mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 17:47:41 +02:00
79f2670da8
1447130 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
79f2670da8 |
pmdomain providers:
- imx: Fix OF node refcount - ti: Fix wakeup configuration for parent devices of wakeup sources -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmoqk98QHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKYu3EADMgGONH+8wEuLwr5NkNQwFZ5ZFOv8IR5Ss MeWXgk5xAnUXJFs11cvgyuW2s3f3gHEayZetffpRYEAp+PPk1tIP3x7Q6QR8RQd6 THPezoGMlG/G3Dm3F8ekF8+igW8awlS5xyQemt4WMLgC62fHMaLsrXqSu383EUy3 GwGEzU+UXBxBBpntdqD1n3ZkUkJZBSMZA9OezfD885mrpJMZvLUsNO+CrsRXS9W/ Cv0WzZveRMYOR7MSQYfou2yVb8QzcgQ9UgGjDUVvFNBrS9EaZuFzWJupUS48XCkg 49herg41k9MF6zVPWOBCEI84jFhvtR+90DSU/P+DpyU9NNWkRmYJ3T72ufbCB++Q VmCyGedKkwsO9FJzzljH0aFFDxBZ8FqBUodm0KSreru7Ft/aGmnq14iGH7avIAp+ DnHQ2q2e3oSwtD+To8JnRuqMUW+EBdEzqzw0CgtrtjkzNakJH4OwzD0Hstl2RdM3 xdgxPFFhEYTmzT6Z9+yVJG+PLWGwHu4sy+Eb7QCddvjnHNNwOMtWPVZQtE31pRMY QqQMcsR1GzUHE4TCti3NpOmCecKnp/c4LAX3gS+xsdybh9QqcSsRMYIn3/adF2I1 2uxrkdXkjga8JAwS5/lotnbbZEC3ZalWMmWj9gwwzZauaFM5GwnX7DewwJ3qmNc+ VBkVefSIDg== =dR2j -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Fix OF node refcount - ti: Fix wakeup configuration for parent devices of wakeup sources * tag 'pmdomain-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: imx: fix OF node refcount pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source |
||
|
Linus Torvalds
|
6e9e0dfc7f |
gpio fixes for v7.1
- fix NULL pointer dereference in gpio-mvebu - fix runtime PM leak in remove path in gpio-zynq - reject invalid module params in gpio-mockup - fix generic IRQ chip leak in remove parh in gpio-rockchip - fix resource leaks in GPIO chip cleanup path on hog failure - fix a regression in how GPIO hogging code handles multiple GPIO chips reusing the same OF node -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmoqZbYACgkQBZ0uy/82 hMN+DhAAqntOaHqRks5PqwZlE8jRCFtx1EkvABTnnNHW5t+HXVF+GpBvzRw43aQG uppIsusTVnxIojDeuBAzueC6UYjhos5/u2UY8jfaE3HQ7bEksUKS5Ba7b+MzlPo4 AsPIZey0zuoj1EJNTUZekii7xDcApFu9l+CV9xKqEH+MIySelREJj5sqprJbdF9y 9hpraeVAn+x333o4zrhWm/mauX/DnFrveqU3nSF+dYQtLwNEJyYntoQZUxrf6I0g AHTWRpUMXeUk3aMfmeuaNXrXnfQksanPDYIWT5LmvWoOWkka+iqX0nbUeA51myhZ soGzfQ7flYQTZRalu4tqjz7YnVpZC1u9xmgaQlOIwVmEyeW1YPOI6yDjIPWZwUFi 3DupOvBf98wpIU8wCLVUN/vul496dLw793S4TOnaSGlaMQnz9mop0Qq6Ffb0hgS+ V5M3cRA2K/aivjtU7r5921M/0NamozIPRadl+1L8USvL1pw8atHjndFIVXgxygln Qi3nxEiqWNRk+45YYM7HFdxGZB4bJefq5qwiB9l4Bmz2FczrpMgFMgvdO/jp6HAN e3YKhfoDrQBd2tf2V3WodmMHhmkR+SLjLfCPZ9rZiueh1NuU/GOzRwN2sD/tABac rV7DSamrrRZzsagHKpyCxTi/Dd0shDh5kVWCtcLggaEO8m7sFEQ= =ov9g -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix NULL pointer dereference in gpio-mvebu - fix runtime PM leak in remove path in gpio-zynq - reject invalid module params in gpio-mockup - fix generic IRQ chip leak in remove parh in gpio-rockchip - fix resource leaks in GPIO chip cleanup path on hog failure - fix a regression in how GPIO hogging code handles multiple GPIO chips reusing the same OF node * tag 'gpio-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: handle gpio-hogs only once gpio: fix cleanup path on hog failure gpio: rockchip: fix generic IRQ chip leak on remove gpio: mockup: reject invalid gpio_mockup_ranges widths gpio: zynq: fix runtime PM leak on remove gpio: mvebu: fix NULL pointer dereference in suspend/resume |
||
|
Linus Torvalds
|
9716c086c8 |
Power management fixes for final 7.1
- Restore allowing writing EPP of 0 when in performance mode in the
amd-pstate driver which was unnecessarily disallowed by one of the
recent updates (Mario Limonciello)
- Remove stale documentation of the epp_cached field in struct
amd_cpudata that has been dropped recently (Zhan Xusheng)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmopns8SHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1nuQH/1WWr4Rm9BV07e+sqK0X62fzV7+TpM8N
Ap7PveJ3qh7LEh2Mh4CiCyycSR4XfAZrKE0FGi7YGbxhcTsG93nlpyzz0dCPyYzM
qJ4lpbLUqt9gu4BknmTAYAIBResZSjYyA1bB7eghcKQzuAXj447PkNvG5Pbij5KS
wLuBPnV1eLtzpdXitg9OHFitu5KBKe/DH8hlsomJkkXN/8rAKIFsfihHw+52r/Hh
fwxt4QPj8e72kZbeAC+YELY40J3Cg8pW7w4G6NbGPFU64FZWwO42a2j+j1PW5unP
lYjNlf0PCQ4Ebi6Z2j24LIlp038fPJcYjV2BJ24PlY4fiN1OYoKZnLo=
=QUn3
-----END PGP SIGNATURE-----
Merge tag 'pm-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address some remaining fallout after introducing dynamic EPP
support in the amd-pstate driver during the current development cycle:
- Restore allowing writing EPP of 0 when in performance mode in the
amd-pstate driver which was unnecessarily disallowed by one of the
recent updates (Mario Limonciello)
- Remove stale documentation of the epp_cached field in struct
amd_cpudata that has been dropped recently (Zhan Xusheng)"
* tag 'pm-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
cpufreq/amd-pstate: Fix setting EPP in performance mode
cpufreq/amd-pstate: drop stale @epp_cached kdoc
|
||
|
Linus Torvalds
|
767622308a |
RISC-V updates for v7.1-rc8
- Fix the implementation of the CFI branch landing pad control prctl()s to return -EINVAL if unknown control bits are set, rather than silently ignoring the request; and add a kselftest for this case - Fix unaligned access performance testing to happen earlier in boot, which fixes a performance regression in the lib/checksum code - Fix a binfmt_elf warning when dumping core (due to missing .core_note_name for CFI registers) -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmopaGkACgkQx4+xDQu9 KkvBng/+LAQwSRM5fRJVEzHq5PvVvElGCcdWoBnRGF/OX3WG9h+HErMCyfz3uKnr sqjlfs8GZTg1ABTIqBOu2eUj0SzsJfXE8Ehc2l5D34VSG2BsPh7CJABxqZtLdWoT K/DlmlDwWZ3Pu4HQKtQeFCRAT1MFhXfgvaomrR4qCmigQyJYeLatuTuvGd0RXL6U CHx9yPJY9++rC1mV+h5IKw/Ml8gQJCdCvYF9zZsRlFxhQi/QL0jz588yCK10qXx4 hFntomFtscnPW3DU57+OpHyKuHG0IyqOmgr093JCFKMr4jDbfxFI1UjEbcfk28Uy YN+RHXXrzvfVlLhZCYk4nlu+YwMBkgZEvwxGFrFIunkVLHI01GB02HNcRGukLRnA zjevjQFK78cvg7LbY3tlqdmOs/RqjpHJd5LwU9FUgj+jXbt5wBviarV6VPAAL2za 8ZgNjxBCO3aT1ec5sIjhu7HrZxgcbv6x7GipmlrKmmSBvE2+Gzcz4jCIIWT9GjOt lGNX/B25ew5sK8zoDsGoTW4dCCHOMHD/vGsXww3IxSrWOQX4Ew9Ffcxks82AYqId C9DttPDZLcN82VeVymgrVZl9JJBkudeLO6fDl1mRgCY11qp1tJG3GaosfA601qiE PYlfsqMlNZKPUO7JXR3l70LbRocNKqJl3Yo7u+KstHV26E99twk= =yfQt -----END PGP SIGNATURE----- Merge tag 'riscv-for-linux-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Fix the implementation of the CFI branch landing pad control prctl()s to return -EINVAL if unknown control bits are set, rather than silently ignoring the request; and add a kselftest for this case - Fix unaligned access performance testing to happen earlier in boot, which fixes a performance regression in the lib/checksum code - Fix a binfmt_elf warning when dumping core (due to missing .core_note_name for CFI registers) * tag 'riscv-for-linux-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: cfi: reject unknown flags in PR_SET_CFI riscv: Fix fast_unaligned_access_speed_key not getting initialized riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI |
||
|
Jann Horn
|
805d5a2b79 |
namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories
open_tree(..., OPEN_TREE_NAMESPACE) and
fsmount(..., FSMOUNT_NAMESPACE, ...) currently work on non-directories,
like regular files. That's bad for two reasons:
- It ends up mounting a regular file over the inherited namespace root,
which is a directory; mounting a non-directory over a directory is
normally explicitly forbidden, see for example do_move_mount()
- It causes setns() on the new namespace to set the cwd to a regular
file, which the rest of VFS does not expect
Fix it by restricting create_new_namespace() (which is used by both of
these flags) to directories.
Leave the behavior for OPEN_TREE_CLONE as-is, that seems unproblematic.
Fixes:
|
||
|
Daniel Drake
|
a23226b7c1 |
gpiolib: handle gpio-hogs only once
Commit |
||
|
Bartosz Golaszewski
|
64911f5aac |
gpio: fix cleanup path on hog failure
If gpiochip_hog_lines() successfully processes some hogs but fails on
a later one, the error handling path in gpiochip_add_data_with_key()
jumps directly to err_remove_of_chip. This leaks resources allocated
earlier for ACPI, interrupts and hogs that were successfully processed.
Use the right label in error path.
Closes: https://sashiko.dev/#/patchset/20260608210108.36248-1-dan%40reactivated.net
Fixes:
|
||
|
Linus Torvalds
|
acb7500801 |
runtime verifier fixes for v7.1:
- Fix reset ordering on per-task destruction Reset the task before dropping the slot instead of after, which was causing out-of-bound memory accesses. - Fix HA monitor synchronization and cleanup Ensure synchronous cleanup for HA monitors by running timer callbacks in RCU read-side critical sections and using synchronize_rcu() during destruction. - Avoid armed timers after tasks exit Add automatic cleanup for per-task HA monitors to prevent timers from firing after task exit. - Fix memory ordering for DA/HA monitors Fix race conditions during monitor start by using release-acquire semantics for the monitoring flag. - Fix initialization for DA/HA monitors Ensure monitors are not initialized relying on potentially corrupted state like the monitoring flag, that is not reset by all monitors type and may have an unknown state in monitors reusing the storage (per-task). - Fix memory safety in per-task and per-object monitors Prevent use-after-free and out-of-bounds access by synchronizing with in-flight tracepoint probes using tracepoint_synchronize_unregister() before freeing monitor storage or releasing task slots. - Adjust monitors for preemptible tracepoints Fix monitors that relied on tracepoints disabling preemption. Explicitly disable task migration when per-CPU monitors handle events to avoid accessing the wrong state and update the opid monitor logic. - Fix incorrect __user specifier usage Remove __user from a non-pointer variable in the extract_params() helper. - Fix bugs in the rv tool Ensure strings are NUL-terminated, fix substring matching in monitor searches, and improve cleanup and exit status handling. - Fix several bugs in rvgen Fix LTL literal stringification, subparsers' options handling, and suffix stripping in dot2k. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaiiJqhQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qlWSAQCZ6/v0Gyb+m7md9V65NWtAA3QKuJWU WvoQIjPLx+zCoAEAmfyhRxWGMKgBYn3yZfBU5nb1CBMcMStJ5Pp8b+uwNAs= =VjFc -----END PGP SIGNATURE----- Merge tag 'trace-rv-v7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier fixes from Steven Rostedt: - Fix reset ordering on per-task destruction Reset the task before dropping the slot instead of after, which was causing out-of-bound memory accesses. - Fix HA monitor synchronization and cleanup Ensure synchronous cleanup for HA monitors by running timer callbacks in RCU read-side critical sections and using synchronize_rcu() during destruction. - Avoid armed timers after tasks exit Add automatic cleanup for per-task HA monitors to prevent timers from firing after task exit. - Fix memory ordering for DA/HA monitors Fix race conditions during monitor start by using release-acquire semantics for the monitoring flag. - Fix initialization for DA/HA monitors Ensure monitors are not initialized relying on potentially corrupted state like the monitoring flag, that is not reset by all monitors type and may have an unknown state in monitors reusing the storage (per-task). - Fix memory safety in per-task and per-object monitors Prevent use-after-free and out-of-bounds access by synchronizing with in-flight tracepoint probes using tracepoint_synchronize_unregister() before freeing monitor storage or releasing task slots. - Adjust monitors for preemptible tracepoints Fix monitors that relied on tracepoints disabling preemption. Explicitly disable task migration when per-CPU monitors handle events to avoid accessing the wrong state and update the opid monitor logic. - Fix incorrect __user specifier usage Remove __user from a non-pointer variable in the extract_params() helper. - Fix bugs in the rv tool Ensure strings are NUL-terminated, fix substring matching in monitor searches, and improve cleanup and exit status handling. - Fix several bugs in rvgen Fix LTL literal stringification, subparsers' options handling, and suffix stripping in dot2k. * tag 'trace-rv-v7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: verification/rvgen: Fix ltl2k writing True as a literal verification/rvgen: Fix options shared among commands verification/rvgen: Fix suffix strip in dot2k tools/rv: Fix cleanup after failed trace setup tools/rv: Fix substring match when listing container monitors tools/rv: Fix substring match bug in monitor name search tools/rv: Ensure monitor name and desc are NUL-terminated rv: Use 0 to check preemption enabled in opid rv: Prevent task migration while handling per-CPU events rv: Ensure synchronous cleanup for HA monitors rv: Add automatic cleanup handlers for per-task HA monitors rv: Do not rely on clean monitor when initialising HA rv: Fix monitor start ordering and memory ordering for monitoring flag rv: Ensure all pending probes terminate on per-obj monitor destroy rv: Prevent in-flight per-task handlers from using invalid slots rv: Reset per-task DA monitors before releasing the slot rv: Fix __user specifier usage in extract_params() |
||
|
Linus Torvalds
|
06f4462d05 |
RTLA fixes for v7.1
- Fix multi-character short option parsing Fix regression in parsing of multiple-character short options (e.g. -p100 /= -p 100/, -un /= -u -n/) caused by getopt_long() internal state corruption after a refactoring. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaiiILRQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qvKKAP9peFJI0pJhGz3xkBdtDjNeTw8k93QT aTutUb4tJUD92wD/QJ0FwiOyzOCqkBHAO2x2R4elTlGm4Wgz9cZXjzHWaw8= =0CcC -----END PGP SIGNATURE----- Merge tag 'trace-tools-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA fix from Steven Rostedt: - Fix multi-character short option parsing Fix regression in parsing of multiple-character short options (eg -p100 /= -p 100/, -un /= -u -n/) caused by getopt_long() internal state corruption after a refactoring. * tag 'trace-tools-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla: Fix parsing of multi-character short options |
||
|
Linus Torvalds
|
685441a6d3 |
11 hotfixes. 9 are for MM. 8 are cc:stable and the remaining 3
address post-7.1 issues or aren't considered suitable for backporting.
Thre's a 2 patch series "mm/damon/{reclaim,lru_sort}: handle ctx
allocation failures" from SeongJae Park which fixes a couple of DAMON
-ENOMEM bloopers. The rest are singletons - please see the individual
changelogs for details.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaieN5AAKCRDdBJ7gKXxA
jkN7AP9wXhRFOUq0EPeQxnlie7vgM/jiDuOoPAn7EUt9S7pqCwEApJnxEbMzXioD
Jx6MxoUqqa/d5wXb7u0MRgT76n9KOwk=
=hdKc
-----END PGP SIGNATURE-----
Merge tag 'mm-hotfixes-stable-2026-06-08-20-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton:
"11 hotfixes. 9 are for MM. 8 are cc:stable and the remaining 3 address
post-7.1 issues or aren't considered suitable for backporting.
Thre's a two-patch series "mm/damon/{reclaim,lru_sort}: handle ctx
allocation failures" from SeongJae Park which fixes a couple of DAMON
-ENOMEM bloopers. The rest are singletons - please see the individual
changelogs for details"
* tag 'mm-hotfixes-stable-2026-06-08-20-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
arm64: mm: call pagetable dtor when freeing hot-removed page tables
mm/list_lru: drain before clearing xarray entry on reparent
mm/huge_memory: use correct flags for device private PMD entry
mm/damon/lru_sort: handle ctx allocation failure
mm/damon/reclaim: handle ctx allocation failure
zram: fix use-after-free in zram_bvec_write_partial()
MAINTAINERS: update Baoquan He's email address
tools headers UAPI: sync linux/taskstats.h for procacct.c
mm/cma_sysfs: skip inactive CMA areas in sysfs
ipc/shm: serialize orphan cleanup with shm_nattch updates
|
||
|
Linus Torvalds
|
fed2efe803 |
RDMA v7.1 second rc window
Several significant bug fixes of pre-existing issues:
- Missing validation on ucap fd types passed from userspace
- Missing validation of HW DMA space vs userpace expected sizes in EFA
queue setup
- DMA corruption when using DMA block sizes >= 4G when setting up MRs in
all drivers
- Missing validation of CPU IDs when setting up dma handles
- Missing validation of IB_MR_REREG_ACCESS when changing writability of a
MR
- Missing validation of received message/packet size in ISER and SRP
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaib4qwAKCRCFwuHvBreF
YRPNAP0TslA/smVGQcGPVHHtLl3b5n47NSE+pwNXFlWUp8yO5AD/T1VmGSRbjbc+
5eqr/1yMqGha1sHBY8XFEbqJKIPFOQY=
=CmEv
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe:
"Several significant bug fixes of pre-existing issues:
- Missing validation on ucap fd types passed from userspace
- Missing validation of HW DMA space vs userpace expected sizes in
EFA queue setup
- DMA corruption when using DMA block sizes >= 4G when setting up MRs
in all drivers
- Missing validation of CPU IDs when setting up dma handles
- Missing validation of IB_MR_REREG_ACCESS when changing writability
of a MR
- Missing validation of received message/packet size in ISER and SRP"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/srp: bound SRP_RSP sense copy by the received length
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
RDMA/umem: Fix truncation for block sizes >= 4G
RDMA/efa: Validate SQ ring size against max LLQ size
RDMA/core: Validate the passed in fops for ib_get_ucaps()
|
||
|
Marco Scardovi
|
1c1e0fc88d |
gpio: rockchip: fix generic IRQ chip leak on remove
The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove/teardown, the generic chips are not automatically freed when the
IRQ domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.
This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the GPIO bank has been removed,
potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
rockchip_gpio_remove().
Fixes:
|
||
|
Samuel Moelius
|
446e8c31d0 |
gpio: mockup: reject invalid gpio_mockup_ranges widths
gpio-mockup validates only that each second gpio_mockup_ranges value is
non-negative before creating the mock chips. The fixed-base form uses
the second value as the first GPIO number after the range, while the
dynamic-base form uses it as the number of GPIOs.
gpio_mockup_register_chip() stores the resulting number of GPIOs in a
u16 and passes it through a PROPERTY_ENTRY_U16("nr-gpios", ...). Values
greater than U16_MAX therefore truncate silently. For example,
gpio_mockup_ranges=-1,65537 creates a one-line mock GPIO chip instead of
rejecting the invalid request.
Reject zero-width, reversed, and over-U16 ranges before registering any
mock chip.
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Link: https://patch.msgid.link/20260609004538.1240091.3fba33a20b88.gpio-mockup-ngpio-u16-truncation@trailofbits.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
|
||
|
Ruoyu Wang
|
6edb934de9 |
gpio: zynq: fix runtime PM leak on remove
pm_runtime_get_sync() increments the runtime PM usage counter even when it
returns an error. zynq_gpio_remove() uses it to keep the controller active
while removing the GPIO chip, but never drops the usage counter again.
Balance the get with pm_runtime_put_noidle() after disabling runtime PM.
Fixes:
|
||
|
Michael Bommarito
|
13e91fd076 |
RDMA/srp: bound SRP_RSP sense copy by the received length
srp_process_rsp() copies sense data from rsp->data + resp_data_len,
where resp_data_len is the full 32-bit value supplied by the SRP target
and is never checked against the number of bytes actually received
(wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so
at most 96 bytes are copied, but the source offset is not bounded.
A malicious or compromised SRP target on the InfiniBand/RoCE fabric that
the initiator has logged into can return an SRP_RSP with
SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer
is allocated at the target-chosen max_ti_iu_len, so the source of the
sense copy lands past the bytes actually received; with resp_data_len
near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.
Copy the sense data only if it has not been truncated, that is, only if
the response header, the response data, and the sense region fit within
the bytes actually received; otherwise drop the sense and log. The
in-tree iSER and NVMe-RDMA receive paths already bound their parse by
wc->byte_len; this brings ib_srp into line with them.
Fixes:
|
||
|
Michael Bommarito
|
29e7b925ae |
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()
computes the login request payload length as wc->byte_len minus
ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.
A remote iSER initiator can post a login Send work request carrying
fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows
and login_req_len becomes negative.
isert_rx_login_req() then reads that negative length back into a signed
int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the
min() is signed it keeps the negative value; the value is then passed as
the memcpy() length and sign-extended to a multi-gigabyte size_t. The
copy into the 8192-byte login->req_buf runs far out of bounds and
faults, crashing the target node. The login phase precedes iSCSI
authentication, so no credentials are required to reach this path.
Reject any login PDU shorter than ISER_HEADERS_LEN before the
subtraction, mirroring the existing early return on a failed work
completion, so login_req_len can never go negative. The upper bound was
already safe: a posted login buffer cannot deliver more than
ISER_RX_PAYLOAD_SIZE, so the difference stays at or below
MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing
lower bound needs to be added.
Fixes:
|
||
|
Jason Gunthorpe
|
badad6fad6 |
RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be
re-evaluated to ensure it is properly pinned as RW. Since the umem is
hidden inside each driver's mr struct add a ib_umem_check_rereg() function
that each driver has to call before processing IB_MR_REREG_ACCESS.
mlx4 has to retain its duplicate ib_access_writable check because it
implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items
in place sequentially while the MR is live, so it will continue to not
support this combination.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Linus Torvalds
|
2d3090a8ae |
This push contains the following changes:
- Fix random config build failure on s390. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmoZLIgACgkQxycdCkmx i6fFgw//QgEmeQwGxgW75DGyP79CWNQEKwAtV7dm2e2jGpGIN5RBUTqIqsvv6ZnU 5TqvZZ91OtCcrLOYaZONfMeuhFAAq639AsZJEcoveWw62PMciebNwXGdUznqc1oo eL5umuiSvrpqnrqly3sEgBpKzNNclH24SOuyBSvaA+nuPXi5mqgrPF4DiCgZEUA+ 7hu0Jj5905EWpnhBpbjQ8qIkrZcG6xGZQMZTPZ/sKg6vIuFfzmmhl6l74qH1YciS rDQWZTnGwLwrxmJQibqaWMN6MQ2jwuAYT3wDDDI91o0hpgucuEVmIC8l6gGmSeBh S9GmBF+wfOf0+f4AeYQU4zD36dXRf90gtqTRYqyIlb+5LW+UzKqHol8zobtma6Mq IYCunmTHDHJW2QfAoJ032HR7rr53QqSNb0XOr2MJzDx4+2ZeccgyNG6hL6TFTyYQ 4JoxjJG3QcU0OH8i9m3IA8bShM/2AXzjztLipz0LbYfB32Xe5S6iZQ7jXUAMuUqB kY1cr1/Pw/xMFeGfy9iZnYPKyxD0ax8lGAh94ztuQQOqH/JvRiDdzJzY4xBPpEDm SG7Axn91e40oygzvsNcs1/1vHPRsbN3p2Rfw1Ty9VjELgGVT9jVy/ynCq7S+z1fq lJ989SAJ2Zr6LLTx/UGOLKEww3QgA0PJFJwdRsW1sBzuh/j8gZg= =YY4W -----END PGP SIGNATURE----- Merge tag 'v7.1-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Fix random config build failure on s390. * tag 'v7.1-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: s390 - add select CRYPTO_AEAD for aes |
||
|
Yun Zhou
|
b9ad50d750 |
gpio: mvebu: fix NULL pointer dereference in suspend/resume
mvebu_pwm_suspend() and mvebu_pwm_resume() are called for all GPIO
banks during suspend/resume, but not all banks have PWM functionality.
GPIO banks without PWM have mvchip->mvpwm set to NULL.
Calling mvebu_pwm_suspend() with mvpwm == NULL causes a NULL pointer
dereference when it tries to access mvpwm->blink_select.
Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write
[00000020] *pgd=00000000
Internal error: Oops: 815 [#1] PREEMPT ARM
Modules linked in:
CPU: 0 UID: 0 PID: 406 Comm: sh Not tainted 6.12.74-rt12-yocto-standard-g4e96f98fb7db-dirty #353
Hardware name: Marvell Armada 370/XP (Device Tree)
PC is at regmap_mmio_read+0x38/0x54
LR is at regmap_mmio_read+0x38/0x54
pc : [<c05fd2ac>] lr : [<c05fd2ac>] psr: 200f0013
sp : f0c11d10 ip : 00000000 fp : c100d2f0
r10: c14fb854 r9 : 00000000 r8 : 00000000
r7 : c1799c00 r6 : 00000020 r5 : 00000020 r4 : c179c7c0
r3 : f0a231a0 r2 : 00000020 r1 : 00000020 r0 : 00000000
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 10c5387d Table: 135ec059 DAC: 00000051
Call trace:
regmap_mmio_read from _regmap_bus_reg_read+0x78/0xac
_regmap_bus_reg_read from _regmap_read+0x60/0x154
_regmap_read from regmap_read+0x3c/0x60
regmap_read from mvebu_gpio_suspend+0xa4/0x14c
mvebu_gpio_suspend from dpm_run_callback+0x54/0x180
dpm_run_callback from device_suspend+0x124/0x630
device_suspend from dpm_suspend+0x124/0x270
dpm_suspend from dpm_suspend_start+0x64/0x6c
dpm_suspend_start from suspend_devices_and_enter+0x140/0x8e8
suspend_devices_and_enter from pm_suspend+0x2fc/0x308
pm_suspend from state_store+0x6c/0xc8
state_store from kernfs_fop_write_iter+0x10c/0x1f8
kernfs_fop_write_iter from vfs_write+0x270/0x468
vfs_write from ksys_write+0x70/0xf0
ksys_write from ret_fast_syscall+0x0/0x54
Add a NULL check for mvchip->mvpwm before calling the PWM
suspend/resume functions.
Fixes:
|
||
|
Linus Torvalds
|
e92a762877 |
hyperv-fixes for v7.1-rc8
-----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmomTIwTHHdlaS5saXVA a2VybmVsLm9yZwAKCRB2FHBfkEGgXqyECADL9eYwEkfwQDB+CmyemmINo/wvOfGu u6husKyGqs3eBe7sPtERarHtN8UlQMGLMVd2CR8QqtD+P9yZjSnNX54ljtweEdIr eAijVHEFmw1e1Lo/lGOv8eldNP3FuUGopz6rkfuQ2S+6xZ9MHIYda5MCZ3I0rbOe Mq+aB17Qhvqp+O4+zfk5wDh9OJ1Wa5c0U0xfKx51SX4qf1KDL7AUIz0Cyy7P8h5q u7MDYFaE4U9d8M5GbRQUGyHr6W0YQuMMUW5Ip04OsQXRKyMR5W20dFtiwoqI4UbF loWUakk4RkC9tEMs6WeLSvqrLgKqbqfDOScYB8OPEUlh5CRMhYp7uhkA =fcaL -----END PGP SIGNATURE----- Merge tag 'hyperv-fixes-signed-20260607' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - MSHV driver fixes from various people (Anirudh Rayabharam, Can Peng, Dexuan Cui, Michael Kelley, Jork Loeser, Wei Liu) - Hyper-V user space tools fixes (Thorsten Blum) - Allow VMBus to be unloaded after frame buffer is flushed (Michael Kelley) * tag 'hyperv-fixes-signed-20260607' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: support 1G hugepages by passing them as 2M-aligned chunks Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs mshv: use kmalloc_array in mshv_root_scheduler_init mshv: Add conditional VMBus dependency hyperv: Clean up and fix the guest ID comment in hvgdk.h drm/hyperv: During panic do VMBus unload after frame buffer is flushed Drivers: hv: vmbus: Provide option to skip VMBus unload on panic mshv: unmap debugfs stats pages on kexec mshv: clean up SynIC state on kexec for L1VH mshv: limit SynIC management to MSHV-owned resources hv: utils: replace deprecated strcpy with strscpy in kvp_register hv: utils: handle and propagate errors in kvp_register mshv: add a missing padding field |
||
|
Rafael J. Wysocki
|
6100a82e34 |
amd-pstate fixes for 7.1 (2026-06-02)
* Fix a kdoc issue * Fix an issue setting performance state in EPP mode introduced earlier in the cycle from new 7.1 content -----BEGIN PGP SIGNATURE----- iQJHBAABCgAxFiEECwtuSU6dXvs5GA2aLRkspiR3AnYFAmofFnsTHHN1cGVybTFA a2VybmVsLm9yZwAKCRAtGSymJHcCdnUxEADH6N8YuF+NVJ+rx/v0YPouzeTPX9F9 UJ6MJgS2aIXpnWd3CmrH2CzhEu8/7oVW/5pRv6wMPdDM2NZnmazFwYZgRsRuW3uZ GrkCFO50sbBBZjt3p8qbiIa+qb3QHkC5+dDP8SHLK7H7UyVcL8bNeXMn1kItJYAk Dnckyrx2ZT9I2pWXUiL5H5IOUPXm3ncWT3B/k4NSI2HGoAONu41Nb91WMZnbMM50 r+kTejYF83c+HdxiUR70zwGHaeqenS4MibHsmeqU13MX2uqT5Mzj0W6b3f2tgsSo qE4/exiCufXNSJCsVNjUCZNY408SZ1MHow14T3aCWRsBb2ou1WNy9AYuteuC1bdM YoFHy2dcEFA0rg7hq6N5SeUGPhrZICCBk02VSDjXOQ82Dl5VXPEST7YmG5dvrll/ HSpcz0CFyD2swDRE4V5avzizJtLc0KtOKCdrqyVx3eh+5pKi5sOWhIM97ck/f7aV ZstHeYm//azficWslWc7orv9LwvgEg+FxInaEcS1/Oe0A3h5PqM/NNK33Fuiflio 8jW8NDNoHtAHOfmO98N3+Kl4/h0atvpPi8YfBUuLGgpQUabVM2flwPMmGW9du2JT b78kPNlmjaIC1DEW6KiGyTYVJJdEG4d+NUn5TlaSgkTJ362VJReWUevXkKat5dQQ fvFzOa0aSbSlmQ== =GCJw -----END PGP SIGNATURE----- Merge tag 'amd-pstate-v7.1-2026-06-02' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull amd-pstate fixes for 7.1 (2026-06-02) from Mario Limonciello: "* Fix a kdoc issue * Fix an issue setting performance state in EPP mode introduced earlier in the cycle from new 7.1 content" * tag 'amd-pstate-v7.1-2026-06-02' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Fix setting EPP in performance mode cpufreq/amd-pstate: drop stale @epp_cached kdoc |
||
|
Linus Torvalds
|
4549871118 | Linux 7.1-rc7 | ||
|
Linus Torvalds
|
c68691dc1d |
Miscellaneous x86 fixes:
- Add more AMD Zen6 models (Pratik Vishwakarma)
- Avoid confusing bootup message by the Intel resctl enumeration
code when running on certain AMD systems (Tony Luck)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok/S0RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1iOHw//Q2lG+XKJAG5wPgvkyp7EcQDgerj22LQS
ybapgg4u0scz4+24yt1vbzSRdvp+wTowSpviw7IH3rbemhWTkB7WZisjaKwPiPzo
gSYC3EtdcJvhaC2jqyhx1JSeR8I+d2U+tzE3OeOOxTvgOK4m3cvZhCsQIttPaO7I
DPW3ctqDYQc8/T4UQWMEyOhsKEGSplxrk8AdvzSG2QP+OOZ0gDBMh2s5ywREjSMq
OFf/tW6QdZm0CuxIYMV1PsdsYFZPI+v8MEtfGyjNw+NmkUEO/VYqQ80J0UC0rbbt
6MUT32vyLkDz0JN+IWW9YQn4OccuFfI+IZStmuZJr9jOFICpMogmIW77oobwN9ai
QeEXEvqvazmVlqMukzaDSlr42yV5nknr6bF+mlTbGIMUkCV2w40OkciyeI30LzNm
cCs/KsJeGb384ArsqH7+5coTHILvacAN9LWjf5E96APCp/2mzXwWT1bMvr7VM7Q/
65C1scpoQ5KgIewf+nijWOn+5FEN6cKVPgW1y06GpI55KDUUGIMgSyb+V5pwwVNa
fRa3qPbASopfyCni/mxPnNqSDVodFks9pDqSrg0WvmQLDdlaAzfwPf5l4F47YNGr
CmnZ7GJb00SZC/M9Pkecy0zXBZv+dfiwjiVnXBDjqYwIC1wOnlj4JTeVuaC7cFuu
688Dr2YMEEk=
=PMk2
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Add more AMD Zen6 models (Pratik Vishwakarma)
- Avoid confusing bootup message by the Intel resctl enumeration
code when running on certain AMD systems (Tony Luck)
* tag 'x86-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/resctrl: Only check Intel systems for SNC
x86/CPU/AMD: Add more Zen6 models
|
||
|
Linus Torvalds
|
09feffa073 |
Miscellaneous timer fixes:
- Fix the arch_inlined_clockevent_set_next_coupled() prototype
in the !CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST case
(Naveen Kumar Chaudhary)
- Fix an off-by-1 bug in the sys_settimeofday() usecs validation
code (Naveen Kumar Chaudhary)
- Mark vdso_k_*_data pointers as __ro_after_init
(Thomas Weißschuh)
- Fix livelock race in tmigr_handle_remote_up()
(Amit Matityahu)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok/CQRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hpFw//US/OxvhU9WBdRsaULcezejwAkq+bUMHe
hrmGtdHSztO+6SsSMaRei9IaJz3YsZCNOYX2bMO3TwMBTtFBAmq5NVGWT6tYcnam
uHpH7qkt8n2HAsRHprBKzyM4Vo9ecYqVKXwd/lLyZyhs04q6iqmu8A99tIHb4e4C
tsNFxWJfhT+bjR/gwvU7uGSkQ1FUqlVNeRtN939/sPlXsRLKBOCHXTSnZ4JOTfL0
+QLae7LemYDxMT9M4fej3fJjoDGNQM0gb7K7FkOjwOHB8tHw2NJ9lRnD5MMh/oFx
Mq2BDfEQMum+LHjS3A/QhiymQQzbghnb6CVf4ae/hcBEdC7athoxJ1AzRDoqsD/N
EfFMaFVEaD3IZkNvU1u4BYDjQpNnnoK/TnYxa5fDoSD/VjVTknlr7gbfkUsJpwR5
cZ4EPk/zmilOJ8xWYlCJi9NHGMc+zsWT3FNdsOXiBt/GGOcu3lTQr8sjHBjm5cFi
coCbokGi6TRj9PA//oEds2JWTYIqXMADte7bleC0qmTfWPsJSHKECn+uOnUOyvg+
rlI8pRIo8uWo20MPjpwF+P4Dc5XGiR3TpvJ8iuXJvQNObItAjfBnJxbgo5fAM13d
VxfzZV2F++6ua/hsd8luAuMcdrFILTaiOEuXT9uyOPoMoBtORE+0CEQKTOgU0Z4e
rvoO+R992e8=
=Sp9X
-----END PGP SIGNATURE-----
Merge tag 'timers-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar:
- Fix the arch_inlined_clockevent_set_next_coupled() prototype in the
!CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST case (Naveen Kumar Chaudhary)
- Fix an off-by-1 bug in the sys_settimeofday() usecs validation code
(Naveen Kumar Chaudhary)
- Mark vdso_k_*_data pointers as __ro_after_init (Thomas Weißschuh)
- Fix livelock race in tmigr_handle_remote_up() (Amit Matityahu)
* tag 'timers-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
timers/migration: Fix livelock in tmigr_handle_remote_up()
vdso/datastore: Mark vdso_k_*_data pointers as __ro_after_init
time: Fix off-by-one in settimeofday() usec validation
clockevents: Fix duplicate type specifier in stub function parameter
|
||
|
Linus Torvalds
|
77e8e6861b |
- Fix uninitialized stack variable in rseq_exit_user_update()
(Qing Wang) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok+EARHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1jeMQ/9FaW8MLhxkd3r8ZULiAiYkF8j0/NZOSe1 EK+oBQm7SiBySiEngvrytAH3fZt3+lRpkxrP38n8BeFviaAbgSGvorVjg2Ac/LAb M42YLmtjNgOkPT/hrNtbWdKLBoqM7phBFtN9zLkVjDascNbLc2odBq25FhTKWhET 7hXXOf+Gv23kD4kWWh9S6VYbenOpIMPgwvcdyXK/bKRLLqplc7ZDoiahn1QpVAYg KTGeAAovuryKlxFTq3+FFjP8NXy2Ex8isu2K3tYylHRpHG6SSBTp5yGZV/886GIR rz46ojcbfOADCGOsEn2xaymmB7+NScXjYyvrzfnrE41WlenNYNVkEK6h2wvmHtn/ djUyUOJ+g+W4cyuZcf4lFZuq/0xO80Fll9ykmKvcEi7s0mpxEtngQ+V0kFNSj7XX N1lrd5LqIMxME1pkfWSc5m+RHsb33d1PDfpZkIxf107HGKhMWsF42t+c7yvk22HS 4jhdzUOKFL2ko3eyoFn6NCQvojI3YVmkVjUKrP+GBHSfMZV8g46i+sp9ux6erRG3 PkodV6tAcfaiLXLB0E3R5b0aes9LfZHGaAD6PtZ51Ujib95tr3Y1gvRpMmsJ1for GcJRIdcYE4U9/5vof69bkeNIfVQyCY3rM0rg7ALjOmjXSDBo5Ksi96pcYW2nqGyt mBUbd/yK69M= =AbXB -----END PGP SIGNATURE----- Merge tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq fix from Ingo Molnar: - Fix uninitialized stack variable in rseq_exit_user_update() (Qing Wang) * tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() |
||
|
Linus Torvalds
|
96c1ddbc16 |
Misc locking fixes:
- Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI
code (Ji'an Zhou)
- Fix a NULL pointer dereference bug in the rtmutex code
(Davidlohr Bueso)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok97sRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hq8A//YmVZmkJVV/5AFYZTJEHQmTpHYR4oyIKE
7u0glsuWfgO+m70RQLQK6FHFC8LRUVmn692fbTrXRb3sEmQvZwpvLjy0JfM2HgFm
Sv/1C0KKGQOE6UVcMIaiJIr+/uNXz6iC1zlln5rbdJOWfQdobNENTC1QDnzUPsWp
810up6kwkG/fgivaemsL29JH7HM5y7dWg8x9RmRmzRMsAVuX2NNeZWr3UVSB1ThA
n9DGR7rhZa2MSb0lDgmzEPn1mn3/8wvMDEaore9qAgXqwQ6wIxKc+9YQoi/CcpH3
Ar7/gsDXpgy1CS5qtwYBajFgwEhqLwtrN90bR4nW7CKFrFxRLZz/G7kS/iV2vjWd
CtlBYMINTNhXA2omuIaTSykt76Y44iV9tul/+m7XCTDocl2gKU/SYSn6+MoEnW+G
Nu3m8clJHQc5SavDJJL/LvIceemeiBUvOwRHYS6jrNcnaUbdwqXrRDYJNYVTIpYX
bdI3moWI25q8nC+rOSXDO9FxY+znJ5ZOEvd/j2W8nl2d7Io+NcJdC6Ec/vKsjIzq
3dORTAevrrqNi37VVRum2ht4QnFXRverFGrpLmgGHbufsBeFCQ7p4n6ovj2AjIg2
jpzwGrkDNZKnjFQrUi5vh70bKkrDlijLGvPGvTfu/7Ah7EYFqTLzNszor8B3XIkd
7eIAsWVGbIk=
=a6/Z
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI
code (Ji'an Zhou)
- Fix a NULL pointer dereference bug in the rtmutex code (Davidlohr
Bueso)
* tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
|
||
|
Linus Torvalds
|
e2264c52e1 |
regulator: Fix for v7.1
Arnd's randconfig testing turned up a missing selection of CONFIG_IRQ_DOMAIN which was causing build breaks. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmolTPsACgkQJNaLcl1U h9Bl/Qf8Dnbw3XoVw2UwJShpXGwPy5QJm0DTDcWOsiiRBge1qLpef+N+7oVf8yxJ O+03DLHEfTe27YU49M76TIzpYakLvR0QVMK5Zg01ffQOCXT1CMTOR6KFeEaP1AOE Fm2LU50IrQtor4WtuWxVzOu/jBZkli2l+0qeElJwsReWCigBFC6crx+wtSxc9YI4 U1H/iEcH+Yu2syLHMH0uAa+2OFsgVQEdz2wZn0unkkB9JcqjCB/dtNntrqxsGLX1 Xq3Xs/KhHMpOS6+zaPHR8qgzf3q2znsnUfW4gitKGHaQwP9o9JxKfNMm47H8eFAm 8XqW+ktte4lazvfvpwZKSJ04AVy1aA== =AwZI -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "Arnd's randconfig testing turned up a missing selection of CONFIG_IRQ_DOMAIN which was causing build breaks" * tag 'regulator-fix-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: mt6363: select CONFIG_IRQ_DOMAIN |
||
|
Linus Torvalds
|
33d8d8ec31 |
Input updates for v7.1-rc6
- two quirks for atkbd to deal with laptops that can not handle "deactivate" command on the keyboard PS/2 port. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaiT7xAAKCRBAj56VGEWX nIomAQDJ9sUO/BpoilRA48fsZr+BMOBmnAvtm6MlpnWkrJKFwAD8D7SmCEwY+blM cmBR5dHgGzb5PD1smow4kGTW7HV20wA= =9ZkJ -----END PGP SIGNATURE----- Merge tag 'input-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - two quirks for atkbd to deal with laptops that can not handle "deactivate" command on the keyboard PS/2 port * tag 'input-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) |
||
|
Richard Patel
|
15b4155138 |
riscv: cfi: reject unknown flags in PR_SET_CFI
prctl(PR_SET_CFI,PR_CFI_BRANCH_LANDING_PADS) silently ignored
unknown control values. Only PR_CFI_{ENABLE,DISABLE,LOCK} should
be permitted.
This changes the behavior of the uABI (fails previously accepted bits
with EINVAL).
Fixes:
|
||
|
Nam Cao
|
aad60bdd0b |
riscv: Fix fast_unaligned_access_speed_key not getting initialized
The static key fast_unaligned_access_speed_key is supposed to be
initialized after check_unaligned_access_all_cpus() has been completed.
However, check_unaligned_access_all_cpus() has been moved to late_initcall
while setting fast_unaligned_access_speed_key still happens at
arch_initcall_sync, thus the static key does not get properly initialized.
fast_unaligned_access_speed_key can still be initialized in CPU hotplug
events, but that cannot be relied on.
Move fast_unaligned_access_speed_key's initialization into
check_unaligned_access_all_cpus() to fix this issue. This also prevent
someone from moving one initcall while forgetting the other in the future.
Fixes:
|
||
|
Andreas Schwab
|
e3573f739e |
riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
Fixes a warning while dumping core:
[54983.546369][ C7] WARNING: [!note_name] fs/binfmt_elf.c:1771 at elf_core_dump+0x910/0xf68, CPU#7: abort01/31982
Fixes:
|
||
|
Nathan Chancellor
|
979c294509 |
cfi: Include uaccess.h for get_kernel_nofault()
After commit |
||
|
Cryolitia PukNgae
|
fb402386af |
Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
After commit |
||
|
Linus Torvalds
|
6086121dc4 |
sound fixes for 7.1-rc7
It's getting calmer, but we cam up with still a handful small fixes, including two core fixes. All look sane and safe. * Core: - Fix wait queue list corruption in snd_pcm_drain() on linked streams - Fix UMP event stack overread in seq dummy driver * USB-audio: - Add quirk for AB13X USB Audio - Fix the regression with sticky mixer volumes in 7.1-rc * ASoC: - Fix 32-slot TDM breakage on Freescale SAI - Varioud DMI quirks for AMD ACP -----BEGIN PGP SIGNATURE----- iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmokRfcOHHRpd2FpQHN1 c2UuZGUACgkQLtJE4w1nLE9uuw/9Fjp6ZQOfGXWzrn4UFiCPE2mzVNbclSIYIIUI iPRAM7+66Rj5IjPaY/a+csAjRAAodqYoTtZgA8rFfjpv4T4nEUbSfEFWnV252vzM JAHZxq4uuxEqUoy7iXPp4k3k9MzEY7AlOYm2F+3CY9cSwn3hwedD03Uq+2qzupmK GrVbYhsJD672rFWM9wmGS4hxarEbXjdtxXJ0i9m10/ydJ8bafURcAO62/74ly/JC YpF4EJpM1oYlDXrsDvWz226MTiu1o/NuIWU5cHEHeMejX5HXKpdR54mVcR9T/CO4 KCw2M2nddn92zInm4yRM05MS2dvlcVxixITTclnRS6bFi0N53wWuX2B1UHYiI+Ko aKM9Ph3GCaWP+4LwEXM0qG5AscRmpJ5aDx22SLB0ObdjjA4boYIrkLSQeocyWrP3 9JucaBD36IEYfwbYN4rK1iEBktzoPzTR57GGqVav0+B4b6D688mlgGjo4WtFowc1 F7AFrwmVozbKyAkq2gqF/6ufIrEY8RB+bRr41MtaG89gu6EiEyNE7V52Jg0WDr7L yw/XtZtN4H2t2TO+0hKTV0sLR1HPC/PoCNb5ayHq/8jpcKJ8uC0KfyxVsgpaC0AZ 3CmtQ4J3hWAFx0Hrl0YKH33taQyAD9M/iOa8WV068YoaxamrkmC3wpIV6C86wL8C FbUW4Uk= =HHlm -----END PGP SIGNATURE----- Merge tag 'sound-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "It's getting calmer, but we still came up with a handful of small fixes, including two core fixes. All look sane and safe. Core: - Fix wait queue list corruption in snd_pcm_drain() on linked streams - Fix UMP event stack overread in seq dummy driver USB-audio: - Add quirk for AB13X USB Audio - Fix the regression with sticky mixer volumes in 7.1-rc ASoC: - Fix 32-slot TDM breakage on Freescale SAI - Varioud DMI quirks for AMD ACP" * tag 'sound-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: seq: dummy: fix UMP event stack overread ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams ASoC: amd: acp70: add standalone RT721 SoundWire machine ASoC: amd: yc: Add MSI Raider A18 HX A9WJG to quirk table ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write ASoC: amd: yc: Enable internal mic on MSI Bravo 17 C7VF ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11 ALSA: usb-audio: Set the value of potential sticky mixers to maximum |
||
|
Linus Torvalds
|
d054796f8b |
Rust fixes for v7.1 (2nd)
Toolchain and infrastructure:
- Fix 'rustc-option' (the Makefile one) when cross-compiling that leads
to build or boot failures in certain configs.
- Work around a Rust compiler bug (already fixed for Rust 1.98.0) thats
lead to boot failures in certain configs due to missing 'uwtable'
LLVM module flags.
- Support a Rust compiler change (starting with Rust 1.98.0) in the
unstable target specification JSON files.
- Forbid Rust + arm + KASAN configs, which do not build.
'kernel' crate:
- Fix NOMMU build by adding a missing helper.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmokBWQACgkQGXyLc2ht
IW02uw//a6zLSwQh3c6wevbyfogCtFXA9zfEmS0VIgaFQ7rtBIMPGCIujXrg7mtM
uc0ZKg27dUyZQfrsKufjkP7ziQbwNaVowuR1/EVeFkF3bWH6BsaJic0/ewFAqbET
lua0IORlqIjxgCCYW4y93NdzzUAwM1ClENzxWsNBd1HdY0t3ZZqpySie6q2sbjws
MVr49Ghne5Q+HOeAgL3vK0ZblPx0Ujd+NcCBDVTzfliwNziGnVW5cS4QKdcYpEdc
nHIHUCpkV2oBivalLSXHPiZBVKRRRq8cNL0iS+6fZdukDER87HJ81EPESfndQFen
xdU5Qj7VHbr/PRR56P6dUpFdqcKCY3/HyoTBbr3GVGnH6pz0hs2605YoMsJI3Js8
IBkVNIAm2P3ud+oTDdA9+2vW/mBFCunfIdogqVPqb5DrPzjSl5uCgAOgX4J2yLLF
FfytH8kSqplLDdCuFq6bFNdZMgEK9qzZR99OqChh2N4xBxFeTuF1Ng+OPGJRSOxz
vlLXCav/j92ckoocqPzMG0V5AjxnrdRfql6lYZqrw7D6lrmMzwJuO7SaXiX+OkL4
hn6GB9FgWX+D6kKHotoMa51UjaDvCHOm3c2K/ROLQ5uuidFsK/585cQDg72/sq+3
nvAAjleYK9VESnlJ8h5BJWdgdWY5CRW/wwh3rprcc1gfXz1jtkA=
=7GFy
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix 'rustc-option' (the Makefile one) when cross-compiling that
leads to build or boot failures in certain configs
- Work around a Rust compiler bug (already fixed for Rust 1.98.0)
thats lead to boot failures in certain configs due to missing
'uwtable' LLVM module flags
- Support a Rust compiler change (starting with Rust 1.98.0) in the
unstable target specification JSON files
- Forbid Rust + arm + KASAN configs, which do not build
'kernel' crate:
- Fix NOMMU build by adding a missing helper"
* tag 'rust-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: x86: support Rust >= 1.98.0 target spec
rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
rust: helpers: add is_vmalloc_addr wrapper for NOMMU builds
rust: kasan/kbuild: fix rustc-option when cross-compiling
ARM: Do not select HAVE_RUST when KASAN is enabled
|
||
|
Linus Torvalds
|
76351effa5 |
vfs-7.1-rc7.fixes
Please consider pulling these changes from the signed vfs-7.1-rc7.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiQb2wAKCRCRxhvAZXjc ol4fAP46Ta2gcT8uzJRHaXo3HMWJYY02dK1pXQ4zZDdiQMMSTgEAuaj/mOvx0VeX prloV/t7TBri6GAiWeE7Wu54d9rJZQ4= =clMX -----END PGP SIGNATURE----- Merge tag 'vfs-7.1-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix error handling in ovl_cache_get() - Tighten access checks for exited tasks in pidfd_getfd() - Fix selftests leak in __wait_for_test() - Limit FUSE_NOTIFY_RETRIEVE to uptodate folios - Reject fuse_notify() pagecache ops on directories - Clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - Fix failure to unlock in nfsd4_create_file() - Fix pointer arithmetic in qnx6 directory iteration - Fix UAF due to unlocked ->mnt_ns read in may_decode_fh() - Avoid potential null folio->mapping deref during iomap error reporting * tag 'vfs-7.1-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: avoid potential null folio->mapping deref during error reporting fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() fs/qnx6: fix pointer arithmetic in directory iteration VFS: fix possible failure to unlock in nfsd4_create_file() signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() fuse: reject fuse_notify() pagecache ops on directories fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios selftests: harness: fix pidfd leak in __wait_for_test pidfd: refuse access to tasks that have started exiting harder ovl: keep err zero after successful ovl_cache_get() |
||
|
Linus Torvalds
|
8e65320d91 |
drm fixes for 7.2-rc6
core: - disable the gem change handle ioctl for security reasons (plan to fix it on list later with proper test coverage) dumb-buffer: - remove strict limits on buffer geometry amdgpu: - BT.2020 fix for DCE - DC bounds checking fixes - SDMA 7.1 fix - UserQ fixes - SI fix - SMU 13 fixes - SMU 14 fixes - GC 12.1 fix - Userptr fix - GC 10.1 fix - GART fix for non-4K pages amdkfd: - UAF race fix - Fix a potential NULL pointer dereference - GC 11 buffer overflow fix for SDMA xe: - Revert removing support for unpublished NVL-S GuC - Suspend fixes related to multi-queue i915: - Fix color blob reference handling in intel_plane_state - Revert "drm/i915/backlight: Remove try_vesa_interface" ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmojVuUACgkQDHTzWXnE hr4uYxAAlYQS0NuQoNrXkLG/4jIwD8aG+83bnUWCEYn59Qurk7ojH4frwDSkxSi/ Klqzk1zdbsIC6LOjI1gevhBY1Z1ASgzBAr7G44lpofeGI7zdxiSAZ6lEu9ClUVLI I6dO73xLtGve5/0pgTrxsSz5p8ZKJhLSHhBf0oCyaKxGEsrirWR3ofV5RqWMy4HS +Y/wouBG69pe8B3OK8SZhXQhJxvhnws6i8p4+pMSAhfICIsMh5aTLsNEwRxdIGzh xXaOsE+mrhWOd6vmwK4qX4HprSocNTJyoRW7hkIFeWLwn0ZIJAmKwgWxmMAgebBe RRHB5dBAm0Krn3RDc1od8dqwZ6YxWRDi1rROJmV93u+qKoYdAIoxpofTW6eB4p4q lphLjTM0EQvreF4XShydMPWta5tiEYIUFL4OWf1eUR8C9Ejd0G8CeKZpDT/gLwWO lxozV9+EZdLAkaGLoBxeghCZPBlsmkYWZ8M++8jLaJQWx1QeCSBCulMEyDEO2MN6 4kM+awVZJ3Ou28Pjux23jSXxRgzRC/Bk373MEijX9FnB2lEYmgFDs9+kMNX1dmsj BcRi8+XSoUh9m1PoLuM+t+/Q+0neUdIfAX/6hqwbWp3knXtM7lQmUpgSo1hcpmop vMIbWZT3/ZjoFrwJSv1HuvYzpiF7YTCzv/BpVZU938FLMyBcOlk= =mrV8 -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly drm fixes, not contributing to things settling down unfortunately. Lots of driver fixes for various bounds checks, leaks and UAF type things, i915/xe probably the most sane, amdgpu has a mix of fixes all over, then ethosu has lots of small fixes. The problem of fixing thing in private has really hit us with the change handle ioctl, and "Sima was right" and we should have disabled the ioctl, since it was only introduced a couple of kernels ago and failed to upstream it's tests in time. The patch here fixes the problems Sima identified, but disables the ioctl as well, with a list of known problems in it and a request for proper tests to be written and upstreamed. It's a niche user ioctl designed for CRIU with AMD ROCm, so I think it's fine to just disable it. Maybe this week will settle down. core: - disable the gem change handle ioctl for security reasons (plan to fix it on list later with proper test coverage) dumb-buffer: - remove strict limits on buffer geometry amdgpu: - BT.2020 fix for DCE - DC bounds checking fixes - SDMA 7.1 fix - UserQ fixes - SI fix - SMU 13 fixes - SMU 14 fixes - GC 12.1 fix - Userptr fix - GC 10.1 fix - GART fix for non-4K pages amdkfd: - UAF race fix - Fix a potential NULL pointer dereference - GC 11 buffer overflow fix for SDMA xe: - Revert removing support for unpublished NVL-S GuC - Suspend fixes related to multi-queue i915: - Fix color blob reference handling in intel_plane_state - Revert "drm/i915/backlight: Remove try_vesa_interface" ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring" * tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernel: (50 commits) drm/gem: Try to fix change_handle ioctl, attempt 4 Revert "drm/i915/backlight: Remove try_vesa_interface" accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() accel/ethosu: reject DMA commands with uninitialized length accel/ethosu: fix arithmetic issues in dma_length() accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85 accel/ethosu: reject NPU_OP_RESIZE commands from userspace accel/ethosu: fix IFM region index out-of-bounds in command stream parser drm/v3d: Fix global performance monitor reference counting drm/xe/multi_queue: skip submit when primary queue is suspended drm/xe: Clear pending_disable before signaling suspend fence Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems drm/amdgpu/userq: move wptr_obj cleanup in mqd_destroy drm/amdgpu: improve the userq seq BO free bit lookup drm/amdgpu/userq: remove the vital queue unmap logging drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 drm/amdkfd: fix NULL dereference in get_queue_ids() drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) ... |
||
|
Simona Vetter
|
1a4f03d22f |
drm/gem: Try to fix change_handle ioctl, attempt 4
[airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far: |
||
|
Dave Airlie
|
8ff3adc8c3 |
Merge tag 'drm-intel-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
- Fix color blob reference handling in intel_plane_state (Chaitanya Kumar Borah) - Revert "drm/i915/backlight: Remove try_vesa_interface" [backlight] (Suraj Kandpal) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Tvrtko Ursulin <tursulin@igalia.com> Link: https://patch.msgid.link/aiKgmwz7VGOaFXIv@linux |
||
|
Dave Airlie
|
f80cbe57ec |
Short summary of fixes pull:
dumb-buffer: - remove strict limits on buffer geometry ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmoiedAbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3ojlPgH/3dtzYxSDc/66kxFEdYw RUOemMjs+EbT8+NU9k0H4rI3IWur8IzOEBXvlVSGwe4J2RusqWDnKpbJij34VgZq 524oSLk92Me+VmO3L3QE07OaZ233tOKYKV44CZraBcBVAl4NSnnmf2pV3yrddsBQ 8vKJPmSCRMiQprkFYcyQc6YEbix/MVXMLRUxS0lNZzCtH5594Ft2ugD+4VMl1Bkd sMi8dMYQrsv2qsgRJhvZHOjT7E1mJuH6DLEn7jgvx3oO4ONZWb4kJ7clgozsLcZn hLFgtQMh8AR+lJaDshRVj5P+xlzgoGkM7eLEjSTQWv1VQ9EMw4/orOWpm55U9v17 4gY= =lxiE -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: dumb-buffer: - remove strict limits on buffer geometry ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260605072602.GA268798@linux.fritz.box |
||
|
Linus Torvalds
|
c10130c234 |
io_uring-7.1-20260605
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmojJQ0QHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgppGsD/0d9CxOz1SLooS0ufvmb0+Jm1d8tHe+NeNv ALINBbvytrEppGNh4M+u25ZcWzevKHZTCIM9++nBNJOlTHLvP+E8dIdUuZvct2GU y1jK28y/K9iM11MMAN2ey7OI8J20ABQGoCfXXwmBbqw3eM27gap74GpLwQ6vDG7E xCnzS8M9R7MUxO2Y2ZfQkfgMUuViNMe3V9r4zz0Dgjn1Ao8cWduJ4BsZBN3sRMtA D9EqU2kd4SscnwYSb8guPlshf3u0oY1GBTFozgUiqPw9bz6EAPk90ikr8gUgsWyk UxgEWQLgIcwkpM+ym5kBGYcy4htA3bYM0XkYN5CaTzFg47roaQW9XVe+w14IAtKR iSVpVGjDv/zZRJjDadN95GEXtVy5ZYZrIt2+2qwns9lTqGwAzHfVlnjNx2tqq4VS LVhqgM6UzXHXun0CpBJVZ66j6kKjDyme8j0RjgZ/Gt2QhnrFIBfUiXjac5UgiZjp +4s9VWdNViomho24lgxgtpGwRPXfdZjbl8LPS2O3tywOQOikUGBpVM7Nja82N/0b mV2szmMl6nCu0wHfqQ54nP7maZa0TtLU6K1ozSd5spOrY5ZDsrleLiciRSCbNR2R jRKEUsReZe7CZ/4h/atZws2/eVCpYh2PMnSFMb1w8v5gnQk94ryPd9KKYbK8dsGk zU0OdJxJ2A== =OdYU -----END PGP SIGNATURE----- Merge tag 'io_uring-7.1-20260605' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "A single fix for a missing flag mask when multishot is used with an incrementally consumed buffer ring, potentially leading to application confusion because of lack of IORING_CQE_F_BUF_MORE consistency" * tag 'io_uring-7.1-20260605' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries |
||
|
Linus Torvalds
|
06121e12c2 |
Third round for Kbuild fixes for 7.1
- kconfig: Fix repeated include selftest expectation
Fixes the currently broken kconfig tests
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Zhou Yuhang <zhouyuhang1010@163.com>
Cc: Zhou Yuhang <zhouyuhang@kylinos.cn>
Cc: linux-kbuild@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEh0E3p4c3JKeBvsLGB1IKcBYmEmkFAmojB54ACgkQB1IKcBYm
EmkQZBAAuCoL7X6Ol7zDXUzhUiuwKiUBL6kVnW7HKG5iAANk/+1LFW8nCoA2Tu6q
uJbZgrlNi/xiq4Wjbr5/MpjmM/vlscLjoacs7hiypOD8UTylcgk2SXMXiUoubns8
tvjBXmnYs2U0J276lwP5hfeWUbnMo7kTWfE7u4GQVEQk8NLPiMnc2/ptqNZ/a02b
jJ3ahuQ1P4DFflUkpgxCXuSRGJat8Y3uzzRO1eNvvZ8EJgg7r8I2QD00aUwuYNSb
ro+UZDdwgVfdD0dwtGgGempQd7qHrS98iKs9fRz6r4TxrHr27Ops9P/PkFP8QtEB
lLQhA0TYSjy4MRfARJHzwfj+fBf5AlXvzKIvxm8pFLq5RMP1b27HP+k7CrsFZceJ
p0mZu6h6CxCgA8g67II6uqhMYzfdbj/jbYBhZjQGafiCT4BH8Qi955BZFTeuQsLc
EcIpoe8w2yUjCRVK2Hp1nkG/C//Irj7BNwyVPd5yHE5ld3gnRfrvpvghfLXvFrHt
1OFihS0jiIrnojcMa/xvw4ZC44/MOktHWgfb9G5KaJWzMRT/1PFwJ2wbS1f5HVQn
htHwJ3CIn2gRbK/oTH7O/Js4MgpcQLO7LrQD5J5fnR+Gmvx+G85QZWa3OiWdrN/8
p9Y7m9hgmx/oApcQzHtOQxaPDrVRINBR6A+wcbCGmGoHUFq53k4=
=Ve6e
-----END PGP SIGNATURE-----
Merge tag 'kbuild-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fix from Nicolas Schier:
"A single simple commit that fixes the currently broken kconfig
selftests"
* tag 'kbuild-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
kconfig: Fix repeated include selftest expectation
|
||
|
Linus Torvalds
|
95b78879a8 |
Arm:
- Correctly drop the ITS translation cache reference when it actually
gets invalidated
- Take the SRCU lock for SW page table walks
- Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming
inaccessible from EL0 after running a guest
- Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init
and MMU notifiers are mutually exclusive
- Correctly handle FEAT_XNX at stage-2
s390:
- More fixes for the new page table management and nested virtualization
x86:
- More fixes for GHCB issues
- Read start/end indices of page size change requests exactly one per vmexit
- Unmap and unpin the GHCB as needed on vCPU free
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoi/4cUHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroOhbQgAryMnK/ik3rzTO/FW6LlHzkQRMN/J
WUE/LB7X9DNynWb5MDfE4dDPrH+jxb8YHeX82vMs3vXi5FXqvdBUTR96O0p9PWuE
pvjiICmpIqYn63vCZiIh0UwvbvaF8ADGr6moCvUfzoxanvnhZBFCzFEDdrKTIw3B
RimdLJ61zEGc8Sjly8GIT8IB3bDmS/GqdKk61fAYGXsDf8QJ2dESuM4/+hed7Yyq
NbT6ar4mrMjZKD2tcPx9ZgrCnqCJFnXmir3EEU2OMxxdXgbpz3cf2YOmA1fwBoQ0
E9qjNybNwnYJnhBn94vZdPSxOADzTKjRmhJ7LSxpvaq3HaZg3ZG1/bshCg==
=tJp+
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"arm64:
- Correctly drop the ITS translation cache reference when it actually
gets invalidated
- Take the SRCU lock for SW page table walks
- Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming
inaccessible from EL0 after running a guest
- Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init
and MMU notifiers are mutually exclusive
- Correctly handle FEAT_XNX at stage-2
s390:
- More fixes for the new page table management and nested
virtualization
x86:
- More fixes for GHCB issues:
- Read start/end indices of page size change requests exactly once
per vmexit
- Unmap and unpin the GHCB as needed on vCPU free"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (23 commits)
KVM: arm64: Correctly identify executable PTEs at stage-2
KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
KVM: arm64: Reassign nested_mmus array behind mmu_lock
KVM: arm64: Restore POR_EL0 access to host EL0
KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free
KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()
KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT
KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata
KVM: SEV: Make it more obvious when KVM is writing back the current PSC index
KVM: s390: Remove ptep_zap_softleaf_entry()
KVM: s390: Fix possible reference leak in fault-in code
KVM: s390: Prevent memslots outside the ASCE range
KVM: s390: Lock pte when making page secure
KVM: s390: Fix fault-in code
KVM: s390: vsie: Fix rmap handling in _do_shadow_crste()
KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl()
...
|
||
|
Linus Torvalds
|
d1b0937f0e |
Probes fixes for v7.1-rc6
- tracing/probes: Point the error offset correctly for eprobe argument error Fix the eprobe event parser to point error position correctly. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmoi0xkbHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8b5awIAL8sYmBb+0dZO9uPvAwS Ar0IlPGd/lnfLNUF5nmin+fSyAr4TIqLIuKjHZ2MxFGxtyITzWQDbXIBT7Wan5vy 3adAJTVgby+jz2k+MvTU1hU1wBt4E4nGvJQJf9Ohk7NuqiUYSDjbkPa2yA3fGFFY HGvvRlj0OF6eYbyiGIUTk5S4AYeBOFB6/qB9MbMTUHPXiM0LgzBVuR+Rimo1iFNO wdqJ9atrj8r4hdvAQLPeKXAfhahhHXlviGVDjtgGa9Gt7jESPw8fDdh5PWKWr7Vy 6Mr/o/16V13bFx4zWRacSwgSFsJsZukDS+bdD5HnEGhb8AYZxOYvy79H6URT3S4e rws= =rQ/U -----END PGP SIGNATURE----- Merge tag 'probes-fixes-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing/probes fix from Masami Hiramatsu: "Fix the eprobe event parser to point error position correctly" * tag 'probes-fixes-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Point the error offset correctly for eprobe argument error |
||
|
Zhou Yuhang
|
65b09bfa8a
|
kconfig: Fix repeated include selftest expectation
The err_repeated_inc test was added with an expected stderr fixture
that does not match the diagnostic printed by kconfig.
Running "make testconfig" currently fails in that test even though the
parser reports the duplicated include correctly:
[stderr]
Kconfig.inc1:4: error: repeated inclusion of Kconfig.inc3
Kconfig.inc2:3: note: location of first inclusion of Kconfig.inc3
The fixture expects "Repeated" and "Location" with capital letters, but
the diagnostic emitted by scripts/kconfig/util.c uses lowercase words.
Update the fixture to match the real message.
Fixes:
|
||
|
Paolo Bonzini
|
7ec0360122 |
KVM/arm64 fixes for 7.1, take #5
- Correctly drop the ITS translation cache reference when it actually gets invalidated - Take the SRCU lock for SW page table walks - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming inaccessible from EL0 after running a guest - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init and MMU notifiers are mutually exclusive - Correctly handle FEAT_XNX at stage-2 -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmoi9m8ACgkQI9DQutE9 ekMOqRAAwCXKfCTXWTbWVrzyPvkHHktQUnUANY262VxFmOzvIlxONu0zQK/Saagl YMJ/nfLbwI4Cz2sLeBplxcyh8dVoc6EglDbB+d+7gXIJWVxA5ToM3yt1Yn+g4hpc 4LTIapANeIDlQ+Z8PyR2WdEdo9a89j9qs+goBgscjHF85N2Qh10G3wioeCGQVTYw Z1woVhyx4VlcUOPWYS3Ws3yqbICousxe5zsKLXb2v5nybauBS7fjh7ACbX2pBlmi X4Pip4vIyfv0hyq5rdvcb/m8pjXgXrrdaZ2pJpvm2ioa5MAQ1SvvHo+HDsOPuoCl p0TlDARd9JpMZdNko5/3qmAmMlE2ap9Qqh7zaAlxt/THoI/0G/7NOaKBclGcp/nw +KjDEFriws2Yeqce+Tl8pF0/MBCmNV61BVSa91xGG3pRdxThV/NCxD4oRWLCDMRJ 3UEAwNVV6FZW7rAbdzlG/spjmloMGPzWq4Mg+iu6BunfOBI6RlabHlRqhaU8SZ/O dX82lzfCpouikgETSJNi7Ta/aCBDWLeuM01TuZ05RO5vCfTdB50SFlmXMRO5zjR0 tVCKg5roKkVd2D81g/kssehpGgOsiBqqiNK7LMYhxzEMC0aySobrtbbq6KT0RVez fbQsrLvFFVGUAMp3k84s2BF+K7EXUh98GgqLerwbg2mp7UhqpW0= =8bS2 -----END PGP SIGNATURE----- Merge tag 'kvmarm-fixes-7.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.1, take #5 - Correctly drop the ITS translation cache reference when it actually gets invalidated - Take the SRCU lock for SW page table walks - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming inaccessible from EL0 after running a guest - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init and MMU notifiers are mutually exclusive - Correctly handle FEAT_XNX at stage-2 |
||
|
Linus Torvalds
|
a8dc5f60d1 |
NFS client bugfix for Linux 7.1
Bugfixes: - Fix a use after free in nfs_write_completion -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR8xgHcVzJNfOYElJo6EXfx2a6V0QUCaiLziAAKCRA6EXfx2a6V 0fX1AP0VI3hJgrOufhJZNFh5/yYTKNtuNIsVzObrbKDirhZjMwEAgQEXgXeB8tN4 IxCq3qi8eK600iLKqn7PwjAvHMrZiwY= =qHOO -----END PGP SIGNATURE----- Merge tag 'nfs-for-7.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fix from Trond Myklebust: - Fix a use after free in nfs_write_completion * tag 'nfs-for-7.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: write_completion: dereference loop-local req, not hdr->req |
||
|
Linus Torvalds
|
6a5358410a |
xfs: fixes for v7.1-rc7
Signed-off-by: Carlos Maiolino <cem@kernel.org> -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCaiKcdwAKCRBcsMJ8RxYu Y4d+AX9CjmcF5yEZVe+7YCc0ktUUvm0EQwXmGDMCm8UzT1kcWVRDF2eIxu/cYKjo a1AfN9gBgMA/yJNYWyUluSiF+vTD2y2iuCX08k2p/8qplUEuEINRjooEp6bgJ6bN BYeFp1mXSw== =Kpi8 -----END PGP SIGNATURE----- Merge tag 'xfs-fixes-7.1-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "A collection of fixes mostly for the RT device, including a small refactor that has no functional change" * tag 'xfs-fixes-7.1-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: Remove mention of PageWriteback xfs: abort mount if xfs_fs_reserve_ag_blocks fails xfs: factor rtgroup geom write pointer reporting into a helper xfs: drop the RTG reference later in xfs_ioc_rtgroup_geometry xfs: fix rtgroup cleanup in CoW fork repair xfs: fix error returns in CoW fork repair xfs: fix overlapping extents returned for pNFS LAYOUTGET xfs: fix use of uninitialized imap in xfs_fs_map_blocks error path xfs: handle racing deletions in xfs_zone_gc_iter_irec |
||
|
Linus Torvalds
|
2b389a573b |
Changes since last update:
- Fix a UAF of sbi->sync_decompress when compressed I/Os
race with unmount
- Fix a regression introduced this development cycle that
incorrectly rejects multiple-algorithm images
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmoiGEoRHHhpYW5nQGtl
cm5lbC5vcmcACgkQUXZn5Zlu5qrkCQ/9HTsNbR3k+xFvSd7wNtV3s2pKRX2ctEVn
KWiOk5ZNRWUWImL7a0gEwjGtkGPDg4yXWHQnm0hPO6bBqXOXoPuDomsSDC5EzvQ+
ID2dxkc+nJeg9MkiKEY3W78yTkOI8Xrn8ZYi02U30Vk0vzWiiEnJG9pKp6XTheAi
zRA2iqoiE00wTbAZCW3xqyHcw2djBRuaBYPYycHJCw3D+sVcnuVrLUeeFNKXsar1
p2FG+9tzPgMhMFJgTkiD7SA0dmRp4PoJsY1d1P1uuqBJ/PFWmWTbnCmNvUZUQFcR
d2rT0jxlW4oA+lzP/RT0lDmvR3howEy4F+gLlsh8jYO5RmtLyAv5gVzxqugN0Jc4
ZSRX6qgVYhsHe/DzbPIbZFjcWUNs7Q1gS6NwUhjlZ9r4CJ2Yh/n43koPWwJB/xTt
HmkSuaOatu5zDHvohlbX2AAoxALDs+fO9lu9C9cgCAx/dS01zdgUyCWYIH43+OAp
BveL+jmzdzLnMakCs3ImsrgTZXxqrmCe0HgsCVjqGsmDCk8y3CDmMhG1EYn0bOgA
OnbkGj2Q/MmXJbrgsogOgc6oIg+sFf1GzMiNFeUTm7nSHgmoqI2f+aTMz9qNmKZu
9XPvyzfPFF/0NPxF9c0e7bwiMyaZLXaHn1wG2eXbubSQbIxRBmnid8XiA/SaOHUq
kY6gkXUB+4k=
=CHHg
-----END PGP SIGNATURE-----
Merge tag 'erofs-for-7.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs fixes from Gao Xiang:
- Fix a UAF of sbi->sync_decompress when compressed I/Os
race with unmount
- Fix a regression introduced this development cycle that
incorrectly rejects multiple-algorithm images
* tag 'erofs-for-7.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
erofs: fix use-after-free on sbi->sync_decompress
|
||
|
Linus Torvalds
|
e4a9638a0b |
three ksmbd server fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmoh6iQACgkQiiy9cAdy T1HZagv+PVKZ5Djru4YzKQH19sYHkiav7FLzwZZy+bTmGlApWci6m/7aBojZOeac t5vaFURjrrGSAY5QQGjtr7rFgsQsQkU6AuSo8BnaGXRdzf9HoMkI0TI/OOGfuELX BCD10yoX8m8SwnrXIPaqHoyfn0uhUHRZk8okWPtPzv19VZK3t84XkQjLjR+IYHwb UZWhmGanjqw2yS5kTuWr6M3+POLnDqrdEzNj8R1ugcQ5aH/s1vfVEUi1vXKnGSBa ZPldxXRUpbEUMwrk1PyXd4Hb/OKpQrAoj3kl6sBXLNvLHtiw4i8+NkpGDg00eXYE xOqAdADNFpWx1lIJVJ845Enn5twaGM8y7KlXr+lEGfVU7iCKahs4d0RkjQON5aTo 1HTx+nov4cP0nojvnPONU0li576E66ryqWzpBqsfEN93ROi+x7snuT9vB6QCjGHH lDv0UgsGF9TGWw2sBBQXhgYBXiFs2e1YSvdfT6KAd2x2SEJOIZ8yM6+ZNLzS1zTP XGjnnZ7S =7kge -----END PGP SIGNATURE----- Merge tag 'v7.1-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix use after free in SMB2_CANCEL - Fix race in ksmbd_reopen_durable_fd - Fix oplock and lease break potential NULL-dref * tag 'v7.1-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers |