github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,447,630 Commits 1 Branch 940 Tags 24 GiB
e8a56d6fc8
Commit Graph

1447630 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Torvalds
e8a56d6fc8 dentry memory safety stuff 
* d_alloc_parallel() API change (Neil's with my changes).
  * NORCU fixes.
  * Reorganization and simplification of dentry eviction logics.
  * Simplifying rcu_read_lock() scopes in fs/dcache.c.
  * Secondary roots work - getting rid of NFS fake root dentries and
  dealing with remaining shrink_dcache_for_umount()/shrink_dentry_list()
  races.
  * making cursors NORCU (surprisingly easy)
 
 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQqUNBr3gm4hGXdBJlZ7Krx/gZQ6wUCai8ppAAKCRBZ7Krx/gZQ
 67xXAP48lSBS6WyiTztk/ZD/0WFO+EemnxEDXZ0s55ejQ1/uswEApWNMaxBYkzxB
 0lgAjKPojjtqYovttP/AHklomSLzMA4=
 =llw0
 -----END PGP SIGNATURE-----

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull dcache updates from Al Viro:

 - d_alloc_parallel() API change (Neil's with my changes)

 - NORCU fixes

 - Reorganization and simplification of dentry eviction logic

 - Simplifying rcu_read_lock() scopes in fs/dcache.c

 - Secondary roots work - getting rid of NFS fake root dentries and
   dealing with remaining shrink_dcache_for_umount() and
   shrink_dentry_list() races

 - making cursors NORCU (surprisingly easy)

* tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (22 commits)
  make cursors NORCU
  nfs: get rid of fake root dentries
  wind ->s_roots via ->d_sib instead of ->d_hash
  shrink_dentry_tree(): unify the calls of shrink_dentry_list()
  shrinking rcu_read_lock() scope in d_alloc_parallel()
  d_walk(): shrink rcu_read_lock() scope
  document dentry_kill()
  adjust calling conventions of lock_for_kill(), fold __dentry_kill() into dentry_kill()
  Document rcu_read_lock() use in select_collect2()
  Shift rcu_read_{,un}lock() inside fast_dput()
  simplify safety for lock_for_kill() slowpath
  fold lock_for_kill() and __dentry_kill() into common helper
  fold lock_for_kill() into shrink_kill()
  shrink_dentry_list(): start with removing from shrink list
  d_prune_aliases(): make sure to skip NORCU aliases
  kill d_dispose_if_unused()
  make to_shrink_list() return whether it has moved dentry to list
  select_collect(): ignore dentries on shrink lists if they have positive refcounts
  find_acceptable_alias(): skip NORCU aliases with zero refcount
  fix a race between d_find_any_alias() and final dput() of NORCU dentries
  ...
 2026-06-15 04:15:31 +05:30
Linus Torvalds
79169a1624 vfs-7.2-rc1.procfs 
Please consider pulling these changes from the signed vfs-7.2-rc1.procfs tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 otp1AQD6ONFiqQZJhnHbVg1MJlA8iP80x0qlil0OKGUMOby4NAD+MZymcLjtP+4O
 T1b9Uca2/qz+L1F5o7vJAD3OAd4BzQA=
 =/KGF
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull procfs updates from Christian Brauner:

 - Revamp fs/filesystems.c

   The file was a mess with a hand-rolled linked list in desperate need
   of a cleanup. The filesystems list is now RCU-ified, /proc files can
   be marked permanent from outside fs/proc/, and the string emitted
   when reading /proc/filesystems is pre-generated and cached instead of
   pointer-chasing and printfing entry by entry on every read.

   The file is read frequently because libselinux reads it and is linked
   into numerous frequently used programs (even ones you would not
   suspect, like sed!). Scalability also improves since reference
   maintenance on open/close is bypassed.

    open+read+close cycle single-threaded (ops/s):
      before: 442732
      after:  1063462 (+140%)

    open+read+close cycle with 20 processes (ops/s):
      before: 606177
      after:  3300576 (+444%)

   A follow-up patch adds missing unlocks in some corner cases and
   tidies things up.

 - Relax the mount visibility check for subset=pid mounts

   When procfs is mounted with subset=pid, all static files become
   unavailable and only the dynamic pid information is accessible. In
   that case there is no point in imposing the full mount visibility
   restrictions on the mounter - everything that can be hidden in procfs
   is already inaccessible. These restrictions prevented procfs from
   being mounted inside rootless containers since almost all container
   implementations overmount parts of procfs to hide certain
   directories.

   As part of this /proc/self/net is only shown in subset=pid mounts for
   CAP_NET_ADMIN, reconfiguring subset=pid is rejected, the
   SB_I_USERNS_VISIBLE superblock flag is replaced with an
   FS_USERNS_MOUNT_RESTRICTED filesystem flag, fully visible mounts are
   recorded in a list, and the mount restrictions are finally
   documented.

 - Protect ptrace_may_access() with exec_update_lock in procfs

   Most uses of ptrace_may_access() in procfs should hold
   exec_update_lock to avoid TOCTOU issues with concurrent privileged
   execve() (like setuid binary execution).

   This fixes the easy cases - the owner and visibility checks and the
   FD link permission checks - with the gnarlier ones to follow later.

* tag 'vfs-7.2-rc1.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fs: fix ups and tidy ups to /proc/filesystems caching
  proc: protect ptrace_may_access() with exec_update_lock (FD links)
  proc: protect ptrace_may_access() with exec_update_lock (part 1)
  docs: proc: add documentation about mount restrictions
  proc: handle subset=pid separately in userns visibility checks
  proc: prevent reconfiguring subset=pid
  proc: subset=pid: Show /proc/self/net only for CAP_NET_ADMIN
  fs: cache the string generated by reading /proc/filesystems
  sysfs: remove trivial sysfs_get_tree() wrapper
  fs: RCU-ify filesystems list
  fs: move SB_I_USERNS_VISIBLE to FS_USERNS_MOUNT_RESTRICTED
  proc: allow to mark /proc files permanent outside of fs/proc/
  namespace: record fully visible mounts in list
 2026-06-15 04:07:58 +05:30
Linus Torvalds
7e0e7bd60d vfs-7.2-rc1.misc 
Please consider pulling these changes from the signed vfs-7.2-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 ou/zAP9SOUE6n58i0BdhLYw0RA9Ge5tz42e4inSFi4tkgfCrDwEAlxbRHDcMyhWB
 dHmx8OW6b5riMrW+lGPMH58RMoTkdQ4=
 =3vuc
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
 "Features:

   - Reduce pipe->mutex contention by pre-allocating pages outside the
     lock in anon_pipe_write().

     anon_pipe_write() called alloc_page() once per page while holding
     pipe->mutex. The allocation can sleep doing direct reclaim and runs
     memcg charging, which extends the critical section and stalls any
     concurrent reader on the same mutex. Now up to 8 pages are
     pre-allocated before the mutex is taken, leftovers are recycled
     into the per-pipe tmp_page[] cache before unlock, and any remainder
     is released after unlock, keeping the allocator out of the critical
     section on both sides. On a writers x readers sweep with 64KB
     writes against a 1 MB pipe throughput improves 6-28% and average
     write latency drops 5-22%; under memory pressure - when the cost of
     holding the mutex across reclaim is highest - throughput improves
     21-48% and latency drops 17-33%. The microbenchmark is added to
     selftests.

   - uaccess/sockptr: fix the ignored_trailing logic in
     copy_struct_to_user() to behave as documented and the usize check
     in copy_struct_from_sockptr() for user pointers, and add
     copy_struct_{from,to}_bounce_buffer() and copy_struct_to_sockptr()
     helpers for upcoming users (IPPROTO_SMBDIRECT, IPPROTO_QUIC).

   - bpf: add a sleepable bpf_real_inode() kfunc that resolves the real
     inode backing a dentry via d_real_inode(). On overlayfs the inode
     attached to the dentry doesn't carry the underlying device
     information; this is used by the filesystem restriction BPF program
     that was merged into systemd.

   - docs: add guidelines for submitting new filesystems, motivated by
     the maintenance burden abandoned and untestable filesystems impose
     on VFS developers, blocking infrastructure work like folio
     conversions and iomap migration.

  Fixes:

   - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
     and drop the now-redundant assignments in callers. This began as a
     one-line dma-buf fix for a path_noexec() warning; a pseudo
     filesystem has no reason not to set SB_I_NOEXEC. All init_pseudo()
     callers were audited: the only visible effect is on dma-buf where
     SB_I_NOEXEC silences the warning.

   - Handle set_blocksize() failures in legacy filesystems (bfs, hpfs,
     qnx4, jfs, befs, affs, isofs, minix, ntfs3, omfs). Mounting a
     device with a sector size > PAGE_SIZE crashed roughly half of them;
     the rest had the same missing error handling pattern. Plus a
     follow-up releasing the superblock buffer_head when setting the
     minix v3 block size fails.

   - mount: honour SB_NOUSER in the new mount API.

   - fs/fcntl: fix a SOFTIRQ-unsafe lock order in fasync signaling by
     switching the process-group paths of send_sigio() and send_sigurg()
     from read_lock(&tasklist_lock) to RCU, matching the single-PID
     path.

   - vfs: add an FS_USERNS_DELEGATABLE flag and set it for NFS, fixing
     delegated NFS mounts (fsopen() in a container with the mount
     performed by a privileged daemon) that broke when non-init
     s_user_ns was tied to FS_USERNS_MOUNT.

   - selftests/namespaces: fix a hang in nsid_test where an unreaped
     grandchild kept the TAP pipe write-end open, a waitpid(-1) race in
     listns_efault_test, and a false FAIL on kernels without listns()
     where the tests should SKIP.

   - filelock: fix the break_lease() stub signature for
     CONFIG_FILE_LOCKING=n.

   - init/initramfs_test: wait for the async initramfs unpacking before
     running; the test and do_populate_rootfs() share the parser state.

   - fs/coredump: reduce redundant log noise in
     validate_coredump_safety().

   - iomap: pass the correct length to fserror_report_io() in
     __iomap_write_begin().

   - backing-file: fix the backing_file_open() kerneldoc.

  Cleanups:

   - initramfs: refactor the cpio hex header parsing to use hex2bin()
     instead of the hand-rolled simple_strntoul() which is reverted, and
     extend the initramfs KUnit tests to cover header fields with 0x
     prefixes.

   - Replace __get_free_pages() and friends with kmalloc()/kzalloc()
     across quota, proc, ocfs2/dlm, nilfs2, nfs, nfsd, libfs, jfs, jbd2,
     isofs, fuse, select, namespace, configfs, binfmt_misc, bfs, and the
     do_mounts init code - part of the larger work of replacing page
     allocator calls with kmalloc().

   - Use clear_and_wake_up_bit() in unlock_buffer() and
     journal_end_buffer_io_sync() instead of open-coding the sequence.

   - Drop unused VFS exports: unexport drop_super_exclusive(), remove
     start_removing_user_path_at(), and fold __start_removing_path()
     into start_removing_path().

   - fs/read_write: narrow the __kernel_write() export with
     EXPORT_SYMBOL_FOR_MODULES().

   - vfs: uapi: retire octal and hex constants in favor of (1 << n) for
     the O_ flags. Finding a free bit for a new flag across the
     architectures was needlessly hard with the mixed bases.

   - dcache: add extra sanity checks of dead dentries in dentry_free()
     via a new DENTRY_WARN_ONCE() that also prints d_flags.

   - iov_iter: use kmemdup_array() in dup_iter() to harden the
     allocation against multiplication overflow.

   - fs/pipe: write to ->poll_usage only once.

   - vfs: remove an always-taken if-branch in find_next_fd().

   - dcache: use kmalloc_flex() for struct external_name in __d_alloc().

   - namei: use QSTR() instead of QSTR_INIT() in path_pts().

   - sync_file_range: delete dead S_ISLNK code.

   - Comment fixes: retire a stale comment in fget_task_next() and fix
     assorted spelling mistakes"

* tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (73 commits)
  backing-file: fix backing_file_open() kerneldoc parameter
  iomap: pass the correct len to fserror_report_io in __iomap_write_begin
  vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS
  filelock: fix break_lease() stub signature for CONFIG_FILE_LOCKING=n
  vfs: uapi: retire octal and hex numbers in favor of (1 << n) for O_ flags
  bpf: add bpf_real_inode() kfunc
  fs/read_write: Do not export __kernel_write() to the entire world
  libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers
  libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
  mount: honour SB_NOUSER in the new mount API
  fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
  selftests/pipe: add pipe_bench microbenchmark
  fs/pipe: pre-allocate pages outside pipe->mutex in anon_pipe_write
  fs: retire stale comment in fget_task_next()
  fs: fix spelling mistakes in comment
  bfs: replace get_zeroed_page() with kzalloc()
  binfmt_misc: replace __get_free_page() with kmalloc()
  configfs: replace __get_free_pages() with kzalloc()
  fs/namespace: use __getname() to allocate mntpath buffer
  fs/select: replace __get_free_page() with kmalloc()
  ...
 2026-06-15 03:59:45 +05:30
Linus Torvalds
ff8747aaca vfs-7.2-rc1.xattr 
Please consider pulling these changes from the signed vfs-7.2-rc1.xattr tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 oiWnAP9ij5MDXEBgslxe/8YzPbyUjIO9qnEJtkGEzL1Z7cyFyAEA8+iAcs8bZmr7
 Pzq0A5x3aK17V+34QkgfRiDTjkv0BgY=
 =xACw
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.xattr' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull simple_xattr updates from Christian Brauner:
 "This reworks the simple xattr api to make it more efficient and easier
  to use for all consumers.

  The simple_xattr hash table moves from the inode into a per-superblock
  cache, removing the per-inode overhead for the common case of few or
  no xattrs. The interface now passes struct simple_xattrs ** so lazy
  allocation is handled internally instead of by every caller, kernfs
  xattr operations on kernfs nodes shared between multiple superblocks
  are properly serialized, and tmpfs constructs "security.foo" xattr
  names with kasprintf() instead of kmalloc() plus two memcpy()s.

  A follow-up fix links kernfs nodes to their parent before the LSM init
  hook runs: with the per-sb cache kernfs_xattr_set() computes the cache
  via kernfs_root(kn), which faulted on a freshly allocated node when
  selinux_kernfs_init_security() called into it - reproducible as a NULL
  pointer dereference on the first cgroup mkdir on SELinux-enabled
  systems.

  On top of this bpffs gains support for trusted.* and security.* xattrs
  so that user space and BPF LSM programs can attach metadata - for
  example a content hash or a security label - to pinned objects and
  directories and inspect it uniformly like on other filesystems. The
  store is in-memory and non-persistent, living only for the lifetime of
  the mount like everything else in bpffs"

* tag 'vfs-7.2-rc1.xattr' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  bpf: Add simple xattr support to bpffs
  kernfs: link kn to its parent before the LSM init hook
  simpe_xattr: use per-sb cache
  simple_xattr: change interface to pass struct simple_xattrs **
  tmpfs: simplify constructing "security.foo" xattr names
  kernfs: fix xattr race condition with multiple superblocks
 2026-06-15 03:54:54 +05:30
Linus Torvalds
ec5d1ae94e vfs-7.2-rc1.iomap 
Please consider pulling these changes from the signed vfs-7.2-rc1.iomap tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 os7sAPsH6z7HATCG9xOAOmsIwgi7l0u7dMNnU7Xrqs9H3qAjNgD/SJ/Ajw0GMkMP
 RxJvze9lvkY9hN9avR9thMVF+yE+fgM=
 =TlkI
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull iomap updates from Christian Brauner:

 - Add the vfs infrastructure required to implement fs-verity support
   for XFS with a post-EOF merkle tree: fsverity generates and stores a
   zero-block hash, and iomap learns to verify data on buffered reads,
   to handle fsverity during writeback via the new IOMAP_F_FSVERITY
   flag, and to write fsverity metadata through iomap_fsverity_write().

 - Skip the memset of the iomap in iomap_iter() once the iteration is
   done. In high-IOPS scenarios (4k randread NVMe polling via io_uring)
   the pointless memset wasted memory write bandwidth; this improves
   IOPS by about 5% on ext4 and xfs.

 - Add balance_dirty_pages_ratelimited() to iomap_zero_iter(), aligning
   it with iomap_write_iter(). This prepares for the exFAT iomap
   conversion where zeroing beyond valid_size can trigger large-scale
   zeroing operations that caused memory pressure without throttling.

 - Remove the over-strict inline data boundary check. If a filesystem
   provides a valid inline_data pointer and length there is no reason to
   require that inline data must not cross a page boundary.

 - Don't make REQ_POLLED imply REQ_NOWAIT, matching the earlier
   equivalent block layer fix: there are valid cases to poll for I/O
   completion without REQ_NOWAIT, and REQ_NOWAIT for file system writes
   is currently not supported as writes aren't idempotent.

 - Introduce IOMAP_F_ZERO_TAIL for filesystems that maintain a separate
   valid data length (exFAT, NTFS). For a write starting at or beyond
   valid_size, __iomap_write_begin() now zeroes only the tail portion of
   the block while preserving valid data before it, instead of leaving
   stale data in the page cache. The flag is also added to the iomap
   trace event strings.

* tag 'vfs-7.2-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  iomap: Add IOMAP_F_ZERO_TAIL flag to trace event strings
  iomap: introduce iomap_fsverity_write() for writing fsverity metadata
  iomap: teach iomap to read files with fsverity
  iomap: introduce IOMAP_F_FSVERITY and teach writeback to handle fsverity
  fsverity: generate and store zero-block hash
  iomap: introduce IOMAP_F_ZERO_TAIL flag
  iomap: don't make REQ_POLLED imply REQ_NOWAIT
  iomap: remove over-strict inline data boundary check
  iomap: add dirty page control to iomap_zero_iter
  iomap: avoid memset iomap when iter is done
 2026-06-15 03:46:54 +05:30
Linus Torvalds
5b7c3f0fe3 vfs-7.2-rc1.eventpoll 
Please consider pulling these changes from the signed vfs-7.2-rc1.eventpoll tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 ouUiAP9oTjqqJEcc50zs79WLZANmgn5+/RONL2c65VHaOh2cHAEA/SWT56OnQ+Rf
 debIkResImn7LiEdbOJCp6PId60hIgE=
 =Z6mX
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.eventpoll' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull eventpoll updates from Christian Brauner:

 - eventpoll clarity refactor

   The recent eventpoll UAF fixes (a6dc643c69 and follow-ups) depended
   on invariants in fs/eventpoll.c that were nowhere documented and had
   to be reverse-engineered from the code: the lifetime relationships
   between struct eventpoll, struct epitem, and struct file, the three
   removal paths coordinating via epi_fget() pins and ep->mtx, the
   ovflist sentinel-encoded scan state machine, the POLLFREE
   release/acquire handshake, and the loop / path check globals
   serialized by epnested_mutex. The fixes were correct but the next
   person to touch this code would hit the same learning curve.

   This series codifies those invariants in source and tightens the
   surrounding structure. No functional changes intended:

     - Documentation: a top-of-file overview with field-protection
       tables for struct eventpoll and struct epitem, a section
       gathering the loop-check / path-check globals next to their
       declarations, labelled comments on the two sides of the POLLFREE
       handshake, refreshed comments on epi_fget() and ep_remove_file(),
       and a docblock on ep_clear_and_put() that names its two-pass
       structure as load-bearing.

     - Mechanical renames: ep_refcount_dec_and_test() -> ep_put() to
       pair with ep_get(), attach_epitem() -> ep_attach_file() for
       ep_remove_file() symmetry, the unused depth argument dropped from
       epoll_mutex_lock(), and the CONFIG_KCMP block relocated next to
       CONFIG_COMPAT so the hot-path code is contiguous.

     - Helper extraction: ep_insert() splits into ep_alloc_epitem() and
       ep_register_epitem(), ep_clear_and_put()'s two passes become
       ep_drain_pollwaits() and ep_drain_tree() so the ordering
       invariant is enforced by the call sequence rather than
       convention, the per-event delivery loop body becomes
       ep_deliver_event(), and the ep->mtx + epnested_mutex acquisition
       dance lifts out of do_epoll_ctl() into ep_ctl_lock() /
       ep_ctl_unlock().

     - Sentinel and predicate cleanup: the EP_UNACTIVE_PTR overload is
       hidden behind named helpers (ep_is_scanning, epi_on_ovflist,
       ...), epi->next is renamed to epi->ovflist_next, and the boolean
       predicates return bool.

     - The per-CTL_ADD scratch state (tfile_check_list, path_count[],
       inserting_into) moves from file-scope globals into a
       stack-allocated struct ep_ctl_ctx plumbed through the loop / path
       check chain.

   Two follow-up fixes are included: missing kernel-doc for the new @ctx
   parameters, and restoring the EP_UNACTIVE_PTR sentinel for
   ctx->tfile_check_list - replacing it with NULL termination broke
   ep_remove_file()'s "never listed" check for the list tail, causing a
   syzbot-reported use-after-free.

 - io_uring related epoll cleanups

   One of the nastier things about epoll is how it allows nesting
   contexts inside each other, leading to the necessity of loop
   detection and the issues that have come with that. There is no reason
   to support nesting on the io_uring side, so contain the damage and
   disallow nested contexts from there: eventpoll gains a file based
   control interface and struct epoll_filefd is renamed to epoll_key.
   The io_uring side proper goes on top of this through the block tree.

 - Fix epoll_wait() reporting false negatives

   ep_events_available() checks ep->rdllist and ep_is_scanning() without
   a lock and can race with a concurrent scan such that neither check
   sees the events, causing epoll_wait() with a zero timeout to wrongly
   report no events even though events are available. A sequence lock
   closes the race and a reproducer is added to the eventpoll selftests.

* tag 'vfs-7.2-rc1.eventpoll' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (25 commits)
  eventpoll: restore EP_UNACTIVE_PTR sentinel for ctx->tfile_check_list
  eventpoll: Fix epoll_wait() report false negative
  selftests/eventpoll: Add test for multiple waiters
  eventpoll: add missing kernel-doc for @ctx function parameters
  eventpoll: rename struct epoll_filefd to epoll_key
  eventpoll: add file based control interface
  eventpoll: export is_file_epoll()
  eventpoll: pass struct epoll_filefd through ep_find() and ep_insert()
  eventpoll: hoist CTL_ADD scratch state into struct ep_ctl_ctx
  eventpoll: use bool for predicate helpers
  eventpoll: rename epi->next and txlist for clarity
  eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
  eventpoll: extract lock dance from do_epoll_ctl() into ep_ctl_lock()
  eventpoll: extract ep_deliver_event() from ep_send_events()
  eventpoll: split ep_clear_and_put() into drain helpers
  eventpoll: split ep_insert() into alloc + register stages
  eventpoll: relocate KCMP helpers near compat syscalls
  eventpoll: rename attach_epitem() to ep_attach_file()
  eventpoll: drop unused depth argument from epoll_mutex_lock()
  eventpoll: rename ep_refcount_dec_and_test() to ep_put()
  ...
 2026-06-15 03:40:54 +05:30
Linus Torvalds
c8ed3a15a7 vfs-7.2-rc1.bh 
Please consider pulling these changes from the signed vfs-7.2-rc1.bh tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 ohE9AQC1p/bgcyPbHoSvFgBmq63rhwfYK/vcd6JJZ9iGuSNDnQEAq6idE8Wo18+J
 xVHLzL5K0aNvt0X3SZZS5BlDyeBhjAg=
 =kkX9
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.bh' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull buffer_head updates from Christian Brauner:
 "This removes b_end_io from struct buffer_head.

  Instead of setting bio->bi_end_io to end_bio_bh_io_sync() which then
  calls bh->b_end_io(), the new bh_submit() and __bh_submit() interfaces
  set bio->bi_end_io to the appropriate completion handler directly,
  replacing two indirect function calls in the completion path with one.
  It is also one fewer function pointer in the middle of a writable data
  structure that can be corrupted, it shrinks struct buffer_head from
  104 to 96 bytes allowing roughly 7% more buffer_heads to be cached in
  the same amount of memory, and it removes some atomic operations as
  the buffer refcount is no longer incremented before calling the end_io
  handler.

  All in-tree users (fs/buffer.c itself, ext4, jbd2, ocfs2, gfs2,
  nilfs2, and md-bitmap) are converted, and submit_bh(),
  mark_buffer_async_write(), and end_buffer_write_sync() are removed"

* tag 'vfs-7.2-rc1.bh' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (34 commits)
  buffer: Remove end_buffer_write_sync()
  buffer: Change calling convention for end_buffer_read_sync()
  buffer: Remove b_end_io
  buffer: Remove submit_bh()
  md-bitmap: Convert read_file_page and write_file_page to bh_submit()
  nilfs2: Convert nilfs_mdt_submit_block to bh_submit()
  nilfs2: Convert nilfs_gccache_submit_read_data to bh_submit()
  nilfs2: Convert nilfs_btnode_submit_block to bh_submit()
  buffer: Remove mark_buffer_async_write()
  gfs2: Convert gfs2_aspace_write_folio to bh_submit()
  gfs2: Remove use of b_end_io in gfs2_meta_read_endio()
  gfs2: Convert gfs2_dir_readahead to bh_submit()
  gfs2: Convert gfs2_metapath_ra to bh_submit()
  ocfs2: Convert ocfs2_write_super_or_backup to bh_submit()
  ocfs2: Convert ocfs2_read_blocks to bh_submit()
  ocfs2: Convert ocfs2_read_block to bh_submit()
  ocfs2: Convert ocfs2_write_block to bh_submit()
  jbd2: Convert jbd2_write_superblock() to bh_submit()
  jbd2: Convert journal commit to bh_submit()
  ext4: Convert ext4_commit_super() to bh_submit()
  ...
 2026-06-15 03:36:08 +05:30
Linus Torvalds
c17fdf62ae vfs-7.2-rc1.writeback 
Please consider pulling these changes from the signed vfs-7.2-rc1.writeback tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 ojA3AP9ZzkUfzQy42N7OfpvgTAIy7TYJ5xPVsK+8e5dNE2D3cgD/X3PZTvapuJUT
 vlQcxL7Q7dGttPVkL0T5fGviZhKuUgo=
 =6QcP
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs writeback updates from Christian Brauner:

 - Fix a race between cgroup_writeback_umount() and inode_switch_wbs()

   When a container exits, a race between cgroup_writeback_umount() and
   inode_switch_wbs()/cleanup_offline_cgwb() can trigger "VFS: Busy
   inodes after unmount" followed by a use-after-free on percpu
   counters.

   There is a window between inode_prepare_wbs_switch() returning true
   (having passed the SB_ACTIVE check and grabbed the inode) and the
   subsequent wb_queue_isw() call: if cgroup_writeback_umount() observes
   the global isw_nr_in_flight counter as non-zero but flush_workqueue()
   finds nothing queued yet, it returns early - leaving a held inode
   reference that blocks evict_inodes() and a later iput() that hits
   freed percpu counters.

   The race is closed by covering the window from
   inode_prepare_wbs_switch() through wb_queue_isw() with an RCU
   read-side critical section and synchronizing in the umount path.

   On top of that the now-dead rcu_barrier() left over from the
   queue_rcu_work() era is removed, and the global
   synchronize_rcu()/flush_workqueue() pair is replaced with a per-sb
   in-flight counter plus pin/unpin/drain helpers so umount no longer
   serializes against switch activity on unrelated superblocks.

   Under cgroup writeback churn on a 16 vCPU guest this takes umount
   latency from ~92-138ms p50 down to ~5-8ms p50 and the cumulative cost
   of cgroup_writeback_umount() from ~62ms to ~4us per call.

   The initial race fix is kept separate and minimal so it backports
   cleanly to stable trees that still queue switches via
   queue_rcu_work().

 - Improve write performance with RWF_DONTCACHE

   Dirty DONTCACHE pages are now tracked per bdi_writeback so that the
   writeback flusher can be kicked in a targeted fashion for
   IOCB_DONTCACHE writes instead of relying on global writeback, and the
   PG_dropbehind flag is preserved when a folio is split.

* tag 'vfs-7.2-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking
  mm: track DONTCACHE dirty pages per bdi_writeback
  mm: preserve PG_dropbehind flag during folio split
  writeback: use a per-sb counter to drain inode wb switches at umount
  writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
  writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
 2026-06-15 03:30:45 +05:30
Linus Torvalds
0793d39ec8 vfs-7.2-rc1.super 
Please consider pulling these changes from the signed vfs-7.2-rc1.super tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 ogMFAP9PfdJW1ChpUaOPI7/Oa7Nm74czRh5RLvwduFe1mevPZQD/dWHFjyGL5dat
 DgS7N38nTwCyohnPx7sDoeRG2g0B4QM=
 =iM4N
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs superblock updates from Christian Brauner:
 "This retires sget().

  CIFS plus the two ext4 KUnit tests (extents-test, mballoc-test) were
  the last in-tree callers, and all three convert cleanly to sget_fc().

  That lets sget() and its prototype come out, taking ~60 lines that
  only existed to be kept in lockstep with sget_fc() on every
  publish-path change"

* tag 'vfs-7.2-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fs: retire sget()
  smb: client: convert cifs_smb3_do_mount() to sget_fc()
  ext4: convert mballoc KUnit test to sget_fc()
  ext4: convert extents KUnit test to sget_fc()
 2026-06-15 03:25:36 +05:30
Linus Torvalds
50b900c564 vfs-7.2-rc1.openat2 
Please consider pulling these changes from the signed vfs-7.2-rc1.openat2 tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 ogT3AQCKd2J6Qz6vsVaHK8Bo9oE06Px4v2NGeu+FgCV0QQMpJQD+KTEnVl4ZepJu
 JsEw202uWeQw9Aj/SoD1oyuYO0ZIrQw=
 =rQxh
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull openat2 updates from Christian Brauner:
 "Features:

   - Add O_EMPTYPATH to openat(2)/openat2(2). To get an operable file
     descriptor from an O_PATH file descriptor it is possible to use
     openat(fd, ".", O_DIRECTORY) for directories, but other file types
     require going through open("/proc/<pid>/fd/<nr>") and thus depend
     on a functioning procfs.

     With O_EMPTYPATH an empty path string is accepted and LOOKUP_EMPTY
     is set at path resolution time, allowing to reopen the file behind
     the file descriptor directly. Selftests are included.

   - Add an OPENAT2_REGULAR flag for openat2(2) which refuses to open
     anything but regular files with the new EFTYPE error code.

     This implements the "ability to only open regular files" feature
     requested by userspace via uapi-group.org and protects services
     from being redirected to fifos, device nodes, and friends.

     All atomic_open implementations were audited for OPENAT2_REGULAR
     handling. Explicit checks were added to ceph, gfs2, nfs (v4), and
     cifs/smb - these are the filesystems whose atomic_open can
     encounter an existing non-regular file and would otherwise call
     finish_open() on it or return a misleading error code.

     The remaining implementations (9p, fuse, vboxsf, nfs v2/v3) only
     call finish_open() on freshly created files and use
     finish_no_open() for lookup hits, letting the VFS catch non-regular
     files via the do_open() safety net.

  Cleanups:

   - Migrate the openat2 selftests to the kselftest harness and move
     them under selftests/filesystems/. The tests were written in the
     early days of selftests' TAP support and the modern kselftest
     harness is much easier to follow and maintain. The contents of the
     tests are unchanged and the new emptypath tests are ported on top.

   - Make the LAST_XXX last-type constants private to fs/namei.c. The
     only user outside of fs/namei.c was ksmbd which only needs to know
     whether the last component is a regular one, so
     vfs_path_parent_lookup() now performs the LAST_NORM check
     internally. The ints are replaced with a dedicated enum last_type"

* tag 'vfs-7.2-rc1.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  vfs: replace ints with enum last_type for LAST_XXX
  vfs: make LAST_XXX private to fs/namei.c
  selftests: openat2: port emptypath_test to kselftest harness
  kselftest/openat2: test for OPENAT2_REGULAR flag
  openat2: new OPENAT2_REGULAR flag support
  openat2: introduce EFTYPE error code
  selftest: add tests for O_EMPTYPATH
  vfs: add O_EMPTYPATH to openat(2)/openat2(2)
  selftests: openat2: migrate to kselftest harness
  selftests: openat2: switch from custom ARRAY_LEN to ARRAY_SIZE
  selftests: openat2: move helpers to header
  selftests: move openat2 tests to selftests/filesystems/
 2026-06-15 03:11:05 +05:30
Linus Torvalds
37c405aeaa kernel-7.2-rc1.misc 
Please consider pulling these changes from the signed kernel-7.2-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 ov8YAQC/PzS/w3jwLjZRsIzXesRtWmSVwf8W+6Df2B3sULCvkQEA8bYlzNJ8+VWx
 3mC0gIKLRtLm6h2fA04z8972xOF3DgY=
 =wmIj
 -----END PGP SIGNATURE-----

Merge tag 'kernel-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc kernel updates from Christian Brauner:
 "Fixes

   - rhashtable: give each instance its own lockdep class

     syzbot reported a circular locking dependency between ht->mutex and
     fs_reclaim via the simple_xattrs rhashtable being torn down during
     inode eviction.

     The predicted deadlock cannot occur: rhashtable_free_and_destroy()
     cancels the deferred worker before taking ht->mutex and
     acquisitions on distinct rhashtables are on distinct mutexes.

     Lockdep flags a cycle anyway because every ht->mutex in the kernel
     shared the single static lockdep class from
     rhashtable_init_noprof().

     The lockdep key is lifted to a per-call-site static key so every
     rhashtable instance gets its own class.

   - selftests/clone3: fix misuse of the libcap library interface in the
     cap_checkpoint_restore test and remove unused variables

   - selftests/pid_namespace: compute the pid_max test limits
     dynamically instead of hardcoding values below the kernel-enforced
     minimum of PIDS_PER_CPU_MIN * num_possible_cpus() which made the
     tests fail on machines with many possible CPUs

   - selftests: fix the Makefile TARGETS entry for nsfs which wasn't
     adjusted when the tests moved under filesystems/

  Cleanups

   - ipc/sem.c: use unsigned int for nsops to match the declaration in
     syscalls.h"

* tag 'kernel-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/clone3: remove unused variables
  selftests/clone3: fix libcap interface usage
  ipc/sem.c: use unsigned int for nsops
  selftests: Fix Makefile target for nsfs
  rhashtable: give each instance its own lockdep class
  selftests/pid_namespace: compute pid_max test limits dynamically
 2026-06-15 03:05:50 +05:30
Linus Torvalds
9c9e6bd4cc kernel-7.2-rc1.task_exec_state 
Please consider pulling these changes from the signed kernel-7.2-rc1.task_exec_state tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 okqlAQDfm+CCTRDZu5EOqYod98xwbmQ/TBJo4rXv/O0E2pRRJwEAqhCNhfTd+MGY
 RtkLnY+bdMEI4Ii+JGLAZdWMc3Hu9Q0=
 =qF04
 -----END PGP SIGNATURE-----

Merge tag 'kernel-7.2-rc1.task_exec_state' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull task_exec_state updates from Christian Brauner:
 "This introduces a new per-task task_exec_state structure and relocates
  the dumpable mode and the user namespace captured at execve() from
  mm_struct onto it. It stays attached to the task for its full
  lifetime.

  __ptrace_may_access() and several /proc owner and visibility checks
  need to consult two pieces of state for any observable task, including
  zombies that have already gone through exit_mm(): the dumpable mode
  and the user namespace captured at execve(). Both live on mm_struct
  today, which exit_mm() clears from the task long before the task is
  reaped. A reader that races with do_exit() observes task->mm == NULL
  and either fails the check or falls back to init_user_ns - which
  denies legitimate access to non-dumpable zombies that were running in
  a nested user namespace.

  mm_struct loses ->user_ns and the dumpability bits in ->flags.
  MMF_DUMPABLE_BITS is reserved so the MMF_DUMP_FILTER_* layout exposed
  via /proc/<pid>/coredump_filter stays stable. task->user_dumpable and
  its exit_mm() snapshot are removed.

  task_exec_state is the privilege domain established by an execve().
  Within a thread group it is shared via refcount; across thread groups
  each task has its own:

   - CLONE_VM siblings (thread-group members, io_uring workers)
     refcount-share the parent's exec_state.

   - Non-CLONE_VM clones (fork(), vfork() without CLONE_VM) allocate a
     fresh exec_state inheriting the parent's dumpable mode and user_ns.

   - execve() in the child allocates a fresh instance and installs it
     under task_lock + exec_update_lock via task_exec_state_replace().

   - Credential changes (setresuid, capset, ...) and
     prctl(PR_SET_DUMPABLE) update dumpability on the current task's
     exec_state, i.e., on the thread group's shared instance.

  On top of this exec_mmap() no longer tears down the old mm while
  holding exec_update_lock for writing and cred_guard_mutex. Neither
  lock is needed for that: exec_update_lock only exists to make the mm
  swap atomic with the later commit_creds() and all its readers operate
  on the new mm; none looks at the detached old mm.

  The cost was real: __mmput() runs exit_mmap() over the entire old
  address space and can block in exit_aio() waiting for in-flight AIO,
  so execve() of a large process blocked ptrace_attach() and every
  exec_update_lock reader for the duration of the teardown.

  The old mm is now stashed in bprm->old_mm and released from
  setup_new_exec() after both locks are dropped, with a backstop in
  free_bprm() for the error paths"

* tag 'kernel-7.2-rc1.task_exec_state' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  exec: free the old mm outside the exec locks
  exec_state: relocate dumpable information
  ptrace: add ptracer_access_allowed()
  exec: introduce struct task_exec_state
  sched/coredump: introduce enum task_dumpable
 2026-06-15 03:00:58 +05:30
Linus Torvalds
5d15ab717d vfs-7.2-rc1.casefold 
Please consider pulling these changes from the signed vfs-7.2-rc1.casefold tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKgAKCRCRxhvAZXjc
 omRSAP4valdmpvuSFbc84F6nn0LjDhTR+zg3uX2iGF6sWaQLjAEAyAhuDH23SQyz
 SSj2KCh/G2c/IXCVM5j0zn7fZxeKBA4=
 =GA7C
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.casefold' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs casefolding updates from Christian Brauner:
 "This exposes the case folding behavior of local filesystems so that
  file servers - nfsd, ksmbd, and user space file servers - can report
  the actual behavior to clients instead of guessing.

  Filesystems report case-insensitive and case-nonpreserving behavior
  via new file_kattr flags in their fileattr_get implementations. fat,
  exfat, ntfs3, hfs, hfsplus, xfs, cifs, nfs, vboxsf, and isofs are
  wired up. Local filesystems that are not explicitly handled default to
  the usual POSIX behavior of case-sensitive and case-preserving.

  nfsd uses this to report case folding via NFSv3 PATHCONF and to
  implement the NFSv4 FATTR4_CASE_INSENSITIVE and FATTR4_CASE_PRESERVING
  attributes - both have been part of the NFS protocols for decades to
  support clients on non-POSIX systems - and ksmbd reports it via
  FS_ATTRIBUTE_INFORMATION. Exposing the information through the
  fileattr uapi covers user space file servers.

  The immediate motivation is interoperability: Windows NFS clients
  hard-require servers to report case-insensitivity for Win32
  applications to work correctly, and a client that knows the server is
  case-insensitive can avoid issuing multiple LOOKUP/READDIR requests
  searching for case variants.

  The Linux NFS client already grew support for case-insensitive shares
  years ago in support of the Hammerspace NFS server - negative dentry
  caching must be disabled (a lookup for "FILE.TXT" failing must not
  cache a negative entry when "file.txt" exists) and directory change
  invalidation must drop cached case-folded name variants. Such servers
  often operate in multi-protocol environments where a single file
  service instance caters to both NFS and SMB clients, and nfsd needs to
  report case folding properly to participate as a first-class citizen
  there.

  A follow-up series brings fixes for the initial work: the nfsd
  case-info probe now uses kernel credentials, maps -ESTALE to
  NFS3ERR_STALE, and has its cost capped across READDIR entries; the nfs
  client avoids transiently zeroed case capability bits during the probe
  and skips the pathconf probe when neither field is consumed; the
  FS_CASEFOLD_FL semantics are clarified in the UAPI header; and the
  tools UAPI headers are synced"

* tag 'vfs-7.2-rc1.casefold' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (22 commits)
  nfsd: Cap case-folding probe cost across READDIR entries
  nfsd: Map -ESTALE from case probe to NFS3ERR_STALE
  nfsd: Use kernel credentials for case-info probe
  fs: Clarify FS_CASEFOLD_FL semantics in UAPI header
  nfs: Skip pathconf probe when neither field is consumed
  nfs: Avoid transient zeroed case capability bits during probe
  tools headers UAPI: Sync case-sensitivity flags from linux/fs.h
  ksmbd: Report filesystem case sensitivity via FS_ATTRIBUTE_INFORMATION
  nfsd: Implement NFSv4 FATTR4_CASE_INSENSITIVE and FATTR4_CASE_PRESERVING
  nfsd: Report export case-folding via NFSv3 PATHCONF
  isofs: Implement fileattr_get for case sensitivity
  vboxsf: Implement fileattr_get for case sensitivity
  nfs: Implement fileattr_get for case sensitivity
  cifs: Implement fileattr_get for case sensitivity
  xfs: Report case sensitivity in fileattr_get
  hfsplus: Report case sensitivity in fileattr_get
  hfs: Implement fileattr_get for case sensitivity
  ntfs3: Implement fileattr_get for case sensitivity
  exfat: Implement fileattr_get for case sensitivity
  fat: Implement fileattr_get for case sensitivity
  ...
 2026-06-15 02:55:34 +05:30
Linus Torvalds
6b5b72ac2c vfs-7.2-rc1.directory.delegations 
Please consider pulling these changes from the signed vfs-7.2-rc1.directory.delegations tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKQAKCRCRxhvAZXjc
 opMRAQD9zbiUu66CHNd49yD3sFtuG8uM7I2VuIoczgW+qKka5QEA8HBVqMtdurZf
 eEcj415FqHQNX1W3jytjU1jYjiwmtgY=
 =Ahl/
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.directory.delegations' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs directory delegations from Christian Brauner:
 "This contains the VFS prerequisites for supporting directory
  delegations in nfsd via CB_NOTIFY callbacks.

  The filelock core gains support for ignoring delegation breaks for
  directory change events together with an inode_lease_ignore_mask()
  helper, and fsnotify gains fsnotify_modify_mark_mask() and a
  FSNOTIFY_EVENT_RENAME data type.

  With this in place nfsd can request delegations on directories and set
  up inotify watches to trigger sending CB_NOTIFY events to clients
  instead of having every directory change break the delegation.

  New tracepoints are added to fsnotify() and to the start of
  break_lease(), and trace_break_lease_block() is passed the currently
  blocking lease instead of the new one.

  A follow-up fix moves the LEASE_BREAK_* flags out of
  #ifdef CONFIG_FILE_LOCKING to fix the build for CONFIG_FILE_LOCKING=n
  configurations"

* tag 'vfs-7.2-rc1.directory.delegations' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  filelock: move LEASE_BREAK_* flags out of #ifdef CONFIG_FILE_LOCKING
  fsnotify: add FSNOTIFY_EVENT_RENAME data type
  fsnotify: add fsnotify_modify_mark_mask()
  fsnotify: new tracepoint in fsnotify()
  filelock: add an inode_lease_ignore_mask helper
  filelock: add a tracepoint to start of break_lease()
  filelock: add support for ignoring deleg breaks for dir change events
  filelock: pass current blocking lease to trace_break_lease_block() rather than "new_fl"
 2026-06-15 02:50:44 +05:30
Linus Torvalds
fac863c887 vfs-7.2-rc1.inode 
Please consider pulling these changes from the signed vfs-7.2-rc1.inode tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKQAKCRCRxhvAZXjc
 oprJAQDhPF8SZCgbPQ6TYVjOZtP2jWZEOrh0UVd0YjisDHqpkAD/ZVlRzvn9jKBT
 uuFnsOsOhJYfsQym5uXJhFWgR1kHsQs=
 =CTxV
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs inode updates from Christian Brauner:
 "This extends the lockless ->i_count handling.

  iput() could already decrement any value greater than one locklessly
  but acquiring a reference always required taking inode->i_lock. Now
  acquiring a reference is lockless as long as the count was already at
  least 1, i.e., only the 0->1 and 1->0 transitions take the lock.

  This avoids the lock for the common cases of nfs calling into the
  inode hash and btrfs using igrab(). Cleanup-wise icount_read_once() is
  added to line up with inode_state_read_once() and the open-coded
  ->i_count loads across the tree are converted, and ihold() is
  relocated and tidied up.

  On top of that some stale lock ordering annotations are retired from
  the inode hash code: iunique() no longer takes the hash lock since the
  inode hash became RCU-searchable and s_inode_list_lock is no longer
  taken under the hash lock either"

* tag 'vfs-7.2-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fs: retire stale lock ordering annotations from inode hash
  fs: allow lockless ->i_count bumps as long as it does not transition 0->1
  fs: relocate and tidy up ihold()
  fs: add icount_read_once() and stop open-coding ->i_count loads
 2026-06-15 02:44:23 +05:30
Linus Torvalds
4d23bdc498 vfs-7.2-rc1.exportfs 
Please consider pulling these changes from the signed vfs-7.2-rc1.exportfs tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKQAKCRCRxhvAZXjc
 osTEAP9jxy3fjL4GlydiPPkfKPPEQAwgVQ7kAi6UeEwOp+21RQEAy2FfDSHCs/Xo
 vDD36+PWi5msceD5KGUL4vGSMSJX4gs=
 =T+h6
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.exportfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull exportfs updates from Christian Brauner:
 "This cleans up the exportfs support for block-style layouts that
  provide direct block device access: the operations for layout-based
  block device access are split out of struct export_operations into a
  separate header, ->commit_blocks() no longer takes a struct iattr
  argument, and the way support for layout-based block device access is
  detected is reworked.

  nfsd's blocklayout code also stops honoring loca_time_modify. This is
  preparation for supporting export of more than a single device per
  file system"

* tag 'vfs-7.2-rc1.exportfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  exportfs,nfsd: rework checking for layout-based block device access support
  exportfs: don't pass struct iattr to ->commit_blocks
  exportfs: split out the ops for layout-based block device access
  nfsd/blocklayout: always ignore loca_time_modify
 2026-06-15 02:38:54 +05:30
Linus Torvalds
d2cb5e633c vfs-7.2-rc1.kfunc 
Please consider pulling these changes from the signed vfs-7.2-rc1.kfunc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiwLKQAKCRCRxhvAZXjc
 omvOAP4qC9EOcysoY0JGOEa4d915tpxYW6mxgv/My1MAMEybsQD+KHMNTiWke4Aj
 CSFyVhZ43R2I+VYO2HTPbzEGOTqs2Qs=
 =WfNh
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull bpf filesystem kfunc fix from Christian Brauner:
 "The bpf_set_dentry_xattr() and bpf_remove_dentry_xattr() kfuncs locked
  the inode of the supplied dentry without checking whether the dentry
  is negative.

  Passing a negative dentry (e.g., from security_inode_create) caused a
  NULL pointer dereference. Negative dentries now fail with EINVAL. The
  WARN_ON(!inode) in the bpf xattr permission helpers is dropped as well
  since it could be triggered the same way, amounting to a denial of
  service on systems with panic_on_warn enabled"

* tag 'vfs-7.2-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries
 2026-06-15 02:34:37 +05:30
Linus Torvalds
8cd9520d35 Linux 7.1 2026-06-14 15:58:38 +01:00
Linus Torvalds
4242809533 ARM fixes for 7.1 
Three fixes:
 - Avoid KASAN instrumentation of half-word IO
 - Use a byte load for KASAN shadow stack
 - Fix kexec and hibernation with PAN
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuNNh8scc2k/wOAE+9OeQG+StrGQFAmousPYACgkQ9OeQG+St
 rGREqQ/+OdeNlX8q7h7Hv5kOXsrjsD/UMjsunzP/RKeZUYskF0zxJyK+qc6BjW1g
 +5zxSikZ+cZZT0rrGma5gOBpNG0FtJSF02CyCSjlKyb6nu09wc1aMZ/DiAMQkZ/u
 wunswFeR3pO97YT6QxJMcv2MVabH4FvWg7aym5KmJycWwRYzDwd1id0b/aEDyP6n
 bEnspk1RnAgp12mC4IjK+dKlsd9wgbrCNBXCyGw35cqEuqaVG021Jkprwxk3jdK/
 sunFPQVZebewiQFQOTQP6jNudYOfV6Uf+7wu67C7inLdffe7r+OW+Z2aFuHXJmXo
 lbpQvmgzHMzpFq5nNQaMFO3cwe6HwPwwDJbXf6eDWvbKPaaU6AQf+Ywcbj/P6Aj6
 7+ellXuSkErTKZSVrJ/wdLB2I1CGHkWbMX6VSXizuZJ5H07E40urkEqIALyw3Q4z
 +8RxnOrfsrlVeE1m+rm5FpOSxokD8kbSn66fP2EwIG1lRbbmFw402nj51a7Vuc8e
 RcSqPt3Y8L9vHCh9c2hxc/IzYTyE21wKeWWP9qPsvR79xyJLLgPbAwvk6sxGLDEY
 Fcourk96GROJ1RQxNXLzjgexrVCVBgZgW+qeOwVcxzejWZbkx7i/9UFCokTHO0bg
 4UrMJ6+XWH49PwDTlxjHBn+HFgAwLlZyFNIbee6fQNqxvYgxo68=
 =aiHy
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux

Pull ARM fixes from Russell King:

 - Avoid KASAN instrumentation of half-word IO

 - Use a byte load for KASAN shadow stack

 - Fix kexec and hibernation with PAN

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
  ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN
  ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
  ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
 2026-06-14 15:37:39 +01:00
Linus Torvalds
e21ee273e6 Fixes for the Qualcomm and Google GS101 clk drivers: 
- Skip parking clks on some Qualcomm platforms so that the
    recovery console keeps working
  - Fix Google GS101 resume by using the correct div register
 -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmot41oUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSXsPQ/+O2tv2vLffz8c5ULgVUB9LUNgyYrS
 eHAifuUIFGunZfjVwOB/5xNGhwXDlCP3OiLRNsyVPhLQ5EuDKME8H0rNn5Iwrxyu
 KWHm4Rd3wsQ0PGLFRvW40QpFEug91SIWl3xVb+a0W7TLdiO6jk6yhzXeSmWWDXWJ
 zyh3m9hKmZKiMcS7SKU7AQNXCfOks3kEwuLRnP9fLWNd3XVXxxqalpDC23h3/pPb
 t96gs/8yC4Aw14krgwkvDsQRdkEQnRm+hCIcjw42UQY3XuzAvrzHYBdNlB+l15z8
 wT/VdsOuk2rqiwkgglU/SCVe0hJkKjK3NYOo+uehCIzFLioGevM6CbDQ33yC1Y+c
 duy5iPjrvGsWSG6jAReNUmQLK0mONWzK079LpZnJM6HgDFoq6Ap8P8N4P1o+lbxI
 p3YseKmeiEdxRxd4k4ysv5WfIpgRgbPF0bXSW9BhtrwoEdlg8jaqdZw8SEOQVGWw
 fqqPQCEhFyiAERZrXpCAL0Dn81znXTy2uAaUe/VffuuN3tWi8lmT4x+1eyJV3MbL
 g/Bd+XqeGAJnjsCcO9oZPNT1knczTmVnjVPFJNZ10Y2ymL1HpvR4pLKEoN6uMgmK
 Cf7o/J0i/BwJGysh86wVpnYOaDmbQ4Pitp1OdvqeyIjziYfRX0jMF4GrA3ivJZGl
 +XwAqGCR33M7H5A=
 =UYw5
 -----END PGP SIGNATURE-----

Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk fixes from Stephen Boyd:
 "Fixes for the Qualcomm and Google GS101 clk drivers:

   - Skip parking clks on some Qualcomm platforms so that the recovery
     console keeps working

   - Fix Google GS101 resume by using the correct div register"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
  clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
  clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked
 2026-06-13 18:21:44 -07:00
Linus Torvalds
2b07ea76fd - Fix potential debugobjects deadlock on PREEMPT_RT kernels 
(Waiman Long)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmotM34RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iY7BAAmlH54KzSFAtKfeIYb7Vc0Yc8JSHicJ0I
 VExAapEODhFyQkOyZCz60a0lqCL0ZaieQ2zIMSr0GtomYBIRoESzxfuN51KBEQ77
 FM8MslGzpOk+u35AY/9WqcKPdu6QQt5cn/uOOaNNXnDtJbkMorcz1hTrZrYVl6XB
 4EnWR2U1f3aN4zz+IM/HpH4/HUOREJi3AXjNvh9aUCWn/yRN4TK1FfKQbMTrCGuq
 wq000+tN16LusLw3QwpFvO9rcuYgqnhHvUOpxrANRYQFUwoaVQsoQ9prvlwNzH8I
 V4ygYVFAQjlteeLWx0O1sk0KSztg9+AIPGC6iiBKu45QjDLDLCIJA764D7gZrw9s
 wUBxlJyyiIzEa2WJ28KPEiJ22wOfhhc2YS80sK2oIP2rjdbYlvcFyvaLATDu5OxG
 M9BZyx5144pVkXkIqqyZOrtGxebJEqsPOb/eKFFvW3G9IUElhcjRh2c/NmGDquNH
 zZz1Oulhc7z8hMtUTNdllXdc0hoYLTO+8xN/WKsMCvpgXnwH9tjo7CySwuWhG2G9
 iYaO7EMBGPGRA+uhj8b/HoOHMF8fq2FtpFg2na3ftVCyfMwmcuUcfpcpMvbuOWql
 9MnCUVEoFXeSr1/zP+II6kC/aQzKN1oddQEX0PcE1lakEpN2f67U5osESkzSuXxl
 WwngN0Rgslc=
 =4bdE
 -----END PGP SIGNATURE-----

Merge tag 'core-urgent-2026-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull debugobjects fix from Ingo Molnar:

 - Fix potential debugobjects deadlock on PREEMPT_RT kernels (Waiman
   Long)

* tag 'core-urgent-2026-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  debugobjects: Don't call fill_pool() in early boot hardirq context
 2026-06-13 08:23:36 -07:00
Linus Torvalds
a5e98d1679 i2c-for-7.1-rc8 
- rust: fix I2cAdapter refcount double increment
 - MAINTAINERS: minor updates
 - imx: keep clock and pinctrl states consistent in runtime PM
 - imx-lpi2c: fix DMA resource leaks on PIO fallback
 - qcom-cci: fix NULL pointer dereference on remove
 - riic: fix reset refcount leak on resume_noirq error path
 - stm32f7: account for analog filter in timing computation
 - tegra: fix suspend/resume handling in NOIRQ phase
 - tegra: update Tegra410 I2C timings to match hardware specs
 - MAINTAINERS: hand over I2C maintainership to Andi
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmotKAIACgkQFA3kzBSg
 KbZ50Q//W+08GJo35DzVDBJ6s2laaI3RQNI7IKan0uI/QMPKT/blALsMxGfBWo5A
 zIKQ/YRahI/n3tZq6vQ+K8eGHIf3qa/97dCja+9IGQGXS0vShNeBiUuxSsZ/BR6f
 8Soz/ULtPHMLmumhb1lfJBypgLgt8itZUQ2Xgr3KrJZrRE4vM8GS/BeEvWM+AMn7
 M8KMulMvuP+j5YsfAtE04mwaLrBT+scgGXRuy5+UkEt13Of2QfuadFjE73WU6O02
 y/0+xtVlyD+JbBLLeGjk36gwX69I/6GSJvCvPbMr1p/UKNW61xTpL0NkBooJm4sD
 pmRlRLJd4Y4R+L6wWRronXGHmKIw6QhjkTlL1CPsHUyGQ4lUOp9zAmhJSbf+HYzZ
 obPweHfORUt++FaaKfZ7vQP4ZRab7JJ0yk7fv4GUnSTvB88ATNC2Hm/BvG9W51lB
 PhgUjgye0DkaY394taRDJP0T8CSmGxyFpt5F2g89itlg73D7yXgV/iscZq6e9oPG
 RQxde5KV+SldlduPpj0w4f/L4SyeHAk1fHwlD2S/sERDlpoCZyUqbNQf/w4fYAl0
 D7fTvPAgN0j+baDSESqCyg/E8kiq4VRrP1bhQapLkmSYMmZUNq9t55np4l+80dT1
 y//Bdu+AkfdAxRfB66aTnVVRRNvV8yzmzKKCBtDDMe82DSje130=
 =K2oD
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:
 "The biggest news here is that this is my last pull request as I2C
  maintainer after 13.5 years. Starting with the 7.2 cycle, Andi Shyti
  is taking over who helped me greatly maintaining the host drivers for
  a while now. Thank you, Andi, and good luck with the subsystem. I'll
  be around for help, of course.

  Technically, there are two patches which might be a tad large for this
  late cycle, but most of them is explaining comments, so I think they
  are suitable.

   - MAINTAINERS:
      - hand over I2C maintainership to Andi
      - minor updates

   - rust: fix I2cAdapter refcount double increment

   - imx: keep clock and pinctrl states consistent in runtime PM

   - imx-lpi2c: fix DMA resource leaks on PIO fallback

   - qcom-cci: fix NULL pointer dereference on remove

   - riic: fix reset refcount leak on resume_noirq error path

   - stm32f7: account for analog filter in timing computation

   - tegra:
      - fix suspend/resume handling in NOIRQ phase
      - update Tegra410 I2C timings to match hardware specs"

* tag 'i2c-for-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  dt-bindings: i2c: mux-gpio: name correct maintainer
  MAINTAINERS: hand over I2C to Andi Shyti
  i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
  MAINTAINERS: i2c: designware: Remove inactive reviewer
  i2c: tegra: Fix NOIRQ suspend/resume
  i2c: tegra: Update Tegra410 I2C timing parameters
  i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
  i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
  i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
  i2c: riic: fix refcount leak in riic_i2c_resume_noirq()
  rust: i2c: fix I2cAdapter refcounts double increment
 2026-06-13 08:14:17 -07:00
Linus Torvalds
062871f137 Pin control fixes for v7.1: 
- Two fixes for the mcp23s08 driver.
 
 - Revert an earlier fix to the AMD pin controller that was
   all wrong. A proper fix is being developed.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmosQ2gACgkQQRCzN7AZ
 XXMYEA/8Dw4lppKbkEOFzsFeCLa6eTu+xb7+cJU1T8xIEk9WA2Ipy/4C+ZceOp3H
 jxs8jsNG7K/flFPOoiMbP1w5ApLyH8n94kyhhyk4NzXj33+Dd189Gx47w/gUX5Pz
 pZICo+Cocfnh/gHsAX5yplf+Ga/k+C+B/Hssw1a+5Zhu37DVMrWK8XvBHNll8J0V
 SDqcFO1kG/fYPyU2DqNZwhdGIaO6jUA/s1xbQs4hCVUNVtMoDS87fFYGPHRNvPjt
 vP+WAA2aM52BXXiZytrZO4RmcCR4xEi0uxrBBPNiX0RFoP3g9xoc4q8nS57vRUJA
 EqLtO7y6nkBZLflzOZYkFU/TVnCKFPkIpwRlgRWzCqznehryg5Ab6+ynS0FEJk6b
 kEvbO0RrpQMjehBtXOZHirjg2BhGjenSiN0jS26LvLQNH+vP0/C7YT8GrwqDu+qV
 l3ZxdpL/GnYnyykvxGDxJ4A9xHuRaBNxVAfNguQYZrbspXeX1BtckSiKWkDCfqkj
 qyLp2ylcU3XmaQEXXZcpO0JtAzpug7EmE/yF5JeHUnlnZ/vgRnlWJCov6a+vN3bf
 bZcIOydFV+29e6DhlbgcCycu62EJn7TPBfgcPTv1hnNe8pYjRxqG8UmsMprcw2U5
 4uwqaVP+/5cI/g6qFEDMdIal1KKImI+AWACUI9lu2D8D5hpDeCk=
 =h1rZ
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - Two fixes for the mcp23s08 driver.

 - Revert an earlier fix to the AMD pin controller that was all wrong. A
   proper fix is being developed.

* tag 'pinctrl-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  Revert "pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11"
  pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
  pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
 2026-06-12 17:23:05 -07:00
Linus Torvalds
4fa048ed72 drm fixes for 7.1-rc8/final 
colorop:
 - make lut interpolation mutable
 - track colorop updates correctly
 
 amdgpu:
 - UserQ fix
 - Userptr fix
 - MCCS freesync fix
 - track colorop changes correctly
 
 amdkfd:
 - Fix an event information leak
 - Events bounds check fix
 - Trap cleanup fix
 
 i915:
 - Check supported link rates DPCD read
 - Fix phys BO pread/pwrite with offset
 
 xe:
 - fix oops in suspend/shutdown without display
 - RAS fixes
 - Use HW_ERR prefix in log
 - include all registered queues in TLB invalidation
 - Fix refcount leak in xe_range_tree in error paths
 - fix job timeout recovery for unstarted jobs and kernel queues
 
 amdxdna:
 - fix possible leak of mm_struct
 
 ivpu:
 - fix integer truncation
 
 vc4:
 - fix leak in krealloc() error handling
 
 virtio:
 - fix dma_fence ref-count leak
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmoshK4ACgkQDHTzWXnE
 hr4Smg/9FUfVrM81DM17+sdtWwj2NVVAqdaR9YfD836qKNJDGcStRfpxxwgrSLnL
 3XHKfieQD/AMTPnhJsz364Ei8XHgqGreTYf3kFl9q3ooDYtRTIILRliSl/e/YaLV
 RFmGVWDYQDhHdRGQiEZ+Nnyg8NzbBa6B0uNGqKX/sq68m3oOKrdffBVlGp5IpmDd
 FM5GLV757UVJMG076GvwqsW/lC8Cm3M4k6/njIEGYggF4fdid1O/hTk8HLx5u9vJ
 IkAf0jwedKRdPQC5L4nSHmTxQHIeiO7Le7zl/uegdZNEWdEIyUMdcXffUZSgrp+Y
 /3vhenjRwDrlmbf6xjCWyn9V1ozgY6B84HOwdutM0cXBuo5tixe1amECyHTcRH/q
 oxNsBBzeo6GYgcZeh8Pt25BFz6o11HqAV2PXOtTvfKqJX5UaNl5yf65nkcqsbCx/
 5AxET2PLsEdaxbBOo4tqXdIo1uyRDfcdt/p06eOLqBPt9iDqNFobzsSIK0UleO62
 zP1XSkR/e4jLVORrW9lSfEXfgtrqxngRHMRp78UxYlKb+dJU3CH2tfkvn+VW+NNB
 rlCb+OdHxDfHYBPO6CM4Qv3XtEjus95HW7DiVLhwdhZfkZZJ0/OSY8YlkVTvXC8E
 Z56vsuyC6fYBVzrjJyhtR+APrG8hDJwWgEC621XLmxo/1PNa22s=
 =gAFg
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-06-13' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Looks like it's settled down a bit more thankfully. Small changes
  across the board, amdgpu/xe leading with some colorop changes in the
  core/amd. Otherwise some misc driver fixes.

  colorop:
   - make lut interpolation mutable
   - track colorop updates correctly

  amdgpu:
   - UserQ fix
   - Userptr fix
   - MCCS freesync fix
   - track colorop changes correctly

  amdkfd:
   - Fix an event information leak
   - Events bounds check fix
   - Trap cleanup fix

  i915:
   - Check supported link rates DPCD read
   - Fix phys BO pread/pwrite with offset

  xe:
   - fix oops in suspend/shutdown without display
   - RAS fixes
   - Use HW_ERR prefix in log
   - include all registered queues in TLB invalidation
   - Fix refcount leak in xe_range_tree in error paths
   - fix job timeout recovery for unstarted jobs and kernel queues

  amdxdna:
   - fix possible leak of mm_struct

  ivpu:
   - fix integer truncation

  vc4:
   - fix leak in krealloc() error handling

  virtio:
   - fix dma_fence ref-count leak"

* tag 'drm-fixes-2026-06-13' of https://gitlab.freedesktop.org/drm/kernel: (24 commits)
  accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
  drm/xe: fix job timeout recovery for unstarted jobs and kernel queues
  drm/xe: fix refcount leak in xe_range_fence_insert()
  drm/xe: include all registered queues in TLB invalidation
  drm/xe/hw_error: Use HW_ERR prefix in log
  drm/xe/drm_ras: Add per node cleanup action
  drm/xe/drm_ras: Make counter allocation drm managed
  drm/xe/display: fix oops in suspend/shutdown without display
  drm/amd/display: use plane color_mgmt_changed to track colorop changes
  drm/atomic: track individual colorop updates
  drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable
  drm/colorop: Remove read-only comments from interpolation fields
  drm/i915/gem: Fix phys BO pread/pwrite with offset
  drm/vc4: fix krealloc() memory leak
  drm/virtio: Fix driver removal with disabled KMS
  drm/i915/edp: Check supported link rates DPCD read
  accel/ivpu: Fix signed integer truncation in IPC receive
  drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
  drm/amd/display: Consult MCCS FreeSync cap only if requested & supported
  drm/amdkfd: Unwind debug trap enable on copy_to_user failure
  ...
 2026-06-12 15:51:16 -07:00
Dave Airlie
7c62657a10 Short summary of fixes pull: 
amd:
 - track colorop changes correctly
 
 amdxdna:
 - fix possible leak of mm_struct
 
 colorop:
 - make lut interpolation mutable
 - track colorop updates correctly
 
 ivpu:
 - fix integer truncation
 
 vc4:
 - fix leak in krealloc() error handling
 
 virtio:
 - fix dma_fence ref-count leak
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmorv5QbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3ojwYMH/iwAK01HiLXYmevOHphW
 bWcxEg4b1vvNUgDZJLP3Edob+OW+81CyO+/VE9jzB+BJ/eN1v7El6EBnrVXh2Bk+
 vuywPmqpqADLtHS8cNuUa12Q0nIi5A3yR9G5r1xvcuzhQgjJcEN7v7MjhvEKUjwI
 Bs8xmplGdO8wpHoxNSTmiluDN34ekf2QK2zk68hDie4z3hhyVgV/E6swfbr6jXR+
 7BjhwV8nF3kB0awvRcQwScmGEqTq653SPI2Fco6oXFmlTBc4tR0qcNyUENCoam4n
 BGpi7VPoqeKrKkQ6qdVUBxtztpMZwoffCWlfCAyr2oWUtYKMwdyyFaj5xrQGDlZl
 iBQ=
 =GN7d
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-06-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

amd:
- track colorop changes correctly

amdxdna:
- fix possible leak of mm_struct

colorop:
- make lut interpolation mutable
- track colorop updates correctly

ivpu:
- fix integer truncation

vc4:
- fix leak in krealloc() error handling

virtio:
- fix dma_fence ref-count leak

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260612081418.GA17001@2a02-2455-9062-2500-e496-5a17-62ba-545e.dyn6.pyur.net
 2026-06-13 07:52:40 +10:00
Linus Torvalds
2a2974b514 pci-v7.1-fixes-3 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmosbh0UHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vzXoQ//Ssd9XRvwx8eMqk6xoYBSD7EmPNpI
 4kKOo10Ilkz5WiKGkFJGjmgEVhxejNPICCatVXwC/O4y7tVk7lInKzUJPJZHP7vx
 CZyL/g2PoXCUojmKfbeWfLN6f9hHtTS13h1PJlTgYMz9OkAzWJXVVkOK55p66HQb
 P+3Li5a4q5LJxs5V22vhxaXF+FV6wJZ7YisyDb6jFnml2AI4+WTAbropCYxcD3Pj
 EmWD1TqLt7cGF6y5BVeSnGW76/WoC+zjXOlZIpEEFDRaZre+JNj/kTpR6f6Jb2er
 ic0G90h/0hK9tR62bOfQ0/5u1AveYeI0OrrEQDoOGg9EV+4J/n3lO20/EtRuVCAT
 tjRuDh49/hWIelndll+TlLMVND4P3P2YJVdCcmL/cDs/XcTTQOZFotaeexH3vvlS
 Z9HPHM6XXahCsQ8QcRmK3VK/rS588avccePIMoFYIxUzj/5mmuLrrzuFSk42DBS7
 Tuky/MiS6J8ja7HgHj9EcwfB5fkQ7MIM+Q1kKuQQv0um0PDdsV5VVitHVEgznZX+
 AIHn8B2m2LOIekH+KMPwKoOPHJ8Nzg0GHJUx+k6QlUueISZz/eeJoLkvhYqQU/2r
 GuvJ94uOV0oCJLGWTUTja5YrOEYKR42zWHZZRnUeL7yXePfhoczg8aj6nTSrAWj9
 I1pW7wWlmYkujOk=
 =/21W
 -----END PGP SIGNATURE-----

Merge tag 'pci-v7.1-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fix from Bjorn Helgaas:

 - Add Frank Li as PCI endpoint reviewer (Frank Li)

* tag 'pci-v7.1-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  MAINTAINERS: Add Frank Li as PCI endpoint reviewer
 2026-06-12 13:49:45 -07:00
Frank Li
d898796a8e MAINTAINERS: Add Frank Li as PCI endpoint reviewer 
I have volunteered to review PCI endpoint-related changes.  Add myself as a
reviewer to be notified when related patches are posted.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Link: https://patch.msgid.link/20260611210007.529205-1-Frank.Li@oss.nxp.com
 2026-06-12 15:15:38 -05:00
Linus Torvalds
2860828361 spi: Fixes for v7.1 
A couple of driver specific fixes for v7.1, a small targetted fix for
 hardware error handling on DesignWare controllers and another for
 handling of custom chip select managmenet on Qualcomm GENI controllers.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmosRy4ACgkQJNaLcl1U
 h9DIigf8CYkVGrJ/PRXvWUcF4xwiwyO1GsM15cDN3LVUC6dD2P2DzHjxVvr5KvzI
 J+ZS7Dyh/TDTZxdCS1foHsQWALtwNfLMqVQHk/YdJDH7ELVQkHzyxUwVa9RJtexM
 d7HHtCoYivANp3CQugJVXux11cRinRCU8aCBvcj7/o26tRxFmvoRT9U7jsAJULyG
 7Mb03RCsOlxi2cOGRSTq3a4b2GanoxD+z7zKde99jTI5haA7oWR3XLEgLSBf5REl
 PUEwTkrPopTqESELOZe+YinGwLhVljAkSX+f6yAAVbk33aW2hSmveNpb5wK40dRF
 E3NmCpAxjcAxo0iIBfVjUHGXIK8now==
 =8A3s
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A couple of driver specific fixes: a small targeted fix for hardware
  error handling on DesignWare controllers and another for handling of
  custom chip select management on Qualcomm GENI controllers"

* tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dw: fix race between IRQ handler and error handler on SMP
  spi: qcom-geni: Fix cs_change handling on the last transfer
 2026-06-12 11:06:16 -07:00
Linus Torvalds
880b719ca0 io_uring-7.1-20260611 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmorP5QQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpvLwEAC2LpbRdv9oclx2l1zhM8RvnRcSMcMrcNzB
 HpDXBe8ljMg/9Omv90FFTjtfmrUvu9McnkxCsvd7j2xLBz1WUOadD1M9qDeDtzSC
 u7BqrL8XnpCrEds5N6nMyXaFnT50HXI5WO2LVGW7Hk3gVO6L6po2aBlXgOJ6K2a+
 BLQ2DN05rNbD4dTbO73wUObSCqEwVrCZp7jnPWL/Z7ff/04HATPOtaEPVtjCyVW9
 v+gFb9DDXzAGVp4MKTeT3rUQQI3wKj/REmI/4hTMHWofcif6rvuSDQg9ktMu/3SW
 Weg7fmbjubeYiKLSsjx+abJ2hefyHOZrXZoaPtx0Moxou6K3RnxFUSCgod+QsBUF
 u1MoDAWhXJx9lDoPjYOjaL8gEv/rwNZoS15OCY3eUWLWtPG6XhYSUQNaIV6Y66eM
 7QzajFfZ50QMPNXSN8jyedOeiXIMu8sjcFdmGiL7ALtGfqdZApVyYZIxXOJ31q6D
 R+ucSQgUXeDF1VsUmLIGkFsbRvPPpoxn+tPZUSVt2me4V2aWWtzdN+ciXaknrKj/
 z1lmEL8eiHBacVIlSnJcUMEChmC59K6M6+YFPJUUQbzLeiYyw5qxdk093OLrfeC/
 ZMw0OpSbjI7antbqHA8UvDlrUGCg89+96sbt5fDfed0dk0j/kjOOfTQEvQO4dOcn
 qlksyQnguQ==
 =cim5
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-7.1-20260611' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Tweak for an off-by-one in the CQ ring accounting for the min wait
   support.

 - Don't truncate end buffer length for a bundle, as the transfer might
   not happen. It's not required in the first place, as the completion
   side handles this condition already.

* tag 'io_uring-7.1-20260611' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/wait: fix min_timeout behavior
  io_uring/kbuf: don't truncate end buffer for bundles
 2026-06-12 10:49:59 -07:00
Linus Torvalds
2e04e0961e USB/Thunderbolt fixes for 7.1-final 
Here are some small bugfixes for USB serial and Thunderbolt drivers for
 some reported and found issues.  Included in here are:
   - usb serial overflow bugs fixed
   - new usb serial device id
   - thunderbolt validation fixes for reported issues
 
 All of these have been in linux-next this week with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaivU8w8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ylkDQCgl/tr857mpCkfWSX+GxFnp5BJhqYAn26ISsqK
 HujT9oSMn1j9W4iR3PEm
 =4zy7
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some small bugfixes for USB serial and Thunderbolt drivers
  for some reported and found issues. Included in here are:

   - usb serial overflow bugs fixed

   - new usb serial device id

   - thunderbolt validation fixes for reported issues

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: serial: kl5kusb105: fix bulk-out buffer overflow
  USB: serial: option: add usb-id for Dell Wireless DW5826e-m
  USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
  USB: serial: io_ti: fix heap overflow in get_manuf_info()
  thunderbolt: Limit XDomain response copy to actual frame size
  thunderbolt: Validate XDomain request packet size before type cast
  thunderbolt: Clamp XDomain response data copy to allocation size
  thunderbolt: Bound root directory content to block size
  thunderbolt: Reject zero-length property entries in validator
 2026-06-12 10:29:06 -07:00
Linus Torvalds
c133f0433a Staging driver fixes for 7.1-final 
Here are two small bugfixes for a staging driver to fix a
 much-reported issue.  The fixes are for the rtl8723bs driver and it's
 something that many scanning tools keep tripping over in convoluted ways
 (and seems to be able to be triggered by network traffic.)  These fixes
 have been in linux-next for many weeks with no reported issues, sorry
 for the delay in getting them to you.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaivZug8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykZ3gCfYVW4wCYm4ZpkkYly3bO75AMaFmIAoMfIB0qD
 tUDe4wHd9gPN2JYTJfxf
 =zdW9
 -----END PGP SIGNATURE-----

Merge tag 'staging-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are two small bugfixes for a staging driver to fix a
  much-reported issue.

  The fixes are for the rtl8723bs driver and it's something that many
  scanning tools keep tripping over in convoluted ways (and seems to be
  able to be triggered by network traffic)

  These fixes have been in linux-next for many weeks with no reported
  issues, sorry for the delay in getting them to you"

* tag 'staging-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
  staging: rtl8723bs: fix buffer over-read in rtw_update_protection
 2026-06-12 10:10:12 -07:00
Linus Torvalds
9a837eff90 Char/Misc driver fixes for 7.1-final 
Here are some small driver fixes for 7.1-final to resolve some reported
 issues.  Included in here are:
   - slimbus qcom driver bugfixes
   - nvmem driver bugfixes
   - fastrpc driver bugfixes
   - stratix10 firmware driver bugfixes
 
 All of these have been in linux-next for over a week with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaivfhg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yldawCfXjPDG6TDV7MbIQd5PyhlUZ+WEJgAoMznv7Lx
 Pi2sdZhJ4pfYBgwC/VAj
 =rn/r
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
 "Here are some small driver fixes for 7.1-final to resolve some
  reported issues. Included in here are:

   - slimbus qcom driver bugfixes

   - nvmem driver bugfixes

   - fastrpc driver bugfixes

   - stratix10 firmware driver bugfixes

  All of these have been in linux-next for over a week with no
  reported issues"

* tag 'char-misc-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  misc: fastrpc: fix use-after-free race in fastrpc_map_create
  misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
  misc: fastrpc: fix DMA address corruption due to find_vma misuse
  misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
  slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
  slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
  slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
  slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
  slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
  slimbus: qcom-ngd-ctrl: Fix probe error path ordering
  slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
  slimbus: qcom-ngd-ctrl: fix OF node refcount
  nvmem: core: fix use-after-free bugs in error paths
  nvmem: layouts: onie-tlv: fix hang on unknown types
  firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe
  firmware: stratix10-svc: Don't fail probe when async ops unsupported
  firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported
 2026-06-12 09:00:28 -07:00
Linus Torvalds
1dadb7e7eb sound fixes for 7.1 
A few small fixes for the last spurt.  All changes are small, mostly
 consisting of driver-specific fixes, along with two UAF fixes for the
 ALSA timer core.
 
 * Core:
   - Two UAF fixes in ALSA timer core
 
 * ASoC:
   - SDCA: Fix NULL pointer dereference
   - amd / yc: Add DMI quirk for ASUS ExpertBook PM1403CDA
   - SOF amd: Fix garbage/spurious warnings
   - wm_adsp: Fix potential NULL dereference when removing firmware
     controls
   - loongson: Fix negative position calculation
   - spi-rzv2h-rspi: Fix SPDR read access width on 16-bit RX path
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmor0GIOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/1uQ/9GlsBaHMjMiAu/CFEVq2NWRpt1bJPoOhJoQpZ
 dSfKF+RdhaxR076Kh968GNcVy/crZiHjKVCSz4Vt3qpazca2Bu3DVpyQ0gaoLu9L
 G0+f14E8FVvRw5akTl83CNPQPi8vlz9fbUvUzAAReXYNwlIztZHLQoo/gSok4S5H
 4PpvduVOu69E46LTvquOA0v0BTNWQ2UaMs6gaW1kRoAWupyggEbunyQKxw7riyuu
 TlWvwaLh2TiEKNGsZiZRzdLFFyKpzIE8EvNgP9AauQapXX3sIqXrwVSY6wLM6+1Q
 3ZCIWrgToRd9McZwW3LmOUUIIRMgq9sgjFRpzSDNFuIkYtabZpBfJOWRGVEyfVOY
 pHvgYqs5kuot4Du4Kie5ObAcbz+iOyIy3TBP61M5uzC81Iy20XbNnYgwmHJAqCmZ
 Wpjga6d6Tu45xQRk2RBXtutWDFKOYDQOKFvKZnLBfu5cbrsIzYkTQiR+QaAbNC92
 LRgKXmMAcdIcpWFPEuRD0gNH2U6bs0oeXx6E8Rxr1wAzIzIau6JUEwPDHmR+JPFT
 nAGxh4vy3aDyhyImK8DTmC7G8XmHwQyhbAYoMCrB0SvKaEKO32Ewrfa8oDXARxYQ
 ooNJ90h2EO4nCJOOXzF2QZksfHQMpU27iJnHy+JUqKkp5FqskSStFKb0KXz/oYd+
 3vNB6FQ=
 =a42R
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A few small fixes for the last spurt. All changes are small, mostly
  consisting of driver-specific fixes, along with two UAF fixes for the
  ALSA timer core.

  Core:
   - Two UAF fixes in ALSA timer core

  ASoC:
   - SDCA: Fix NULL pointer dereference
   - amd / yc: Add DMI quirk for ASUS ExpertBook PM1403CDA
   - SOF amd: Fix garbage/spurious warnings
   - wm_adsp: Fix potential NULL dereference when removing firmware
     controls
   - loongson: Fix negative position calculation
   - spi-rzv2h-rspi: Fix SPDR read access width on 16-bit RX path"

* tag 'sound-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions
  ASoC: loongson: Fix invalid position error in ls_pcm_pointer
  spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
  ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA
  ASoC: SOF: amd: set ipc flags to zero
  ASoC: SOF: amd: fix for ipc flags check
  ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
  ALSA: timer: Fix UAF at snd_timer_user_params()
  ALSA: timer: Forcibly close timer instances at closing
 2026-06-12 08:52:10 -07:00
Linus Torvalds
fd41dc46db soc: fixes for 7.3, part 3 
Two more small fixes came in, both addressing corner cases in platform
 specific code: the microchip mpfs system controller probe and the CPU
 power management on 32-bit rockchips SoCs.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmorLtUACgkQmmx57+YA
 GNm00xAAsYhcrY71KndI6OCLG/j8/WXd544Ghu/18JTVAzBiSug4KRtBfPaMCzAK
 ZyPX/G5SqihSYOTZ8ETMUSFasde7AyHE7UphB5TMH5uesPjjKdToGMVWnhjVpY7y
 3ECYSsbkWw0p8FHwh//utRxThwSaK0wnJrb2Q465Wf9URktBrQ5jGltfOow8+jji
 nLMZ5UpQ21tqQP0qkPkusIDqQKabfcFzjjzuj+2e0BCFZcxLChZXO+xxfTYjkMjt
 eOzVuN75QIbRK1QVc9aHo+xs7pFqR969tNK7889aSXLUi2UzyFy+32pPxeZQVyWB
 vTHsx5/RqhIvu9BwSHPNTOSYhjS6EmYR5PPOyB74uhMnhwCtjfHEiP28K9J5ROfC
 FVBIAJvb7w4aLoBcxQoI3wroCzv22RV4wiy+FPvUX8RT0kZ1D4aj0N0x1SDxoJ1I
 mak2Cf5m4vRfJ1PIQroxX3hn0M36ayp4Z7kKX8CAol8fc8fUanXRy+6VN34IByiC
 c54Hlt6xNaOBVm7xC1tuONgvRRmoTI8RvtRK9uvOAyiqx5hjNDuTuhXGwG/WApYL
 PTC7Yzmqb5Hj6FhuCsG0IO32DzHY6E2lBCsnpYjPDDo41oYDM+ALFJ4w67d6rfgf
 Ns9phfPVzgNJF2i/r1rU26auN+zg4IgzI+hMbkzxsVNLJ4giBoU=
 =4BDQ
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "Two more small fixes came in, both addressing corner cases in platform
  specific code: the microchip mpfs system controller probe and the CPU
  power management on 32-bit rockchips SoCs"

* tag 'soc-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  ARM: rockchip: keep reset control around
  soc: microchip: mpfs-sys-controller: fix resource leak on probe error
 2026-06-12 08:44:56 -07:00
Wolfram Sang
35ebcfcc9e i2c-host-fixes for v7.1-rc8 
- imx: keep clock and pinctrl states consistent in runtime PM
 - imx-lpi2c: fix DMA resource leaks on PIO fallback
 - qcom-cci: fix NULL pointer dereference on remove
 - riic: fix reset refcount leak on resume_noirq error path
 - stm32f7: account for analog filter in timing computation
 - tegra: fix suspend/resume handling in NOIRQ phase
 - tegra: update Tegra410 I2C timings to match hardware specs
 - MAINTAINERS: hand over I2C maintainership to Andi
 -----BEGIN PGP SIGNATURE-----
 
 iHQEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCaivYkgAKCRDaeAVmJtMt
 bq6BAQDIi1pJu3mcfXZagsn/DWVqM55a6H8pvYHkpdIQFcchXQD4lgbiopNoKusj
 I5qIKtRs2KD/FLAhWYl0vhEoY4PkBw==
 =LfKo
 -----END PGP SIGNATURE-----

Merge tag 'i2c-host-fixes-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current

i2c-host-fixes for v7.1-rc8

- imx: keep clock and pinctrl states consistent in runtime PM
- imx-lpi2c: fix DMA resource leaks on PIO fallback
- qcom-cci: fix NULL pointer dereference on remove
- riic: fix reset refcount leak on resume_noirq error path
- stm32f7: account for analog filter in timing computation
- tegra: fix suspend/resume handling in NOIRQ phase
- tegra: update Tegra410 I2C timings to match hardware specs
- MAINTAINERS: hand over I2C maintainership to Andi
 2026-06-12 17:05:44 +02:00
Wolfram Sang
5cad752e1e dt-bindings: i2c: mux-gpio: name correct maintainer 
The YAML conversion added me as maintainer but I can't recall being
asked nor do I want to maintain it. Add Peter as maintainer for the
binding as he is maintainer of the driver.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Peter Korsgaard <peter.korsgaard@barco.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
 2026-06-12 16:58:38 +02:00
Mateusz Guzik
cf30ceccfa
fs: fix ups and tidy ups to /proc/filesystems caching 
- add missing unlocks in some corner cases
- whitespace touch ups
- s/smp_store_release/rcu_assign_pointer/ [nop, the macro expands to the same thing]
- mark file_systems_string as __read_mostly

Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Link: https://patch.msgid.link/20260610143954.34185-1-mjguzik@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-06-12 14:26:27 +02:00
Wolfram Sang
9bffa2a615
MAINTAINERS: hand over I2C to Andi Shyti 
After 13.5 years of maintaining I2C, it is finally time for me to move
to other areas. So, I hereby transfer I2C maintainership to Andi Shyti.
He has been taking care of the I2C host drivers for a while now and
kindly agreed to look after the whole subsystem. Thank you, Andi! I also
want to thank all contributors, reviewers, and fellow maintainers making
all these years a mostly smooth ride. Happy hacking, everyone!

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260609091612.8228-4-wsa+renesas@sang-engineering.com
 2026-06-12 11:11:58 +02:00
Dave Airlie
6fe5552f67 Merge tag 'drm-xe-fixes-2026-06-11' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes 
UAPI Changes:

Cross-subsystem Changes:

Core Changes:

Driver Changes:
 - fix oops in suspend/shutdown without display (Jani)
 - RAS fixes (Raag)
 - Use HW_ERR prefix in log (Raag)
 - include all registered queues in TLB invalidation (Tangudu)
 - Fix refcount leak in xe_range_tree in error paths (Wentao)
 - fix job timeout recovery for unstarted jobs and kernel queues (Rodrigo)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/aitt8ZkYmxIT9cdP@gsse-cloud1.jf.intel.com
 2026-06-12 13:57:17 +10:00
Dave Airlie
c7be308858 Merge tag 'drm-intel-fixes-2026-06-11' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes 
- Check supported link rates DPCD read [edp] (Nikita Zhandarovich)
- Fix phys BO pread/pwrite with offset [gem] (Joonas Lahtinen)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Tvrtko Ursulin <tursulin@igalia.com>
Link: https://patch.msgid.link/aipkcUDnTlzre-8F@linux
 2026-06-12 13:32:49 +10:00
Linus Torvalds
f51cae6603 dma-mapping fixes for Linux 7.1 
Three more fixes for the DMA-mapping code, related to PCI P2PDMA, DMA
 debug and DMA link ranges API (Li RongQing and Jason Gunthorpe).
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaisf2gAKCRCJp1EFxbsS
 RASLAP953EuMof1qqGoMSNpDMIYNO0392Tdqyiq+nm1BwnLWfgEA/Q0m9yVtxbR7
 zP/dxo+H95OforpTNJYdEWnXOBaAbwM=
 =o0ql
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-7.1-2026-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping fix from Marek Szyprowski:
 "Three more fixes for the DMA-mapping code, related to PCI P2PDMA, DMA
  debug and DMA link ranges API (Li RongQing and Jason Gunthorpe)"

* tag 'dma-mapping-7.1-2026-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
  dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
  dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
 2026-06-11 14:22:26 -07:00
Takashi Iwai
b0d1553d51 ASoC: Fixes for v7.1 
A few more fixes for this release, some smaller driver specific ones
 plus a final quirk.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoq+TEACgkQJNaLcl1U
 h9Dh6Af/UsCFmuhthu0qJ6kDXkr5rtetUsv3NI1ek0VrBj5MXFzPBJ664IeoExjm
 9EIcBEOkMewzZWo8KuG0GZV1MO60P5z3xRBAsidwxEfzLKnLKHNtQM5lrh1RTgBJ
 NU21OpEwgRQtPxFQVsCHY2TV7IxHwvlEdZ9SeikBAlBXpU1tbnm9HQN+LT3kO8m0
 +vKYlfHN/q/HucmZVzOmottYSjBS3oxVXU2/QFvui6ThhyaXc9t7oU6sYYFzaYBg
 WoZT+ZEoEbyKR1WBIh3FwVGpxB2wuwIefo/E22/WDUtVQ0ZxMiNxEwhjqgh+7Uo0
 BVbzFBYyBSrtTqWp3AEPSStLKnPs7A==
 =0BRq
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v7.1-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v7.1

A few more fixes for this release, some smaller driver specific ones
plus a final quirk.
 2026-06-11 21:29:47 +02:00
Linus Torvalds
2b414a95b8 s390 fixes for final 7.1 
- s390 selects GENERIC_LOCKBREAK when PREEMPT is enabled to tackle
   an old compile error that no longer exists. Since recently PREEMPT
   is always enabled, which causes massive performance regressions.
   Remove GENERIC_LOCKBREAK from s390 Kconfig to fix the degradation.
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCaiq9bRccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8FCuAQDlvObouwyTRvY5xZVKCw4LChA1
 DlVeSwoEw/y9VPqShgD8DXviQZNlPxD5gDQU+vptYeK0RlL/U3oHpmUxNnWDDgM=
 =QmVH
 -----END PGP SIGNATURE-----

Merge tag 's390-7.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fix from Alexander Gordeev:

 - s390 selects GENERIC_LOCKBREAK when PREEMPT is enabled to tackle an
   old compile error that no longer exists. Since recently PREEMPT is
   always enabled, this LOCKBREAK config causes massive performance
   regressions.

   Remove GENERIC_LOCKBREAK from s390 Kconfig to fix the degradation.

* tag 's390-7.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: Remove GENERIC_LOCKBREAK Kconfig option
 2026-06-11 10:30:37 -07:00
Linus Torvalds
22e2036479 Including fixes from IPsec and netfilter. 
This is relatively small, mostly because we are a bit behind our PW
 queue. I'm not aware of any pending regression.
 
 Current release - regressions:
 
   - netfilter: nf_tables_offload: drop device refcount on error
 
 Previous releases - regressions:
 
   - core: add pskb_may_pull() to skb_gro_receive_list()
 
   - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
 
   - ipv6: fix a potential NPD in cleanup_prefix_route()
 
   - ipv4: fix use-after-free caused by the fqdir_pre_exit() flush
 
   - eth: bnxt_en: fix NULL pointer dereference
 
   - eth: emac: fix use-after-free during device removal
 
   - eth: octeontx2-af: fix memory leak in rvu_setup_hw_resources()
 
   - eth: tun: zero the whole vnet header in tun_put_user()
 
   - eth: sit: reload inner IPv6 header after GSO offloads
 
 Previous releases - always broken:
 
   - core: fix double-free in netdev_nl_bind_rx_doit()
 
   - netfilter: nf_log: validate MAC header was set before dumping it
 
   - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
 
   - tcp: restrict SO_ATTACH_FILTER to priv users
 
   - mctp: usb: fix race between urb completion and rx_retry cancellation
 
   - eth: mlx5: fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
 
   - eth: mvpp2: sync RX data at the hardware packet offset
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmoqtzwSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkoocP/jvEqlK2vp2BDrNR2GHz/mTMkarRaYnB
 Q6TSmTqRFtfjQYgVhIsNgmzcdUq7B+Y8glhpDmWx5FPS0crK/gS3J91hGzmJOIK4
 qXn7DLyKT/uxW7jEDFSMaetxH3PvSa/PQXi4RdSaM2mN9ZXIG6IqlrClOQ/MAYGK
 W8/OoKV2XmjasqmKPbl36fk4q5+EKxaoZZ8OibzYk00pCSxxa5iDdX05gpTgBQ9t
 Vu14Qmc9bvnQAmhSnsQhUE0dhqS66iHztcPo27AK5ovBdcx9+BgaXnAlITslgM6H
 OyIxtK3gTnpdo6PkVJU2BNazYVBWyJl2nlUgGAS3AsdjYL86UEugRHVQevO0cnrO
 t4dMgOrLjNmjf9HUlqfeIed9BC0Erdg/yrIYuXPhCouF1DVyX6bZwA/nGaBOGVBF
 wIpgArLfUhqG1O2jXNG6HTM/HeeBIZmu9BHPtGSF7mab1018f3Bd3ZPhxLYC6lru
 sg1fV8ECXoHgUIxtv6+ZeH2MZN9yUxubisH6MvMQVlSZRxISnejMNCYWfwf5V1RF
 052wEi4aPNJ5Gf5jrq3e1Xk7pNl+nupYziBoE9gGTfj6OmCSIK3ySm0U5dpAgAo+
 kpSDjU6zj15QG+GTe07YRgt2n/aeeXJ2Sm1y/qvx6+4tOvlsgjaKRkfxhKKCrxZJ
 Z7q4cBFLoDdT
 =xvWb
 -----END PGP SIGNATURE-----

Merge tag 'net-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from IPsec and netfilter.

  This is relatively small, mostly because we are a bit behind our PW
  queue. I'm not aware of any pending regression.

  Current release - regressions:

   - netfilter: nf_tables_offload: drop device refcount on error

  Previous releases - regressions:

   - core: add pskb_may_pull() to skb_gro_receive_list()

   - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()

   - ipv6: fix a potential NPD in cleanup_prefix_route()

   - ipv4: fix use-after-free caused by the fqdir_pre_exit() flush

   - eth:
      - bnxt_en: fix NULL pointer dereference
      - emac: fix use-after-free during device removal
      - octeontx2-af: fix memory leak in rvu_setup_hw_resources()
      - tun: zero the whole vnet header in tun_put_user()
      - sit: reload inner IPv6 header after GSO offloads

  Previous releases - always broken:

   - core: fix double-free in netdev_nl_bind_rx_doit()

   - netfilter: nf_log: validate MAC header was set before dumping it

   - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()

   - tcp: restrict SO_ATTACH_FILTER to priv users

   - mctp: usb: fix race between urb completion and rx_retry
     cancellation

   - eth:
      - mlx5: fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
      - mvpp2: sync RX data at the hardware packet offset"

* tag 'net-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits)
  octeontx2-af: fix IP fragment flag corruption on custom KPU profile load
  ipv6: Fix a potential NPD in cleanup_prefix_route()
  net: txgbe: initialize PHY interface to 0
  net: txgbe: distinguish module types by checking identifier
  net: txgbe: initialize module info buffer
  net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
  net: mvpp2: refill RX buffers before XDP or skb use
  net: mvpp2: limit XDP frame size to the RX buffer
  net: mvpp2: sync RX data at the hardware packet offset
  netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
  netfilter: nft_fib: fix stale stack leak via the OIFNAME register
  netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
  netfilter: nf_log: validate MAC header was set before dumping it
  netfilter: x_tables: avoid leaking percpu counter pointers
  netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
  netfilter: nf_tables_offload: drop device refcount on error
  netfilter: revalidate bridge ports
  rds: mark snapshot pages dirty in rds_info_getsockopt()
  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
  ptp: ocp: fix resource freeing order
  ...
 2026-06-11 10:17:49 -07:00
Linus Torvalds
79f2670da8 pmdomain providers: 
- imx: Fix OF node refcount
  - ti: Fix wakeup configuration for parent devices of wakeup sources
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmoqk98QHHVsZmhAa2Vy
 bmVsLm9yZwAKCRD+JoQlc1iMKYu3EADMgGONH+8wEuLwr5NkNQwFZ5ZFOv8IR5Ss
 MeWXgk5xAnUXJFs11cvgyuW2s3f3gHEayZetffpRYEAp+PPk1tIP3x7Q6QR8RQd6
 THPezoGMlG/G3Dm3F8ekF8+igW8awlS5xyQemt4WMLgC62fHMaLsrXqSu383EUy3
 GwGEzU+UXBxBBpntdqD1n3ZkUkJZBSMZA9OezfD885mrpJMZvLUsNO+CrsRXS9W/
 Cv0WzZveRMYOR7MSQYfou2yVb8QzcgQ9UgGjDUVvFNBrS9EaZuFzWJupUS48XCkg
 49herg41k9MF6zVPWOBCEI84jFhvtR+90DSU/P+DpyU9NNWkRmYJ3T72ufbCB++Q
 VmCyGedKkwsO9FJzzljH0aFFDxBZ8FqBUodm0KSreru7Ft/aGmnq14iGH7avIAp+
 DnHQ2q2e3oSwtD+To8JnRuqMUW+EBdEzqzw0CgtrtjkzNakJH4OwzD0Hstl2RdM3
 xdgxPFFhEYTmzT6Z9+yVJG+PLWGwHu4sy+Eb7QCddvjnHNNwOMtWPVZQtE31pRMY
 QqQMcsR1GzUHE4TCti3NpOmCecKnp/c4LAX3gS+xsdybh9QqcSsRMYIn3/adF2I1
 2uxrkdXkjga8JAwS5/lotnbbZEC3ZalWMmWj9gwwzZauaFM5GwnX7DewwJ3qmNc+
 VBkVefSIDg==
 =dR2j
 -----END PGP SIGNATURE-----

Merge tag 'pmdomain-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

Pull pmdomain fixes from Ulf Hansson:

 - imx: Fix OF node refcount

 - ti: Fix wakeup configuration for parent devices of wakeup sources

* tag 'pmdomain-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  pmdomain: imx: fix OF node refcount
  pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source
 2026-06-11 09:54:51 -07:00
Lizhi Hou
2f41af638c accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() 
aie2_populate_range() jumps back to the again label without calling
mmput(mm), leaking a reference to the mm_struct.

Add the missing mmput() before jumping to again.

Fixes: e486147c91 ("accel/amdxdna: Add BO import and export")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com
 2026-06-11 09:50:07 -07:00
Linus Torvalds
6e9e0dfc7f gpio fixes for v7.1 
- fix NULL pointer dereference in gpio-mvebu
 - fix runtime PM leak in remove path in gpio-zynq
 - reject invalid module params in gpio-mockup
 - fix generic IRQ chip leak in remove parh in gpio-rockchip
 - fix resource leaks in GPIO chip cleanup path on hog failure
 - fix a regression in how GPIO hogging code handles multiple GPIO chips
   reusing the same OF node
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmoqZbYACgkQBZ0uy/82
 hMN+DhAAqntOaHqRks5PqwZlE8jRCFtx1EkvABTnnNHW5t+HXVF+GpBvzRw43aQG
 uppIsusTVnxIojDeuBAzueC6UYjhos5/u2UY8jfaE3HQ7bEksUKS5Ba7b+MzlPo4
 AsPIZey0zuoj1EJNTUZekii7xDcApFu9l+CV9xKqEH+MIySelREJj5sqprJbdF9y
 9hpraeVAn+x333o4zrhWm/mauX/DnFrveqU3nSF+dYQtLwNEJyYntoQZUxrf6I0g
 AHTWRpUMXeUk3aMfmeuaNXrXnfQksanPDYIWT5LmvWoOWkka+iqX0nbUeA51myhZ
 soGzfQ7flYQTZRalu4tqjz7YnVpZC1u9xmgaQlOIwVmEyeW1YPOI6yDjIPWZwUFi
 3DupOvBf98wpIU8wCLVUN/vul496dLw793S4TOnaSGlaMQnz9mop0Qq6Ffb0hgS+
 V5M3cRA2K/aivjtU7r5921M/0NamozIPRadl+1L8USvL1pw8atHjndFIVXgxygln
 Qi3nxEiqWNRk+45YYM7HFdxGZB4bJefq5qwiB9l4Bmz2FczrpMgFMgvdO/jp6HAN
 e3YKhfoDrQBd2tf2V3WodmMHhmkR+SLjLfCPZ9rZiueh1NuU/GOzRwN2sD/tABac
 rV7DSamrrRZzsagHKpyCxTi/Dd0shDh5kVWCtcLggaEO8m7sFEQ=
 =ov9g
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix NULL pointer dereference in gpio-mvebu

 - fix runtime PM leak in remove path in gpio-zynq

 - reject invalid module params in gpio-mockup

 - fix generic IRQ chip leak in remove parh in gpio-rockchip

 - fix resource leaks in GPIO chip cleanup path on hog failure

 - fix a regression in how GPIO hogging code handles multiple GPIO chips
   reusing the same OF node

* tag 'gpio-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpiolib: handle gpio-hogs only once
  gpio: fix cleanup path on hog failure
  gpio: rockchip: fix generic IRQ chip leak on remove
  gpio: mockup: reject invalid gpio_mockup_ranges widths
  gpio: zynq: fix runtime PM leak on remove
  gpio: mvebu: fix NULL pointer dereference in suspend/resume
 2026-06-11 09:15:57 -07:00
Kean Ren
e4c60a1d4b
ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions 
sdca_dev_unregister_functions() iterates over all SDCA function
descriptors and calls sdca_dev_unregister() on each func_dev without
checking for NULL. When a function registration has failed partway
through, or the device cleanup races with probe deferral, func_dev
entries may be NULL, leading to a kernel oops:

  BUG: kernel NULL pointer dereference, address: 0000000000000040
  RIP: 0010:device_del+0x1e/0x3e0
  Call Trace:
   sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca]
   release_nodes+0x35/0xb0
   devres_release_all+0x90/0x100
   device_unbind_cleanup+0xe/0x80
   device_release_driver_internal+0x1c1/0x200
   bus_remove_device+0xc6/0x130
   device_del+0x161/0x3e0
   device_unregister+0x17/0x60
   sdw_delete_slave+0xb6/0xd0 [soundwire_bus]
   sdw_bus_master_delete+0x1e/0x50 [soundwire_bus]
   ...
   sof_probe_work+0x19/0x30 [snd_sof]

This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake)
with the SOF audio driver probe failing due to missing Panther Lake
firmware, causing the subsequent cleanup of SoundWire devices to
trigger the crash.

Fix this with three changes:

1) Add a NULL guard in sdca_dev_unregister() so that callers do not
   need to pre-validate the pointer (defense in depth).

2) In sdca_dev_unregister_functions(), skip NULL func_dev entries
   and clear func_dev to NULL after unregistration, making the
   function idempotent and safe against double-invocation.

3) In sdca_dev_register_functions(), roll back all previously
   registered functions when a later one fails, so the function
   array is never left in a partially-populated state.

Fixes: 4496d1c65b ("ASoC: SDCA: add function devices")
Signed-off-by: Kean Ren <rh_king@163.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260611023757.1553960-1-rh_king@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
 2026-06-11 15:55:23 +01:00
Florian Fainelli
009b6c6486 ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN 
Commit 7af5b901e8 ("ARM: 9358/2: Implement PAN for LPAE by TTBR0
page table walks disablement") implemented PAN for LPAE kernels by
setting TTBCR.EPD0 on every kernel entry, disabling TTBR0 page-table
walks while running in kernel mode. The commit correctly updated
cpu_suspend() in arch/arm/kernel/suspend.c, but missed two other code
paths that switch the CPU to the identity mapping before jumping to
low-PA (TTBR0-range) physical addresses:

1. setup_mm_for_reboot() in arch/arm/mm/idmap.c, used by the kexec
   reboot path. With TTBCR.EPD0 still set, the subsequent branch to
   the identity-mapped cpu_v7_reset causes a PrefetchAbort because the
   TTBR0 page-table walk needed to resolve the identity-mapped address
   is disabled. This manifests as a hard hang or "bad PC value" panic
   on LPAE kernels booted on CPUs that strictly enforce EPD0 for
   instruction fetch (e.g. Cortex-A53 in AArch32 mode) while the same
   image may accidentally work on Cortex-A15 due to microarchitectural
   differences in EPD0 enforcement.

2. arch_restore_image() in arch/arm/kernel/hibernate.c, which calls
   cpu_switch_mm(idmap_pgd, &init_mm) directly without going through
   setup_mm_for_reboot(), leaving TTBCR.EPD0 set while the identity
   mapping is active.

Fix both sites by calling uaccess_save_and_enable() before switching
to the identity mapping, mirroring what the original commit did for
cpu_suspend().

Assisted-by: Cursor:claude-sonnet-4.6

Fixes: 7af5b901e8 ("ARM: 9358/2: Implement PAN for LPAE by TTBR0 page table walks disablement")
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
 2026-06-11 14:52:03 +01:00
Karl Mehltretter
77a1f6883d ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow 
Commit 44e9a3bb76 ("ARM: 9430/1: entry: Do a dummy read from
VMAP shadow") added a dummy read from the KASAN VMAP stack shadow in
__switch_to(). The read uses ldr, but the KASAN shadow address is
byte-granular and is not guaranteed to be word aligned.

ARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and
CONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to()
with an alignment exception before reaching init.

Use ldrb for the dummy shadow access. The code only needs to fault in the
shadow mapping if the stack shadow is missing, so a byte load is sufficient
and matches the granularity of KASAN shadow memory.

Fixes: 44e9a3bb76 ("ARM: 9430/1: entry: Do a dummy read from VMAP shadow")
Cc: stable@vger.kernel.org # v6.13+
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
 2026-06-11 14:52:01 +01:00