegra: Fix NOIRQ suspend/resume\n i2c: tegra: Update Tegra410 I2C timing parameters\n i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()\n i2c: stm32f7: fix timing computation ignoring i2c-analog-filter\n i2c: imx: fix clock and pinctrl state inconsistency in runtime PM\n i2c: riic: fix refcount leak in riic_i2c_resume_noirq()\n rust: i2c: fix I2cAdapter refcounts double increment\n" }, { "commit": "062871f1371b2e02a272ff5279c6479aff0a37ef", "tree": "e088c0636470795dbdb8563d01867a94a9e3c750", "parents": [ "4fa048ed72531d6c2a2147fa9b52b6a5451213a2", "3f786abd23951f3f600a62fef42469d9200d5f52" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 17:23:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 17:23:05 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Two fixes for the mcp23s08 driver.\n\n - Revert an earlier fix to the AMD pin controller that was all wrong. A\n proper fix is being developed.\n\n* tag \u0027pinctrl-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n Revert \"pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11\"\n pinctrl: mcp23s08: Read spi-present-mask as u8 not u32\n pinctrl: mcp23s08: Initialize mcp-\u003edev and mcp-\u003eaddr before regmap init\n" }, { "commit": "4fa048ed72531d6c2a2147fa9b52b6a5451213a2", "tree": "694b56bbd68008cda854051e488c787b7e9d616c", "parents": [ "2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0", "7c62657a10625e4e113de248d41f543d5a2f3a1a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 15:51:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 15:51:16 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-06-13\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Looks like it\u0027s settled down a bit more thankfully. Small changes\n across the board, amdgpu/xe leading with some colorop changes in the\n core/amd. Otherwise some misc driver fixes.\n\n colorop:\n - make lut interpolation mutable\n - track colorop updates correctly\n\n amdgpu:\n - UserQ fix\n - Userptr fix\n - MCCS freesync fix\n - track colorop changes correctly\n\n amdkfd:\n - Fix an event information leak\n - Events bounds check fix\n - Trap cleanup fix\n\n i915:\n - Check supported link rates DPCD read\n - Fix phys BO pread/pwrite with offset\n\n xe:\n - fix oops in suspend/shutdown without display\n - RAS fixes\n - Use HW_ERR prefix in log\n - include all registered queues in TLB invalidation\n - Fix refcount leak in xe_range_tree in error paths\n - fix job timeout recovery for unstarted jobs and kernel queues\n\n amdxdna:\n - fix possible leak of mm_struct\n\n ivpu:\n - fix integer truncation\n\n vc4:\n - fix leak in krealloc() error handling\n\n virtio:\n - fix dma_fence ref-count leak\"\n\n* tag \u0027drm-fixes-2026-06-13\u0027 of https://gitlab.freedesktop.org/drm/kernel: (24 commits)\n accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()\n drm/xe: fix job timeout recovery for unstarted jobs and kernel queues\n drm/xe: fix refcount leak in xe_range_fence_insert()\n drm/xe: include all registered queues in TLB invalidation\n drm/xe/hw_error: Use HW_ERR prefix in log\n drm/xe/drm_ras: Add per node cleanup action\n drm/xe/drm_ras: Make counter allocation drm managed\n drm/xe/display: fix oops in suspend/shutdown without display\n drm/amd/display: use plane color_mgmt_changed to track colorop changes\n drm/atomic: track individual colorop updates\n drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable\n drm/colorop: Remove read-only comments from interpolation fields\n drm/i915/gem: Fix phys BO pread/pwrite with offset\n drm/vc4: fix krealloc() memory leak\n drm/virtio: Fix driver removal with disabled KMS\n drm/i915/edp: Check supported link rates DPCD read\n accel/ivpu: Fix signed integer truncation in IPC receive\n drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()\n drm/amd/display: Consult MCCS FreeSync cap only if requested \u0026 supported\n drm/amdkfd: Unwind debug trap enable on copy_to_user failure\n ...\n" }, { "commit": "7c62657a10625e4e113de248d41f543d5a2f3a1a", "tree": "0489a36702999be344762419119adb9d6d92a25b", "parents": [ "6fe5552f678bdbb925388ecff30a257b382cb9f6", "2f41af638c92bac6f1f9275ea2d1901baef578f3" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 13 07:50:04 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 13 07:52:40 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-06-12\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namd:\n- track colorop changes correctly\n\namdxdna:\n- fix possible leak of mm_struct\n\ncolorop:\n- make lut interpolation mutable\n- track colorop updates correctly\n\nivpu:\n- fix integer truncation\n\nvc4:\n- fix leak in krealloc() error handling\n\nvirtio:\n- fix dma_fence ref-count leak\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260612081418.GA17001@2a02-2455-9062-2500-e496-5a17-62ba-545e.dyn6.pyur.net\n" }, { "commit": "2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0", "tree": "b9717d818a60b051be6af12f543c3c5ff8b5e792", "parents": [ "28608283615e5e7e92ea79c8ea13507f4b5e0cbe", "d898796a8e7ed8528c775f33da056e9978c4c248" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 13:49:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 13:49:45 2026 -0700" }, "message": "Merge tag \u0027pci-v7.1-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull pci fix from Bjorn Helgaas:\n\n - Add Frank Li as PCI endpoint reviewer (Frank Li)\n\n* tag \u0027pci-v7.1-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n MAINTAINERS: Add Frank Li as PCI endpoint reviewer\n" }, { "commit": "d898796a8e7ed8528c775f33da056e9978c4c248", "tree": "2c431a26832cac72b5054db0f8a903f92f42830c", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Frank Li", "email": "Frank.Li@nxp.com", "time": "Thu Jun 11 17:00:05 2026 -0400" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri Jun 12 15:15:38 2026 -0500" }, "message": "MAINTAINERS: Add Frank Li as PCI endpoint reviewer\n\nI have volunteered to review PCI endpoint-related changes. Add myself as a\nreviewer to be notified when related patches are posted.\n\nSigned-off-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nReviewed-by: Krzysztof Wilczyński \u003ckwilczynski@kernel.org\u003e\nLink: https://patch.msgid.link/20260611210007.529205-1-Frank.Li@oss.nxp.com\n" }, { "commit": "28608283615e5e7e92ea79c8ea13507f4b5e0cbe", "tree": "eea3e0785303e33f3bcba976cd211084b128add4", "parents": [ "880b719ca0da9d2470fd2652e8ed959ca5143280", "3c60184e39b57e5efe664fe8540cdbc1bc7ea899" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 11:06:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 11:06:16 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A couple of driver specific fixes: a small targeted fix for hardware\n error handling on DesignWare controllers and another for handling of\n custom chip select management on Qualcomm GENI controllers\"\n\n* tag \u0027spi-fix-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dw: fix race between IRQ handler and error handler on SMP\n spi: qcom-geni: Fix cs_change handling on the last transfer\n" }, { "commit": "4a8e51250625671e4a0175e18b4001cc03ac3971", "tree": "a1e8aaa9a85e53746452a2cb01ec3f88dacaad46", "parents": [ "8a7c7d3954c2839bb2f6ebe475648ec14b8a2c9f" ], "author": { "name": "Will McVicker", "email": "willmcvicker@google.com", "time": "Thu May 21 13:29:03 2026 -0700" }, "committer": { "name": "Will McVicker", "email": "willmcvicker@google.com", "time": "Fri Jun 12 10:52:17 2026 -0700" }, "message": "ANDROID: gki_defconfig: arm64: Enable the Wonder driver\n\nThis adds the Android Wonder Wi-Fi virtual device driver as a GKI\nmodule.\n\nBug: 505327866\nChange-Id: I015c1ff183805701d02495f8e4f45ddf84175282\nSigned-off-by: Will McVicker \u003cwillmcvicker@google.com\u003e\n" }, { "commit": "8a7c7d3954c2839bb2f6ebe475648ec14b8a2c9f", "tree": "ccc72572dbf36b54b54ebd7cd0e46b6c281e00f0", "parents": [ "8d4a8c760dd2122b0f788ae9953970c7d628d4d5" ], "author": { "name": "Will McVicker", "email": "willmcvicker@google.com", "time": "Tue May 19 16:46:56 2026 -0700" }, "committer": { "name": "Will McVicker", "email": "willmcvicker@google.com", "time": "Fri Jun 12 10:52:12 2026 -0700" }, "message": "ANDROID: Add Wonder driver to GKI\n\nThis adds the Wonder Wi-Fi virtual device driver to the Android Common\nKernel as a GKI driver. It is based off of the android17-6.18 wonder\ndriver at version 3.6.5.\n\nBug: 505327866\nChange-Id: Icc8584f08550c7db760aa437be5534d7487fcf98\nSigned-off-by: Will McVicker \u003cwillmcvicker@google.com\u003e\n" }, { "commit": "880b719ca0da9d2470fd2652e8ed959ca5143280", "tree": "a40dde0f220d9195a4ef66306cce8279b62f62c8", "parents": [ "2e04e0961e9226d7e1fdd5bda3373289ba7a3f24", "29fe1bd01b99714f3136f922230a643c2742cda9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:49:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:49:59 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260611\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Tweak for an off-by-one in the CQ ring accounting for the min wait\n support.\n\n - Don\u0027t truncate end buffer length for a bundle, as the transfer might\n not happen. It\u0027s not required in the first place, as the completion\n side handles this condition already.\n\n* tag \u0027io_uring-7.1-20260611\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/wait: fix min_timeout behavior\n io_uring/kbuf: don\u0027t truncate end buffer for bundles\n" }, { "commit": "2e04e0961e9226d7e1fdd5bda3373289ba7a3f24", "tree": "7550e06f803c22c412a6997c40287512ee57240f", "parents": [ "c133f0433ad78ef51b5b4d3d26ed1940236d71a2", "e47832c73b83ec21e67026726a1c8124697792af" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:29:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:29:06 2026 -0700" }, "message": "Merge tag \u0027usb-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB / Thunderbolt fixes from Greg KH:\n \"Here are some small bugfixes for USB serial and Thunderbolt drivers\n for some reported and found issues. Included in here are:\n\n - usb serial overflow bugs fixed\n\n - new usb serial device id\n\n - thunderbolt validation fixes for reported issues\n\n All of these have been in linux-next this week with no reported\n issues\"\n\n* tag \u0027usb-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n USB: serial: kl5kusb105: fix bulk-out buffer overflow\n USB: serial: option: add usb-id for Dell Wireless DW5826e-m\n USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n USB: serial: io_ti: fix heap overflow in get_manuf_info()\n thunderbolt: Limit XDomain response copy to actual frame size\n thunderbolt: Validate XDomain request packet size before type cast\n thunderbolt: Clamp XDomain response data copy to allocation size\n thunderbolt: Bound root directory content to block size\n thunderbolt: Reject zero-length property entries in validator\n" }, { "commit": "c133f0433ad78ef51b5b4d3d26ed1940236d71a2", "tree": "6deb9241d5434b3d4f1a83fcca32c6868a562d0b", "parents": [ "9a837eff9032ca0e047b068ff101d2183eb0afa1", "88e994c57a79f62d5338231d8d37ee8dd98baffe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:10:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 10:10:12 2026 -0700" }, "message": "Merge tag \u0027staging-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are two small bugfixes for a staging driver to fix a\n much-reported issue.\n\n The fixes are for the rtl8723bs driver and it\u0027s something that many\n scanning tools keep tripping over in convoluted ways (and seems to be\n able to be triggered by network traffic)\n\n These fixes have been in linux-next for many weeks with no reported\n issues, sorry for the delay in getting them to you\"\n\n* tag \u0027staging-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction\n staging: rtl8723bs: fix buffer over-read in rtw_update_protection\n" }, { "commit": "9a837eff9032ca0e047b068ff101d2183eb0afa1", "tree": "9281b338a1335e104441b7dffc780efff0ac77bd", "parents": [ "1dadb7e7eb5a052a58fb2ec8d60c07186158efc4", "07ebe87915d8accdaba20c4f88c5ae430fe62fbb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 09:00:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 09:00:28 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc driver fixes from Greg KH:\n \"Here are some small driver fixes for 7.1-final to resolve some\n reported issues. Included in here are:\n\n - slimbus qcom driver bugfixes\n\n - nvmem driver bugfixes\n\n - fastrpc driver bugfixes\n\n - stratix10 firmware driver bugfixes\n\n All of these have been in linux-next for over a week with no\n reported issues\"\n\n* tag \u0027char-misc-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n misc: fastrpc: fix use-after-free race in fastrpc_map_create\n misc: fastrpc: Fix NULL pointer dereference in rpmsg callback\n misc: fastrpc: fix DMA address corruption due to find_vma misuse\n misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context\n slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock\n slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD\n slimbus: qcom-ngd-ctrl: Initialize controller resources in controller\n slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd\n slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership\n slimbus: qcom-ngd-ctrl: Fix probe error path ordering\n slimbus: qcom-ngd-ctrl: Fix up platform_driver registration\n slimbus: qcom-ngd-ctrl: fix OF node refcount\n nvmem: core: fix use-after-free bugs in error paths\n nvmem: layouts: onie-tlv: fix hang on unknown types\n firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe\n firmware: stratix10-svc: Don\u0027t fail probe when async ops unsupported\n firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported\n" }, { "commit": "1dadb7e7eb5a052a58fb2ec8d60c07186158efc4", "tree": "8dacc111044d2dcecf7c5fef2c9bf74eded2f574", "parents": [ "fd41dc46db5eecf21c9d53fe034a731a2767030a", "b0d1553d51c3d188baae6d77e6f3dfb415a7b623" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:52:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:52:10 2026 -0700" }, "message": "Merge tag \u0027sound-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A few small fixes for the last spurt. All changes are small, mostly\n consisting of driver-specific fixes, along with two UAF fixes for the\n ALSA timer core.\n\n Core:\n - Two UAF fixes in ALSA timer core\n\n ASoC:\n - SDCA: Fix NULL pointer dereference\n - amd / yc: Add DMI quirk for ASUS ExpertBook PM1403CDA\n - SOF amd: Fix garbage/spurious warnings\n - wm_adsp: Fix potential NULL dereference when removing firmware\n controls\n - loongson: Fix negative position calculation\n - spi-rzv2h-rspi: Fix SPDR read access width on 16-bit RX path\"\n\n* tag \u0027sound-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions\n ASoC: loongson: Fix invalid position error in ls_pcm_pointer\n spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX\n ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA\n ASoC: SOF: amd: set ipc flags to zero\n ASoC: SOF: amd: fix for ipc flags check\n ASoC: wm_adsp: Fix NULL dereference when removing firmware controls\n ALSA: timer: Fix UAF at snd_timer_user_params()\n ALSA: timer: Forcibly close timer instances at closing\n" }, { "commit": "8d4a8c760dd2122b0f788ae9953970c7d628d4d5", "tree": "28bde39f6f660d793b8036cc213e5a93c23aa683", "parents": [ "92ef7d7f224acb58badc3455fce5b2f2c821eb17" ], "author": { "name": "Satya Durga Srinivasu Prabhala", "email": "satyap@qti.qualcomm.com", "time": "Tue Jun 02 10:04:30 2026 -0700" }, "committer": { "name": "Todd Kjos", "email": "tkjos@google.com", "time": "Fri Jun 12 08:51:07 2026 -0700" }, "message": "ANDROID: kleaf: export get_kunit_modules_superset from modules.bzl\n\nget_kunit_modules_superset() returns the full superset of KUnit module\npaths as a plain list (no select()), making it safe to call at Bazel\nload time. Re-export it from the public modules.bzl so downstream\ncan use it to auto-derive KUnit module lists without duplicating\nor manually syncing the list.\n\nBug: 519179681\nChange-Id: Ibe0b2cc88fb421a7ac1e43cecd6d38ababce52b8\nSigned-off-by: Satya Durga Srinivasu Prabhala \u003csatyap@qti.qualcomm.com\u003e\n(cherry picked from commit 73860a1ea8361064ec22303e318cb240d018b722)\n" }, { "commit": "fd41dc46db5eecf21c9d53fe034a731a2767030a", "tree": "7feafea0af1648abcbcd8844d5b5ed483be107c4", "parents": [ "f51cae6603c05b4b1fac65c773592e5bc8037251", "9c648f3554920721d8878807cd794fe2d7f989e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:44:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 12 08:44:56 2026 -0700" }, "message": "Merge tag \u0027soc-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"Two more small fixes came in, both addressing corner cases in platform\n specific code: the microchip mpfs system controller probe and the CPU\n power management on 32-bit rockchips SoCs\"\n\n* tag \u0027soc-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n ARM: rockchip: keep reset control around\n soc: microchip: mpfs-sys-controller: fix resource leak on probe error\n" }, { "commit": "35ebcfcc9ef29afcf258db854ccf25572c75baef", "tree": "fef851d3e7f8e223cf9c6f78172384a7e850b81a", "parents": [ "5cad752e1e73c326c9d784ceb34c9129285539c5", "9bffa2a61551da9ac32171f09d556974cb96d70a" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Jun 12 17:05:44 2026 +0200" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Jun 12 17:05:44 2026 +0200" }, "message": "Merge tag \u0027i2c-host-fixes-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-host-fixes for v7.1-rc8\n\n- imx: keep clock and pinctrl states consistent in runtime PM\n- imx-lpi2c: fix DMA resource leaks on PIO fallback\n- qcom-cci: fix NULL pointer dereference on remove\n- riic: fix reset refcount leak on resume_noirq error path\n- stm32f7: account for analog filter in timing computation\n- tegra: fix suspend/resume handling in NOIRQ phase\n- tegra: update Tegra410 I2C timings to match hardware specs\n- MAINTAINERS: hand over I2C maintainership to Andi\n" }, { "commit": "5cad752e1e73c326c9d784ceb34c9129285539c5", "tree": "99da4fd8ce62e4d051c0ed2fae69600b6b98c790", "parents": [ "498cc8f0a93b3e71d186e30d1b93b6f3eca96738" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Thu Jun 11 14:20:53 2026 +0200" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Jun 12 16:58:38 2026 +0200" }, "message": "dt-bindings: i2c: mux-gpio: name correct maintainer\n\nThe YAML conversion added me as maintainer but I can\u0027t recall being\nasked nor do I want to maintain it. Add Peter as maintainer for the\nbinding as he is maintainer of the driver.\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nAcked-by: Peter Korsgaard \u003cpeter.korsgaard@barco.com\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\n" }, { "commit": "92ef7d7f224acb58badc3455fce5b2f2c821eb17", "tree": "2492ceab4ca42d3961a61d55691acfe96814b03b", "parents": [ "ea498199688e9d4d6edd30fac0ceda527ea7f422" ], "author": { "name": "Jacky Liu", "email": "qsliu@google.com", "time": "Fri Jun 12 01:52:47 2026 -0700" }, "committer": { "name": "android-test-infra-autosubmit@system.gserviceaccount.com", "email": "android-test-infra-autosubmit@system.gserviceaccount.com", "time": "Fri Jun 12 04:51:21 2026 -0700" }, "message": "Revert^2 \"ANDROID: Delete top-level build.config.constants.\"\n\nThis reverts commit 0daecfe5a597d8bd02943158d5f4c24d28e26fde.\n\nReason for revert: b/522958753 has been fixed\n\nBug: 448148817\nBug: 522958753\nChange-Id: I3bb7e5b2d2e1175ffc30ac4244b9756d4da3a0bc\nSigned-off-by: Jacky Liu \u003cqsliu@google.com\u003e\n" }, { "commit": "9bffa2a61551da9ac32171f09d556974cb96d70a", "tree": "5a510a275dbf1012c1f2d6e8b34fa7aa16ead2b6", "parents": [ "695fcefd4a81466ef9c529790b4e96f1ea2ba051" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Tue Jun 09 11:16:14 2026 +0200" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Jun 12 11:11:58 2026 +0200" }, "message": "MAINTAINERS: hand over I2C to Andi Shyti\n\nAfter 13.5 years of maintaining I2C, it is finally time for me to move\nto other areas. So, I hereby transfer I2C maintainership to Andi Shyti.\nHe has been taking care of the I2C host drivers for a while now and\nkindly agreed to look after the whole subsystem. Thank you, Andi! I also\nwant to thank all contributors, reviewers, and fellow maintainers making\nall these years a mostly smooth ride. Happy hacking, everyone!\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260609091612.8228-4-wsa+renesas@sang-engineering.com\n" }, { "commit": "ea498199688e9d4d6edd30fac0ceda527ea7f422", "tree": "05caf9ff5ab7e2efb7d9bc20a1ce37e2f84eded5", "parents": [ "f6261bf2c0ac275ae8dfb13fdf9960248848adca" ], "author": { "name": "Yuan-Jen (淵仁) Cheng", "email": "cyuanjen@google.com", "time": "Wed Jun 03 23:43:55 2026 -0700" }, "committer": { "name": "Yuan-Jen (淵仁) Cheng", "email": "cyuanjen@google.com", "time": "Fri Jun 12 01:03:55 2026 -0700" }, "message": "ANDROID: Update devicetree_library dt-bindings dependencies\n\nAdd include/linux/kconfig.h to the hdrs of the dt-bindings target. This\nis required for device trees to use `IS_ENABLED` macro.\n\nBug: 448483795\nChange-Id: Icb120826738b0c315a272981f313924b8060f8d6\nSigned-off-by: Yuan-Jen (淵仁) Cheng \u003ccyuanjen@google.com\u003e\n" }, { "commit": "6fe5552f678bdbb925388ecff30a257b382cb9f6", "tree": "c63ead6390afc3bfdba9d3ee89e8c9946e15b71f", "parents": [ "c7be308858890007b4da9b6498a1c1f3e6647dee", "347ccc0453fca2c669e8dc8a72000e76ca4adf10" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:57:16 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:57:17 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-06-11\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nUAPI Changes:\n\nCross-subsystem Changes:\n\nCore Changes:\n\nDriver Changes:\n - fix oops in suspend/shutdown without display (Jani)\n - RAS fixes (Raag)\n - Use HW_ERR prefix in log (Raag)\n - include all registered queues in TLB invalidation (Tangudu)\n - Fix refcount leak in xe_range_tree in error paths (Wentao)\n - fix job timeout recovery for unstarted jobs and kernel queues (Rodrigo)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/aitt8ZkYmxIT9cdP@gsse-cloud1.jf.intel.com\n" }, { "commit": "c7be308858890007b4da9b6498a1c1f3e6647dee", "tree": "e31a5cd8d17179c0dab0056cacbdb83aee0d0b7e", "parents": [ "2aaaf5931b16938a017b7db51b8d9fadad857adc", "d21ad938398bca695a511307de38a65889e3b354" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:32:49 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 12 13:32:49 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-06-11\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Check supported link rates DPCD read [edp] (Nikita Zhandarovich)\n- Fix phys BO pread/pwrite with offset [gem] (Joonas Lahtinen)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/aipkcUDnTlzre-8F@linux\n" }, { "commit": "f6261bf2c0ac275ae8dfb13fdf9960248848adca", "tree": "758225c0a0658a3402d056b8d1f37ff98d47dd9f", "parents": [ "0daecfe5a597d8bd02943158d5f4c24d28e26fde" ], "author": { "name": "Juan Yescas", "email": "jyescas@google.com", "time": "Thu Jun 11 17:34:51 2026 -0700" }, "committer": { "name": "android-test-infra-autosubmit@system.gserviceaccount.com", "email": "android-test-infra-autosubmit@system.gserviceaccount.com", "time": "Thu Jun 11 19:40:12 2026 -0700" }, "message": "Revert \"ANDROID: Delete top-level build.config.constants.\"\n\nThis reverts commit b4221e52ff0edf4d07a3c526292056bc878e96fc.\n\nReason for revert: The kernel buils are failing b/522958753\n\nBug: 448148817\nBug: 522958753\nChange-Id: I76f92b6e76138586baec6506617e1d4e7cceb2cb\nSigned-off-by: Juan Yescas \u003cjyescas@google.com\u003e\n" }, { "commit": "0daecfe5a597d8bd02943158d5f4c24d28e26fde", "tree": "758225c0a0658a3402d056b8d1f37ff98d47dd9f", "parents": [ "05c6fbd18c50f80608fc7773e801bf1e636d6d58" ], "author": { "name": "Juan Yescas", "email": "jyescas@google.com", "time": "Thu Jun 11 17:35:17 2026 -0700" }, "committer": { "name": "android-test-infra-autosubmit@system.gserviceaccount.com", "email": "android-test-infra-autosubmit@system.gserviceaccount.com", "time": "Thu Jun 11 19:12:46 2026 -0700" }, "message": "Revert \"ANDROID: Delete top-level build.config.constants.\"\n\nThis reverts commit b4221e52ff0edf4d07a3c526292056bc878e96fc.\n\nReason for revert: The kernel builds are failing b/522958753\n\nBug: 448148817\nBug: 522958753\nChange-Id: I6aeef041de5d135e2a2b5718b172d39e4b3ffcab\nSigned-off-by: Juan Yescas \u003cjyescas@google.com\u003e\n" }, { "commit": "05c6fbd18c50f80608fc7773e801bf1e636d6d58", "tree": "ee2cea1265d910e4b1c4be6d7ae2fc95c4047937", "parents": [ "b4221e52ff0edf4d07a3c526292056bc878e96fc" ], "author": { "name": "wuwei1", "email": "11150500@vivo.corp-partner.google.com", "time": "Thu Aug 15 22:28:40 2024 +0800" }, "committer": { "name": "android-test-infra-autosubmit@system.gserviceaccount.com", "email": "android-test-infra-autosubmit@system.gserviceaccount.com", "time": "Thu Jun 11 16:35:50 2026 -0700" }, "message": "ANDROID: GKI: enable CONFIG_TCP_CONG_BBR\n\nEnable support for BBR (Bottleneck Bandwidth and RTT) TCP congestion\ncontrol algorithm, which maximizes network utilization under certain\nscenarios. Note this still maintains CUBIC as the default algorithm.\n\nBug: 362198193\nChange-Id: I2885893e565f91d14cb2c139d975e4abfee80daf\nSigned-off-by: wuwei1 \u003c11150500@vivo.corp-partner.google.com\u003e\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\n(cherry picked from commit ee7395c4cb9b2e56e8f2dae5ac4a9f9cb9d78192)\n(cherry picked from commit eadaba3bbc28dff77f64d21aec830b72f4e235de)\n" }, { "commit": "b4221e52ff0edf4d07a3c526292056bc878e96fc", "tree": "99b9c5b0e2027a8a138b1850beb71bbcfb75ce13", "parents": [ "5c247c8d50a835c281948ad74274a10ca94bef7c" ], "author": { "name": "HONG Yifan", "email": "elsk@google.com", "time": "Tue Jun 02 20:14:12 2026 +0000" }, "committer": { "name": "android-test-infra-autosubmit@system.gserviceaccount.com", "email": "android-test-infra-autosubmit@system.gserviceaccount.com", "time": "Thu Jun 11 15:25:02 2026 -0700" }, "message": "ANDROID: Delete top-level build.config.constants.\n\nThe constants were moved to bazel/constants.scl and has been\nautomatically loaded. It is not necessary to source\nbuild.config.constants manually. Delete the top-level symlink\nfor simplicity.\n\ngo/keep-ack-clean\n\nBug: 448148817\nChange-Id: Ic1505a9c6a2676ffa2bb031286f78ae5c2609d11\nSigned-off-by: HONG Yifan \u003celsk@google.com\u003e\n" }, { "commit": "f51cae6603c05b4b1fac65c773592e5bc8037251", "tree": "d21144c1263676433eeceb4dbc25e8eb8789fe6e", "parents": [ "2b414a95b8f7307d42173ba9e580d6d3e2bcbfce", "6ec91df8aff77e2e8fe3179c1f3fc15b43a40ba3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 14:22:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 14:22:26 2026 -0700" }, "message": "Merge tag \u0027dma-mapping-7.1-2026-06-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fix from Marek Szyprowski:\n \"Three more fixes for the DMA-mapping code, related to PCI P2PDMA, DMA\n debug and DMA link ranges API (Li RongQing and Jason Gunthorpe)\"\n\n* tag \u0027dma-mapping-7.1-2026-06-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n iommu/dma: Do not try to iommu_map a 0 length region in swiotlb\n dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device\n dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments\n" }, { "commit": "b0d1553d51c3d188baae6d77e6f3dfb415a7b623", "tree": "76dd45e84f64a07e4a57bc6f8434055021d06850", "parents": [ "053a401b592be424fea9d57c789f66cd5d8cec11", "e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 11 21:29:47 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 11 21:29:47 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc7\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nA few more fixes for this release, some smaller driver specific ones\nplus a final quirk.\n" }, { "commit": "2b414a95b8f7307d42173ba9e580d6d3e2bcbfce", "tree": "e3349ab3ed37a969406d19f956d659503a006c92", "parents": [ "22e2036479cb77df6281ebbd376ae6c330774790", "1f57f68c4dd101e5e8ffc9ffa6428f45bcdd776a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:30:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:30:37 2026 -0700" }, "message": "Merge tag \u0027s390-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fix from Alexander Gordeev:\n\n - s390 selects GENERIC_LOCKBREAK when PREEMPT is enabled to tackle an\n old compile error that no longer exists. Since recently PREEMPT is\n always enabled, this LOCKBREAK config causes massive performance\n regressions.\n\n Remove GENERIC_LOCKBREAK from s390 Kconfig to fix the degradation.\n\n* tag \u0027s390-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390: Remove GENERIC_LOCKBREAK Kconfig option\n" }, { "commit": "22e2036479cb77df6281ebbd376ae6c330774790", "tree": "d872b0d89bf987fe6abf5897d6034baea0b5608f", "parents": [ "79f2670da86722d075633d20fa57418994ee6940", "7360b96099806396f4ce15233f6dddcb69248d34" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:17:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 10:17:49 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from IPsec and netfilter.\n\n This is relatively small, mostly because we are a bit behind our PW\n queue. I\u0027m not aware of any pending regression.\n\n Current release - regressions:\n\n - netfilter: nf_tables_offload: drop device refcount on error\n\n Previous releases - regressions:\n\n - core: add pskb_may_pull() to skb_gro_receive_list()\n\n - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n\n - ipv6: fix a potential NPD in cleanup_prefix_route()\n\n - ipv4: fix use-after-free caused by the fqdir_pre_exit() flush\n\n - eth:\n - bnxt_en: fix NULL pointer dereference\n - emac: fix use-after-free during device removal\n - octeontx2-af: fix memory leak in rvu_setup_hw_resources()\n - tun: zero the whole vnet header in tun_put_user()\n - sit: reload inner IPv6 header after GSO offloads\n\n Previous releases - always broken:\n\n - core: fix double-free in netdev_nl_bind_rx_doit()\n\n - netfilter: nf_log: validate MAC header was set before dumping it\n\n - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n\n - tcp: restrict SO_ATTACH_FILTER to priv users\n\n - mctp: usb: fix race between urb completion and rx_retry\n cancellation\n\n - eth:\n - mlx5: fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list\n - mvpp2: sync RX data at the hardware packet offset\"\n\n* tag \u0027net-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits)\n octeontx2-af: fix IP fragment flag corruption on custom KPU profile load\n ipv6: Fix a potential NPD in cleanup_prefix_route()\n net: txgbe: initialize PHY interface to 0\n net: txgbe: distinguish module types by checking identifier\n net: txgbe: initialize module info buffer\n net: mvpp2: build skb from XDP-adjusted data on XDP_PASS\n net: mvpp2: refill RX buffers before XDP or skb use\n net: mvpp2: limit XDP frame size to the RX buffer\n net: mvpp2: sync RX data at the hardware packet offset\n netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n netfilter: nf_log: validate MAC header was set before dumping it\n netfilter: x_tables: avoid leaking percpu counter pointers\n netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n netfilter: nf_tables_offload: drop device refcount on error\n netfilter: revalidate bridge ports\n rds: mark snapshot pages dirty in rds_info_getsockopt()\n ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n ptp: ocp: fix resource freeing order\n ...\n" }, { "commit": "79f2670da86722d075633d20fa57418994ee6940", "tree": "0d2f43a8115f545204ab0fb32e800718516f4bab", "parents": [ "6e9e0dfc7f2e34627a4280b8e168479018d95732", "fba0510cd62666951dcc0221527edc0c47ae6599" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:54:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:54:51 2026 -0700" }, "message": "Merge tag \u0027pmdomain-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - imx: Fix OF node refcount\n\n - ti: Fix wakeup configuration for parent devices of wakeup sources\n\n* tag \u0027pmdomain-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: imx: fix OF node refcount\n pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source\n" }, { "commit": "2f41af638c92bac6f1f9275ea2d1901baef578f3", "tree": "89ac96a1ae37f6f1c7755df1aa0c9bc5709bea21", "parents": [ "d79716401a954677a93c4dd51fec65beccb38296" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Wed Jun 10 08:11:27 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Thu Jun 11 09:50:07 2026 -0700" }, "message": "accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()\n\naie2_populate_range() jumps back to the again label without calling\nmmput(mm), leaking a reference to the mm_struct.\n\nAdd the missing mmput() before jumping to again.\n\nFixes: e486147c912f (\"accel/amdxdna: Add BO import and export\")\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com\n" }, { "commit": "6e9e0dfc7f2e34627a4280b8e168479018d95732", "tree": "ea9e9c32d46105105c8aff10deab06aa3f7cfda0", "parents": [ "9716c086c8e8b141d35aa61f2e96a2e83de212a7", "a23226b7c1f69eafd9ced4e037fb51c9758c0501" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:15:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 11 09:15:57 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix NULL pointer dereference in gpio-mvebu\n\n - fix runtime PM leak in remove path in gpio-zynq\n\n - reject invalid module params in gpio-mockup\n\n - fix generic IRQ chip leak in remove parh in gpio-rockchip\n\n - fix resource leaks in GPIO chip cleanup path on hog failure\n\n - fix a regression in how GPIO hogging code handles multiple GPIO chips\n reusing the same OF node\n\n* tag \u0027gpio-fixes-for-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpiolib: handle gpio-hogs only once\n gpio: fix cleanup path on hog failure\n gpio: rockchip: fix generic IRQ chip leak on remove\n gpio: mockup: reject invalid gpio_mockup_ranges widths\n gpio: zynq: fix runtime PM leak on remove\n gpio: mvebu: fix NULL pointer dereference in suspend/resume\n" }, { "commit": "e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd", "tree": "61b183bfed5b976e4620b489cec82301a20e41b6", "parents": [ "6ad3914e06a48a02e362d0df2b1073c7c567c93d" ], "author": { "name": "Kean Ren", "email": "rh_king@163.com", "time": "Thu Jun 11 10:37:57 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jun 11 15:55:23 2026 +0100" }, "message": "ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions\n\nsdca_dev_unregister_functions() iterates over all SDCA function\ndescriptors and calls sdca_dev_unregister() on each func_dev without\nchecking for NULL. When a function registration has failed partway\nthrough, or the device cleanup races with probe deferral, func_dev\nentries may be NULL, leading to a kernel oops:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000040\n RIP: 0010:device_del+0x1e/0x3e0\n Call Trace:\n sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca]\n release_nodes+0x35/0xb0\n devres_release_all+0x90/0x100\n device_unbind_cleanup+0xe/0x80\n device_release_driver_internal+0x1c1/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x161/0x3e0\n device_unregister+0x17/0x60\n sdw_delete_slave+0xb6/0xd0 [soundwire_bus]\n sdw_bus_master_delete+0x1e/0x50 [soundwire_bus]\n ...\n sof_probe_work+0x19/0x30 [snd_sof]\n\nThis was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake)\nwith the SOF audio driver probe failing due to missing Panther Lake\nfirmware, causing the subsequent cleanup of SoundWire devices to\ntrigger the crash.\n\nFix this with three changes:\n\n1) Add a NULL guard in sdca_dev_unregister() so that callers do not\n need to pre-validate the pointer (defense in depth).\n\n2) In sdca_dev_unregister_functions(), skip NULL func_dev entries\n and clear func_dev to NULL after unregistration, making the\n function idempotent and safe against double-invocation.\n\n3) In sdca_dev_register_functions(), roll back all previously\n registered functions when a later one fails, so the function\n array is never left in a partially-populated state.\n\nFixes: 4496d1c65bad (\"ASoC: SDCA: add function devices\")\nSigned-off-by: Kean Ren \u003crh_king@163.com\u003e\nReviewed-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260611023757.1553960-1-rh_king@163.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "5c247c8d50a835c281948ad74274a10ca94bef7c", "tree": "7413d50fbf9f301bb1d217a103f36740f8f72817", "parents": [ "6f25e0da2951c90af2d4c2b458eeee96a98427dc", "9716c086c8e8b141d35aa61f2e96a2e83de212a7" ], "author": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Thu Jun 11 14:19:15 2026 +0000" }, "committer": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Thu Jun 11 14:19:15 2026 +0000" }, "message": "Merge 9716c086c8e8 (\"Merge tag \u0027pm-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\") into android-mainline\n\nSteps on the way to v7.1-rc8\n\nChange-Id: Ied9a0957722245d07af6d52086b1ff2cf133e332\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\n" }, { "commit": "009b6c6486b94a3aff566b017256b598dc96bf18", "tree": "5486704578b67ab5e9a49ca30a74f14bea60203a", "parents": [ "77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Mon May 25 17:38:17 2026 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Thu Jun 11 14:52:03 2026 +0100" }, "message": "ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN\n\nCommit 7af5b901e847 (\"ARM: 9358/2: Implement PAN for LPAE by TTBR0\npage table walks disablement\") implemented PAN for LPAE kernels by\nsetting TTBCR.EPD0 on every kernel entry, disabling TTBR0 page-table\nwalks while running in kernel mode. The commit correctly updated\ncpu_suspend() in arch/arm/kernel/suspend.c, but missed two other code\npaths that switch the CPU to the identity mapping before jumping to\nlow-PA (TTBR0-range) physical addresses:\n\n1. setup_mm_for_reboot() in arch/arm/mm/idmap.c, used by the kexec\n reboot path. With TTBCR.EPD0 still set, the subsequent branch to\n the identity-mapped cpu_v7_reset causes a PrefetchAbort because the\n TTBR0 page-table walk needed to resolve the identity-mapped address\n is disabled. This manifests as a hard hang or \"bad PC value\" panic\n on LPAE kernels booted on CPUs that strictly enforce EPD0 for\n instruction fetch (e.g. Cortex-A53 in AArch32 mode) while the same\n image may accidentally work on Cortex-A15 due to microarchitectural\n differences in EPD0 enforcement.\n\n2. arch_restore_image() in arch/arm/kernel/hibernate.c, which calls\n cpu_switch_mm(idmap_pgd, \u0026init_mm) directly without going through\n setup_mm_for_reboot(), leaving TTBCR.EPD0 set while the identity\n mapping is active.\n\nFix both sites by calling uaccess_save_and_enable() before switching\nto the identity mapping, mirroring what the original commit did for\ncpu_suspend().\n\nAssisted-by: Cursor:claude-sonnet-4.6\n\nFixes: 7af5b901e847 (\"ARM: 9358/2: Implement PAN for LPAE by TTBR0 page table walks disablement\")\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6", "tree": "3afa2c4dfe697591dd09fb424fb50d824585505c", "parents": [ "d59ed803715a71fb9582e139d648ece8d66dc743" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Sun May 24 06:52:35 2026 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Thu Jun 11 14:52:01 2026 +0100" }, "message": "ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow\n\nCommit 44e9a3bb76e5 (\"ARM: 9430/1: entry: Do a dummy read from\nVMAP shadow\") added a dummy read from the KASAN VMAP stack shadow in\n__switch_to(). The read uses ldr, but the KASAN shadow address is\nbyte-granular and is not guaranteed to be word aligned.\n\nARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and\nCONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to()\nwith an alignment exception before reaching init.\n\nUse ldrb for the dummy shadow access. The code only needs to fault in the\nshadow mapping if the stack shadow is missing, so a byte load is sufficient\nand matches the granularity of KASAN shadow memory.\n\nFixes: 44e9a3bb76e5 (\"ARM: 9430/1: entry: Do a dummy read from VMAP shadow\")\nCc: stable@vger.kernel.org # v6.13+\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "d59ed803715a71fb9582e139d648ece8d66dc743", "tree": "2459a5d66d333bcbe24441af8ca49f7c28f87784", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Sun May 24 06:52:36 2026 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Thu Jun 11 14:52:00 2026 +0100" }, "message": "ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O\n\nFor CPUs before ARMv6, __raw_readw() and __raw_writew() are implemented\nas C volatile halfword accesses so the compiler can generate an access\nsequence that is safe for those machines. With KASAN enabled, those C\naccesses are instrumented as normal memory accesses.\n\nThat is not valid for MMIO. On ARM926/VersatilePB with KASAN enabled,\nPL011 probing traps in __asan_store2() while registering the UART, because\nthe instrumented writew() tries to check KASAN shadow for an MMIO address.\n\nKeep the existing volatile halfword access, but move the ARMv5 definitions\ninto __no_kasan_or_inline functions so raw MMIO halfword accesses are not\ninstrumented by KASAN. The ARMv6-and-newer inline assembly path is\nunchanged.\n\nFixes: 421015713b30 (\"ARM: 9017/2: Enable KASan for ARM\")\nCc: stable@vger.kernel.org # v5.11+\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "347ccc0453fca2c669e8dc8a72000e76ca4adf10", "tree": "092779b1e82f7b088e379c4179af4bd7c7831156", "parents": [ "ba36786b21d19082e696eda85bfcd49e7071944a" ], "author": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Jun 10 11:25:49 2026 -0400" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Thu Jun 11 06:39:43 2026 -0700" }, "message": "drm/xe: fix job timeout recovery for unstarted jobs and kernel queues\n\nA job that GuC never scheduled (never started) indicates a GuC\nscheduling failure; previously such jobs were silently errored out\ninstead of triggering a GT reset to recover. Trigger a GT reset and\nresubmit them, but only when the queue was not already killed or banned:\nan unstarted job on an already banned queue is the ban working as\nintended and must neither clear the ban nor kick off a reset, otherwise\na banned userspace queue could be resurrected and spam GT resets.\n\nKernel queues are always recovered this way and wedge the device once\nrecovery attempts are exhausted, since kernel work must not silently\nfail. A started job that times out on a userspace VM bind queue stays\nbanned rather than being reset and retried.\n\nThe queue is banned early in the timeout handler to signal the G2H\nscheduling-done handler so it wakes the disable-scheduling waiter;\nwithout it the waiter sleeps the full 5s timeout. When a reset is\nwarranted the ban is cleared before rearming so that\nguc_exec_queue_start() can resubmit jobs after the GT reset - a\nstill-banned queue would block resubmission and cause an infinite TDR\nloop. The already-banned case is gated out before this point via\nskip_timeout_check, so it is unaffected.\n\nv2: (Himal) Do it for any queue type, not just kernel/migration\nv3: - (Sashiko and Sanjay): don\u0027t clear the ban / GT reset for already\n killed/banned queues on unstarted-job timeout\n - Update commit message\n - (Matt) Add Fixes tag\n\nFixes: fe05cee4d953 (\"drm/xe: Don\u0027t short circuit TDR on jobs not started\")\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nCc: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nAssisted-by: GitHub-Copilot:claude-sonnet-4.6\nAssisted-by: GitHub-Copilot:claude-opus-4.8\nTested-by: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nReviewed-by: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nLink: https://patch.msgid.link/20260610152548.404575-3-rodrigo.vivi@intel.com\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n(cherry picked from commit b1107d085e7e8ed15ba6f80c102528a9c8a6cb0e)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "ba36786b21d19082e696eda85bfcd49e7071944a", "tree": "4c7fb38d4903c3cc758fac88447962d09b14ecb2", "parents": [ "e4aaac46593733a06ec1a1f1a63128206d67fcaa" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Wed Jun 10 10:27:05 2026 -0700" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Thu Jun 11 06:39:40 2026 -0700" }, "message": "drm/xe: fix refcount leak in xe_range_fence_insert()\n\nxe_range_fence_insert() acquires a reference on fence via\ndma_fence_get() and stores it in rfence-\u003efence. It then calls\ndma_fence_add_callback() and handles two cases: when the callback\nis successfully registered (err \u003d\u003d 0) the fence is transferred to\nthe tree for later cleanup; when the fence is already signaled\n(err \u003d\u003d -ENOENT) it manually drops the extra reference with\ndma_fence_put(fence).\n\nHowever, dma_fence_add_callback() can fail with other errors\n(e.g. -EINVAL) and in that case the code falls through to the free:\nlabel without releasing the acquired reference, leaking it.\n\nFix the leak by adding an else branch that calls dma_fence_put()\nbefore jumping to free: for any error other than -ENOENT.\n\nFixes: 845f64bdbfc9 (\"drm/xe: Introduce a range-fence utility\")\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com\n(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "6f25e0da2951c90af2d4c2b458eeee96a98427dc", "tree": "7ac195ba315309240a77062c556950afc7a5dce3", "parents": [ "51706e724b9e74874658f32243a32fe17ee07613" ], "author": { "name": "Eric Biggers", "email": "ebiggers@google.com", "time": "Wed May 20 18:26:25 2026 +0000" }, "committer": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Thu Jun 11 06:06:14 2026 -0700" }, "message": "ANDROID: GKI: Enable crc_kunit and more crypto KUnit tests\n\nEnable crc_kunit and some recently-added crypto tests. The code tested\nby these tests is already enabled in gki_defconfig.\n\nTest: adb root; kernel/tests/tools/run_test_only.sh -s 0.0.0.0:6520 \\\n -t kunit:crc_kunit \\\n -t kunit:aes_cbc_macs_kunit \\\n -t kunit:chacha20poly1305_kunit \\\n -t kunit:ghash_kunit \\\n -t kunit:nh_kunit \\\n -td ~/src/android-mainline/out/virtual_device_x86_64/dist/tests.zip\nBug: 486247481\nChange-Id: Ia83cf8c6a49bd5fac1fd763342825316535b5694\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\n" }, { "commit": "7360b96099806396f4ce15233f6dddcb69248d34", "tree": "0d26fe1f8292949f5da3727d3500f37b5f22046f", "parents": [ "64ced6c0882756db52cbedf50bc66338de4a4045" ], "author": { "name": "Kiran Kumar K", "email": "kirankumark@marvell.com", "time": "Mon Jun 08 15:24:55 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:59:34 2026 +0200" }, "message": "octeontx2-af: fix IP fragment flag corruption on custom KPU profile load\n\nnpc_cn20k_apply_custom_kpu() overwrites KPU profile entries with custom\nfirmware values and then calls npc_cn20k_update_action_entries_n_flags()\nover all entries. Since the same function already ran during default\nprofile initialisation, entries not overridden by the custom firmware\nget their flags translated twice, corrupting the CN20K-specific values.\n\nFix this by extracting the per-entry translation into a helper\nnpc_cn20k_translate_action_flags() and calling it as each custom entry\nis loaded, removing the redundant batch call at the end.\n\nFixes: ef992a0f12e8 (\"octeontx2-af: npc: cn20k: MKEX profile support\")\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nSigned-off-by: Kiran Kumar K \u003ckirankumark@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260608095455.1499203-1-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "64ced6c0882756db52cbedf50bc66338de4a4045", "tree": "e367659ac44fc0518a60896bec81e60840fa6755", "parents": [ "29899ec61ac6fcc9d46f5f8d0b72117d9a676c2e", "c7d573551f9286100a055ef696cde6af54549677" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:29:59 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:30:00 2026 +0200" }, "message": "Merge tag \u0027nf-26-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) Revalidate bridge ports, add missing NULL checks to fetch the bridge\n device by the port. From Florian Westphal.\n\n2) Fix netdevice refcount leak in the error path of nft_fwd hardware\n offload function, also from Florian.\n\n3) Unregister helper expectfn callback on conntrack helper module\n removal, otherwise dangling pointer remains in place,\n from Weiming Shi.\n\n4) Fix possible pointer infoleak in getsockopt() IPT_SO_GET_ENTRIES,\n From Kyle Zeng.\n\n5) Validate that device MAC header is present before nf_syslog\n accesses it. From Xiang Mei.\n\n6-8) Three patches to address a possible infoleak of stale stack\n data in three nf_tables expressions, due to mismatch in the\n _init() and _eval() function which is possible since 14fb07130c7d.\n From Davide Ornaghi and Florian Westphal.\n\nnetfilter pull request 26-06-10\n\n* tag \u0027nf-26-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n netfilter: nf_log: validate MAC header was set before dumping it\n netfilter: x_tables: avoid leaking percpu counter pointers\n netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n netfilter: nf_tables_offload: drop device refcount on error\n netfilter: revalidate bridge ports\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260610161629.214092-1-pablo@netfilter.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6ad3914e06a48a02e362d0df2b1073c7c567c93d", "tree": "b650bd7c92e779976173b5b0bf2b6c22e96cd0e1", "parents": [ "310628484ef06f95c5589374fade917a5689787b" ], "author": { "name": "Li Jun", "email": "lijun01@kylinos.cn", "time": "Thu Jun 11 09:00:45 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jun 11 11:21:24 2026 +0100" }, "message": "ASoC: loongson: Fix invalid position error in ls_pcm_pointer\n\nThe \"invalid position\" error occurred when the DMA position descriptor\nreturned an invalid address value (e.g., pos \u003d -1048838144). This happened\nbecause the `bytes_to_frames()` function returns a signed value, but when\n`addr \u003c runtime-\u003edma_addr`, the subtraction produces a negative result that\ngets interpreted as a large unsigned integer in comparisons.\nwhen the addr is abnormal, for example,the DMA controller is abnormal in\nhardware,x\u003d0 should not be a point(x \u003d\u003d runtime-\u003ebuffer_size),but a range,\nwhich includes the addr address being less than runtime -\u003edma1-adr, and\nthe addr exceeding the DMA address range.the value of pos should not better\na negative，return 0, maybe better.\n\n[ 32.834431][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.845019][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.855588][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.866145][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 32.995394][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 33.006025][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[ 33.016748][ 2] soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n\nSigned-off-by: Li Jun \u003clijun01@kylinos.cn\u003e\n[Remove XRUN reporting I\u0027d mistakenly avised adding on prior review -- broonie]\nLink: https://patch.msgid.link/20260611010045.3668574-1-lijun01@kylinos.cn\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "29899ec61ac6fcc9d46f5f8d0b72117d9a676c2e", "tree": "ab82359e5c0d7089f7fceaa8a065b7736927e3b1", "parents": [ "b70c687b7cf267fb08586667a3946c8851cad672", "26aad08a928901296aabfbc7a33ecb951656bb98" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:00:49 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 12:00:49 2026 +0200" }, "message": "Merge tag \u0027ipsec-2026-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-06-10\n\n1) xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n Propagate SKBFL_SHARED_FRAG when paged fragments are moved between\n skbs so ESP can decide whether in-place crypto is safe.\n\n2) xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload\n Replace the unlocked read of xtfs-\u003era_newskb with a local flag so a\n concurrent reassembly can no longer free first_skb between\n spin_unlock and the post-loop check.\n\n3) xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n Prune the inexact bin under xfrm_policy_lock so a concurrent\n xfrm_hash_rebuild() can no longer free it before xfrm_policy_kill()\n dereferences it.\n\n4) xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n Move hrtimer_cancel() for the output and drop timers ahead of their\n spinlocks, breaking the softirq/lock cycle that could deadlock\n against the timer callbacks on SMP.\n\n5) xfrm: espintcp: do not reuse an in-progress partial send\n Fail a new send when espintcp_push_msgs() returns with emsg-\u003elen\n still set, so a blocking caller can no longer overwrite ctx-\u003epartial\n while a previous transfer still owns it.\n\n6) esp: fix page frag reference leak on skb_to_sgvec failure\n Add a flag to esp_ssg_unref() to unconditionally unref the source\n scatterlist, releasing the old page references that are otherwise\n leaked when the second skb_to_sgvec() in esp_output_tail() fails.\n\nPlease pull or let me know if there are problems.\n\nipsec-2026-06-10\n\n* tag \u0027ipsec-2026-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n esp: fix page frag reference leak on skb_to_sgvec failure\n xfrm: espintcp: do not reuse an in-progress partial send\n xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload\n xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260610140800.2562818-1-steffen.klassert@secunet.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b70c687b7cf267fb08586667a3946c8851cad672", "tree": "39c7bed2d853db117c8467e216891b644ea9ee62", "parents": [ "0068940907d33217ae01217f84910a5cde606c17" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Tue Jun 09 17:54:48 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 11:57:11 2026 +0200" }, "message": "ipv6: Fix a potential NPD in cleanup_prefix_route()\n\naddrconf_get_prefix_route() can return the fib6_null_entry sentinel\nentry which has a NULL fib6_table pointer. Therefore, before setting the\nroute\u0027s expiration time, check that we are not working with this entry,\nas otherwise a NPD will be triggered [1].\n\nNote that the other callers of addrconf_get_prefix_route() are not\nsusceptible to this bug:\n\n1. addrconf_prefix_rcv(): Requests a route with the \u0027RTF_ADDRCONF |\n RTF_PREFIX_RT\u0027 flags which are not set on fib6_null_entry.\n\n2. modify_prefix_route(): Fixed by commit a747e02430df (\"ipv6: avoid\n possible NULL deref in modify_prefix_route()\").\n\n3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for\n fib6_null_entry and returns an error.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[...]\nCall Trace:\n\u003cTASK\u003e\n__kasan_check_byte (mm/kasan/common.c:573)\nlock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1))\n_raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1))\ncleanup_prefix_route (net/ipv6/addrconf.c:1280)\nipv6_del_addr (net/ipv6/addrconf.c:1342)\ninet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119)\ninet6_rtm_deladdr (net/ipv6/addrconf.c:4812)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6997)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2555)\nnetlink_unicast (net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1899)\n__sock_sendmsg (net/socket.c:802 (discriminator 4))\n____sys_sendmsg (net/socket.c:2698)\n___sys_sendmsg (net/socket.c:2752)\n__sys_sendmsg (net/socket.c:2784)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nFixes: 5eb902b8e719 (\"net/ipv6: Remove expired routes with a separated list of routes.\")\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nReviewed-by: David Ahern \u003cdahern@nvidia.com\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260609145448.768318-1-idosch@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0068940907d33217ae01217f84910a5cde606c17", "tree": "aa2ce14e471e9d7d586d306e7e1cad4466719489", "parents": [ "b59873c9c40d0cbc16df86cf6cb5430330a0ac74", "47f848aac4e79bdb197f849fa86e71fff1ad36ef" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:15 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:16 2026 +0200" }, "message": "Merge branch \u0027net-txgbe-fix-module-identification\u0027\n\nJiawen Wu says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: txgbe: fix module identification\n\nFor AML devices, there are some issues where the wrong module\nindentified then configure PHY failed.\n\nThe module info buffers should be initialized to 0 before the firmware\nreturns information. And DECLARE_PHY_INTERFACE_MASK() does not guarantee\nzeroed contents, so explicitly clear the temporary interface masks before\nsetting supported interfaces.\n\nRework txgbe_identify_module() to validate module identifiers through\nexplicit type checks instead of relying on transceiver_type heuristics.\nWhen using the SFP module, transceiver_type could be a random value,\nbecause it was read from an invalid register.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260608070842.36504-1-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47f848aac4e79bdb197f849fa86e71fff1ad36ef", "tree": "aa2ce14e471e9d7d586d306e7e1cad4466719489", "parents": [ "f2df54ddbfb04a006ee326a5d8270434a414e0af" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Jun 08 15:08:42 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:14 2026 +0200" }, "message": "net: txgbe: initialize PHY interface to 0\n\nDECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents. Add a\nnew macro DECLARE_PHY_INTERFACE_MASK_ZERO(), make the stack variable to\nbe zeroed before setting supported interfaces.\n\nFixes: 57d39faed4c9 (\"net: txgbe: improve functions of AML 40G devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-4-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f2df54ddbfb04a006ee326a5d8270434a414e0af", "tree": "c324685962425d4260e8e82d6284466bf54d671f", "parents": [ "0487cfca46517ff6699c72dc1a8872b0af3c31a9" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Jun 08 15:08:41 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:14 2026 +0200" }, "message": "net: txgbe: distinguish module types by checking identifier\n\nRework txgbe_identify_module() to validate module identifiers through\nexplicit type checks instead of relying on transceiver_type heuristics.\nWhen using the SFP module, transceiver_type could be a random value,\nbecause it was read from an invalid register.\n\nFixes: 57d39faed4c9 (\"net: txgbe: improve functions of AML 40G devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-3-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0487cfca46517ff6699c72dc1a8872b0af3c31a9", "tree": "d6b994cf0f085cd66054d5fd0265b8c54bd4c7b5", "parents": [ "b59873c9c40d0cbc16df86cf6cb5430330a0ac74" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Jun 08 15:08:40 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 10:55:14 2026 +0200" }, "message": "net: txgbe: initialize module info buffer\n\nThe module info buffer should be initialized to 0 before the firmware\nreturns information. Otherwise, there is a risk that the buffer field\nnot filled by the firmware is random value.\n\nFixes: 343929799ace (\"net: txgbe: Support to handle GPIO IRQs for AML devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-2-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b59873c9c40d0cbc16df86cf6cb5430330a0ac74", "tree": "b0eb340983a1a9528d273b170e237255f038c236", "parents": [ "512db8267b73a220a64180d95ab5eebe7c4964a8", "77a6b90ce56bc982dcfa94229b8e28e6abb16e95" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:33 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:33 2026 +0200" }, "message": "Merge branch \u0027net-mvpp2-fix-xdp-rx-buffer-handling\u0027\n\nTil Kaiser says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mvpp2: fix XDP RX buffer handling\n\nThis is v5 of the earlier XDP_PASS fix. The XDP_PASS change is\nretained, and the series also fixes related RX/XDP buffer handling\nissues found during review.\n\nTested with tools/testing/selftests/drivers/net/xdp.py on mvpp2\nhardware.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260607134943.21996-1-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "77a6b90ce56bc982dcfa94229b8e28e6abb16e95", "tree": "b0eb340983a1a9528d273b170e237255f038c236", "parents": [ "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:43 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: build skb from XDP-adjusted data on XDP_PASS\n\nWhen an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail()\nand then returns XDP_PASS, mvpp2 still builds the skb from fixed offsets\nderived from the original RX descriptor. Packet geometry changes made by\nthe XDP program are therefore discarded before the skb reaches the stack.\n\nUpdate rx_offset and rx_bytes from xdp.data and xdp.data_end for\nXDP_PASS. This makes skb_reserve() and skb_put() reflect the packet seen\nby XDP, and makes RX byte accounting for XDP_PASS follow the length of the\nskb passed to the network stack.\n\nKeep a separate rx_sync_size for page-pool recycling on skb allocation\nfailure, which must stay tied to the received buffer range.\n\nNon-PASS verdicts continue to account the descriptor length because no skb\nis passed up in those cases.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-5-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6", "tree": "adb0381ccb32e0e21023ba87db46fa17078dfb79", "parents": [ "f3c6aa078927e6fe8121c9c591ddee8716c5305a" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:42 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: refill RX buffers before XDP or skb use\n\nThe RX error path returns the current descriptor buffer to the hardware\nBM pool. That is only valid while the driver still owns the buffer.\n\nmvpp2_rx_refill() can fail after the current buffer has been handed to\nXDP or attached to an skb. In those cases mvpp2_run_xdp() may have\nrecycled, redirected, or queued the page for XDP_TX, and an skb free also\nretires the data buffer. Returning such a buffer to BM lets hardware DMA\ninto memory that is no longer owned by the RX ring.\n\nRefill the BM pool before handing the current buffer to XDP or to the\nskb. If the allocation fails there, drop the packet and return the\nstill-owned current buffer to BM, preserving the pool depth. Once the\nrefill succeeds, later local drops retire/free the current buffer instead\nof returning it to BM.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nFixes: d6526926de73 (\"net: mvpp2: fix memory leak in mvpp2_rx\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-4-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f3c6aa078927e6fe8121c9c591ddee8716c5305a", "tree": "1c280e4029f2d969be34e95055b03c9791b4492e", "parents": [ "180235600934bef6add3be637c296d6cf3272e67" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:41 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: limit XDP frame size to the RX buffer\n\nmvpp2 has short and long BM pools, and short pool buffers can be smaller\nthan PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with\nPAGE_SIZE as frame size.\n\nXDP helpers use frame_sz to validate tail growth and to derive the hard\nend of the data area. Advertising PAGE_SIZE for short buffers can let\nbpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting\nmemory or later tripping skb tailroom checks.\n\nInitialize the XDP buffer with bm_pool-\u003efrag_size so XDP tailroom matches\nthe actual buffer backing the packet.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "180235600934bef6add3be637c296d6cf3272e67", "tree": "ecb9855b324d5a209827608ae91fc302d3d85901", "parents": [ "512db8267b73a220a64180d95ab5eebe7c4964a8" ], "author": { "name": "Til Kaiser", "email": "mail@tk154.de", "time": "Sun Jun 07 15:49:40 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 11 09:57:31 2026 +0200" }, "message": "net: mvpp2: sync RX data at the hardware packet offset\n\nmvpp2 programs the RX queue packet offset, so hardware writes received\ndata at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at\ndma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the\nunused headroom and misses the same number of bytes at the packet tail.\n\nOn non-coherent DMA systems this can leave the CPU reading stale cache\ncontents for the end of the received frame.\n\nUse dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range\noffset so the sync covers the Marvell header and packet data actually\nwritten by hardware.\n\nFixes: e1921168bbd4 (\"mvpp2: sync only the received frame\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-2-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9716c086c8e8b141d35aa61f2e96a2e83de212a7", "tree": "918331b178b771fa02019c3fc60c8da519c22ddf", "parents": [ "767622308a1d8b111038fca0059b964da1f6d9c4", "6100a82e34cb75571feba920a9c18f60698d598a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 11:53:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 11:53:55 2026 -0700" }, "message": "Merge tag \u0027pm-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These address some remaining fallout after introducing dynamic EPP\n support in the amd-pstate driver during the current development cycle:\n\n - Restore allowing writing EPP of 0 when in performance mode in the\n amd-pstate driver which was unnecessarily disallowed by one of the\n recent updates (Mario Limonciello)\n\n - Remove stale documentation of the epp_cached field in struct\n amd_cpudata that has been dropped recently (Zhan Xusheng)\"\n\n* tag \u0027pm-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq/amd-pstate: Fix setting EPP in performance mode\n cpufreq/amd-pstate: drop stale @epp_cached kdoc\n" }, { "commit": "e4aaac46593733a06ec1a1f1a63128206d67fcaa", "tree": "8544b7271c0230c1b1008acd1ad26e0d925db736", "parents": [ "381b3576a87f4ed6e76adb78d7d9400428f8f4b7" ], "author": { "name": "Tangudu Tilak Tirumalesh", "email": "tilak.tirumalesh.tangudu@intel.com", "time": "Mon Jun 08 21:57:44 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:29 2026 -0700" }, "message": "drm/xe: include all registered queues in TLB invalidation\n\nContext-based TLB invalidation currently selects only scheduling-active\nexec queues via q-\u003eops-\u003eactive(). During rebind flows, queues may be\nsuspended (or transitioning through resume) while still owning valid\ntranslations, causing them to be skipped from invalidation and leading\nto missed TLB invalidations on LR rebinds.\n\nThe underlying issue is a TOCTOU: q-\u003eguc-\u003estate bits are flipped lock-free\nfrom enable_scheduling(), disable_scheduling{,_deregister}(), the\nsuspend/resume sched-msg handlers, handle_sched_done(), and\nguc_exec_queue_stop(); nothing in send_tlb_inval_ctx_ppgtt() serializes\nagainst them, so any state-based predicate can race.\n\nInclude all the registered queues so that TLB invalidations are not\nmissed. This is race-free because list membership on vm-\u003eexec_queues.list\nis stable under vm-\u003eexec_queues.lock held by the caller. The performance\nimpact is expected to be minimal and harmless. If it does turn out to be\na concern, we can come back with a race-safe solution to ignore certain\nqueues.\n\nFixes: 6cdaa5346d6f (\"drm/xe: Add context-based invalidation to GuC TLB invalidation backend\")\nAssisted-by: Claude:claude-opus-4.6\nSuggested-by: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nSigned-off-by: Tangudu Tilak Tirumalesh \u003ctilak.tirumalesh.tangudu@intel.com\u003e\nReviewed-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260608162745.338725-2-tilak.tirumalesh.tangudu@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit aa625e1e9f0710e424fe4f0e3f032807df81b5b0)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "381b3576a87f4ed6e76adb78d7d9400428f8f4b7", "tree": "6a6ef436b54ca5037ee139ecafd77e7fe2b119e5", "parents": [ "3e3f5b0c5ae6845b4d8d23f079e872635cd8b0ae" ], "author": { "name": "Raag Jadav", "email": "raag.jadav@intel.com", "time": "Tue Jun 02 10:18:44 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:25 2026 -0700" }, "message": "drm/xe/hw_error: Use HW_ERR prefix in log\n\nHardware errors should be logged with HW_ERR prefix. Make them\nconsistent with existing logs.\n\nFixes: 01aab7e1c9d4 (\"drm/xe/xe_hw_error: Add support for PVC SoC errors\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-5-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit ad60a618c49fef07d1860bfb1091140d29f5eddb)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "3e3f5b0c5ae6845b4d8d23f079e872635cd8b0ae", "tree": "16a72ad3985e16f0d23c9a636606bb86438be4c7", "parents": [ "4dcfcdc9fbb5efef21e149adf349d42d84c9da04" ], "author": { "name": "Raag Jadav", "email": "raag.jadav@intel.com", "time": "Tue Jun 02 10:18:43 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:22 2026 -0700" }, "message": "drm/xe/drm_ras: Add per node cleanup action\n\ncleanup_node_param() is not registered for previous node in case of counter\nallocation failure, which results in stale memory of previous node that\nisn\u0027t cleaned up on unwind. Add per node cleanup action which guarantees\ncleanup on unwind and also simplifies the cleanup logic.\n\nFixes: b40db12b542f (\"drm/xe/xe_drm_ras: Add support for XE DRM RAS\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-4-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 67fc5543d8274b2fcbef87734fad0469358f4478)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "4dcfcdc9fbb5efef21e149adf349d42d84c9da04", "tree": "d83dccc2072546a25d046b7d72c36321cadcdb66", "parents": [ "68938cc08e23a94fd881e845837ff918de005ce7" ], "author": { "name": "Raag Jadav", "email": "raag.jadav@intel.com", "time": "Tue Jun 02 10:18:42 2026 +0530" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:18 2026 -0700" }, "message": "drm/xe/drm_ras: Make counter allocation drm managed\n\ncleanup_node_param() is not registered for previous node in case of counter\nallocation failure, which results in stale memory of previous node that\nisn\u0027t cleaned up on unwind. Fix this using drm managed allocation, which is\nguaranteed to be cleaned up on unwind.\n\nFixes: b40db12b542f (\"drm/xe/xe_drm_ras: Add support for XE DRM RAS\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-3-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 58d77c77ea0c5cb2b755ebe23e973c8272acd896)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "68938cc08e23a94fd881e845837ff918de005ce7", "tree": "333af8b83be098430cb8576342f728825a4be97e", "parents": [ "4549871118cf616eecdd2d939f78e3b9e1dddc48" ], "author": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Fri May 15 19:09:20 2026 +0300" }, "committer": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jun 10 09:33:09 2026 -0700" }, "message": "drm/xe/display: fix oops in suspend/shutdown without display\n\nThe xe driver keeps track of whether to probe display, and whether\ndisplay hardware is there, using xe-\u003einfo.probe_display. It gets set to\nfalse if there\u0027s no display after intel_display_device_probe(). However,\nthe display may also be disabled via fuses, detected at a later time in\nintel_display_device_info_runtime_init().\n\nIn this case, the xe driver does for_each_intel_crtc() on uninitialized\nmode config in xe_display_flush_cleanup_work(), leading to a NULL\npointer dereference, and generally calls display code with display info\ncleared.\n\nCheck for intel_display_device_present() after\nintel_display_device_info_runtime_init(), and reset\nxe-\u003einfo.probe_display as necessary. Also do unset_display_features()\nfor completeness, although display runtime init has already done\nthat. This will need to be unified across all cases later.\n\nMove intel_display_device_info_runtime_init() call slightly earlier,\nsimilar to i915, to avoid a bunch of unnecessary setup for no display\ncases.\n\nNote #1: The xe driver has no business doing low level display plumbing\nlike for_each_intel_crtc() to begin with. It all needs to happen in\ndisplay code.\n\nNote #2: The actual bug is present already in commit 44e694958b95\n(\"drm/xe/display: Implement display support\"), but the oops was likely\nintroduced later at commit ddf6492e0e50 (\"drm/xe/display: Make display\nsuspend/resume work on discrete\").\n\nFixes: 44e694958b95 (\"drm/xe/display: Implement display support\")\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7904\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/6150\nCc: stable@vger.kernel.org # v6.8+\nReviewed-by: Suraj Kandpal \u003csuraj.kandpal@intel.com\u003e\nLink: https://patch.msgid.link/20260515160920.1082842-1-jani.nikula@intel.com\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n(cherry picked from commit 7c3eb9f47533220888a67266448185fd0775d4da)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n" }, { "commit": "51706e724b9e74874658f32243a32fe17ee07613", "tree": "ba29330e9c02c6329efdef6a50b605c7c9e271a1", "parents": [ "58fc570165e1e356d3ee35d61c447c3d85cbcf14", "acb7500801e98639f6d8c2d796ed9f64cba83d3a" ], "author": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Wed Jun 10 16:23:56 2026 +0000" }, "committer": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Wed Jun 10 16:23:56 2026 +0000" }, "message": "Merge acb7500801e9 (\"Merge tag \u0027trace-rv-v7.1-rc6-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\") into android-mainline\n\nSteps on the way to v7.1-rc8\n\nChange-Id: Id738bb2246a318f6efdc5433896fb8e0306f5ecf\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\n" }, { "commit": "c7d573551f9286100a055ef696cde6af54549677", "tree": "3b55982a657bd6eaadfa6632b3acc0ec7c1f8dc4", "parents": [ "ab185e0c4fb82dfba6fb86f8271e06f931d9c64c" ], "author": { "name": "Davide Ornaghi", "email": "d.ornaghi97@gmail.com", "time": "Wed Jun 10 12:39:13 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:32 2026 +0200" }, "message": "netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n\nNFT_META_BRI_IIFHWADDR declares its destination register with\nlen \u003d ETH_ALEN (6 bytes), which the register-init tracking rounds up to\ntwo 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does\nmemcpy(dest, br_dev-\u003edev_addr, ETH_ALEN), writing only 6 bytes and\nleaving the upper 2 bytes of the second register as uninitialised\nnft_do_chain() stack. A downstream load of that register span leaks\nthose stale bytes to userspace.\n\nZero the second register before the memcpy so the full declared span is\nwritten.\n\nFixes: cbd2257dc96e (\"netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Davide Ornaghi \u003cd.ornaghi97@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "ab185e0c4fb82dfba6fb86f8271e06f931d9c64c", "tree": "fe4753675107e422020c0706b4ef3453286bef14", "parents": [ "772cecf198da732faebb5dcfc46d66a505be8495" ], "author": { "name": "Davide Ornaghi", "email": "d.ornaghi97@gmail.com", "time": "Wed Jun 10 12:39:12 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:19 2026 +0200" }, "message": "netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n\nFor NFT_FIB_RESULT_OIFNAME the destination register is declared with\nlen \u003d IFNAMSIZ (four 32-bit registers), but on the lookup-fail,\nRTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one\nregister via \"*dest \u003d 0\". The remaining three registers are left as\nwhatever was on the stack in nft_do_chain()\u0027s struct nft_regs, and a\ndownstream expression that loads the register span can leak that\nuninitialised kernel stack to userspace.\n\nThe NFTA_FIB_F_PRESENT existence check has the same shape: it is only\nmeaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type\nwhile the eval stores a single byte via nft_reg_store8(), leaving the rest\nof the declared span stale.\n\nFix both:\n\n - replace the bare \"*dest \u003d 0\" in the eval with nft_fib_store_result(),\n which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already\n used on the other early-return path), and\n\n - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its\n destination as a single u8, so the marked span matches the one byte\n the eval writes.\n\nFixes: f6d0cbcf09c5 (\"netfilter: nf_tables: add fib expression\")\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Davide Ornaghi \u003cd.ornaghi97@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "772cecf198da732faebb5dcfc46d66a505be8495", "tree": "477ccc145bc5973aa7d806445cd8e4f6b38a0b4c", "parents": [ "a84b6fedbc97078788be78dbdd7517d143ad1a77" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Jun 09 21:28:09 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:12 2026 +0200" }, "message": "netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n\nnft_exthdr_init() passes user-controlled priv-\u003elen to\nnft_parse_register_store(), which marks that many bytes in the\nregister bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT\nis set, the eval paths write only 1 byte (nft_reg_store8) or\n4 bytes (*dest \u003d 0 on TCP/DCCP error path). When len \u003e 4,\nregisters beyond the first are never written, retaining\nuninitialized stack data from nft_regs.\n\nBail out if userspace requests too much data when F_PRESENT is set.\n\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nFixes: c078ca3b0c5b (\"netfilter: nft_exthdr: Add support for existence check\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "a84b6fedbc97078788be78dbdd7517d143ad1a77", "tree": "b949480e102f10fa258f524b96b607699c7151c6", "parents": [ "f7f2fbb0e893a0238dc464f8d8c0f5609bec584f" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Tue Jun 09 15:55:02 2026 -0700" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 18:00:01 2026 +0200" }, "message": "netfilter: nf_log: validate MAC header was set before dumping it\n\nThe fallback path of dump_mac_header() guards the MAC header access\nonly with \"skb-\u003emac_header !\u003d skb-\u003enetwork_header\", without checking\nskb_mac_header_was_set(). When the MAC header is unset, mac_header is\n0xffff, so the test passes and skb_mac_header(skb) returns\nskb-\u003ehead + 0xffff, ~64 KiB past the buffer; the loop then reads\ndev-\u003ehard_header_len bytes out of bounds into the kernel log.\n\nThis is reachable via the netdev logger: nf_log_unknown_packet() calls\ndump_mac_header() unconditionally, and an skb sent through AF_PACKET\nwith PACKET_QDISC_BYPASS reaches the egress hook with mac_header still\nunset (__dev_queue_xmit(), which would reset it, is bypassed).\n\nAdd the skb_mac_header_was_set() check the ARPHRD_ETHER path already\nuses, and replace the open-coded MAC header length test with\nskb_mac_header_len(). Only skbs with an unset MAC header are affected;\nvalid ones are dumped as before.\n\n BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831)\n Read of size 1 at addr ffff88800ea49d3f by task exploit/148\n Call Trace:\n kasan_report (mm/kasan/report.c:595)\n dump_mac_header (net/netfilter/nf_log_syslog.c:831)\n nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963)\n nf_log_packet (net/netfilter/nf_log.c:260)\n nft_log_eval (net/netfilter/nft_log.c:60)\n nft_do_chain (net/netfilter/nf_tables_core.c:285)\n nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307)\n nf_hook_slow (net/netfilter/core.c:619)\n nf_hook_direct_egress (net/packet/af_packet.c:257)\n packet_xmit (net/packet/af_packet.c:280)\n packet_sendmsg (net/packet/af_packet.c:3114)\n __sys_sendto (net/socket.c:2265)\n\nFixes: 7eb9282cd0ef (\"netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "f7f2fbb0e893a0238dc464f8d8c0f5609bec584f", "tree": "e2886b33a6821900694c7e4fc017a6a89c360de1", "parents": [ "c3009418f9fa1dcb3eb86f4d8c92583537b5faa3" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Sat Jun 06 01:10:31 2026 -0700" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:59:01 2026 +0200" }, "message": "netfilter: x_tables: avoid leaking percpu counter pointers\n\nThe native and compat get-entries paths copy the fixed rule entry header\nfrom the kernelized rule blob to userspace before overwriting the entry\u0027s\ncounter fields with a sanitized counter snapshot.\n\nOn SMP kernels, entry-\u003ecounters.pcnt contains the percpu allocation\naddress used by x_tables rule counters. A caller can provide a userspace\nbuffer that faults during the initial fixed-header copy after pcnt has\nbeen copied but before the later sanitized counter copy runs. The syscall\nthen returns -EFAULT while leaving the raw percpu pointer in userspace.\n\nCopy only the fixed entry prefix before counters from the kernelized rule\nblob, then copy the sanitized counter snapshot into the counter field.\nApply this ordering to the IPv4, IPv6, and ARP native and compat\nget-entries implementations so a fault cannot expose the internal percpu\ncounter pointer.\n\nFixes: 71ae0dff02d7 (\"netfilter: xtables: use percpu rule counters\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "c3009418f9fa1dcb3eb86f4d8c92583537b5faa3", "tree": "8ab258ae3560c0e20835e1745b54c9a9aa886bf3", "parents": [ "efc542561729a2859397dad51bda1fe41262beb1" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Wed Jun 03 00:38:17 2026 -0700" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:58:39 2026 +0200" }, "message": "netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp-\u003eexpectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp-\u003eexpectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp-\u003eexpectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n nf_hook_slow (net/netfilter/core.c:619)\n __ip_local_out (net/ipv4/ip_output.c:120)\n __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n tcp_connect (net/ipv4/tcp_output.c:4374)\n tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose -\u003eexpectfn matches the descriptor being torn\ndown. Call it from each NAT helper\u0027s exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops.\n\nFixes: f587de0e2feb (\"[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "efc542561729a2859397dad51bda1fe41262beb1", "tree": "2bb16a7ee4276bb9c7d2905291e42b5cee73b3c6", "parents": [ "ccb9fd4b87538ccf19ccff78ee26700526d94867" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Fri Jun 05 13:47:12 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:58:29 2026 +0200" }, "message": "netfilter: nf_tables_offload: drop device refcount on error\n\nReported by sashiko:\nIf nft_flow_action_entry_next() returns NULL, dev reference leaks.\n\nFixes: c6f85577584b (\"netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it\")\nReported-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "ccb9fd4b87538ccf19ccff78ee26700526d94867", "tree": "85002bc68f328b5d7c414d4157689881fa3d000f", "parents": [ "4aacf509e537a711fa71bca9f234e5eb6968850e" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Jun 02 17:04:25 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jun 10 17:58:20 2026 +0200" }, "message": "netfilter: revalidate bridge ports\n\nebt_redirect_tg() dereferences br_port_get_rcu() return without a\nNULL check, causing a kernel panic when the bridge port has been\nremoved between the original hook invocation and an NFQUEUE\nreinject.\n\nA mere NULL check isn\u0027t sufficient, however. As sashiko review\npoints out userspace can not only remove the port from the bridge,\nit could also place the device in a different virtual device, e.g.\nmacvlan.\n\nIf this happens, we must drop the packet, there is no way for us to\nreinject it into the bridge path.\n\nSwitch to _upper API, we don\u0027t need the bridge port structure.\nAlso, this fix keeps another bug intact:\n\nBoth nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER\ntoo aggressive, which prevents certain logging features when queueing\nin bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old\nCONFIG_BRIDGE_NETFILTER cruft is off.\n\nFixes tag is a common ancestor, this was always broken.\n\nFixes: f350a0a87374 (\"bridge: use rx_handler_data pointer to store net_bridge_port pointer\")\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nAssisted-by: Claude:claude-sonnet-4-6\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "310628484ef06f95c5589374fade917a5689787b", "tree": "b7c193be0159a3845cb02809e8b359cd0a337cb2", "parents": [ "0e152e4126fa14e697d8514cdd1567b18c679f08" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Wed Jun 10 20:08:17 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Jun 10 16:39:13 2026 +0100" }, "message": "spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX\n\nThe RZ/V2H hardware manual (section 7.5.2.2.1) specifies that read access\nsize for the SPI Data Register (SPDR) are fixed at 32 bits. The\nRZV2H_RSPI_RX macro for the 16-bit data path used readw(), violating\nthis requirement.\n\nSwitch to readl() for the 16-bit RX path to conform to the hardware\nspecification.\n\nFixes: 8b61c8919dff (\"spi: Add driver for the RZ/V2H(P) RSPI IP\")\nSuggested-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nReviewed-by: Fabrizio Castro \u003cfabrizio.castro.jz@renesas.com\u003e\nLink: https://patch.msgid.link/20260610-rzv2h-rspi-v2-1-40c80b4a2c90@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "512db8267b73a220a64180d95ab5eebe7c4964a8", "tree": "3b8a0b6a7ed0b5cf632cf6eef72cf7ff1924f0e3", "parents": [ "a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Jun 08 02:32:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 10 08:18:16 2026 -0700" }, "message": "rds: mark snapshot pages dirty in rds_info_getsockopt()\n\nrds_info_getsockopt() pins the destination user pages with FOLL_WRITE and\nthe RDS_INFO_* producers memcpy the snapshot into them through\nkmap_atomic(). Because that copy goes through the kernel direct map, the\ndirty bit on the user PTE is never set, so unpin_user_pages() releases the\npages without marking them dirty. A file-backed destination page can then\nbe reclaimed without writeback, silently discarding the copied data.\n\nUse unpin_user_pages_dirty_lock() with make_dirty\u003dtrue so the modified\npages are marked dirty before they are unpinned.\n\nFixes: a8c879a7ee98 (\"RDS: Info and stats\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260608-rds_fix-v1-1-006c88543408@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9", "tree": "df7e012789b2152c7b475522d48e3d05cc4fe710", "parents": [ "627366c51145a07f675b1800fb5ea2ec960bd900" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Jun 08 16:46:13 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 10 08:16:07 2026 -0700" }, "message": "ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n\nIn vti6_tnl_lookup(), when an exact match for a tunnel fails,\nthe code falls back to searching for wildcard tunnels:\n\n- Tunnels matching the packet\u0027s local address, with any remote address\n wildcard remote).\n\n- Tunnels matching the packet\u0027s remote address, with any local address\n (wildcard local).\n\nHowever, vti6 stores all these different types of tunnels in the same\nhash table (ip6n-\u003etnls_r_l) prone to hash collisions.\n\nThe bug is that the fallback search loops in vti6_tnl_lookup() were\nmissing checks to ensure that the candidate tunnel actually has\na wildcard address.\n\nFixes: fbe68ee87522 (\"vti6: Add a lookup method for tunnels with wildcard endpoints.\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20260608164613.933023-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "767622308a1d8b111038fca0059b964da1f6d9c4", "tree": "567c86cdc36bf13a566c93f28a0d38f5e0a87a4f", "parents": [ "805d5a2b792819171be100c50c9ddafa0f8c2231", "15b4155138505669d3d43d7692459ee8ea2a86e7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 07:18:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 07:18:32 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linux-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n\n - Fix the implementation of the CFI branch landing pad control prctl()s\n to return -EINVAL if unknown control bits are set, rather than\n silently ignoring the request; and add a kselftest for this case\n\n - Fix unaligned access performance testing to happen earlier in boot,\n which fixes a performance regression in the lib/checksum code\n\n - Fix a binfmt_elf warning when dumping core (due to missing\n .core_note_name for CFI registers)\n\n* tag \u0027riscv-for-linux-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: cfi: reject unknown flags in PR_SET_CFI\n riscv: Fix fast_unaligned_access_speed_key not getting initialized\n riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI\n" }, { "commit": "805d5a2b792819171be100c50c9ddafa0f8c2231", "tree": "cd654c208c02a858c590003e3e05039c430facf3", "parents": [ "acb7500801e98639f6d8c2d796ed9f64cba83d3a" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Jun 05 22:27:33 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jun 10 07:09:20 2026 -0700" }, "message": "namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories\n\nopen_tree(..., OPEN_TREE_NAMESPACE) and\nfsmount(..., FSMOUNT_NAMESPACE, ...) currently work on non-directories,\nlike regular files. That\u0027s bad for two reasons:\n\n - It ends up mounting a regular file over the inherited namespace root,\n which is a directory; mounting a non-directory over a directory is\n normally explicitly forbidden, see for example do_move_mount()\n\n - It causes setns() on the new namespace to set the cwd to a regular\n file, which the rest of VFS does not expect\n\nFix it by restricting create_new_namespace() (which is used by both of\nthese flags) to directories.\n\nLeave the behavior for OPEN_TREE_CLONE as-is, that seems unproblematic.\n\nFixes: 9b8a0ba68246 (\"mount: add OPEN_TREE_NAMESPACE\")\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: stable@kernel.org\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e47832c73b83ec21e67026726a1c8124697792af", "tree": "4754bd2d9943abebe43080690e90c53e5cee525c", "parents": [ "4316acc7ddaaa4572da1a55a2bc561d341c9c2a4", "96d47e40bf9db4a9efd5c8fb53287a508d165f14" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jun 10 12:25:33 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jun 10 12:25:33 2026 +0200" }, "message": "Merge tag \u0027usb-serial-7.1-rc8\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus\n\nJohan writes:\n\nUSB serial fixes for 7.1-rc8\n\nHere is one more buffer overflow fix.\n\nThis one has been in linux-next overnight with no reported issues.\n\n* tag \u0027usb-serial-7.1-rc8\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:\n USB: serial: kl5kusb105: fix bulk-out buffer overflow\n" }, { "commit": "d79716401a954677a93c4dd51fec65beccb38296", "tree": "afffed2d3f386137b5e8dfbdb6dec0a111edcf91", "parents": [ "2e235e2a2784b12b735321e5b42240ca51c49b0f" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Tue Jun 09 12:20:21 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:37 2026 -0300" }, "message": "drm/amd/display: use plane color_mgmt_changed to track colorop changes\n\nEnsure the driver tracks changes in any colorop property of a plane\ncolor pipeline by using the same mechanism of CRTC color management and\nupdate plane color blocks when any colorop property changes. It fixes an\nissue observed on gamescope settings for night mode which is done via\nshaper/3D-LUT updates.\n\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com\n" }, { "commit": "2e235e2a2784b12b735321e5b42240ca51c49b0f", "tree": "676ea24469c0131f742531df9b198f4b76c7c0ec", "parents": [ "94ff735296d371045fce163451a3d65e44ac4729" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Tue Jun 09 12:20:20 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:36 2026 -0300" }, "message": "drm/atomic: track individual colorop updates\n\nAs we do for CRTC color mgmt properties, use color_mgmt_changed flag to\ntrack any value changes in the color pipeline of a given plane, so that\ndrivers can update color blocks as soon as plane color pipeline or\nindividual colorop values change. Since we\u0027re here, only announce and\ntrack changes to plane COLOR_PIPELINE prop if its value is actually\nchanging.\n\nFixes: 8c5ea1745f4c (\"drm/colorop: Add BYPASS property\")\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: 41651f9d42eb (\"drm/colorop: Add 1D Curve subtype\")\nFixes: 3410108037d5 (\"drm/colorop: Add multiplier type\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nFixes: e5719e7f1900 (\"drm/colorop: Add 3x4 CTM type\")\nFixes: 99a4e4f08abe (\"drm/colorop: Add 1D Curve Custom LUT type\")\nFixes: 2afc3184f3b3 (\"drm/plane: Add COLOR PIPELINE property\")\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e #v1\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com\n" }, { "commit": "94ff735296d371045fce163451a3d65e44ac4729", "tree": "4d7280de41157b84aaf9fa34cc45102b5f29697c", "parents": [ "e480228cf65583040c894bb9cc02e1d5b328cee0" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Tue Jun 09 12:20:19 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:35 2026 -0300" }, "message": "drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable\n\nAs interpolation props are actually mutable props, any changes should be\nhandled by drm_colorop_state. Move their enum and make it correctly\nbehaves as mutable.\n\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com\n" }, { "commit": "e480228cf65583040c894bb9cc02e1d5b328cee0", "tree": "896f108a6f7f47426d32ec12eff1c461d7570781", "parents": [ "5d563a5da8717629ae72f9eadf1e0e340bd1658b" ], "author": { "name": "Alex Hung", "email": "alex.hung@amd.com", "time": "Tue Jun 09 12:20:18 2026 +0200" }, "committer": { "name": "Melissa Wen", "email": "melissa.srw@gmail.com", "time": "Wed Jun 10 07:13:34 2026 -0300" }, "message": "drm/colorop: Remove read-only comments from interpolation fields\n\nThe lut1d_interpolation and lut3d_interpolation fields and their\nassociated properties were marked as read-only, but userspace\ncan set them via drm_atomic_colorop_set_property().\n\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com\n" }, { "commit": "d21ad938398bca695a511307de38a65889e3b354", "tree": "7a7842d24c2dc98a5822194a4a1f624b5b612cae", "parents": [ "2673cefa99ca918e7ac5b0388ff578a83656c896" ], "author": { "name": "Joonas Lahtinen", "email": "joonas.lahtinen@linux.intel.com", "time": "Wed Jun 10 09:03:14 2026 +0300" }, "committer": { "name": "Tvrtko Ursulin", "email": "tursulin@ursulin.net", "time": "Wed Jun 10 09:23:22 2026 +0100" }, "message": "drm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\nReported-by: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nFixes: c6790dc22312 (\"drm/i915: Wean off drm_pci_alloc/drm_pci_free\")\nCc: \u003cstable@vger.kernel.org\u003e # v4.5+\nCc: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\nCc: Simona Vetter \u003csimona@ffwll.ch\u003e\nCc: Jani Nikula \u003cjani.nikula@linux.intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nSigned-off-by: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\nLink: https://patch.msgid.link/20260610060314.26111-1-joonas.lahtinen@linux.intel.com\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)\nSigned-off-by: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\n" }, { "commit": "a23226b7c1f69eafd9ced4e037fb51c9758c0501", "tree": "bdb1249e86f117d266f43007e12e8a20d577d87f", "parents": [ "64911f5aac534191e6b9a52ca1d50ba870a12d86" ], "author": { "name": "Daniel Drake", "email": "dan@reactivated.net", "time": "Mon Jun 08 22:01:08 2026 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Jun 10 10:12:57 2026 +0200" }, "message": "gpiolib: handle gpio-hogs only once\n\nCommit d1d564ec49929 (\"gpio: move hogs into GPIO core\") introduced a\nbehaviour change that breaks boot on Raspberry Pi 5 when using the\nfirmware-supplied device tree:\n\n gpiochip_add_data_with_key: GPIOs 544..575\n (/soc@107c000000/gpio@7d517c00) failed to register, -22\n brcmstb-gpio 107d517c00.gpio: Could not add gpiochip for bank 1\n brcmstb-gpio 107d517c00.gpio: probe with driver brcmstb-gpio failed\n with error -22\n\ngpio-brcmstb registers two gpio_chips against the device tree\nnode gpio@7d517c00, one for each bank. The firmware-supplied DT includes\na gpio-hog on RP1 RUN, and this gpio-hog is attempted to be applied to\n*both* gpio_chips. This succeeds against bank 0 (which hosts the GPIO)\nand fails for bank 1 (which does not).\n\nIn the previous implementation, failures to apply gpio-hogs were\nquietly ignored. In the new code, the error code propagates and causes\nprobe to fail.\n\nClosely approximate the previous behaviour by using the OF_POPULATED flag\nto ensure that each gpio-hog is processed only once. The flag was\npreviously being set before the gpio-hogs were processed, so as part\nof this change, the flag now gets set only after the gpio-hog is actioned.\nThe handling of gpio-hogs on a DT node with multiple gpio_chips remains a\nbit incomplete/unclear, but this at least retains the ability to apply\nhogs to the first gpio_chip per node.\n\nFixes: d1d564ec49929 (\"gpio: move hogs into GPIO core\")\nSigned-off-by: Daniel Drake \u003cdan@reactivated.net\u003e\nLink: https://patch.msgid.link/20260608210108.36248-1-dan@reactivated.net\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "64911f5aac534191e6b9a52ca1d50ba870a12d86", "tree": "0c1f69b8aac45264830b5a5b0d898425842077fe", "parents": [ "1c1e0fc88d6ef65bf15d517853251f75ab9d18c3" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Tue Jun 09 14:17:50 2026 +0200" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Jun 10 09:29:19 2026 +0200" }, "message": "gpio: fix cleanup path on hog failure\n\nIf gpiochip_hog_lines() successfully processes some hogs but fails on\na later one, the error handling path in gpiochip_add_data_with_key()\njumps directly to err_remove_of_chip. This leaks resources allocated\nearlier for ACPI, interrupts and hogs that were successfully processed.\nUse the right label in error path.\n\nCloses: https://sashiko.dev/#/patchset/20260608210108.36248-1-dan%40reactivated.net\nFixes: d1d564ec4992 (\"gpio: move hogs into GPIO core\")\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260609-gpio-hogs-fixes-v1-2-b4064f8070e7@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "58fc570165e1e356d3ee35d61c447c3d85cbcf14", "tree": "399587cd2bb882f5cac1e945f27839ebb72bea8b", "parents": [ "0e29148d6eaca87fa2a4fc67fc2a2695d566fe3e" ], "author": { "name": "Alice Ryhl", "email": "aliceryhl@google.com", "time": "Wed Jun 03 20:37:48 2026 +0000" }, "committer": { "name": "android-test-infra-autosubmit@system.gserviceaccount.com", "email": "android-test-infra-autosubmit@system.gserviceaccount.com", "time": "Tue Jun 09 23:26:57 2026 -0700" }, "message": "ANDROID: Update rust to 1.95.0\n\nUpdate the rustc version used for Linux to 1.95.0.\n\nBug: 519669611\nChange-Id: I48670fe60f50ee8980d2934e69ecd989e7f6ba02\nSigned-off-by: Alice Ryhl \u003caliceryhl@google.com\u003e\n" }, { "commit": "627366c51145a07f675b1800fb5ea2ec960bd900", "tree": "990be156d92cb46ee485603636a17cde5e1fb1c9", "parents": [ "7f2fcff15e99bb852f6967396ed12b38376e2c8d" ], "author": { "name": "Vadim Fedorenko", "email": "vadim.fedorenko@linux.dev", "time": "Mon Jun 08 15:59:52 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 09 19:26:56 2026 -0700" }, "message": "ptp: ocp: fix resource freeing order\n\nCommit a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to disable\nevents\") added a call to ptp_disable_all_events() which changes the\nconfiguration of pins if they support EXTTS events. In ptp_ocp_detach()\npins resources are freed before ptp_clock_unregister() and it leads to\nuse-after-free during driver removal. Fix it by changing the order of\nfree/unregister calls. To avoid irq handler running on the other core\nwhile ptp device unregistering, call synchronize_irq() after HW is\nconfigured to stop producing irqs and no irqs are in-flight.\n\nFixes: a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to disable events\")\nSigned-off-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260608155952.240304-1-vadim.fedorenko@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7f2fcff15e99bb852f6967396ed12b38376e2c8d", "tree": "9e55df43af361295d6b49d09c03eed3bba79fab5", "parents": [ "34080db3e70ddf94c38512ad2331e3c3afca6cc1" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Sat Jun 06 22:44:28 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 09 18:33:18 2026 -0700" }, "message": "tun: zero the whole vnet header in tun_put_user()\n\ntun_put_user() declares an on-stack struct virtio_net_hdr_v1_hash_tunnel\nwithout zeroing it. For a non-tunnel skb, virtio_net_hdr_tnl_from_skb()\nonly initializes the first 10 bytes (sizeof(struct virtio_net_hdr)),\nleaving bytes 10..23 (num_buffers and the hash/tunnel fields) as stack\ngarbage.\n\nAn unprivileged user can set the vnet header size to 24 with\nTUNSETVNETHDRSZ, so __tun_vnet_hdr_put() copies all 24 bytes of the\npartially-initialized struct to userspace, leaking 14 bytes of kernel\nstack on every read of a non-tunnel packet.\n\nFix it the same way tun_get_user() already does by zeroing the whole\nheader right after declaration.\n\nFixes: 288f30435132 (\"tun: enable gso over UDP tunnel support.\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260607054428.3050243-1-xmei5@asu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "34080db3e70ddf94c38512ad2331e3c3afca6cc1", "tree": "4c2f6bc5d976a1095a47e92e9fd9bd7a44caef19", "parents": [ "1ee90b77b727df903033db873c75caac5c27ec98" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Sat Jun 06 12:24:48 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 09 18:32:54 2026 -0700" }, "message": "net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion\n\nrds_ib_xmit_atomic() always programs a masked atomic opcode\n(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)\nfor every RDS atomic cmsg. But the completion-side switch in\nrds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked\natomic completion falls through to default and returns rm \u003d\u003d NULL while\nsend-\u003es_op is left set. rds_ib_send_cqe_handler() then dereferences the\nNULL rm via rm-\u003em_final_op, oopsing in softirq context. An unprivileged\nAF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection\ntriggers it; on hardware that natively accepts masked atomics (mlx4,\nmlx5) no extra setup is needed.\n\n RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!\n Oops: general protection fault [#1] SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]\n RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)\n Call Trace:\n \u003cIRQ\u003e\n rds_ib_send_cqe_handler (net/rds/ib_send.c:282)\n poll_scq (net/rds/ib_cm.c:274)\n rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)\n tasklet_action_common (kernel/softirq.c:943)\n handle_softirqs (kernel/softirq.c:573)\n run_ksoftirqd (kernel/softirq.c:479)\n \u003c/IRQ\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nHandle the masked atomic opcodes in the same case as the non-masked\nones: they map to the same struct rds_message.atomic union member, so\nthe existing container_of()/rds_ib_send_unmap_atomic() body is correct\nfor them.\n\nFixes: 20c72bd5f5f9 (\"RDS: Implement masked atomic operations\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260606192447.1179255-2-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1ee90b77b727df903033db873c75caac5c27ec98", "tree": "fa75c2bd3b0ed9cffc4194f8bff69d673a1718c9", "parents": [ "6f4c80a2a7e6d06753b89a578b710a2499a5e62b" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Sat Jun 06 19:18:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 09 18:32:08 2026 -0700" }, "message": "net: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type \u003d\u003d PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership.\n\nFixes: 8605330aac5a (\"tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260607021819.49698-1-kylebot@openai.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6f4c80a2a7e6d06753b89a578b710a2499a5e62b", "tree": "2b6aaf21646e46bbab6f4801c2c31236c3a27457", "parents": [ "d289d5307762d1838aaece22c6b6fcad9e8865f9" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Sun Jun 07 19:03:47 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 09 18:16:51 2026 -0700" }, "message": "sctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/75af23a89adf881a0895d511775e4770da367cbf.1780873427.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d289d5307762d1838aaece22c6b6fcad9e8865f9", "tree": "2c008ad8dcfc38cd1c966da1512feb37083df696", "parents": [ "f8373d7090b745728de66308deeecc67e8d319ce" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Jun 08 15:59:18 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 09 18:15:47 2026 -0700" }, "message": "ip6_vti: set netns_immutable on the fallback device.\n\njohn1988 and Noam Rathaus reported that vti6_init_net() does not set the\nnetns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).\n\nOther similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel)\ncorrectly set this flag during their fallback device initialization to\nprevent them from being moved to another network namespace.\n\nFixes: 61220ab34948 (\"vti6: Enable namespace changing\")\nReported-by: Noam Rathaus \u003cnoamr@ssd-disclosure.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20260608155918.787644-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8373d7090b745728de66308deeecc67e8d319ce", "tree": "5af795adee2dd851c0090a2115ffa86d3e76e92c", "parents": [ "d930276f2cddd0b7294cac7a8fe7b877f6d9e08d" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Mon Jun 08 08:22:34 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 09 18:12:30 2026 -0700" }, "message": "sctp: fix uninit-value in __sctp_rcv_asconf_lookup()\n\n__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF\nchunk can hold the ADDIP header and a parameter header, then calls\naf-\u003efrom_addr_param(), which reads the full address (16 bytes for IPv6)\ntrusting the parameter\u0027s declared length.\n\nAn unauthenticated peer can send a truncated trailing ASCONF chunk that\ndeclares an IPv6 address parameter but stops after the 4-byte parameter\nheader; reached from the no-association lookup path, from_addr_param() then\nreads uninitialized bytes past the parameter.\n\nImpact: an unauthenticated SCTP peer makes the receive path read up to 16\nbytes of uninitialized memory past a truncated ASCONF address parameter.\n\nThe sibling __sctp_rcv_init_lookup() bounds parameters with\nsctp_walk_params(); this path open-codes the fetch and omits the bound.\nVerify the whole address parameter lies within the chunk before\nfrom_addr_param() reads it, the same class of fix as commit 51e5ad549c43\n(\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").\n\nFixes: df2185771439 (\"[SCTP]: Update association lookup to look at ASCONF chunks as well\")\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "d930276f2cddd0b7294cac7a8fe7b877f6d9e08d" }