github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,446,793 Commits 1 Branch 940 Tags 24 GiB
e7524845cd
Commit Graph

1446793 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Torvalds
e7524845cd cgroup: Fixes for v7.1-rc6 
One cpuset fix and a maintenance update, both low-risk:
 
 - Fix cpuset partition CPU accounting under sibling CPU exclusion that could
   produce wrong CPU assignments and trigger scheduling-domain warnings.
   Includes selftests.
 
 - Update an email address in MAINTAINERS.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCah9Z6A4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGVX5AP4+fK552V1p4VmIyvIJoWnejnwj5iqLLQ5ibTYM
 gCFESQEA2IdF+YizlhcU7kMqkER7N6natK/jRUjPTnv/9IFqcAc=
 =tevl
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:
 "One cpuset fix and a maintenance update, both low-risk:

   - Fix cpuset partition CPU accounting under sibling CPU exclusion
     that could produce wrong CPU assignments and trigger
     scheduling-domain warnings. Includes selftests.

   - Update an email address in MAINTAINERS"

* tag 'cgroup-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup/cpuset: Change Ridong's email
  cgroup/cpuset: Add test cases for sibling CPU exclusion on partition update
  cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask calculation
 2026-06-03 08:59:24 -07:00
Linus Torvalds
ac5c3716c6 sched_ext: Fixes for v7.1-rc6 
Two low-risk fixes:
 
 - Drop a spurious warning that can fire during cgroup migration while a
   sched_ext scheduler is loaded.
 
 - Fix a drgn-based debug script that broke after scheduler state moved into
   a per-scheduler struct.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCah9Z2A4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGT1zAQCjQeWMm3ULnezjh6Oqx7KhPAdq20Gfzx6/hwjM
 Lq1xHAD7B1aiUrMc6Hg405EI6vP9lScjxF6TyvEqmtfL0EmA0ww=
 =mZNl
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:
 "Two low-risk fixes:

   - Drop a spurious warning that can fire during cgroup migration while
     a sched_ext scheduler is loaded

   - Fix a drgn-based debug script that broke after scheduler state
     moved into a per-scheduler struct"

* tag 'sched_ext-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
  tools/sched_ext: Fix scx_show_state per-scheduler state reads
 2026-06-03 08:52:26 -07:00
Ridong Chen
57aff99111 cgroup/cpuset: Change Ridong's email 
The chenridong@huaweicloud.com is no longer a valid email,
replace it with the personal email ridong.chen@linux.dev

Signed-off-by: Ridong Chen <ridong.chen@linux.dev>
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
 2026-06-02 11:28:54 -10:00
Tejun Heo
02e545c429 sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() 
A WARN fires when systemd's user manager writes "+cpu +memory +pids" to
its own subtree_control while a sched_ext scheduler is loaded:

  WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0
   scx_cgroup_move_task+0xa8/0xb0
   sched_move_task+0x134/0x290
   cpu_cgroup_attach+0x39/0x70
   cgroup_migrate_execute+0x37d/0x450
   cgroup_update_dfl_csses+0x1e3/0x270
   cgroup_subtree_control_write+0x3e7/0x440

scx_cgroup_can_attach() arms cgrp_moving_from only when a task's cpu
cgroup changes. It can still be NULL when scx_cgroup_move_task() runs,
through this sequence:

  Step                               Result
  ---------------------------------  ----------------------------------
  1. cpu enabled on cgroup G         cpu css = A
  2. cpu toggled off then on for G   A killed, B created (same cgroup)
  3. an exiting task keeps A alive   migration skips it, A now stale
  4. +memory migrates G              stale A vs current B pulls cpu in
  5. cpu attach runs for all tasks   hits a live, cpu-unchanged task
  6. scx_cgroup_move_task() on it    cgrp_moving_from NULL -> WARN

The mismatch is that scx_cgroup_can_attach() keys on cgroup identity
while migration drives the move on css identity, so a NULL cgrp_moving_from
here is a legitimate css-only migration, not a missing prep.

The call is already gated on cgrp_moving_from, so just drop the warning.
ops.cgroup_prep_move() and ops.cgroup_move() stay paired.

Fixes: 8195136669 ("sched_ext: Add cgroup support")
Cc: stable@vger.kernel.org # v6.12+
Reported-by: Matt Fleming <mfleming@cloudflare.com>
Closes: https://lore.kernel.org/all/20260601124156.2205704-1-mfleming@cloudflare.com/
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
 2026-06-02 11:27:50 -10:00
Linus Torvalds
ba3e43a9e6 soc: fixes for 7.1, part 2 
Following the previous set of fixes, this addresses another significant
 number of small issues found in firmware drivers (tee, optee, qcomtee,
 qcom ice, exynos acpm) drivers through various tools. This is about
 error handling, resource leaks, concurrency and a use-after-free bug.
 
 The fixes for the Qualcomm ICE driver also introduce interface changes
 in the UFS and MMC drivers using it.
 
 Outside of firmware drivers, there are a few fixes across the tree:
 
  - Minor driver code mistakes in the Atmel EBI memory controller,
    the i.MX soc ID driver and socfpga boot logic
 
  - A defconfig change to avoid a boot time regression on multiple
    qualcomm boards
 
  - Device tree fixes for qualcomm, at91 and gemini, addressing
    mostly minor configuration mistakes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmofFFQACgkQmmx57+YA
 GNkoZxAAjEoE6xgVJjQBQug02+puOll3DSjYjYahg434nUoIpfY4bU4247eUtvxi
 QU5kSRQbMaYBpBM5pqgqdG0P0KiP8UsrDWgGr1CbHhCtO2H2cJ6ICUFAXmgpZ+n3
 P7R4hROu+EoRb6urgRG6koL6LYId1nRSKOvWsPEz8cXcVE/nwdaYgU6GB9aS2B0v
 zAcLGMtACNU9iiDZNW+pt97CkMr38pjEkcmWxfQBSqcjck0JsujHCuCWLwPALKAo
 V1aSKPgg1YUMs3+2LeXyhv5rFrBmXfRJ1v7unLKXAvJ9k+DZb63D5AIFT6xjD7Qh
 nF/IgPmiFPaYKVskTWS7UHWVLZY7mBstb4gWei1fNE8deCXA35ntuNSg1YkIabvF
 s/g5g2/EuiCTobZLO+xAGHJvfB/iVx2k2w6CzYpxXtOOf8CNzskWkRnerK3RF+TM
 LIN1JhrZJzAnHL+Z8jv3z2+vo1sUOMuQax723xYoh/7LUUr1yp0hBJExkjJJ8s3q
 5GOob3WnjH9n15OAsJvNXlKIWstIi/BPSXyATmca6tDsEnuv3KE9Sok4ZT/Gsjxk
 2L/aIlnnu6qX4BlQ7Hrfl2+LDp7jX1RP7MFMGxHscD36ws7ZU9asoUc5MxPrnZno
 Oay2HTyiA42YvsN+R6oI331VSTd/hXLemqvP9JpENvSbpuGm2So=
 =uqVQ
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "Following the previous set of fixes, this addresses another
  significant number of small issues found in firmware drivers (tee,
  optee, qcomtee, qcom ice, exynos acpm) drivers through various tools.

  This is about error handling, resource leaks, concurrency and a
  use-after-free bug.

  The fixes for the Qualcomm ICE driver also introduce interface changes
  in the UFS and MMC drivers using it.

  Outside of firmware drivers, there are a few fixes across the tree:

   - Minor driver code mistakes in the Atmel EBI memory controller, the
     i.MX soc ID driver and socfpga boot logic

   - A defconfig change to avoid a boot time regression on multiple
     qualcomm boards

   - Device tree fixes for qualcomm, at91 and gemini, addressing mostly
     minor configuration mistakes"

* tag 'soc-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits)
  firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion
  firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
  firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
  ARM: dts: gemini: Fix partition offsets
  ARM: socfpga: Fix OF node refcount leak in SMP setup
  soc: qcom: ice: Fix the error code when 'qcom,ice' property is not found
  arm64: dts: qcom: eliza: Add power-domain and iface clk for ice node
  arm64: dts: qcom: milos: Add power-domain and iface clk for ice node
  tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()
  tee: fix params_from_user() error path in tee_ioctl_supp_recv
  tee: shm: fix shm leak in register_shm_helper()
  tee: fix tee_ioctl_object_invoke_arg padding
  arm64: defconfig: Enable PCI M.2 power sequencing driver
  scsi: ufs: ufs-qcom: Remove NULL check from devm_of_qcom_ice_get()
  mmc: sdhci-msm: Remove NULL check from devm_of_qcom_ice_get()
  soc: qcom: ice: Return proper error codes from devm_of_qcom_ice_get() instead of NULL
  soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
  soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
  ARM: dts: microchip: sam9x7: fix GMAC clock configuration
  firmware: samsung: acpm: Fix mailbox channel leak on probe error
  ...
 2026-06-02 10:54:11 -07:00
Linus Torvalds
4a694a77c3 13 hotfixes. All are for MM. 10 are cc:stable and the remaining 3 
address post-7.1 issues or aren't considered suitable for backporting.
 
 There's a 3 patch series "userfaultfd: verify VMA state across UFFDIO_COPY
 retry" from Mike Rapoport which fixes a few uffd things.  The rest are
 singletons - please see the individual changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCah5U6wAKCRDdBJ7gKXxA
 jmzcAP9N+WQo4qNZYYjSURqJof48Q4nght5C0ZHtsVk5itNJEQEAiecouCreqDSE
 VUY9mQHyEawIfORkPTUijnkjV8b+lwc=
 =m8J3
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2026-06-01-20-58' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM fixes from Andrew Morton:
 "13 hotfixes. All are for MM. 10 are cc:stable and the remaining 3
  address post-7.1 issues or aren't considered suitable for backporting.

  There's a three-patch series "userfaultfd: verify VMA state across
  UFFDIO_COPY retry" from Mike Rapoport which fixes a few uffd things.
  The rest are singletons - please see the individual changelogs for
  details"

* tag 'mm-hotfixes-stable-2026-06-01-20-58' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  userfaultfd: remove redundant check in vm_uffd_ops()
  userfaultfd: refuse to __mfill_atomic_pte() for unsupported VMAs
  userfaultfd: verify VMA state across UFFDIO_COPY retry
  mm/huge_memory: update file PMD counter before folio_put()
  mm/huge_memory: update file PUD counter before folio_put()
  mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
  mm/damon/ops-common: call folio_test_lru() after folio_get()
  mm/cma: fix reserved page leak on activation failure
  mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
  mm/hugetlb: restore reservation on error in hugetlb folio copy paths
  mm/cma_debug: fix invalid accesses for inactive CMA areas
  memcg: use round-robin victim selection in refill_stock
  mm/hugetlb: avoid false positive lockdep assertion
 2026-06-02 08:59:35 -07:00
Linus Torvalds
6f3ed7fec7 - fix race condition in dm-cache-policy-smq 
-----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRnH8MwLyZDhyYfesYTAyx9YGnhbQUCah2mPxQcbXBhdG9ja2FA
 cmVkaGF0LmNvbQAKCRATAyx9YGnhbVGGAQDNaDwK2kE1az7Jpgu91U23R8fSxeBz
 SomeFHmqEHcEQAEAk2/3vG20zshIWFbz9Y1ZdZ9q9RKLrAh/83i3YVLbkQQ=
 =D0RT
 -----END PGP SIGNATURE-----

Merge tag 'for-7.1/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fix from Mikulas Patocka:

 - fix race condition in dm-cache-policy-smq

* tag 'for-7.1/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm cache policy smq: check allocation under invalidate lock
 2026-06-01 19:55:30 -07:00
Linus Torvalds
4b5821f73b auxdisplay for v7.2-1 
* Fix potential out-of-bound access in line-display library
 * Miscellaneous refactoring and cleaning up
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqaflIX74DDDzMJJtb7wzTHR8rCgFAmodSKkACgkQb7wzTHR8
 rCgnTBAAoHqEq6XKc6qqsShvyDhcyiyGdGasF1a1kfMVRTjRYa/KytEgD8Jl27N/
 MTmN3mq+Z2INKovcs4iGoRUAFxMAs9pzRqBQHI6u98mhwbMuWklCzaRa9NyrdEAI
 iHYpWZ557qGsn+aU/N9Q9Dy78FIOFlKSuvgbLQmjr1XQUwpbc7EkPO0o3QD/o7qP
 BphL0FpP6CMhLsb7+ZyFjjN+ntftvZ92LGVaBBiZA+xqDHHTzcEVHDNdl4C/0ZjS
 JIDTtStCgcCBHg/EUHJ68Oa2yEqOuWsuclX+YoL22Zu2qi7UW0FFhQEXiKtx/eMi
 HS2C1aYGVQVLvFjuTe1lYO1PbxCL5ddhvZarz+8LfvK03T6ExPHkB/Z1VUWJoE+L
 3ZrGpjFw6LOkk3MkeCul2MNclmvspPz2XKUern9+pX62NWbOxSbzRNknDH87muSF
 iQMpo8qTNf+9XlyxC2EGNS6IqwAJ/qXCXUmXdFJzRoWtwLmm6CBiwZGxaPE5XwsB
 iWvitQj0dkPjcgungKhl0c/eZ0wpZ8HFEh4muUIEIP/uZWiNjQywGGXyuduhlKvs
 ro2uDWSBG/7EVds676abD3Po/PRYUzxD3KgrN2CG0C+8YuqWc8tO7pcWtKWgI+yt
 tw143EAS30/HBCsP7A+wdNG0Rddlv4NaE5PTaz7zbQmOc5YqFho=
 =VUfV
 -----END PGP SIGNATURE-----

Merge tag 'auxdisplay-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay

Pull auxdisplay updates from Andy Shevchenko:

 - Fix potential out-of-bound access in line-display library

 - Miscellaneous refactoring and cleaning up

[ Andy says this could easily be delayed until 7.2, but it's _so_ tiny
  that it's more work for me to schedule it for later than to just take
  it now, and just doesn't seem worth delaying    - Linus ]

* tag 'auxdisplay-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay:
  auxdisplay: Kconfig: drop unneeded quotes in PANEL_BOOT_MESSAGE dep
  auxdisplay: line-display: fix OOB read on zero-length message_store()
  auxdisplay: max6959: use regmap_assign_bits() in max6959_enable()
 2026-06-01 19:50:33 -07:00
Guangshuo Li
d3f0a606b9 dm cache policy smq: check allocation under invalidate lock 
commit 2d1f7b65f5 ("dm cache policy smq: fix missing locks in
invalidating cache blocks") added mq->lock around the destructive part of
smq_invalidate_mapping(), but left the e->allocated check outside the
critical section.

That leaves a check-then-act race. Two concurrent invalidators can both
observe e->allocated as true before either of them takes mq->lock. The
first invalidator that acquires the lock removes the entry from the
queues and hash table and then calls free_entry(), which clears
e->allocated and puts the entry back on the free list. The second
invalidator can then acquire mq->lock and continue with the stale result
of the unlocked check.

This can corrupt the SMQ queues or hash table by deleting an entry that
is no longer on those structures. It can also hit the allocation check in
free_entry() when the same entry is freed again.

Move the allocation check under mq->lock so the predicate and the
destructive operations are serialized by the same lock.

Fixes: 2d1f7b65f5 ("dm cache policy smq: fix missing locks in invalidating cache blocks")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
 2026-06-01 17:30:24 +02:00
Arnd Bergmann
fce4668a01 SoCFPGA dts fix for v7.1 
- Fix OF node refcount leak
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmoVtIMACgkQGZQEC4Gj
 KPR1iA/+PXPSx51qgfkJKNUrEzAq8WOrsjDMrLI596unfXVpi4thWy5+4DaSIk8A
 o+1u8iXwHTNFeBcG+KUKqVmCAgyVLc3ZZ3OkaCH2+y0MBa6qKXI/+7/0yd/4F5Hu
 5L+e0QrUdUEJKvjAXZAIym8RqYnXR53P0Ur3imGqkJlqZFwnME+Eez0Uvtj5fIZA
 NEDeSbbrwVsQ4etOfI0HjyI/lkEFEJqcgVg2APOraDtPmM9Wmf9XXh5BRUvgLptK
 JTtYa7exiLyX0qbgWE/+7w7omjruDYOgXTrzjrpuW+rlH/jvh+ATJrl2R7bIR6lJ
 0Ez2T/9W1WD6p8LxgMIyg8eFXfKf+cVFIyGmS95F0Q5jC1cRRdM84JPDHHcO5QYO
 tr3m4IwORyQbzAyAjbq/KRiBEx0LsjuBTLQez/YrDbMdy0BrgTIYvT26taV+bSXF
 4iF50SbtGuQz3A8N5USOD4mo1bkx7QI1ezVNqXZJuuJ9+B4ieeOPzcg9s0Y4D+6z
 qP2OdaaaU9c8IYLxClHk3k5QMiPP9PgosPMfrCd1Iw18qaUNIaTMbc+3k4sAyMpz
 WNbKgIHgOR/amWGrUgoyAYwvs5IYOhJvU1L3yslgRxzMMrvW5Mx13nuCVw/44gD8
 BS5VwUyfPjeOxfkZJVOtUxwBX3znQJkHjIUFD6lfDAHTjFlSn/M=
 =Qs3M
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmodllEACgkQmmx57+YA
 GNlnnA/+PO0ieAuD1mwzSgcPhWeT9r9x33s4YrjYvzXtm+WW5G7tRcdlPzFkIIbP
 nbvU2/0h2nNcxH2fr3HcTqEy2BHVoE0M5rJ0+K806XIfIJPP1BAVUguTUi8BojFF
 fLILUVVCsc0dmMduvBkD0HjDR+ZxRxw21NzMtG3ufCp095bk6YZD/D6rrYAvLSRd
 sxotmyBdoIYL755/BOeNWNT362c8NvK6p2j3VAItozJeGT7c37t4x6tu4hbzWh6H
 cxJodqQFRhIbURiDc6tMGoUOAM1bpnX0z7l/swnRT9aQo3oAzhwkas2RBhfVUmDi
 c2Z+4s1INMRnkPIyOtjwNsIUrRukNXaS5WpnWjkEc7xtdjmfw9jwnmkbHqx80nHq
 qY688wZ2u+UFFJuX6MQxJ2J6Iu2ws8w+ZnMSgR46SRv3wiEHUUFJVvVnk8SAyZ6D
 y0JMstYbPHIkF0cWc9SA2FZE524ak6X2qJCSro+VVRne2RaDFgJv1Q6rSWPCU9Cd
 75wO6MXI0TP5bTm0wCYe6OPvNErsG0O7ezs4H48tofU8kL0vfpmAoLnrzG3xq/9g
 HaUea7kOtekkfdicnjnV9hK6PhUHrhxfbCkNkLsZCbRnqsQim/B/3Hyi+jwFvDhe
 Rlu4/qwTp9c8Zk+hyEDuNF2uORiSNS3dF5EGdDGCiGF6t5cR5fY=
 =p4Za
 -----END PGP SIGNATURE-----

Merge tag 'socfpga_fix_for_v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes

SoCFPGA dts fix for v7.1
- Fix OF node refcount leak

* tag 'socfpga_fix_for_v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  ARM: socfpga: Fix OF node refcount leak in SMP setup

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-06-01 16:25:19 +02:00
Arnd Bergmann
d4715546cc Microchip AT91 fixes for v7.1 
This update includes:
 - a fix for the GMAC DT node on SAM9X7 SoC to properly describe the
   available clocks
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTsZ8eserC1pmhwqDmejrg/N2X7/QUCahxHEwAKCRCejrg/N2X7
 /aZcAP9W2CfnPGFuBHoT4DR3NLDcqgt0p6hni2RpV3P+ELK1NgEAqIYlIyf0RXbV
 j4TU9cbq6Z7iXb2hsMjF1gebKj1V6QU=
 =Z26Y
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmodlkkACgkQmmx57+YA
 GNkk2BAAsLgM/0tVJsx22CF0KouOrDhyjjbKt7/i70qnCkhC9K831X9O8dFBYIma
 8hZT/Rc0PWX9KueQl2IqiI+KKY2kjZ+zJGS64j21LVmdzPgVgR3/gzgf81IIzJMO
 aBuL7JbOZAO8aZ5sJQc6xvPo+fdO1sZmBU0yMRLZbSiOyH3rbpDO7KVAJzOo95F5
 GC3cNPGqSt91ytNSBI8E8OhVrJktr7ssgKOsIaGRxfERVTBA+utGfqJucDQJHIOC
 VDGg/31KQfvkz2cgrqFKzP6xAKk2drqM5Z5b7jZpu4FQkSEz2lAeqQEE1i+9eDx4
 EntZUaro1xQUOmk4J2MYLb0Kbf89jEvQ33wZogYpjLWsUt4nSAeviS2fcN4B8OQ7
 L7oYHeQh2hZoqncaz8xRT8R5WHvN8udI29LHsPBVNaka/BTphkgE35Ggxww5H0Ij
 XeWxyx4+DpxJk2NZ0UdlF1tUCSz5hEInLMkJ8uOsY5FFmBa8h57KHnCymu/wxn8G
 CFm/lc4p/VkIrivU0Kn9YHYT1HtBpYE2q9U9clLPthxI/IGma7DjF8qy+FXXQ51m
 0zdp/OcCVcVWIpOPj+iFyucQUpxY+mdAEWN5ppIf3yZVYxcxFWVOW6ADzHP1G9N2
 1ryn6jJIqp6mm9W+T7hNbgUqzraTGH4gHGjUD+79dVQeL1HVZZk=
 =xRm6
 -----END PGP SIGNATURE-----

Merge tag 'at91-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes

Microchip AT91 fixes for v7.1

This update includes:
- a fix for the GMAC DT node on SAM9X7 SoC to properly describe the
  available clocks

* tag 'at91-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux:
  ARM: dts: microchip: sam9x7: fix GMAC clock configuration

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-06-01 16:25:03 +02:00
Mike Rapoport (Microsoft)
9d7bea186b userfaultfd: remove redundant check in vm_uffd_ops() 
Lorenzo says:

  static const struct vm_uffd_ops *vma_uffd_ops(struct vm_area_struct *vma)
  {
          if (vma_is_anonymous(vma))
                  return &anon_uffd_ops;
          return vma->vm_ops ? vma->vm_ops->uffd_ops : NULL;
  }

  This is doing a redundant check _and_ making life confusing, as if
  !vma->vm_ops is a condition that can be reached there, it can't, as
  vma_is_anonymous() is literally a !vma->vm_ops check :)

Remove the redundant check.

Link: https://lore.kernel.org/20260527184751.4147364-4-rppt@kernel.org
Fixes: 0f48947c42 ("userfaultfd: introduce vm_uffd_ops")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Suggested-by: Lorenzo Stoakes <ljs@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: David Carlier <devnexen@gmail.com>
Cc: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-05-31 21:50:26 -07:00
Mike Rapoport (Microsoft)
df3ee3b3bb userfaultfd: refuse to __mfill_atomic_pte() for unsupported VMAs 
__mfill_atomic_pte() unconditionally dereferences ops because there is an
assumption that VMAs that can undergo mfill_* operations are vetted on
registration and must have valid vm_uffd_ops.

Add a guard against potential bugs and make sure __mfill_atomic_pte()
bails out if ops is NULL.

Link: https://lore.kernel.org/20260527184751.4147364-3-rppt@kernel.org
Fixes: ad9ac30813 ("userfaultfd: introduce vm_uffd_ops->alloc_folio()")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Suggested-by: Lorenzo Stoakes <ljs@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Reviewed-by: David CARLIER <devnexen@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Michael Bommarito <michael.bommarito@gmail.com>
Cc: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-05-31 21:50:25 -07:00
Mike Rapoport (Microsoft)
85668fda93 userfaultfd: verify VMA state across UFFDIO_COPY retry 
Patch series "userfaultfd: verify VMA state across UFFDIO_COPY retry", v2.

... and two more small fixes.


This patch (of 3):

mfill_copy_folio_retry() drops the VMA lock for copy_from_user() and
reacquires it afterwards.  The destination VMA can be replaced during that
window.

The existing check compares vma_uffd_ops() before and after the retry, but
if a shmem VMA with MAP_SHARED is replaced with a shmem VMA with
MAP_PRIVATE (or vice versa) the replacement goes undetected.

The change from MAP_PRIVATE to MAP_SHARED will treat the folio allocated
with shmem_alloc_folio() as anonymous and this will cause BUG() when
mfill_atomic_install_pte() will try to folio_add_new_anon_rmap().

The change from MAP_SHARED to MAP_PRIVATE allows injection of folios into
the page cache of the original VMA.

There is no need to change for hugetlb because it never uses
mfill_copy_folio_retry().

Introduce helpers for more comprehensive comparison of VMA state:
- mfill_retry_state_save() to save the relevant VMA state into a struct
  mfill_retry_state (original uffd_ops, relevant VMA flags, vm_file and
  pgoff) before dropping the lock
- mfill_retry_state_changed() to compare the saved state with the state
  of the VMA acquired after retaking the locks
- mfill_retry_state_put() to release vm_file pinning.

Use DEFINE_FREE() cleanup to wrap mfill_retry_state_put() to avoid
complicating error handling paths in mfill_copy_folio_retry().

Link: https://lore.kernel.org/20260527184751.4147364-1-rppt@kernel.org
Link: https://lore.kernel.org/20260527184751.4147364-2-rppt@kernel.org
Fixes: 292411fda2 ("mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry()")
Fixes: 6ab703034f ("userfaultfd: mfill_atomic(): remove retry logic")
Co-developed-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Suggested-by: Peter Xu <peterx@redhat.com>
Co-developed-by: David Carlier <devnexen@gmail.com>
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-05-31 21:50:25 -07:00
Yin Tirui
8d87805992 mm/huge_memory: update file PMD counter before folio_put() 
__split_huge_pmd_locked() updates the file/shmem RSS counter after
dropping the PMD mapping's folio reference.  If folio_put() drops the last
reference, mm_counter_file() can later read freed folio state via
folio_test_swapbacked().

Move the counter update before folio_put().

Link: https://lore.kernel.org/20260526101337.1984081-1-yintirui@huawei.com
Fixes: fadae29530 ("thp: use mm_file_counter to determine update which rss counter")
Signed-off-by: Yin Tirui <yintirui@huawei.com>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Acked-by: David Hildenbrand (arm) <david@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Chen Jun <chenjun102@huawei.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Yang Shi <yang.shi@linux.alibaba.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-05-31 21:50:25 -07:00
Yin Tirui
40990c87a2 mm/huge_memory: update file PUD counter before folio_put() 
__split_huge_pud_locked() updates the file/shmem RSS counter after
dropping the PUD mapping's folio reference.  If folio_put() drops the last
reference, mm_counter_file() can later read freed folio state via
folio_test_swapbacked().

Move the counter update before folio_put().

Link: https://lore.kernel.org/20260526101355.1984244-1-yintirui@huawei.com
Fixes: dbe5415329 ("mm/huge_memory: add vmf_insert_folio_pud()")
Signed-off-by: Yin Tirui <yintirui@huawei.com>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Acked-by: David Hildenbrand (arm) <david@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Chen Jun <chenjun102@huawei.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-05-31 21:50:25 -07:00
Muchun Song
c7bde43f6d mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback 
vmemmap_restore_pte() rebuilds restored vmemmap pages from a tail-page
template derived from compound_head().  This is wrong when the current PTE
already maps a page whose contents are not tail-page metadata.

In the rollback path of vmemmap_remap_free(), the first restored PTE is
backed by vmemmap_head and contains head-page metadata.  Reconstructing
that page from a tail-page template overwrites the head-page state and
corrupts the restored vmemmap page.

Fix this by copying the full page from the page currently mapped by the
PTE.  Also pass vmemmap_tail to the rollback walk so only PTEs backed by
the shared tail page are restored, while the head PTE remains mapped to
vmemmap_head.  Add VM_WARN_ON_ONCE() checks for unexpected cases.

Link: https://lore.kernel.org/20260525025213.2229628-1-songmuchun@bytedance.com
Fixes: c0b495b91a ("mm/hugetlb: refactor code around vmemmap_walk")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Kiryl Shutsemau <kas@kernel.org>
Acked-by: Oscar Salvador (SUSE) <osalvador@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-05-31 21:50:24 -07:00
SeongJae Park
d6b8b02a27 mm/damon/ops-common: call folio_test_lru() after folio_get() 
damon_get_folio() speculatively calls folio_test_lru() before
folio_try_get().  The folio can get freed and reallocated to a tail page. 
In the case, VM_BUG_ON_PGFLAGS() in const_folio_flags() can be triggered. 
Remove the speculative call.

Also mark folio_test_lru() check right after folio_try_get() success as no
more unlikely.

The race should be rare.  Also the problem can happen only if the kernel
has enabled CONFIG_DEBUG_VM_PGFLAGS.  No real world report of this issue
has been made so far.  This fix is based on only theoretical analysis. 
That said, a bug is a bug.  A similar issue was also fixed via commit
3203b3ab0f ("mm/filemap: don't call folio_test_locked() without a
reference in next_uptodate_folio()").  I don't expect this change will
make a meaningful impact to DAMON performance in the real world, though I
will be happy to be corrected from the real world reports.

The issue was discovered [1] by Sashiko.


Link: https://lore.kernel.org/20260525162256.8317-1-sj@kernel.org
Link: https://lore.kernel.org/20260517234112.89245-1-sj@kernel.org [1]
Fixes: 3f49584b26 ("mm/damon: implement primitives for the virtual memory address spaces")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: Fernand Sieber <sieberf@amazon.com>
Cc: Leonard Foerster <foersleo@amazon.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-05-31 21:50:24 -07:00
Linus Torvalds
e43ffb69e0 Linux 7.1-rc6 2026-05-31 15:14:24 -07:00
Linus Torvalds
8d9c51eac6 [GIT PULL for v7.1-rc6] media fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmocey8ACgkQCF8+vY7k
 4RVECg//S/RyTkfjj+T98e7/mfmTDvCGt0Yf3ZqrZFpKG86Abea7itEzUkOWHLBy
 eiJPvQIN2DX1ShIUl2FCA7WLb0tcrWDthQnXEjiY6FIsxJ9vFOO1xt3ITTIEBoV4
 yWepMVxbWYcG/Keo8CHb3JqopOpiuJD5GARSEXBLAq/1qib8RYFBR1mrkIlSRJm6
 22vso92qMFutAgVGbIlCbrh+xQ4UphpvVj1PEGe/eFA5P0zF1y0tpwc+ZIXUV855
 w8ZfVHBJH6CWpwNyBqSVc012rzKFmZafoZi4iENIbOMSeeq/aNNk31zW5DurQ4I+
 qcb9usbhHdfDTDCelfdaIXyUX7EaFkXJUu/n9hIYjSxVR9hRTwwVWsoGCyWBIMdl
 Q+nW1JnRlKo3Qc8Yh7h3Pvb0v38kqzzoOQKXdsMdmkzgkMlnEn/dy5mkVyKAmRN6
 E7RECkfOehRnWLFGHaLIbcqLCurIOVcpfqZKaTDC1wTE8UeMb9XBNDDKRyqpMABQ
 rFowKDtkwFXsJtAqfpgF1nwanJD9alMkgBAAKti/QkbLuJKLN7yxyhx0i/pUEy7i
 0Oe/JQ+xHnnozeVpLQtQS2fLu7Dbni2B4M06J1MO5N4AZIlHpMOVjGpOhzDyIiZb
 BMu1w28zPzsfGhInm8dE0uVg5COG8Tp9BhMgXJyIJdiG23hPoIc=
 =52nn
 -----END PGP SIGNATURE-----

Merge tag 'media/v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:

 - rc: igorplugusb: fix control request setup packet

 - vsp1: revert a couple patches to fix regressions when setting DRM
   pipelines

* tag 'media/v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: rc: igorplugusb: fix control request setup packet
  Revert "media: renesas: vsp1: brx: Fix format propagation"
  Revert "media: renesas: vsp1: Initialize format on all pads"
 2026-05-31 11:50:39 -07:00
Linus Torvalds
968966c282 Miscellaneous x86 fixes: 
- Make the clearcpuid= boot parameter less prominent
    and warn about its dangers & caveats (Borislav Petkov)
 
  - Do not access the (new) PLATFORM_ID MSR when running as a guest
    (Borislav Petkov)
 
  - x86 ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines, to fix crash when using such trampolines
    (Alexis Lothoré)
 
  - Fix x86-64 CFI build error (Peter Zijlstra)
 
  - Revert FPU signal return magic number check optimization, because
    it broke CRIU and gVisor in certain FPU configurations
    (Andrei Vagin)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmob2swRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jCdA//aKJpLZRwT3cHs/Wmu8oh+MbWVcOJqavz
 Vkdbh5EEDQJ0/HAbrt/ms3gismg08GBTSpycJIKCF+p98n0s3hjBSzVJjF1kLbT+
 vCZH4M3qXiYylghu+gHCYwCPr8cWEWjf+x8nIBlBdHgDPJ88g09VHmtHRdnwFMOt
 lA6lew7UfNlUqxMA6p58elIZtbJvRG7QpUHHjOidut5uBSvrij08vPo1IYFAqUw8
 DvQnvXEv1jit8zAOp7gQDheqdzP058zk6kR177taIxLDJsJlqL8ozJRDW4NB72v2
 HBaj8DiXzsXyovck/H/t36nv5ikotNjDvlP31RZfTZ5VIlfvyNPF1vb38kC8lVlC
 gfq2H8Bw3pktldDKTFh0f1XnkmmiDTEf/zsDqeMSDXfF4t5LPw15nfRLzU9rO4nd
 po6s9GhLdo5lOv6BG2dsFhYxLSZTEHFTe03Q8EzGNgYUJupJVAtRwmnGQP0zv9QJ
 /nMUhZQPGN5PCeXo2YMdyB+wWaKVRjfAE2lz/V97Vb3WfjSAQ1eF+kb0keDFFwQD
 3HQq8k2nxLFIXEX7LJa+qTH2Hnu0PZgoy9yRreo2sOaUHcTfzAIxyT5RzeKl+eDw
 0wUjDGkXS7vCzIOMp4+H2HC3r5aeCTX9YY0XWhxs8M0UcGzO8XEKdgjJTD6KiKCY
 RX9Uj2FmmIA=
 =4sLh
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:

 - Make the clearcpuid= boot parameter less prominent
   and warn about its dangers & caveats (Borislav Petkov)

 - Do not access the (new) PLATFORM_ID MSR when running
   as a guest (Borislav Petkov)

 - x86 ftrace: Relocate %rip-relative percpu refs in dynamic
   trampolines, to fix crash when using such trampolines
   (Alexis Lothoré)

 - Fix x86-64 CFI build error (Peter Zijlstra)

 - Revert FPU signal return magic number check optimization,
   because it broke CRIU and gVisor in certain FPU configurations
   (Andrei Vagin)

* tag 'x86-urgent-2026-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  Revert "x86/fpu: Refine and simplify the magic number check during signal return"
  x86/kvm/vmx: Fix x86_64 CFI build
  x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
  x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a guest
  Documentation/arch/x86: Hide clearcpuid=
 2026-05-31 08:52:16 -07:00
Linus Torvalds
13bd441bb9 SCSI fixes on 20260531 
Two core changes, the only one of significance being the change to kick queues
 in SDEV_CANCEL which had a small window for stuck requests.  The major driver
 fixes are the one to the FC transport class to widen the FPIN counter to
 counter a theoretical (and privileged) fabric traffic injection attack and the
 other is an iscsi fix where a malicious target could trick the kernel into an
 output buffer overrun.  Both the driver fixes were AI assisted.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCahxQ/RsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIX+HgD+Mqf+AKbV/EhPhKAfONeBaE0Q5e78KTyK
 3e47Qxjs+mQBAKhWUwodLDS/WSm7Fbdj7tn/kuPSaH+R+JQltnPR4QPG
 =BRJ7
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two core changes, the only one of significance being the change to
  kick queues in SDEV_CANCEL which had a small window for stuck
  requests.

  The major driver fixes are the one to the FC transport class to widen
  the FPIN counter to counter a theoretical (and privileged) fabric
  traffic injection attack and the other is an iscsi fix where a
  malicious target could trick the kernel into an output buffer overrun.

  Both the driver fixes were AI assisted"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: iscsi: Validate CHAP_R length before base64 decode
  scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
  scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
  scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
  scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
  scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()
  scsi: megaraid_sas: Fix NULL pointer dereference on firmware duplicate completion
  scsi: devinfo: Add BLIST_NO_RSOC for Promise VTrak E310f
  scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
 2026-05-31 08:45:08 -07:00
Linus Torvalds
9cf1afe6de i2c-for-7.1-rc6 
davinci: fix fallback bus frequency on missing clock-frequency
 virtio: mark device ready initially
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmocCPMACgkQFA3kzBSg
 KbaSxw/+Kp+Rcj0G2RTRqpf5d7V9KIY35l+7gerd8/F7+zfIVNDJrz0FQfiTn6hr
 nB0EPmKtq1VnJDMxCFeCT0P4AoNBFbGCXxmCXkVnypUiLeHooBFZH5d8f+HCII4c
 t72HKZ0OgitAu12ApgnNFuMoInUnVrQy64DfIjkDxQLWva08WfW2mT74Ok61OJHd
 TjgononOu/Tsrk/F0fekRdxfAXx8myULOG/kLIxRNlv4ysv962ros2t0i05PtYyg
 z+wz0uZ1KP06nmOwZz0Pm1dlVHNuAlWqfzczF4Drts4Qj3vIHhuhIVQM4zGdylSR
 39KGiDmpOomPg9OIg70iMGw/FBDPd6UcOj20AWrTKsRENTU2xnIslQ/9Nk00RF7Q
 mP1kBolEkaXF7pugdeBDDWi7iwbawT6dpKlv/hSr6hAnBJXnLO+QxXaMproEl/1f
 igRoYx/Q/BCozYp3aR7ZahUKUF+xfpIkSfFZ02DUcbf2mBsSmQNXwN1VjrUkBqnQ
 VSYLZsBz+kqgkF+yAr2sL7BfTYzFCKeJMPOfBK4OF3wXZ43omCCWzr2hxMTGehTS
 17K5lHtzxneaAdTDLrFDUe8YBMSvKRolGcnIcnrNM/4fc7QEYBDaYns6j05vpnrP
 +4rDv4Db/hRxL6FsUuVaMc5aW9tdT+oxkVv9jea+2EbI7rxdqIM=
 =AcAd
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:

 - davinci: fix fallback bus frequency on missing clock-frequency

 - virtio: mark device ready initially

* tag 'i2c-for-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: virtio: mark device ready before registering the adapter
  i2c: davinci: fix division by zero on missing clock-frequency
 2026-05-31 08:33:08 -07:00
Linus Torvalds
227abb780c Input updates for v7.1-rc5 
- updates to Elan I2C touchpad driver to handle a new IC type and to
   validate size of supplied firmware to prevent OOB access
 
 - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II and
   "Nova 2 Lite" from GameSir controllers as well as a fix to prevent a
   potential OOB access when handling "Share" button
 
 - an update to Synaptics touchpad driver to use RMI mode for touchpad in
   Thinkpad E490
 
 - updates to Atmel MXT driver adding checks to prevent potential OOB
   accesses
 
 - a fix to IMS PCU driver to free correct amount of memory when
   tearing it down
 
 - a fixup to the recent change to Atlas buttons driver
 
 - a small cleanup in fm801-fp for PCI IDs table initialisation
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCahvBFwAKCRBAj56VGEWX
 nP7XAQDH9WIYBX7XEHSPInN6GH8GngWA/94v3b6UpBSL2UFdQQEAo1+WoyOGL/Dh
 0U0g5CcvDwx9irF8qJBWX2a3DRNPngo=
 =hDBA
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - updates to Elan I2C touchpad driver to handle a new IC type and to
   validate size of supplied firmware to prevent OOB access

 - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II
   and "Nova 2 Lite" from GameSir controllers as well as a fix to
   prevent a potential OOB access when handling "Share" button

 - an update to Synaptics touchpad driver to use RMI mode for touchpad
   in Thinkpad E490

 - updates to Atmel MXT driver adding checks to prevent potential OOB
   accesses

 - a fix to IMS PCU driver to free correct amount of memory when tearing
   it down

 - a fixup to the recent change to Atlas buttons driver

 - a small cleanup in fm801-fp for PCI IDs table initialisation

* tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
  Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
  Input: atlas - check ACPI_COMPANION() against NULL
  Input: atmel_mxt_ts - check mem_size before calculating config memory size
  Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
  Input: fm801-gp - simplify initialisation of pci_device_id array
  Input: xpad - add "Nova 2 Lite" from GameSir
  Input: xpad - add support for ASUS ROG RAIKIRI II
  Input: elan_i2c - validate firmware size before use
  Input: xpad - fix out-of-bounds access for Share button
  Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
  Input: elan_i2c - increase device reset wait timeout after update FW
  Input: elan_i2c - add ic type 0x19
 2026-05-31 08:27:18 -07:00
Linus Torvalds
174914ea55 two client fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmobEhoACgkQiiy9cAdy
 T1FKOwv+Nl0yAN9RgvfC5LEw7q2ksB+22y403iwzWMNwdUkn6SWfkDH2d4s2hNUP
 G6sV2FED64klTOPHbWaD71k44IIBOKuuKL8X+nfLHUesu4OpZl+pXH29a1n/F/Bk
 eRCWsnW2MkUhVFw1BNreck/JKLa0q8HH6gaq8eRBQwufkTrrcC4h0wCUyDZU+JIZ
 aCOZgCr1k9QlfHKnAZALdDYV8LjqJB45lVhnuDrX/gS4TqfNMXRFgxxFKK4nrdQu
 LCjYThsXaWl5d6sAbJRiDFa4TViYgT9uYus5YJDEjVMWUByYwCJppoFBboOGAjIo
 HITdjUrn+UEyzkgfC3jgiyFq674xzWFH07ZuKgTP3Tss7A2rWZx81sWP1hehmTTR
 4N+QKDcZUHVedvIkBwh2XC4E9oiNAE75SLgz+jO5aWY3H8QTIIojaUK6P6ZF7shG
 gG8UU16Ch+cHBKAanwOaUD3tNYss8LJx+3nD11JA4MYWbMfIKakVHft1/NN02zAW
 pi731q/v
 =Ms9+
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - fix uninitialized variable in smb2_writev_callback()

 - detect short folioq copy in cifs_copy_folioq_to_iter()

* tag 'v7.1-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: fix uninitialized variable in smb2_writev_callback
  smb: client: detect short folioq copy in cifs_copy_folioq_to_iter()
 2026-05-30 17:05:58 -07:00
Linus Torvalds
9d87d0fc8c liveupdate: kho: two regression fixes 
* fix order calculation for kho_unpreserve_pages() to make sure sure that
   the order calculation in kho_unpreserve_pages() mathes the order
   calculation in kho_preserve_pages().
 * fix math in calculation of KHO_TREE_MAX_DEPTH to make it work with 16KB
   pages.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmobGd4ACgkQOQOGJssO
 /ZGaRQf/a0vTak489XqXhddHkulyMnif1UEEYsltxQ8bJkC0SRx+v/PcC0Uf2g7+
 n/1vQZxWGUlLawjMDhubCWp2JawRZh9/rzPfb96z3nsjUckaQI3sKdEe7fK9jIVL
 2y2QHa26RJj7dlEcJbUToSgVbRrP8qJbiUVjo1i3ViVFsevj1gaNBo8h8oJa694z
 S1wXndBz7HYdSNuRgMc5rGUbzgVu9rl2rdTHR6ecRUfTVuQr1ZYrb7v6wi4AI3XL
 KZp6TXmDuvPikJwoWsQtBRK5VmLQxsCa5ryu4M+GEBOwezNZex29Yi2TrZWZ2KZk
 ViCFzYQLHY7RUrlhL7+tGN2SiLYKqg==
 =LtZL
 -----END PGP SIGNATURE-----

Merge tag 'liveupdate-fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux

Pull liveupdate fixes from Mike Rapoport:
 "Two kexec handover regression fixes:

   - fix order calculation for kho_unpreserve_pages() to make sure sure
     that the order calculation in kho_unpreserve_pages() mathes the
     order calculation in kho_preserve_pages().

   - fix math in calculation of KHO_TREE_MAX_DEPTH to make it work with
     16KB pages"

* tag 'liveupdate-fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  kho: fix order calculation for kho_unpreserve_pages()
  kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes
 2026-05-30 15:39:47 -07:00
Linus Torvalds
a29c0b0caf memblock: fix regression from memblock_free_late() refactoring 
After refactoring of memblock_free_late() and free_init_pages() it became
 possible to call memblock_free() after memblock init data was discarded.
 
 Make sure memblock_free() does not touch memblock.reserved unless it is
 called early enough or when ARCH_KEEP_MEMBLOCK is enabled.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmobERsACgkQOQOGJssO
 /ZGiqQgArOfAxLDWWinyherNcejWY+GKsNdWNYoGOv8UEw2oTTBmjyrOqHrGcevQ
 YlLjBxc2v9LzW9wCRnW0ngoq6/28ABLwyLpB+sMyHU8KaJDyYnAhfe7xt59aqE2N
 JuQaSRY8irZG8g2Yks2ZWIPbDoIXJVvGI342L96OYLO63eehV9u5e7kbBebOZpH1
 JlnbsaMGjhh2RgLrWWEy4EW1NZ5bYHer6fmCVIlUWtz9X67OjKD5na8bdi9ADEay
 Wu2CjYwZFdScM4FQ8r2l9UHxjnU8EQKRxVOm2+hO8wRiE3efzezDCp5Laacvf9o6
 KLrkVONfYUpScis3qLpNZly3IjAeVw==
 =H1VN
 -----END PGP SIGNATURE-----

Merge tag 'fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock

Pull memblock fix from Mike Rapoport:
 "Fix regression from memblock_free_late() refactoring

  After refactoring of memblock_free_late() and free_init_pages() it
  became possible to call memblock_free() after memblock init data was
  discarded.

  Make sure memblock_free() does not touch memblock.reserved unless it
  is called early enough or when ARCH_KEEP_MEMBLOCK is enabled"

* tag 'fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
  memblock: don't touch memblock arrays when memblock_free() is called late
 2026-05-30 15:37:05 -07:00
Henri A
171022c7d5 media: rc: igorplugusb: fix control request setup packet 
Commit eac69475b0 ("media: rc: igorplugusb: heed coherency
rules") changed the control request storage from an embedded struct to
an allocated pointer so it can obey DMA coherency rules.

However, the driver still passes &ir->request to usb_fill_control_urb().
That points the URB setup packet at the pointer field itself rather than
at the allocated struct usb_ctrlrequest.

USB core then interprets pointer bytes as the setup packet. This can
produce an invalid bRequestType and trigger the control direction warning
reported by syzbot:

  usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0

Pass ir->request itself as the setup packet.

Fixes: eac69475b0 ("media: rc: igorplugusb: heed coherency rules")
Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51
Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5.5
Signed-off-by: Henri A <contact@henrialfonso.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
 2026-05-30 18:21:47 +02:00
Linus Torvalds
670b77dfeb USB and Thunderbolt fixes for 7.1-rc6 
Here is a set of USB fixes and new device ids for 7.1-rc6.  Nothing
 major in here, just lots of tiny fixes for reported issues found by
 users and some older patches found by some scanning tools.  Included in
 here are:
   - typec fixes found by fuzzers that have decided to finally look at
     that device interaction path (i.e. before a driver is bound to a
     device).
   - typec fixes for issues found by users
   - thunderbolt driver fixes for reported problems
   - cdns3 driver fixes
   - dwc3 driver fixes
   - new device quirks added
   - usb serial driver fixes for broken devices
   - other small driver fixes
 
 All of these have been in linux-next for over a week with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCahrHyA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymLRgCeN/oLFmGYFHjcJEZ8d0AjKbRS34oAn3r822bO
 1mEsGeOojdWNUm4wzu1k
 =pf1m
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB and Thunderbolt fixes from Greg KH:
 "Here is a set of USB fixes and new device ids for 7.1-rc6. Nothing
  major in here, just lots of tiny fixes for reported issues found by
  users and some older patches found by some scanning tools. Included in
  here are:

   - typec fixes found by fuzzers that have decided to finally look at
     that device interaction path (i.e. before a driver is bound to a
     device)

   - typec fixes for issues found by users

   - thunderbolt driver fixes for reported problems

   - cdns3 driver fixes

   - dwc3 driver fixes

   - new device quirks added

   - usb serial driver fixes for broken devices

   - other small driver fixes

  All of these have been in linux-next for over a week with no reported
  issues"

* tag 'usb-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (54 commits)
  USB: serial: cypress_m8: validate interrupt packet headers
  USB: serial: safe_serial: fix memory corruption with small endpoint
  USB: serial: omninet: fix memory corruption with small endpoint
  USB: serial: mxuport: fix memory corruption with small endpoint
  USB: serial: cypress_m8: fix memory corruption with small endpoint
  USB: cdc-acm: Fix bit overlap and move quirk definitions to header
  usb: dwc2: Fix use after free in debug code
  usb: chipidea: core: convert ci_role_switch to local variable
  usb: gadget: f_fs: serialize DMABUF cancel against request completion
  usb: gadget: f_fs: copy only received bytes on short ep0 read
  usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
  dt-bindings: usb: Fix EIC7700 USB reset's issue
  usbip: vudc: Fix use after free bug in vudc_remove due to race condition
  dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy' property constraints
  usb: storage: Add quirks for PNY Elite Portable SSD
  USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
  usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
  usb: usbtmc: check URB actual_length for interrupt-IN notifications
  xhci: tegra: Fix ghost USB device on dual-role port unplug
  usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
  ...
 2026-05-30 08:37:45 -07:00
Linus Torvalds
495fb8dd7f TTY/Serial driver fixes for 7.1-rc6 
Here are some small serial driver fixes for 7.1-rc6.  Included in here
 are:
   - mips serial driver fixes to resolve some long-standing issues with
     how they interacted with the console.  That's the "majority" of the
     changes in this merge request
   - sh-sci driver regression fix
   - 8250 driver regression fixes
   - other small serial driver fixes for reported problems.
 
 All of these have been in linux-next for over a week with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCahrImA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykedQCfb1CR0Z6lElo/02m3wmR+EfvGyoUAoLj8QU71
 dFaLWzZQk8Hb6ajmVYK5
 =tgAC
 -----END PGP SIGNATURE-----

Merge tag 'tty-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial driver fixes from Greg KH:
 "Here are some small serial driver fixes for 7.1-rc6. Included in here
  are:

   - mips serial driver fixes to resolve some long-standing issues with
     how they interacted with the console. That's the "majority" of the
     changes in this merge request

   - sh-sci driver regression fix

   - 8250 driver regression fixes

   - other small serial driver fixes for reported problems.

  All of these have been in linux-next for over a week with no reported
  issues"

* tag 'tty-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: dz: Enable modular build
  serial: zs: Convert to use a platform device
  serial: dz: Convert to use a platform device
  serial: zs: Switch to using channel reset
  serial: zs: Fix bootconsole handover lockup
  serial: dz: Fix bootconsole handover lockup
  serial: dz: Fix bootconsole message clobbering at chip reset
  serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
  serial: 8250: dispatch SysRq character in serial8250_handle_irq()
  serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
  tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
  serial: altera_jtaguart: handle uart_add_one_port() failures
  serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
  serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
  tty: add missing tty_driver include to tty_port.h
  serial: qcom-geni: fix UART_RX_PAR_EN bit position
  serial: sh-sci: fix memory region release in error path
  tty: serial: pch_uart: add check for dma_alloc_coherent()
  serial: zs: Fix swapped RI/DSR modem line transition counting
 2026-05-30 08:34:03 -07:00
Linus Torvalds
2544785177 Char/Misc/IIO fixes for 7.1-rc6 
Here are some small char/misc/iio driver fixes for 7.1-rc6.  Included in
 here are:
   - lots of small IIO driver fixes for reported problems.
   - Android binder bugfixes for reported issues.
   - small comedi test driver fixes
   - counter driver fix
   - parport driver fix (people still use this?)
   - rpi driver fix
   - uio driver fix
 
 All of these have been in linux-next for over a week with no reported
 problems.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCahrJeQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykKIwCfelyNaZgO2yRfSS1fGmzSv3+W8+sAoK5QHkEY
 TvJIOm1Cwi8/n3vI42Hz
 =EB+S
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc/iio fixes from Greg KH:
 "Here are some small char/misc/iio driver fixes for 7.1-rc6. Included
  in here are:

   - lots of small IIO driver fixes for reported problems.

   - Android binder bugfixes for reported issues.

   - small comedi test driver fixes

   - counter driver fix

   - parport driver fix (people still use this?)

   - rpi driver fix

   - uio driver fix

  All of these have been in linux-next for over a week with no reported
  problems"

* tag 'char-misc-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (41 commits)
  Revert "gpib: cb7210: Fix region leak when request_irq fails"
  misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
  gpib: cb7210: Fix region leak when request_irq fails
  parport: Fix race between port and client registration
  uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory
  rust_binder: Avoid holding lock when dropping delivered_death
  rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
  comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
  comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
  iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
  iio: gyro: itg3200: fix i2c read into the wrong stack location
  iio: dac: ad5686: fix powerdown control on dual-channel devices
  iio: dac: ad5686: acquire lock when doing powerdown control
  iio: temperature: tsys01: fix broken PROM checksum validation
  iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
  iio: buffer: hw-consumer: fix use-after-free in error path
  iio: dac: ad5686: fix input raw value check
  iio: dac: ad5686: fix ref bit initialization for single-channel parts
  iio: ssp_sensors: cancel delayed work_refresh on remove
  iio: adc: meson-saradc: fix calibration buffer leak on error
  ...
 2026-05-30 08:30:12 -07:00
Alexis Bouzigues
1d774589f9 i2c: virtio: mark device ready before registering the adapter 
virtio_i2c_probe() synchronously probes child i2c drivers on the bus,
but peripherals may use the bus at probe for tasks like reading a chip
id. The vhost-user-i2c backend stalls at such probes unless DRIVER_OK
is already set before the virtqueue is first kicked.

Set DRIVER_OK explicitly before i2c_add_adapter(), as done for the
same reason in commit f5866db64f ("virtio_console: enable VQs
early") and commit 71e4b8bf04 ("virtio_rpmsg: set DRIVER_OK before
using device").

Signed-off-by: Alexis Bouzigues <BouziguesAlexis@JohnDeere.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
 2026-05-30 15:56:07 +02:00
Wolfram Sang
e2aecff95b i2c-host-fixes for v7.1-rc6 
davinci: fix fallback bus frequency on missing clock-frequency
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCahpiiQAKCRDaeAVmJtMt
 bp+eAQDfsx42uAWytASKf7/lFJcPJvlBPXMa5ZwwqtwlBW+jPwEAned0rKUYyIGz
 bpVpIO+H3iiaG325v9dxD56rmu9eEwE=
 =Vmap
 -----END PGP SIGNATURE-----

Merge tag 'i2c-host-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current

i2c-host-fixes for v7.1-rc6

davinci: fix fallback bus frequency on missing clock-frequency
 2026-05-30 15:50:41 +02:00
Greg Kroah-Hartman
05d5d79440 Revert "gpib: cb7210: Fix region leak when request_irq fails" 
This reverts commit 2eae90a457.

Turns out not to be correct.

Link: https://lore.kernel.org/r/PpNUbGhrvT8I_KayoDvQYI2PYjmMw1QEkuVBDZz2PwBsVVgPkBXJarc2mBM0IhiH3AQG0GtgqEsDRXNj3yUKEDBaZa25u73pAjvcE6vfRsg=@protonmail.com
Reported-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Hongling Zeng <zhongling0719@126.com>
Cc: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2026-05-30 12:25:36 +02:00
Linus Torvalds
1246c246d9 three ksmbd server fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmoZxw8ACgkQiiy9cAdy
 T1HhnwwAvivw/s84qQhbkgQllNMdb4SPl+Ph+DRMiwyrZjXr36kv8jtiPIRIlplB
 Uk+jXpswQXNk6qVKriUzbM1xGTyBin4iFhDzXfLoMmtZtETAmnbHWX9cVFblOibb
 o+kMYMRXo+TGvQE5d47VKMioL7W5AUFoXfrIfOvWMhnRBaPwgb/aTblUxLFtHYLw
 rhDm24p5JKxHv9YsR5+XWofGP2STstMDgkKBYjqYolmrEaq1ho3qBVQtcGY/DJFT
 5heZ/b+Tv8N0s9ccMOAipAW509Qjn3Tml5SvgRCTZ56nEuZHeZBYCoXLhdV1tPG9
 iuCPxTKrgFkDOZNSdweZscR5OD3MlbDC103K6W/mDEZk3IIv3ZGYe4atBwiz8kMl
 09xvct3UJviHuOWjVgI7TBDV+Y0Gpf7zTeOLfixhn2RrVjU2IwrKUjZBjKGkZAFI
 r5YcTK1FOe3a7WwXNYkVXVvTfwqvpIclQCs+qnQqAiEjvBNWvmTtgGg2eOlxEnBo
 j4AE8Ryh
 =0uMS
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rc6-ksmbd-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - security fix for FSCTL_SET_SPARSE

 - fix leak in ksmbd_query_inode_status()

 - fix OOB read in smb_check_perm_dacl()

* tag 'v7.1-rc6-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
  ksmbd: release ksmbd_inode ref via ksmbd_inode_put on lookup paths
  ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
 2026-05-29 21:50:56 -07:00
Linus Torvalds
2765233a48 drm fixes for 7.1-rc6 
dumb-buffer:
 - prevent overflows in dumb-buffer creation
 
 dma-buf:
 - fix UAF in dma_buf_fd() tracepoint
 
 gem:
 - fix for the fix for the fix for the change handle ioctl
 
 i915:
 - Fix potential UAF in TTM object purge
 - Use polling when irqs are unavailable
 - Fix HDR pre-CSC LUT programming loop
 - Block DC states on vblank enable when Panel Replay supported
 - Use DC_OFF wake reference to block DC6 on vblank enable
 
 xe:
 - Restore IDLEDLY regiter on engine reset
 
 amdgpu:
 - GEM_OP warning fix
 - GEM_OP locking fix
 - Userq fixes
 - DCN 2.1 refclk fix
 - SI fix
 - HMM fixes
 
 amdkfd:
 - svm_range_set_attr locking fix
 - CRIU restore fix
 - KFD debugger fix
 
 amdxdna:
 - require IOMMU on AIE2
 
 hyperv:
 - improve protocol validation
 
 ivpu:
 - test write offset in debugfs
 
 rocket:
 - fix UAF in bo creation
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmoaG2kACgkQDHTzWXnE
 hr4euhAAl3u8saUVPRr3QObFBUdCi8X8ngZKd0o9L82TEqNz6iC8TFxwyVPr+0Mh
 gEi2nvskopDRTb9So8LUAuevuT1r5KZRKH0w3FdR/bSCuO3hxrei0v3lM/L7D7Gn
 ULQS1bP3kp4N1Bikt3UP5JSeJDhlpuwMqoapnA4Zz3WRnxVg6aFEYSc7Xb7dOWpS
 2k5cJHd0IBxgF3/faw9vOM5DklwZqUAbIBxdziFA7Oepg0OxkypXpBPSioNhEW7f
 hj8rlIDRXbLp33RXoL9UyJkXRIkFhjiAhmVcqTgO+nN7w8M2TKBsH/wkWly4d+aS
 PveE+15zdRo0Tzw2DbTDYRCMyeBRpeik4s332ILSGse0MMt4RFz3wpB0fB/DriOz
 BvHBOnUQerZfPk/dGarC8PxqoE70SZaPrMlvEkBmZpcY3OzIUEwV7Pd+r8W9PWjH
 g6ECgPkvCyskJJPugrLYVqQkwjSIF5s+LmKwVfgvuqfyRenXPqrdPwSwEeZb43iC
 NXGP8Au8QVsQKNdP6LzASclq3GcxYTfRK/v+wAgaSTpdvOkWhLBtyjPcO3aGWDgM
 Ve8YFAPSobetEe5B9esBpliXQKj17juSxdJkut6B63RJ6fPk6r2Mza3lGmhHQs0R
 FiyryFtQpzA5iETaiLe4TsaRZzWxzSHZEfV9GediQTRn8gQKEe0=
 =tlSw
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular pull, doesn't seem too insane or AI owned, couple of UAF fixes
  and another repair for an earlier fix, mostly amdgpu and i915 display
  with xe/i915 accel, and misc core/driver fixes.

  It might be a bit bigger than usual at this stage, but I'm not seeing
  anything too scary here.

  dumb-buffer:
   - prevent overflows in dumb-buffer creation

  dma-buf:
   - fix UAF in dma_buf_fd() tracepoint

  gem:
   - fix for the fix for the fix for the change handle ioctl

  i915:
   - Fix potential UAF in TTM object purge
   - Use polling when irqs are unavailable
   - Fix HDR pre-CSC LUT programming loop
   - Block DC states on vblank enable when Panel Replay supported
   - Use DC_OFF wake reference to block DC6 on vblank enable

  xe:
   - Restore IDLEDLY regiter on engine reset

  amdgpu:
   - GEM_OP warning fix
   - GEM_OP locking fix
   - Userq fixes
   - DCN 2.1 refclk fix
   - SI fix
   - HMM fixes

  amdkfd:
   - svm_range_set_attr locking fix
   - CRIU restore fix
   - KFD debugger fix

  amdxdna:
   - require IOMMU on AIE2

  hyperv:
   - improve protocol validation

  ivpu:
   - test write offset in debugfs

  rocket:
   - fix UAF in bo creation"

* tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel: (33 commits)
  drm/gem: fix race between change_handle and handle_delete
  drm: prevent integer overflows in dumb buffer creation helpers
  dma-buf: fix UAF in dma_buf_fd() tracepoint
  drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
  drm/amdgpu: fix amdgpu_hmm_range_get_pages
  drm/amdgpu/userq: use array instead of list for userq_vas
  drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid
  drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
  drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper
  drm/amd/pm/si: Disregard vblank time when no displays are connected
  drm/amdkfd: Check for pdd drm file first in CRIU restore path
  drm/amdgpu: fix potential overflow in fs_info.debugfs_name
  drm/amdgpu/userq: make sure queue is valid in the hang_detect_work
  drm/amdgpu/userq: reserve root bo without interruption
  drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails
  drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index
  drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
  drm/amd/display: Write REFCLK to 48MHz on DCN21
  drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock
  drm/amdgpu/userq: Fix doorbell object cleanup of queue
  ...
 2026-05-29 19:08:20 -07:00
Linus Torvalds
f5e5d3509b spi: Updaets for v7.1 
One substantive fix here, fixing corruption of the maximum frequency for
 spi-mem operations which caused users to remember what should have been
 a temporarily modified maximum frequency as the standard going forward,
 potentially causing instability when the modification raised rather than
 lowered the frequency.
 
 We also have a trivial patch which just documents the correct way to
 describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no
 code changes.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoZyKAACgkQJNaLcl1U
 h9BkSQf+OPY/DuHr46oL4AH36df3FkihkFmaTlipyP2io7HiTgYG67wdXtVfh4H2
 w8D9GT+ukrCGgWkJK+Qgf3IbX19BkL/1kyeDATBJErMd/XHQqn6u38+Lhe3EAqzP
 L4S/pWHmtC/pKynPbsUUkunAYeUa3DK6ZHteZyCe/R+fTKizXOH5Lh74Dcm/pa+V
 b8Aut8Igq32K5KXDkk+TzACkiGDaFs+M7QDfNGI9WN3zBrzxWtS/9ktF5/cN5gBG
 dzjcLb+XJoZnJHwMa7geS7cVvKpPMbqX8fYwip+hhaPfyugP9EvdPibcAhUltGw3
 TNFYV4HpFeGuf7yIoEIzapvVdvvbjA==
 =iELF
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "One substantive fix here, fixing corruption of the maximum frequency
  for spi-mem operations which caused users to remember what should have
  been a temporarily modified maximum frequency as the standard going
  forward, potentially causing instability when the modification raised
  rather than lowered the frequency.

  We also have a trivial patch which just documents the correct way to
  describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no
  code changes"

* tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
  spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible
 2026-05-29 18:07:37 -07:00
Linus Torvalds
230ff934f7 regmap: Fix for v7.1 
Some other fixing in an API user turned up the fact that we weren't
 correctly applying cache only mode to volatile registers in
 regmap_update_bits(), causing us to try to access hardware that was
 powered off or otherwise not in a state to accept I/O.  This fix returns
 an error instead, avoiding more serious consequences.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoZyXsACgkQJNaLcl1U
 h9DJZgf/aOLHE/EBIBcq9QBczGj5Js2/diVO4YCR0WGISbYv4tRfhwkO5SMyPFZ0
 Zk7c9rfzEqauQW3tpsPUhg/B5gK6HOZ/gIAZA7+CjmLCDxg2EBxclFFnl7UKWt8d
 Xs5YdokBL4ZrlVBtgL3YerQ4dCSiDr6FLZYAnFWy5FLXkNbwqvxhUzc7LzAnY/Z3
 pLw/LOnSc1LwXhf10gCKI8OoHdQSPu0pNr9ZYG1smD1J/K9V9Pgbdq0oLrGquwB1
 F8mIFdncblhW4ChbWDUxhF26htKpv4qwdjWKdkHlNDXAYPrS70Ea2PqVP1XwEWdK
 WxouWVBIpOOqGt0OCYooADmHADJ6VQ==
 =9bVn
 -----END PGP SIGNATURE-----

Merge tag 'regmap-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap fix from Mark Brown:
 "Some other fixing in an API user turned up the fact that we weren't
  correctly applying cache only mode to volatile registers in
  regmap_update_bits(), causing us to try to access hardware that was
  powered off or otherwise not in a state to accept I/O. This fix
  returns an error instead, avoiding more serious consequences"

* tag 'regmap-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: reject volatile update_bits() in cache-only mode
 2026-05-29 16:39:56 -07:00
Linus Torvalds
f3be0c984e Quick follow up, nothing super urgent here. Main reason I'm sending 
this out is because the IPsec and Bluetooth PRs did not make it
 yesterday. I don't want to have to send you all of this + whatever
 comes next week, for rc7. The fixes under "Previous releases -
 regressions" are for real user-reported regressions from v7.0.
 
 Previous releases - regressions:
 
  - Revert "ipv6: preserve insertion order for same-scope addresses"
 
  - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU
    on netns exit got backported to stable and was causing serious
    accumulation of dying netns's for real workloads
 
  - pcs-mtk-lynxi: fix bpi-r3 serdes configuration
 
 Previous releases - always broken:
 
  - usual grab bag of race, locking and leak fixes for Bluetooth
 
  - handful of page handling fixes for IPsec
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmoZ+wAACgkQMUZtbf5S
 IrtXJQ/9Gwf702wvkRaeLdqrwQ/qLsvDfx5s+3ALIE0Xsm4z9g7V0XKrZ0cfiI1h
 aWGX8HugXEQuy9QvlFt09tgGEd76159g2WdlsBbh1raqiJRUw4GJKXYvwCmBZxsT
 o8bwfVTQ8CVmUTCKhYrpzJKroT6jR8dKHIrkRn5ZyBOBPMOhK8rnDs1OdseW5haI
 b/EkQrzzvTxd7/dJETIJszMQh/nbS5XIlKpQ+f7dfzR1gtO2GOJ24VWqrimonRTo
 qvMwyt+ca2axv7Af796I8mz7X9rqLjWVWzY2uSpd7Y5zITyQwHNbeNvxzr2Ivi4g
 2BcIi+ZHeeRbgQ9EL+rzapTnnIPIw0APPXnp5NnnNDj0RRG3G6PzulW9SmcdsmGD
 o6E7axSZPQT/KnCw1/N7uMfB9cPzgb1i0h8rbE6tCvtkDtJwECtey7Dc7RU9zLqP
 e0jWDv99+MyEqGPcu2LAg2IWLfsuQiV4priy4mM1NgOTQVgS1yw7+x0GiTqiClJ0
 GcOCTOdvYKlmzhLzsLo4I+AcKZq2uJi8wNXMUEP5pmuYByVeF5j+MmoFpQspzx+L
 gdUh9IctAjd47oX/uNaRtocOriU+JJEApToE9WekMb0XYd5Qx1jnt3WqB9ZFuDf4
 smjUirtAWYcT3d4SXR4wGzB5WEa8TITH07A7sa8noozzNmQRu1E=
 =ttPc
 -----END PGP SIGNATURE-----

Merge tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull more networking fixes from Jakub Kicinski:
 "Quick follow up, nothing super urgent here. Main reason I'm sending
  this out is because the IPsec and Bluetooth PRs did not make it
  yesterday. I don't want to have to send you all of this + whatever
  comes next week, for rc7. The fixes under "Previous releases -
  regressions" are for real user-reported regressions from v7.0.

  Previous releases - regressions:

   - Revert "ipv6: preserve insertion order for same-scope addresses"

   - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU on
     netns exit got backported to stable and was causing serious
     accumulation of dying netns's for real workloads

   - pcs-mtk-lynxi: fix bpi-r3 serdes configuration

  Previous releases - always broken:

   - usual grab bag of race, locking and leak fixes for Bluetooth

   - handful of page handling fixes for IPsec"

* tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits)
  wireguard: send: append trailer after expanding head
  Revert "ipv6: preserve insertion order for same-scope addresses"
  net: skbuff: fix pskb_carve leaking zcopy pages
  ipv6: fix possible infinite loop in fib6_select_path()
  ipv6: fix possible infinite loop in rt6_fill_node()
  bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
  vsock/virtio: bind uarg before filling zerocopy skb
  Revert "esp: fix page frag reference leak on skb_to_sgvec failure"
  net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
  sctp: fix race between sctp_wait_for_connect and peeloff
  net: mana: Skip redundant detach on already-detached port
  net: mana: Add NULL guards in teardown path to prevent panic on attach failure
  Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
  Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
  Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions
  Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
  Bluetooth: ISO: fix UAF in iso_recv_frame
  Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
  Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
  Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
  ...
 2026-05-29 15:46:40 -07:00
Linus Torvalds
77590cacab Clang build fixes for 7.1 #2 
- Account for recently implemented -Wattribute-alias in clang by
   disabling it in the same places it is disabled for GCC.
 
 Signed-off-by: Nathan Chancellor <nathan@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR74yXHMTGczQHYypIdayaRccAalgUCahnrhQAKCRAdayaRccAa
 loxRAP0dhAttt5Nzj1QVvVshp5gUdELM+zXD1qyXAY9Z81V3rgD8C867ax5pGAgO
 kV2PwaBK5P6FJ8joUz4m3qB20FXXYQs=
 =drMM
 -----END PGP SIGNATURE-----

Merge tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux

Pull clang build fix from Nathan Chancellor:
 "A small fix to disable -Wattribute-alias for clang in the few places
  it is already disabled for GCC, now that tip of tree clang has
  implemented -Wattribute-alias as GCC has"

* tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux:
  Disable -Wattribute-alias for clang-23 and newer
 2026-05-29 15:17:53 -07:00
Andrei Vagin
44eeff9bc4 Revert "x86/fpu: Refine and simplify the magic number check during signal return" 
This reverts

  dc8aa31a7a ("x86/fpu: Refine and simplify the magic number check during signal return").

The aforementioned commit broke applications that construct signal frames in
userspace (such as CRIU and gVisor) if the frame's xstate size is smaller than
the kernel's fpstate->user_size.

Furthermore, this introduces a critical issue for checkpoint/restore tools
like CRIU. If a process is checkpointed while inside a signal handler, its
stack contains a signal frame formatted according to the source host's xstate
capabilities.

If that process is later restored on a destination host with larger xstate
capabilities (e.g., a newer CPU with more features enabled, resulting in
a larger fpstate->user_size), the kernel will look for FP_XSTATE_MAGIC2 at the
destination host's larger user_size offset instead of the offset encoded in
the frame's fx_sw->xstate_size.

This causes the magic2 check to fail, forcing sigreturn to silently fall back
to "FX-only" mode. Upon return from the signal handler, the process's extended
state is reset to initial values instead of being restored, leading to silent
data corruption.

The aforementioned commit cited

  d877550eaf ("x86/fpu: Stop relying on userspace for info to fault in xsave buffer")

as justification to stop relying on userspace for the magic number check.

However, these two changes are fundamentally different. The last one only
changed how much memory the kernel ensures is paged-in before running XRSTOR
to prevent an infinite loop. It did not change the signal frame format or how
the layout is validated.

Reverting this change restores the use of fx_sw->xstate_size for
locating magic2 and restores the necessary sanity checks, ensuring that
the signal frame remains self-describing and portable.

  [ bp: Massage commit message. ]

Fixes: dc8aa31a7a ("x86/fpu: Refine and simplify the magic number check during signal return")
Signed-off-by: Andrei Vagin <avagin@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Chang S. Bae <chang.seok.bae@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260429000623.3356606-1-avagin@google.com
 2026-05-29 15:05:30 -07:00
Arnd Bergmann
930c882020 Memory controller drivers - fixes for v7.1 
Fix probing of Atmel EBI memory controller driver e.g. on at91
 sam9x60-curiosity board due to usage of platform_driver_probe() which is
 not handling deferred probe.  Lack of EBI driver caused dependant NAND
 controller to fail to probe, basically failing entire board boot.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmoZPZ4QHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1wBTEACWlhnslXLbIma+QXkLDvVG4wi+WvDLMM+q
 nQGXDwFa5bkmE9dwlkVeLiDMIhBj+q0WMgH3ctHQCPyde2l8vIvdkuWM+HyGgFTs
 eNmQTIFyn09YayZTzWE/5q/fJcIBMeFyfLPDnf562qs+cWu7BxfT8M4jvvdpQ9QH
 BJZbBLq4l80+X6Q1AlLP4djklY7CRosV/8Acuo2cIaiIEPVEWaGdFX5EcGSqSvFf
 3uMIHw/X+BiHpsZv02NLFOF57El3COEJNrgaiSUM9NtUkPfgvrIIBZgUwhdvG81r
 0+3eUKqL1jvZc2K6QLUvNR9lWuCE+5g4jVhgF+mPkXyIKu5Nl1x1JO09Q+IBTkZd
 r+rJFn+mBdAFGc0gHufHNyP8QiXntmCn0BVp6paBH0RQUroC3MWaJaYGxyk1fUA4
 ohCtRqFUqkDyDebqLrtZAe1R87B382Ia+477h5pRvivEViVrRFm+n3TJl2k54Gcw
 eTs/HFv58jn2122Uz2vOmUMVlVQsbrzrm1LpPHoAmkcDkogkRSDaGUK/o3RLvh1l
 nzIelNNL3KNpw6R6wHzEJUINS31VgVxc6WadK60py5MmmoGvS1hIXOF6/iBx8Vk6
 RAyuW1LNuj6eAhwmBK6h2tQn+Gs/pidymlrassdxzPUwrft7mMuc2CwfL92QAwtN
 X3eFiWuayw==
 =4VXt
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaB6MACgkQmmx57+YA
 GNl5aQ/+LKUsj8Z1+ldO3y8RznLbgD4eszkgT3vjUrGj1VxdBijHL/EWqBtfacoJ
 Lat6nNMmFeE8LcDqStm3SwM20N2m5PaXFPcIeDaDL/ZiM+v3YfCTvX4lkzQGJ1B7
 dIs89cPyMQX2qwF8+uKRZou80RNAwRWTp/zT0Q7sIxnzsQ6Gz2tybuxEZ2abgdmT
 X2F1HY3ex8TXTA+NqfJLubf9eHtbXxI1KqFtjU9+YI83OHFqSPNHLNmKCNH0uHkn
 vhGXZgX6RuebtYCw0Fo73cLm3UUj24204pVuujA07OmQmPiZ5Xvp1wMGZtmNkzQU
 L1f3Pav+UDopM6IIzbc2d+Y/YSvupS8ADkaYmcsxLo2KTpdRyRrEf3If2AiQGpxG
 kTCLKWkXDVg8SQic0W+jHC+8wnm9Ec8Idp08s/4XPlA1vSo8MRSE+TDHBmDGgDhQ
 IqvddJE+uT2ZW1yU2Wao7rfQ3KRaWuz7xPYb7ySilAn1i6LtCjysUaDISxRBCiYQ
 bQoxXvvWdmqg8aDpsRyhW2mwQN+4vEeq/IH73XoiZH6jzTj9wReHbudKDG1gREFx
 X/0tBBwuuJhwNbtOj+DVrJlM1WqPDjb7zw6yzEinf3LzvEYR8BGK+R0w3mWa8Eal
 bJCEjHg4mx6LEkFdleFmhLyAL7fVJoxydmpb3HpQ+5r0xk01YhM=
 =8TQP
 -----END PGP SIGNATURE-----

Merge tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes

Memory controller drivers - fixes for v7.1

Fix probing of Atmel EBI memory controller driver e.g. on at91
sam9x60-curiosity board due to usage of platform_driver_probe() which is
not handling deferred probe.  Lack of EBI driver caused dependant NAND
controller to fail to probe, basically failing entire board boot.

* tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
  memory: atmel-ebi: Allow deferred probing

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-05-29 23:39:46 +02:00
Arnd Bergmann
f5e70b3f30 Samsung SoC driver fixes for v7.1 
Fix several concurrency issues present in Samsung ACPM firmware drivers,
 used currently only on Google GS101.  Tudor with help of Sashiko
 identified several missing barriers and incomplete synchronization,
 leading to possible transfer data corruption or use after free.  Few
 other issues related to probe, including missing mailbox cleanup, were
 also fixed.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmoZgsoQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1wmbEACCXrSzY82MLt6XmVByWQy9U9OBLkC471qA
 GhcVdC0uMs6hD5prvJCnHVP236XKUZnT6EZjpBW+8Me3Yw4z4j9Wdd5j0z1haEF5
 DdldsjBjrawsXazVVlj4J7iE1fv83dZrgOASDXFhP+GHRPsfrCYWlNIPhWcG8wwp
 68yYY8FT4hQ4/i5otWixHSdeaadPV/TWf+W90l/1Z6uXdt/9CzAcavHiLOkLWji+
 dy87ZNTcpZoCqa12sPz2wkmMXj5ET5vUsuvoVZu3376ViU8q/6kSIRYtIQjCgM8J
 cMNArDequv6g24ra+W8D234qo50fBAVpeYHFyZKDJYekkJ9HJyQ2NXarJz/kvEUw
 ZkmUA/SgZUc0hM5i0J+5O6K7lTed6eMmkR72QTT/uQZOAcEkqsFpkuZhAetxguR8
 vO7p99+QAS/grHKiXaLKTOYgpoxitqx0int0FZ1shWbeO/OYorrZ00x0OkK++V++
 WsI7SJVNco/LM4APdSIRBphZ5ULl6xgu2SLO05J7uQFgiUWU0Q9v+t1MxIbvmL0T
 HH5H1STGr12LOBwnJDjK/AYbAhFFM9pZxgPJU9S4NzKu3peQJjgLvnOeEEmLkmeQ
 47bKUlrOMQIP5lpzLBYtL9NT/7fyQKfl8fbdq5O3KwthMvOiit6mGD+ExDoptIp4
 4T+NBiG08A==
 =hb6T
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaByIACgkQmmx57+YA
 GNmeiA/9EZ+LO2JUrUVhMNXOfUmDGrpfL/mVqcGL9ksK+EkOW+9Fae8f9hWrvBFh
 exeMRTwKDcA2hag6AnBiKhctLYFIZ7+nRb/xu2ybasdIAloR10oDKlmgzH/Yj4c9
 MsIgfuK+q5FnOxyhtNEZ4JszYYvAl3wfFvBR1241L52tJ+vyOLxEjk/8rhESFv1P
 rTeCXlRA/dJ4hqpP9j+QflgrvrIYe1vhsBdNFXQEcjUgQnqySPY7Ynlnr1BJMyWQ
 N4x+gJ9ZITr75kzMJCwqGXfktwPP6+BahBHDk8i6U6zfFwb2DJFHx0OSYf3Z1s1w
 V7wxIMiGr/XZ/r0D6prlqYAjLZS8KL9sYEC/UB+WB95SwnFWm3J1K895rt4awuzY
 HD6jhgPlyvIBEJRI7ZNMB4Hg0p9Z5pXse1EDseDdAnAth9brbFN7d/JbbtTMKfny
 jyQJG8rEUvmSF+No35VprFW6JhyDHFlnrQvoSQdLgxsKHrMRcI1xYnQXi2aILlYI
 cYCYzL2lAeteaMHVMrPDoLQGCbKnvTz+pAhiOXTX2ie6XS8JuYPhf1H+Pp8GTozp
 P+Iy995FZ92aaCyPmINa8lN2hfuC3qhxNZehZ8bEShKQ+44wab1SV6q/shM+HPt2
 i1OLt9Kg/CWt6hVXW3jkZvdNry1HuPP3f4jrQwquOFh6h2VlnXw=
 =zqbF
 -----END PGP SIGNATURE-----

Merge tag 'samsung-drivers-fixes-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes

Samsung SoC driver fixes for v7.1

Fix several concurrency issues present in Samsung ACPM firmware drivers,
used currently only on Google GS101.  Tudor with help of Sashiko
identified several missing barriers and incomplete synchronization,
leading to possible transfer data corruption or use after free.  Few
other issues related to probe, including missing mailbox cleanup, were
also fixed.

* tag 'samsung-drivers-fixes-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion
  firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
  firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
  firmware: samsung: acpm: Fix mailbox channel leak on probe error
  firmware: samsung: acpm: Fix cross-thread RX length corruption

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2026-05-29 23:37:36 +02:00
Zhenghang Xiao
7164d78559 drm/gem: fix race between change_handle and handle_delete 
drm_gem_change_handle_ioctl leaves the old handle live in the IDR
during the window between spin_unlock(table_lock) and the final
spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old
handle succeeds in this window, decrements handle_count to 0, and frees
the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping table_lock so that any
concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.
Restore the old entry on the prime-bookkeeping error path.

Fixes: 5e28b7b944 ("drm: Set old handle to NULL before prime swap in change_handle")
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260526085313.26791-1-kipreyyy@gmail.com
 2026-05-30 07:01:39 +10:00
Linus Torvalds
d0ee290071 Arm: 
- Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by
   making sure the config symbol is correctly spelled out in the code
 
 - Don't reset the AArch32 view of the PMU counters to zero when the
   guest is writing to them
 
 - Fix an assorted collection of memory leaks in the newly added tracing
   code
 
 - Fix the capping of ZCR_EL2 which could be used in an unsanitised way
   by an L2 guest
 
 x86:
 
 - Include the kernel's linux/mman.h in KVM selftests to ensure MADV_COLLAPSE
   is defined, as older libc versions may not provide it.
 
 - Include execinfo.h if and only if KVM selftests are building against glibc,
   and provide a test_dump_stack() for non-glibc builds.
 
 - Silence an annoying RCU splat on (even non-KVM-related) panics.  The splat
   is technically legit, but in practice not an issue.  To have a race, you
   would need to unload the KVM modules at exactly the time a panic happens;
   and speaking of incredibly rare races, taking the locks risks introducing
   a deadlock if the module unload code took the lock on a CPU that has been
   halted.  Which seems possibly more likely than the RCU grace period issue,
   so just shut it up.  This code used to be in KVM but is now outside it;
   but the x86 maintainers haven't picked it up, so here we are.
 
 - Rate-limit global clock updates once again (but without delayed work), as
   KVM was subtly relying on the old rate-limiting for NPT correction to guard
   against "update storms" when running without a master clock on systems with
   overcommitted CPUs.
 
 - Fix a brown paper bag goof where KVM checked if ERAPS is "dirty" instead of
   marking it dirty when emulating INVPCID.
 
 - Flush the TLB when transitioning from xAVIC => x2AVIC to ensure the CPU TLB
   doesn't contain AVIC-tagged entries for the APIC base GPA.
 
 - The top 10 commits fix buffer overflow (and potential TOC/TOU) flaws in the
   page state change protocol for encrypted VMs.  AI models find it quite
   easily given it was reported three times, but aren't as good at writing
   a comprehensive fix.  There's more to clean up in the area, which will
   come in 7.2.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoZ2qQUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroPPFQgAhDwSk+VVnn4vuerijZh6eo3Tz4EQ
 af0Ccng1uDuTuz9HzkF/ffR4z3tBMYtUhVtUiPu5xrUabzmIW7T0roNvsCwzVZor
 ekZt3Y8FgwSgF+nxbBQQXBPvv+tOHpoIhfbirftWE9tRRFivfK1Z1duRGwsv7Seb
 0eK+iB1huJLjXqIZQtSLEY44LSoQbDIt/StkkYFLUr10oOvTRCFiu2wPA2gZrK56
 KTVrCg7rtn135wh8TVA72u+pIszylIPFTQ1HbbzzBoQ8/Opp0olFL3q0HeAwkx6D
 q0EJiNMP0QD8NDC7Q8efAit4wI0pXE4Y6ScHQJTm3p+hB6KXc9o7LKbCmA==
 =6jit
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "arm64:

   - Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by
     making sure the config symbol is correctly spelled out in the code

   - Don't reset the AArch32 view of the PMU counters to zero when the
     guest is writing to them

   - Fix an assorted collection of memory leaks in the newly added
     tracing code

   - Fix the capping of ZCR_EL2 which could be used in an unsanitised
     way by an L2 guest

  x86:

   - Include the kernel's linux/mman.h in KVM selftests to ensure
     MADV_COLLAPSE is defined, as older libc versions may not provide
     it.

   - Include execinfo.h if and only if KVM selftests are building
     against glibc, and provide a test_dump_stack() for non-glibc
     builds.

   - Silence an annoying RCU splat on (even non-KVM-related) panics.

     The splat is technically legit, but in practice not an issue. To
     have a race, you would need to unload the KVM modules at exactly
     the time a panic happens; and speaking of incredibly rare races,
     taking the locks risks introducing a deadlock if the module unload
     code took the lock on a CPU that has been halted. Which seems
     possibly more likely than the RCU grace period issue, so just shut
     it up. This code used to be in KVM but is now outside it; but the
     x86 maintainers haven't picked it up, so here we are.

   - Rate-limit global clock updates once again (but without delayed
     work), as KVM was subtly relying on the old rate-limiting for NPT
     correction to guard against "update storms" when running without a
     master clock on systems with overcommitted CPUs.

   - Fix a brown paper bag goof where KVM checked if ERAPS is "dirty"
     instead of marking it dirty when emulating INVPCID.

   - Flush the TLB when transitioning from xAVIC => x2AVIC to ensure the
     CPU TLB doesn't contain AVIC-tagged entries for the APIC base GPA.

   - The top 10 commits fix buffer overflow (and potential TOC/TOU)
     flaws in the page state change protocol for encrypted VMs. AI
     models find it quite easily given it was reported three times, but
     aren't as good at writing a comprehensive fix. There's more to
     clean up in the area, which will come in 7.2"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)
  KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
  KVM: SEV: Check PSC request indices against the actual size of the buffer
  KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
  KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
  KVM: SEV: Compute the correct max length of the in-GHCB scratch area
  KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
  KVM: SEV: Ignore Port I/O requests of length '0'
  KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
  KVM: SEV: Ignore MMIO requests of length '0'
  KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
  KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
  KVM: arm64: Fix memory leak in hyp_trace_unload()
  KVM: arm64: Fix rollback in hyp_trace_buffer_share_hyp()
  KVM: arm64: Fix meta-page unsharing in pKVM hyp tracing
  KVM: arm64: PMU: Preserve AArch32 counter low bits
  KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
  KVM: x86: Fix ERAPS RAP clear on INVPCID single-context invalidation
  KVM: arm64: Fix CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC
  KVM: selftests: Guard execinfo.h inclusion for non-glibc builds
  KVM: x86: Rate-limit global clock updates on vCPU load
  ...
 2026-05-29 13:47:55 -07:00
Dave Airlie
6e40c93789 Short summary of fixes pull: 
amdxdna:
 - require IOMMU on AIE2
 
 dumb-buffer:
 - prevent overflows in dumb-buffer creation
 
 dma-buf:
 - fix UAF in dma_buf_fd() tracepoint
 
 hyperv:
 - improve protocol validation
 
 ivpu:
 - test write offset in debugfs
 
 rocket:
 - fix UAF in bo creation
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmoZON4bFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3ojkmQH/iTes3bKpMGoXvNUWblI
 QYDtLgQR6uHwDwJgeYDBxu2RZQvS2y29bsW02dSCtAgQ+OkAb5TKRg1ew/cBfKQm
 QSjp4aT1qM+U+mqWhJhN40dtyyEVXZ4JlzeVcACLQhRzuohd2u5AybONtW/1NRnX
 BSpKXbntjKk+1EX6do0Cs4I8KaSKkogBAeKRIbS+J9w4rTBds3LefOGjhHo+hVkY
 +G4LAjEYO1onmN+OGvqZGXtdZKhH6j1rb8trRWHYkkcNP8GLWPQ2WFOMXDNLcxA3
 l3EUcOiU0ka6oW2NunO7rFay0h/+VFDU2VyUUvUTBKSxjbQ/7uhdIa+UoYYJOQ6B
 I+Y=
 =UkZG
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-05-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

amdxdna:
- require IOMMU on AIE2

dumb-buffer:
- prevent overflows in dumb-buffer creation

dma-buf:
- fix UAF in dma_buf_fd() tracepoint

hyperv:
- improve protocol validation

ivpu:
- test write offset in debugfs

rocket:
- fix UAF in bo creation

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260529070009.GA313534@linux.fritz.box
 2026-05-30 06:40:28 +10:00
Jakub Kicinski
78ef59e7a6 Merge branch 'wireguard-fixes-for-7-1-rc6' 
Jason A. Donenfeld says:

====================
WireGuard fixes for 7.1-rc6

Please find one small patch, fixing the order of adding padding onto a
packet, to ensure padding bytes get zeroed properly.
====================

Link: https://patch.msgid.link/20260529173134.3080773-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-05-29 13:01:31 -07:00
Jason A. Donenfeld
f75e3eb08f wireguard: send: append trailer after expanding head 
With how this is currently written, we add the trailer, zero it out, and
then add the header space on. If that header space requires a
reallocation + copy, the zeros in the trailer aren't copied, because the
skb len hasn't actually been yet expanded to cover that. Instead add the
padding at the end of the process rather than at the beginning.

Fixes: e7096c131e ("net: WireGuard secure network tunnel")
Cc: stable@vger.kernel.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://patch.msgid.link/20260529173134.3080773-2-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-05-29 13:01:27 -07:00
Fernando Fernandez Mancera
072aa0f5c3 Revert "ipv6: preserve insertion order for same-scope addresses" 
Chris Adams reported that preserving insertion order for same-scope
addresses is causing SSH connections to be dropped after stopping a VM
while running NetworkManager.

NetworkManager caches the IPv6 address configuration, when a RA arrives,
it determines the list of addresses to configure and checks if the
addresses are already in the right order in the kernel. If they aren't,
NetworkManager removes and re-adds them to achieve the desired order.

As the order changes, NetworkManager is confused and reconfigures the
addresses on every update. In addition, this would also affect to cloud
tooling that relies on IPv6 addresses order to identify primary and
secondaries addresses.

This reverts commit cb3de96eea.

Fixes: cb3de96eea ("ipv6: preserve insertion order for same-scope addresses")
Reported-by: Chris Adams <linux@cmadams.net>
Closes: https://lore.kernel.org/netdev/20260521135310.GC977@cmadams.net/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260529112357.5079-1-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-05-29 13:00:54 -07:00
Jakub Kicinski
c84ff04def ipsec-2026-05-29 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmoZWqgACgkQrB3Eaf9P
 W7cz1A//RDEq8pvp1kefBC6YLM9nAEpiIS+gdBWjUty/zC2bpuvWPnEaDKXeZVVx
 Vvo9ITV6BsgNsiUEOyM5ehsDknY9TZMFXSawQQWGiRZmGtP+wM3fesoklUDUz+QD
 JBaPg7JEcGjFXPlr1X+MF+bvPVfyPaf/s8VEcatFfkPVV2JZPiENwLmxq/ZV3LWF
 R5pB0Mz1AreRJQ3IZuUn8ae/UqUQ+GSP3VtI45lrNDWDBeVeP8zT3orm4Tv9ITYm
 doNvbXWYhZNlXUcP0qZ887G2Kn6dbrUbsdp0dOnQDAQu2NR0+tYQWxhoCN5Ps3zl
 OisDsNEp4aUzwFkwIE84E43rygD6wc7lx+BGgdFUM2FtmxRv7fUiIuvVuCtC87hv
 CsK0SueSgog5x3Ltx/P5O+hn80wKAUqPMESb/7Oxja0rUXi251E7WLVNJdgV0t2y
 OJMOMFm1uFwsckFBoSi54QNbJkFFK2lvdl+jQ068E7Cqf88LeqtNe56TOLr/Ut7I
 UnQakEDnOgzi1HHcpOs/hycyqvPgvBqhRI6IwAtZZFUzQ/i+usmLUIP4AhQRsA9u
 ffI/m+7uF4EJ4H+L/FxZds+AMGh28sL6a3muKpYgcHRJ/3bDPOGaL8NHyy+sTfFW
 U6GpFqjv2sEWZM8bCN1g7ymNg+70a/xeFwu6/38+X3cP7bg+QgE=
 =NQJ5
 -----END PGP SIGNATURE-----

Merge tag 'ipsec-2026-05-29' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Steffen Klassert says:

====================
pull request (net): ipsec 2026-05-29

1) xfrm: route MIGRATE notifications to caller's netns
   Thread the caller's netns through km_migrate() so that
   MIGRATE notifications go to the issuing netns, fixing both the
   init_net listener leak and MOBIKE notifications inside
   non-init netns. From Maoyi Xie.

2) xfrm: ipcomp: Free destination pages on acomp errors
   Move the out_free_req label up so that allocated destination
   pages are released on decompression errors, not only on success.
   From Herbert Xu.

3) xfrm: Check for underflow in xfrm_state_mtu
   Reject configurations that cause xfrm_state_mtu() to underflow,
   preventing a negative TFCPAD value from becoming a memset size
   that triggers an out-of-bounds write of several terabytes.
   From David Ahern.

4) xfrm: ah: use skb_to_full_sk in async output callbacks
   Convert the possibly-incomplete skb->sk to a full socket pointer
   in async AH callbacks so that a request_sock or timewait_sock
   never reaches xfrm_output_resume() downstream consumers.
   From Michael Bommarito.

5) Add and revert: esp: fix page frag reference leak on skb_to_sgvec failure
   The patch does not fix te issue completely.

6) xfrm: esp: restore combined single-frag length gate
   Check the aligned post-trailer combined length against a page limit
   in the fast path, preventing skb_page_frag_refill() from falling
   back to a page too small for the destination scatterlist.
   From Jingguo Tan.

7) xfrm: iptfs: reset runtime state when cloning SAs
   Reinitialise the clone's mode_data runtime objects before
   publishing it, preventing queued skbs from being freed with
   list state copied from the original SA when migration fails.
   From Shaomin Chen.

8) xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
   Flush policy tables and drain the workqueue in a .pre_exit handler
   so that cleanup_net() pays one RCU grace period per batch instead
   of one per namespace, fixing stalls at high CLONE_NEWNET rates.
   From Usama Arif.

9) xfrm: input: hold netns during deferred transport reinjection
   Take a netns reference when queueing deferred transport reinjection
   work and drop it after the callback completes, keeping the skb->cb
   net pointer valid until the deferred work runs.
   From Zhengchuan Liang.

* tag 'ipsec-2026-05-29' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
  Revert "esp: fix page frag reference leak on skb_to_sgvec failure"
  xfrm: input: hold netns during deferred transport reinjection
  xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
  xfrm: iptfs: reset runtime state when cloning SAs
  xfrm: esp: restore combined single-frag length gate
  esp: fix page frag reference leak on skb_to_sgvec failure
  xfrm: ah: use skb_to_full_sk in async output callbacks
  xfrm: Check for underflow in xfrm_state_mtu
  xfrm: ipcomp: Free destination pages on acomp errors
  xfrm: route MIGRATE notifications to caller's netns
====================

Link: https://patch.msgid.link/20260529092648.3878973-1-steffen.klassert@secunet.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-05-29 12:57:23 -07:00