kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
1,484,088 commits 117 branches 5,827 tags 6.3 GiB
Commit graph

87,272 commits

Author SHA1 Message Date
Linus Torvalds
fd179f8a05 ata fixes for 7.3-rc5 
- Extend the quirk "no LPM on ATI" quirk, that is currently only
    applied for Samsung drives, to include AMD controllers as well.
    The AMD AHCI controllers are newer versions of the ATI AHCI
    controllers, and these controllers still have LPM issues with
    Samsung drives - LPM works with drives from other vendors (me)
 
  - Fix errors in the libata.force parameter documentation (me)
 
  - Verify the sense data descriptor lengths for ATA PASS-THROUGH
    command, so that a malicious device cannot write past the buffer
    length (Matthias)
 
  - Mention the libata for-next branch in MAINTAINERS such that the
    git ls-remote command done by get_maintainer.pl --self-test=scm
    can verify it (Matthias)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCargFGAAKCRDJZDGjmcZN
 cm3QAP97hnUqqmFfM20u4KSVo/1KV93S/uJ4kVGdsDf5HNvsZgEApw/OlB7lZ8dE
 hZ3otv4Yv1bxC4rdOs6RIJrz8aDCBQU=
 =q1Z4
 -----END PGP SIGNATURE-----

Merge tag 'ata-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fixes from Niklas Cassel:

 - Extend the quirk "no LPM on ATI" quirk, that is currently only
   applied for Samsung drives, to include AMD controllers as well.

   The AMD AHCI controllers are newer versions of the ATI AHCI
   controllers, and these controllers still have LPM issues with
   Samsung drives - LPM works with drives from other vendors (me)

 - Fix errors in the libata.force parameter documentation (me)

 - Verify the sense data descriptor lengths for ATA PASS-THROUGH
   command, so that a malicious device cannot write past the buffer
   length (Matthias)

 - Mention the libata for-next branch in MAINTAINERS such that the
   git ls-remote command done by get_maintainer.pl --self-test=scm
   can verify it (Matthias)

* tag 'ata-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  MAINTAINERS: name the libata/linux for-next branch
  ata: libata-scsi: bound the ATA passthru sense descriptor writes
  ata: libata: Correct libata.force parameter documentation
  ata: libata-core: Extend Samsung LPM quirk to AMD controllers
 2026-09-26 11:14:35 -07:00
Linus Torvalds
547463efb9 s390 fixes for 7.3-rc5 
- Fix several bugs in PCI error recovery SCLP reporting: don't report
   success on skipped recovery, report errors when no pdev is associated,
   add missing device lock, and fix struct pci_dev reference leak in
   zpci_report_status()
 
 - Fix several bugs in CIO code: fix use of invalid SCHIB data, guard PMCW
   field accesses, check device number valid bit in PMWC before accessing
   other fields, and fix NULL pointer dereference in
   ccw_device_get_util_str()
 
 - Fix virtual vs physical address confusion in channel measurement
   facility code on kernels with CONFIG_RANDOMIZE_IDENTITY_BASE=y
 
 - Fix couple of bugs in s390dbf: fix copy of failed static debug areas,
   skip view registration on failure, and reject NULL pointer in
   debug_dump()
 
 - Fix sriov_numvfs attribute name in zPCI documentation
 
 - Fix typos in comments
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEECMNfWEw3SLnmiLkZIg7DeRspbsIFAmq2V1AACgkQIg7DeRsp
 bsJ7zg/7BrnPs0WyKv9NZvVUudYbz3nUIAleJo6HcDK2SUDr+EX3W4U7OjsXL6Fv
 H76hx5AqF6ddtUOJ2uevCAb3PKm0eA7vmK9YiERAclrBA+tWGW0xBwCqqyc84k38
 CPxOBr87Ae1jIIcfDxfBWujtKTFi/4BpSvKvKgg3mnd2egny4UnHnABx5ZcClEee
 p6aVjCKycQFHwNLMoJA1BxvGSpcXdiKXbm6VRJ4gCaBnVuzkLUv1ZMp/Pi1fWVbV
 E1AEztZ/03Tfry51q7wQLv6wD5lR3Z/Py2vZ4YIbelQwVMAMI+rFtgd5oFfo9qkF
 gcFJ+faE9m0E/nsoaaVCaa2Ja4+hV/vZ5ik0bq1ljEqEvInaa2XTuxNAljId351Y
 JrLvCdaip0FkMNMqEym0iydMAlpc491GAhzNrT3yvq6t03VVpxprPPA6VIwHg+zk
 UBMP+QdxtnaV8AAUzDD9E255d88N4DECBICUgf1XjFm/I7xLJFWyUvbzcqNn9VnY
 EGVBOeQmoByhCL9lN0+nzEM1sgT+hQB/C3WmLqiuLxrxjnc8dVr8rVHcPXFgARPw
 Ht3W9jxdTdl4VBwckOWmbvG4L6spXFLdEzI51cP46L1RKWhFjLl/6RoY8fUHf4Vz
 YnHutQevSoPI2D6G4v8K1FBz9wclxCojBPbXCmevfbL9B4ChPoQ=
 =r3uP
 -----END PGP SIGNATURE-----

Merge tag 's390-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Heiko Carstens:

 - Fix several bugs in PCI error recovery SCLP reporting: don't report
   success on skipped recovery, report errors when no pdev is
   associated, add missing device lock, and fix struct pci_dev reference
   leak in zpci_report_status()

 - Fix several bugs in CIO code: fix use of invalid SCHIB data, guard
   PMCW field accesses, check device number valid bit in PMWC before
   accessing other fields, and fix NULL pointer dereference in
   ccw_device_get_util_str()

 - Fix virtual vs physical address confusion in channel measurement
   facility code on kernels with CONFIG_RANDOMIZE_IDENTITY_BASE=y

 - Fix couple of bugs in s390dbf: fix copy of failed static debug areas,
   skip view registration on failure, and reject NULL pointer in
   debug_dump()

 - Fix sriov_numvfs attribute name in zPCI documentation

 - Fix typos in comments

* tag 's390-7.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
  s390/debug: Fix NULL pointer dereference in debug_info_copy()
  s390/debug: Do not register views for failed static debug areas
  s390/debug: Reject NULL debug info in debug_dump()
  s390/cmf: Fix virtual vs physical address confusion
  s390/pci: Don't report recovery success on skipped recovery
  s390/pci: Report SCLP status on error events when no pdev is associated
  s390/pci: Fix missing device lock in zpci_report_status()
  s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()
  s390/cio: Guard PMCW field accesses with dnv check
  s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
  s390/cio: Fix cio_update_schib() to not cache invalid schib
  s390/pci/docs: Fix sriov_numvfs attribute name
  s390: Fix typos in comments
 2026-09-25 09:39:33 -07:00
Linus Torvalds
f2c53ea949 Including fixes from Bluetooth, NFC and Netfilter. 
Every week in this release is record-setting for number of posted
 patches. It doesn't seem like we're creating any regressions with
 all these fixes, 3 Fixes tags here point to 7.2 commits but none
 are true regression fixes. We're trying to keep the count down,
 nonetheless.
 
 Previous releases - regressions:
 
  - net: don't require the hwtstamp NDOs when a PHY provides timestamping
 
  - ipv6: fix dst leak for uncached routes
 
  - vrf: stop corrupting skb->csum when capturing CHECKSUM_COMPLETE
    packets
 
 Previous releases - always broken:
 
  - packet: use ubuf_info completion for TX_RING packets
 
  - arp: terminate device name before lookup
 
  - ipv6: do not let ipv6_find_hdr() return an offset past the packet end
 
  - udp: remove a disconnected socket from the 4-tuple hash table
 
  - sctp: discard the rest of the packet on a stale-cookie error
 
  - eth: mlx5: Bridge, fix remaining switchdev ownership gaps on merged
    eswitch
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmq1bCQACgkQMUZtbf5S
 IrsgCBAAiHOxV3pR0pNw+K/dO5maYhuUV4w+Xcd6CbjRnxzYtImVC1q2ieez5dEe
 JrQrVK76t2wuEgGSyiWcckIufPL8xYg5nYaOUbkYMC2QRtDaqhCo+u2jXu26/Lr8
 O3sI2cj86XDZN+xKTvmLld1zIRyD6MhYxWz+gIicArdBqTsr5JsWkwhJE7SH013a
 iVGu0sIxTgCNu/AusD6SdtwFte26dqvadelI8yuDhBR6rM9pi4EWXChleg7ohCsu
 DoZTlaEjEiFavat+6ni99oz8MAT0WVBX0IzTqZa6TCnbCw4qUEbqN8G+CNgC/VPe
 Sq5FRoo6vJjlFviwgWPbpje2FoOYtk6CX1eTavx8gZ4pPMTzGkT62crS+ETwLO5H
 mRbE+ZjG8UDTUKpIY5P/IQYdznHSc9Ny/pHNlZhFmDdntJOp1lnegx5CmZkyuZxC
 Qc0hoFxKdjUrpQ1n0ygT3/P6MT9vXMwbGP52VLIxaB1oaYCKFV71NOp0ET5fCnYb
 CBK8cdN0kcaSLrpi3MnPamyQoNZfH78BiuKsLDu/TWg3i2HGmFTlp0/LJ0nkQcCU
 4KlCmiJNOkHjbQKHNtYMUOZQcZu5witEv33kb7gr581b0RR+n0lZTaXcnRIyXYdb
 ORqIa1Khg5mW3DLaIc9IrzEGGAW5zXUHc5OX7t8J2rVRQWhBEh4=
 =YiiK
 -----END PGP SIGNATURE-----

Merge tag 'net-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, NFC and Netfilter.

  Every week in this release is record-setting for number of posted
  patches. It doesn't seem like we're creating any regressions with all
  these fixes, three 'Fixes' tags here point to 7.2 commits but none are
  true regression fixes. We're trying to keep the count down,
  nonetheless.

  Previous releases - regressions:

   - net: don't require the hwtstamp NDOs when a PHY provides
     timestamping

   - ipv6: fix dst leak for uncached routes

   - vrf: stop corrupting skb->csum when capturing CHECKSUM_COMPLETE
     packets

  Previous releases - always broken:

   - packet: use ubuf_info completion for TX_RING packets

   - arp: terminate device name before lookup

   - ipv6: do not let ipv6_find_hdr() return an offset past the packet
     end

   - udp: remove a disconnected socket from the 4-tuple hash table

   - sctp: discard the rest of the packet on a stale-cookie error

   - eth: mlx5: Bridge, fix remaining switchdev ownership gaps on merged
     eswitch"

[ And lots of other random network driver fixes ]

* tag 'net-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (189 commits)
  tcp: prevent collapsing skbs across boundary in rtx queue
  vlan: ensure sufficient headroom in vlan_dev_hard_header()
  net/sched: sch_teql: fix shadowed err in __teql_resolve()
  bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
  llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
  llc: reserve device headroom for allocated frames
  gve: DQO: reject TSO packets with an out of range MSS
  gve: fix TX drop when GSO MSS is too small for hw
  gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
  net: flush skb_defer_nodes in dev_cpu_dead()
  net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
  af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
  tipc: Fix a data race on mon->peer_cnt in mon_timeout()
  net: phy: intel-xway: workaround 100BASE-TX Link-Up issue
  net/smc: fix UAF on lgr list traversal in smcr_port_err()
  net/rds: size a connection's path set by the transport it ends up with
  nfp: hold IPsec RX state under the XArray lock
  net: ena: fix MMIO read buffer leak on probe failure
  net: ena: fix PHC cleanup on probe failure
  net/sched: act_ct: fix helper UAF due to extensions realloc
  ...
 2026-09-24 11:45:33 -07:00
Linus Torvalds
415f204422 Landlock fix for v7.3-rc5 
-----BEGIN PGP SIGNATURE-----
 
 iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCarVI0xAcbWljQGRpZ2lr
 b2QubmV0AAoJEOXj0OiMgvbSEVgA+gNbC9CVCbCo0oufZbVpQwlwtuuEKEVpvxZx
 q7oFYKCsAP9svCujGCXRHOmWhAAwe+wpXNb43l8coFn+pCfA8x3fCw==
 =NOli
 -----END PGP SIGNATURE-----

Merge tag 'landlock-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull Landlock fixes from Mickaël Salaün:
 "This mainly fixes the Landlock tracepoint support merged this cycle so
  that denial and rule events report the intended policy context,
  whether through tracefs or BTF-visible callbacks.

  The size of this all is mainly from propagating the corrected contract
  through event definitions and producers, adding new tests for the
  reported context, and updating the documentation.

  Also improve annotation and fix a GCC 16 build warning"

* tag 'landlock-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
  landlock: Widen ruleset versions to 64 bits
  landlock: Add counted_by in landlock_domain
  landlock: Fix tracepoint contract documentation
  selftests/landlock: Test network denial context
  selftests/landlock: Test filesystem denial blockers
  landlock: Report the effective signal number
  landlock: Report the actual ptrace tracer
  landlock: Fix network denial trace context
  landlock: Fix rule tracepoint context
  landlock: Fix filesystem denial blocker reporting
  landlock: Fix tracepoint fixed-width type names
  landlock: Work around gcc-16 -Wuninitialized warning
 2026-09-24 10:53:59 -07:00
Linus Torvalds
5fc5768c7c bpf-fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQJRBAABCgA7FiEE+soXsSLHKoYyzcli6rmadz2vbToFAmq1NvAdHGFsZXhlaS5z
 dGFyb3ZvaXRvdkBnbWFpbC5jb20ACgkQ6rmadz2vbTpmpA//fqEoC6Sq1zxo3ADH
 hV0Z9ewkNTjjH85QnispjcRkAhSHG3JscNXKRXm1NmNkwJsHJ4TDIKcjABYDjquD
 wqfvL9hLXPsvud0M/PR6/CZeBAWXpukkaxeYedY+83ttTHjzR0tDq0Ne9yvIV+Nc
 hS0qFIIHs8C6l2nyuNSxvgrv216orG8qd0Bi3tpDfsLqCsLLEmDyQ1H+ZzpJF2xW
 RV3oMcggCeo305m8+uiofQGf8hmmRrmA7SEfF+Qe08ab2GOn9glINfVTbTE3AdQW
 fkvAk8Zuio3hwwMBHDWWYXrKO0N3ykzcDk4V6JPUWiH1dOANf1tS3G1uJyxb4tsv
 dHVdA0xL3sg7YnuSywfb82vTXvQz5QEFeDYxxLB2fMJe8LcCfgF1lkIr1DbdrMjI
 hlozGCs3p/GVIVNhjGVPezWsUvzK4PIuKVM6U1qWojtAhXU/bJCvP0iBU83RlBL7
 S0GGSC/qvkuPed9hAp2pnrrRo/9GEp1PZq8AXsp3nti0OaRxgxpjjQQFzZEWlOrR
 bErtbKziHzl2xARvCRycNZ+QWT4ZdjmK++8pba7hOuFkRclOV4KRWk4OthBvcADu
 NfNsVXdXpOnesg7TNIUJ8heVAYPjKaBHJBuG2Prghrnc95uqEQwOfbYT15zAbe6I
 l3HqGerSa7WtbrnCwsf1DvyPPII=
 =ZxKg
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Fix bpf_skb_change_tail() to drop the checksum offload instead of
   rejecting the trim of CHECKSUM_PARTIAL skbs (Daniel Borkmann)

 - Add KF_PERFMON kfunc flag and require CAP_PERFMON for kfuncs that
   read arbitrary memory and for untrusted read-only memory reads
   (Daniel Borkmann)

 - Clear scalar delta on narrowing stack spill (Daniel Borkmann)

 - Set up the frame pointer for the exception callback in arm64 JIT, and
   zero-fill other CPUs when BPF_F_CPU update creates a per-cpu hash
   element (Donggeun Yoo)

 - Various fixes (Emil Tsalapatis):
     - Fix bounds check underflow for skb-backed dynptrs
     - Fix rx_queue_mapping context access code generation in bpf_sock
     - Reject packet pointer arguments to subprogs that may mutate the
       packet
     - Reject ALU instructions that see arena and non-arena operands on
       different code paths

 - Fix copied_seq double-counting on sockmap self-redirect
   (Geliang Tang)

 - Fix divide-by-zero in btf_struct_walk() on a flexible array of
   zero-sized elements, fix out-of-bounds read of rtt_min in sock_ops
   (Jiayuan Chen)

 - Fix bpf_sock_destroy() out-of-bounds read of sk_protocol on TIME_WAIT
   and request socks, and sleeping under RCU when destroying a listener
   with pending children (Jiayuan Chen)

 - Fix JEQ/JNE with immediate operand in MIPS32 JIT and missing zero
   extension of BSWAP 16/32 in MIPS64 JIT (Johan Almbladh)

 - Avoid soft lockup in htab lookup[_and_delete] batch operations on
   large maps (Jose Fernandez)

 - Various fixes (Kumar Kartikeya Dwivedi):
     - Verify global subprogs in each sleepability context they are
       called from
     - Make post-verification instruction rewrites killable
     - Preserve packet pointer displacement in regsafe()
     - Apply CO-RE relocations before subprogram validation, restrict
       CO-RE poisoning to relocatable instructions, and reject truncated
       ldimm64 CO-RE relocations in libbpf
     - Assign lock identity to callback map values
     - Compare stack frames in regs_exact()
     - Bound ownership depth through local kptrs and graph roots

 - Fix u32 overflow in map batch operations when the map size exceeds
   4GB (Masoud Aghasi)

 - Fix UAF in bpf memalloc due to concurrent consumption of ttrace lists
   in alloc_bulk() (Pu Lehui)

 - Allow gotox as the terminal instruction of a program or a subprogram
   (Siddharth Chintamaneni)

 - Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL, skip unsettled links
   in link iterator, and reject dev-bound-only programs on other devices
   (Weiming Shi)

 - Reject non-negative stack offsets in stack_slot_obj_get_spi()
   (Xu Yunxiang)

 - Check params size before reading reserved fields in
   bpf_crypto_ctx_create() (Yuqi Xu)

 - Reject max_entries > INT_MAX in sock_map_alloc() (Zhao Gongyi)

 - Use a 32-bit compare in xsk_map_gen_lookup() (Zhiling Zou)

 - Use kvfree() in xdp_test_run_teardown() (Zhixing Chen)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (58 commits)
  selftests/bpf: Test per-cpu initialization of a BPF_F_CPU created element
  bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element
  bpf: Fix BSWAP 32 and 16 on MIPS64
  bpf: Fix immediate JMP JEQ/JNE on MIPS32
  bpf: Reject dev-bound-only programs on other devices
  bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
  selftests/bpf: Test for mixed arena/nonarena code paths
  bpf: Prevent variable arena/non-arena register contents
  selftests/bpf: Test rejection of pkt args to mutating subprogs
  bpf: Reject pkt arguments in mutating subprogs
  selftests/bpf: Add selftests for rx_queue_mapping context access
  bpf: Fix bpf_sock context code generation
  selftests/bpf: Test dynptr slices past end of skb
  bpf: Fix bounds check for skb-backed dynptrs
  selftests/bpf: Reject iterator destruction through fp+0
  bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
  bpf: Check params size before reading reserved fields
  selftests/bpf: Check local object ownership depth
  bpf: Bound ownership depth through local kptrs and graph roots
  selftests/bpf: Cover frame changes in bounded loops
  ...
 2026-09-24 08:25:26 -07:00
Linus Torvalds
f49a343b30 Pin control fixes for the v7.3 series: 
- Serialize the calls to pinctrl_generic_dt_nod_to_map()
 
 - Fix a typo in S4 group in the Meson driver.
 
 - Fix bank width and regmap usage in the MPFS-SSIO driver.
 
 - Data register output latch behavior and voltage encoding
   fixes in the Sunxi driver.
 
 - Free the IRQ domain on the error path in the single driver.
 
 - Fix some QUP1 SE2/SE3 groups and a missing OF module
   alias in the Qualcomm drivers.
 
 - Fix up the register banks for AON (I guess always-on)
   pins in the Tegra238 driver.
 
 Signed-off-by: Linus Walleij <linusw@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmq1Bm4ACgkQQRCzN7AZ
 XXM36g//fk1LQHrRfCHR4VmPTP8SIielpN4J6RaTdVZYrOF5HB4FU1nkJvhgNH73
 YAiIeBR/XG7gevMnfuE3w9H6zSrw7bb4l1+piV+o4T5Zo1SNC2WAnHdIXJ/isrZq
 rHjwBcd5kvit+2VlaUxLZERc8V8L7+t6rD1+QDDrgqd2Ji3ekKB5bB4kdumuE5Yp
 c+oirXvcgC7Bi2Ql35HTeWFmie5IAbfAHFiXryUwJREZNbakS17sQRXQxesib0fi
 UPml71+vDVluKtluB065PwE8W4JpLi7+SkhMcB4xgT/ofMt46wzTtCU6VfBaTM/0
 dHLr6Kr9ajjmNzk5i3DZMFFY2C2ywqyGCCfgTO2m5wX9WaBNFoO8UsZ9Xb/Ij+RZ
 9T6Ub6QCJcvvZIScRXTAQEKiJ4I4cMOt1wL4rJfX8YQA0Aha9r7YXxnLxBM7AgvB
 8AzIJcgm5RSC2uJaRnNpSgOvBk6XYXGnC22MTbDR3CIdkYZcWy7M9XLYI21UtCOh
 ZmYvxiJGHoa2qe+AgHYgvO5lFIW9qTUOL11XXQJQwziTC7A/I/Qnf6Gwyq12KE1Q
 TuAGRqeWCo4UPEYhc5myKceF1J6ljJosWwsF3VH9Vj4N2/CHIcbikWE33g1qCIbf
 VCsPaPKegsLoK4nNau0z296nqNmNFjmuyTn8gcdEMlQYGP4WwhA=
 =PxJM
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - Serialize the calls to pinctrl_generic_dt_nod_to_map()

 - Fix a typo in S4 group in the Meson driver

 - Fix bank width and regmap usage in the MPFS-SSIO driver

 - Data register output latch behavior and voltage encoding
   fixes in the Sunxi driver

 - Free the IRQ domain on the error path in the single driver

 - Fix some QUP1 SE2/SE3 groups and a missing OF module alias
   in the Qualcomm drivers

 - Fix up the register banks for AON (I guess always-on) pins
   in the Tegra238 driver

* tag 'pinctrl-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: tegra238: Fix register bank for AON pin groups
  pinctrl: qcom: ipq5210: Publish the OF module alias
  pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions
  pinctrl: single: free the IRQ on domain creation failure
  pinctrl: sunxi: A523: fix voltage withstand encoding
  pinctrl: sunxi: keep a shadow copy of the data register output latches
  pinctrl: mpfs-mssio: use correct regmap function to set bank voltage
  pinctrl: mpfs-mssio: fix width of unused bank voltage setting
  pinctrl: generic: serialise pinctrl_generic_dt_node_to_map()
  pinctrl: meson: Fix typo in s4 group name
 2026-09-24 06:19:09 -07:00
Linus Torvalds
ef33dd4e0a arm64 fixes for -rc5 
- Fix the recently merged user ABI for the Arm CMN PMU driver filtering
   logic so that the ordering matches the hardware spec
 
 - Fix spurious warning when attempting to read PROT_NONE mappings of
   /dev/mem
 
 - Allow WFxT to be disabled on the command line, which is necessary for
   some configurations of recent Apple SoCs
 
 - Fix EL2 fine-grained trap configuration for the CPU PMU
 
 - Fix MIDR matching when applying CPU errata workarounds in a VM
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmq06TIQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNPGQCACK7VeQk7ER46znaeMNyHaQARWkuF7D3wdU
 wCvt/hppo6DzHpsiWw5rDrBIHyeVpWkilDVROuaM1q8Qf6HaFe2h+sbuK96OVo1Y
 OLP1aZUBj3ZGLUNBIxDANP4A200Avd6gFLLY2jPvZ2YyJfEB9Ok3D0KahaRdtMh9
 PGX4qo3j7dZaTLChMrVhXApAidkZ079w5+Di5wXilU5QNyCWsfA+SKBY7jZWP7jw
 yPQ5PPDeYDYUziCUT4ooAegY9vODgmtbikXPFQQzF0zPeTtqKuFwSekdXnkJQS3E
 R3+bBmV5JrDuitjMqUvrxreTGZqWj6R1mHL4tsActCnhTFEc2mar
 =dNHO
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:

 - Fix the recently merged user ABI for the Arm CMN PMU driver filtering
   logic so that the ordering matches the hardware spec

 - Fix spurious warning when attempting to read PROT_NONE mappings of
  /dev/mem

 - Allow WFxT to be disabled on the command line, which is necessary for
   some configurations of recent Apple SoCs

 - Fix EL2 fine-grained trap configuration for the CPU PMU

 - Fix MIDR matching when applying CPU errata workarounds in a VM

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
  arm64: errata: match the target implementation CPU's own MIDR
  arm64: Add override for WFxT
  arm64: io: Reject non-user protection in ioremap_prot()
  perf/arm-cmn: Fix multi-filter encoding
 2026-09-24 06:08:15 -07:00
Fuad Tabba
2bc6b21871 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 
__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.
PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in
HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host
traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The
kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU
driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a
write from EL0 reaches the trap and takes the host down without a panic
message.

Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already
does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9
bits.

Fixes: 858c7bfcb3 ("arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9")
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Oliver Upton <oupton@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
 2026-09-23 12:34:30 +00:00
Mina Almasry
73b3fc67a4 net: devmem: document that bind-tx is unprivileged by design 
Unlike bind-rx, which configures shared NIC RX queues to steer incoming
traffic into the caller's dmabuf and requires CAP_NET_ADMIN
(uns-admin-perm), bind-tx only DMA-maps the caller's dmabuf so the caller
can transmit from it on their own sockets without affecting other traffic
or device configuration.

Add a comment in netdev.yaml and above netdev_nl_bind_tx_doit() to make it
explicit that NETDEV_CMD_BIND_TX is unprivileged by design.

Signed-off-by: Mina Almasry <almasrymina@google.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://patch.msgid.link/20260921195545.493253-1-almasrymina@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-09-22 18:40:15 -07:00
Niklas Cassel
88a0474d92 ata: libata: Correct libata.force parameter documentation 
Align the documented libata.force options with their implementation.
The force table accepts PIO modes 0 through 6, not mode 7, and ncqati
controls NCQ generally rather than only queued TRIM.

The max_sec_1024 and max_sec_lba48 options only set transfer size
limits. Remove the misleading claim that they can also clear them.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260918124030.1962773-6-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
 2026-09-21 13:08:58 +02:00
Linus Torvalds
b12dd0fa48 Input updates for v7.3-rc3 
- Fixes for evdev and input compat handling to zero-initialize on-stack
   absinfo and force-feedback effect structures before partial or compat
   copies from userspace, preventing kernel stack memory disclosure
 
 - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
   when writing multi-chunk blocks over SMBus and to avoid a NULL pointer
   dereference during suspend/resume when the RMI device is unbound
 
 - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
   buttons on the Microsoft Surface Pro 11) and to validate the ACPI
   package element count before dereferencing
 
 - A fix for the adp5588-keys driver to cache the initial GPIO hardware
   state before registering the gpiochip so pre-configured pin states are
   not clobbered by GPIO hogs during registration
 
 - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
   HID report size before copying into the response buffer, preventing a
   buffer overflow
 
 - A fix for the HP SDC serio driver to use timer_shutdown_sync() on
   module exit so the periodic kicker timer cannot rearm itself during
   teardown
 
 - A fix for the eeti_ts touchscreen driver to export its OF module alias
   so the module autoloads on Device Tree platforms
 
 - Updates to the xpad joystick driver adding support for the Victrix Pro
   BFG controller and Azeron devices, and fixing the device type
   classification for the PDP Marvel Xbox 360 controller
 
 - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book Pro
   16 2026
 
 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
   touchpad and TrackPoint respond immediately at boot
 
 - Other minor updates and documentation fixes, including reading the
   "ti,poll-period" property as u32 in tsc2007, adding the mt6572
   compatible to the MediaTek keypad Device Tree binding, fixing an
   attribute name typo in the trackpoint sysfs ABI documentation, and
   documenting that no new LED codes should be added to the input
   subsystem.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaq9j+gAKCRBAj56VGEWX
 nJ5KAQDnTOivIghgIGnlKTIYLSV4cJ0fWJh7J1/ubx9soK+9RwD/bDUdyryAaSTr
 x95U7/fEvq/lXBFyK2LXyahuTC6vNQY=
 =Vsfi
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - Fixes for evdev and input compat handling to zero-initialize on-stack
   absinfo and force-feedback effect structures before partial or compat
   copies from userspace, preventing kernel stack memory disclosure

 - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
   when writing multi-chunk blocks over SMBus and to avoid a NULL
   pointer dereference during suspend/resume when the RMI device is
   unbound

 - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
   buttons on the Microsoft Surface Pro 11) and to validate the ACPI
   package element count before dereferencing

 - A fix for the adp5588-keys driver to cache the initial GPIO hardware
   state before registering the gpiochip so pre-configured pin states
   are not clobbered by GPIO hogs during registration

 - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
   HID report size before copying into the response buffer, preventing a
   buffer overflow

 - A fix for the HP SDC serio driver to use timer_shutdown_sync() on
   module exit so the periodic kicker timer cannot rearm itself during
   teardown

 - A fix for the eeti_ts touchscreen driver to export its OF module
   alias so the module autoloads on Device Tree platforms

 - Updates to the xpad joystick driver adding support for the Victrix
   Pro BFG controller and Azeron devices, and fixing the device type
   classification for the PDP Marvel Xbox 360 controller

 - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book
   Pro 16 2026

 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
   touchpad and TrackPoint respond immediately at boot

 - Other minor updates and documentation fixes, including reading the
   "ti,poll-period" property as u32 in tsc2007, adding the mt6572
   compatible to the MediaTek keypad Device Tree binding, fixing an
   attribute name typo in the trackpoint sysfs ABI documentation, and
   documenting that no new LED codes should be added to the input
   subsystem

* tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: hp_sdc - shut down kicker timer on module exit
  Input: xpad - add support for Victrix Pro BFG Controller
  Input: tsc2007 - read "ti,poll-period" as u32
  Input: trackpoint - fix the inertia attribute name in the ABI document
  Input: eeti_ts - publish the OF module alias
  Input: xpad - add support for Azeron devices
  Input: xpad - fix PDP Marvel Xbox 360 controller
  Input: document that no new LED codes should be added
  Input: soc_button_array - check btns_desc->package.count
  Input: soc_button_array - fix MS Surface Pro 11 probe failure
  Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
  Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
  Input: cyttsp5 - clamp the HID report size before memcpy
  Input: zero ff_effect before compat copy in input_ff_effect_from_user
  Input: evdev - zero absinfo before partial copy in EVIOCSABS
  Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
  Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
  Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
  dt-bindings: input: mediatek,mt6779-keypad: add mt6572
  Input: adp5588-keys - cache GPIO state before registering the gpiochip
 2026-09-20 07:02:34 -07:00
Mickaël Salaün
3fa5aa398e
 		landlock: Fix tracepoint contract documentation 
The tracepoint documentation claims that denial and lifecycle events
expose every input needed to reproduce a verdict. Instead document how
denial, ruleset, and domain events identify the denying policy, checked
operation and object, and reason for denial. Direct consumers to generic
tracepoints for additional operational context.

State the reconstruction limits: IDs are boot-local, rule checks have no
request ID, and exported records may be lost or cross-CPU reordered.

Also replace the incorrect BPF_RAW_TRACEPOINT guidance with libbpf
SEC("tp_btf/...") attachment and refer consumers to the event prototypes
for callback argument layouts.

Cc: Günther Noack <gnoack@google.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Link: https://patch.msgid.link/20260918185036.608651-10-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
 2026-09-20 14:13:33 +02:00
Mickaël Salaün
1a985d3890
 		landlock: Fix rule tracepoint context 
Name each event after the identity it reports. Add-rule events describe
UAPI rule insertion, so rename them after LANDLOCK_RULE_PATH_BENEATH and
LANDLOCK_RULE_NET_PORT. Check-rule events describe matches in internal
rule trees, so rename them after LANDLOCK_KEY_INODE and
LANDLOCK_KEY_NET_PORT. This remains accurate if multiple UAPI rule types
share one lookup and stored rule. Keep denial event names based on
filesystem and network families because they describe final access
decisions.

Use u64 for growable access masks passed by value to add-rule and
check-rule typed BTF callbacks. CO-RE can relocate pointer-reached
fields, but it cannot widen a scalar callback slot declared by a BPF
program. Keep native access_mask_t for internal state and trace records.

For add-rule callbacks, report the normalized per-call contribution
passed to landlock_insert_rule() and expose the complete validated flags
value. Put the ruleset and flags first as a common invocation prefix.
This distinguishes duplicate and effective-zero additions without
recovering arguments from saved syscall registers.

Cc: Günther Noack <gnoack@google.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Fixes: 63747c9477 ("landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints")
Fixes: 3f1f106e4c ("landlock: Add tracepoints for rule checking")
Link: https://patch.msgid.link/20260918185036.608651-4-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
 2026-09-20 11:08:02 +02:00
Linus Torvalds
40288c9206 drm fixes for 7.3-rc4 
core:
 - fix vblank pending event leak
 
 ttm:
 - swapout fixes
 
 dma-buf:
 - scattergather fixes
 - enable dma-buf debug on debug kernels
 
 dma-fence:
 - fix signaling bit checks
 
 sched:
 - fix virtual runtime race
 
 msm:
 - DT:
   - Corrected indentation
 - Core:
   - Marked fbdev as system memory
 - GPU:
   - Fixed autosuspend cleanup on teardown
   - a750: fix timestamps
   - Increase GMU fw init timeout
   - Misc fixes/cleanups
 - DPU:
   - Fixed clock rounding, unbreaking newest platforms
   - Cleared pending flush state
 - DP:
   - Skip PUSH_IDLE when link was never enabled
   - Fixed bandwidth checks
 - HDMI:
   - Fixed runtime PM cleanup on probe failure
 
 xe:
 - shrinker related fixes
 - xe_mmio_gem fault handler and destroy fixes
 - xe disable i2c irq on unbind
 
 i915:
 - Revert a commit touching registers that don't necessarily exist
 - Check for negative numbers before passing to BIT()
 
 amdgpu:
 - SMU 14.x fix
 - DC IRQ fix
 - Runtime PM fix for P2P
 - RAS fix
 - PCIe reporting fix
 - DCN 6 fix
 - Device removal fix
 - DC MALL fix
 
 amdkfd:
 - GC 12.x fixes
 - Boundary checks
 - Mapping clear fix
 
 nouveau:
 - suspend/resume fixes
 
 gud:
 - out of bounds access fix
 - ignore damage clips in full update
 
 vc4:
 - use-after-free fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmqttwkACgkQDHTzWXnE
 hr73Ww//S+8xgr8cpmJxoUrOrTnd4yeX/oj+HSRkEHQPdNayOf+pNnP4y+nChfXi
 ddQ3jTRyG5JwNmXRG0ouKf9koQk/V54R8v9CBtNQYsN2K58xW6riCIaEeOUbe3r1
 1IQgYCEfS32b7/9D2lo1768LbJ0KWBr6qznKrfvC7vJ62wK3F0B9EzOmsKSzLxd3
 gdUfyxEbtgegKOAamCbUyJyuzCErGkMAtkQ0HnmQGYmqqBBRS7Uvl1HN10JMoLSM
 MmR40g+dsp6ZzBDywNrdmIGDv749o1/k/zm5i6c2hJSibYBPR5sWtKICwu1ND44u
 ts2HjJJdyhm5PLiS09i9nVUnMkzV0N2czIDZvt9izp8+k8P4Bh/y1iagda1G0U65
 h7dp9j8WXMCApxXNjplNgjMLSO7g4UJI1rAWjxGY4ecu62XHErrZ6tbjrOVOaa1T
 Xh8IN4EqPr+tRSKnW4AxwwwA1EfxNwoJSxglAvBvIaCjEhRWRlj7Sdo0Wrtg3WKy
 sORar40ySYHR+MeAbabewjRoMPq1Nyqh4D2PrOv48a4MK7a6Fl5ed6EHpyOSHYKF
 7tMbLLLtDMIYX24wd/j8CkvhcTp09iphzXSqmUlIBn3t1gbrXspzCQtRU0UrsamJ
 QSbtL+qUoYSsobmpYOzuTVnO8W4oOnnIYaLz+TpVNDd7o7nzZf0=
 =EC37
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-09-19' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Things have picked back up a bit this week, mostly amdgpu, xe and msm
  this time. There are a bunch of scattered changes across the rest of
  drivers and core stuff, nouveau, i915.

  core:
   - fix vblank pending event leak

  ttm:
   - swapout fixes

  dma-buf:
   - scattergather fixes
   - enable dma-buf debug on debug kernels

  dma-fence:
   - fix signaling bit checks

  sched:
   - fix virtual runtime race

  msm:
   - DT:
      - Corrected indentation
   - Core:
      - Marked fbdev as system memory
   - GPU:
      - Fixed autosuspend cleanup on teardown
      - a750: fix timestamps
      - Increase GMU fw init timeout
      - Misc fixes/cleanups
   - DPU:
      - Fixed clock rounding, unbreaking newest platforms
      - Cleared pending flush state
   - DP:
      - Skip PUSH_IDLE when link was never enabled
      - Fixed bandwidth checks
   - HDMI:
      - Fixed runtime PM cleanup on probe failure

  xe:
   - shrinker related fixes
   - xe_mmio_gem fault handler and destroy fixes
   - xe disable i2c irq on unbind

  i915:
   - Revert a commit touching registers that don't necessarily exist
   - Check for negative numbers before passing to BIT()

  amdgpu:
   - SMU 14.x fix
   - DC IRQ fix
   - Runtime PM fix for P2P
   - RAS fix
   - PCIe reporting fix
   - DCN 6 fix
   - Device removal fix
   - DC MALL fix

  amdkfd:
   - GC 12.x fixes
   - Boundary checks
   - Mapping clear fix

  nouveau:
   - suspend/resume fixes

  gud:
   - out of bounds access fix
   - ignore damage clips in full update

  vc4:
   - use-after-free fix

  versilicon:
   - plane format fix

  longsoon:
   - blend mode property fix"

* tag 'drm-fixes-2026-09-19' of https://gitlab.freedesktop.org/drm/kernel: (59 commits)
  drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates
  drm/amdgpu: fix rmmio iounmap skipped on device removal
  drm/amdgpu: Skip KFD mapping clear before initialization
  drm/amd/display: Fix NULL dereference in dcn50/dcn60 init_hw
  drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
  drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
  drm/amdgpu: Fix GPU PCIe link capability reporting
  drm/amdgpu: check ras and obj before dereference
  drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
  drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1
  drm/amd/display: Atomize IRQ register read/modify/write ops
  drm/amd/pm: report energy accumulator for smu 14.0.3
  drm/loongson: Create blend mode property for cursor plane
  drm/xe/i2c: Disable IRQ on unbind
  Revert "drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable"
  drm/verisilicon: remove ARGB formats from primary plane
  drm/verisilicon: add primary modifier for format tables
  drm/verisilicon: set blend mode for the cursor plane
  drm/sched: Fix virtual runtime race
  drm/i915/display: check configuration index before shifting
  ...
 2026-09-18 16:37:37 -07:00
Linus Torvalds
d24e3bf4c5 hwmon fixes for v7.3-rc4 
* cgbc-hwmon: Add missing sensors, and fix current sensors ID lookup
 
 * gpioufan: Return IRQ_HANDLED from the shared alarm IRQ handler to fix
   possible interrupt storm
 
 * hp-wmi-sensors: Improve raw WMI string handling, and fix UaF in show
   function
 
 * k10temp: Fix model id range of Zen5 Turin to stop reporting temperature
   data for non-existing CCDs
 
 * pmbus
 
   - core: Increase number of phases to fix UaF problems
 
   - tps53679: Fix TPS53676 phase page decoding, and select page 0
     for single-page applications
 
 * pwm-fan: Stop RPM timer before freeing tach data to fix UaF problem
 
 * w83793: Release probe data through kref to fix UaF problem
 
 * w83791d: Remove fan/pwm 4-5 sysfs group on remove to fix UaF problem
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmqtY4YACgkQyx8mb86f
 mYHX0Q//UmlkmqkHH3XdKi1QX/RV60f82HfzXRkMq98FYocEYv4TKnru3U5pRLY3
 Vs/h4GcDWT16ApqKbciBxgoUj72XBohm/T0gv8rhC/gkx4w8F7/CPuCB6vq9kIAj
 EIOHM3KoulfwUN6K1JeFdo5sIrTMxYGnQoJjS31/HfExEGbcBMZjA4eWLkqA0s18
 zmtYKbCJbG2WFRkI8/HKeQ2MwFE3RLNrxPVNvWJNzwIPjMvaAD7eDSsRjgXpaH6s
 A2OHpnGkDLE1qeyuYYx+nFYmMQDGDxnt6QvEjX5cVUYE+jDIXuzF5HJVfLCaXoSJ
 cFJmyNVTNE6Is1g6qeBRwObSq/NJH3O6p7kXCf5qwO27XBXgt/7K4q751tMq8oEE
 kXiYn3WfBL4WJjYqQw8kEh2/D18fyj9XmoS7iBXzf1qXgRSROm/9irMBjsWiw0WF
 92iE9U7UaE/a5fGX+dbRnB7QmLZ33U5TzA3ERb+MwJQj6o8Llvb5gmJOmlYebpa1
 zRiu285Y3oGnjjkFgzvpps9hsVw3kb2Xs2utMbTPrJ2z4SUO9KInl+ifOr5w9VI+
 sNU0Rn3eQ6IT40NMO9FhHPciZygKmob6hNDYh/6e+OulMDW7XW46ES2e8jjwME30
 fjDpfKDxoAU/xQ548XQJBRcUNjUhV8S6NYZr3H4PpyWlPVmSkOY=
 =lG35
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - Add missing sensors, and fix current sensors ID lookup (cgbc-hwmon)

 - Return IRQ_HANDLED from the shared alarm IRQ handler to fix possible
   interrupt storm (gpioufan)

 - Improve raw WMI string handling, and fix UaF in show function
   (hp-wmi-sensors)

 - Fix k10temp model id range of Zen5 Turin to stop reporting
   temperature data for non-existing CCDs

 - pmbus:
     - Increase number of phases to fix UaF problems
     - Fix TPS53676 phase page decoding, and select page 0 for
       single-page applications

 - Stop pwm-fan RPM timer before freeing tach data to fix UaF

 - Release w83793 probe data through kref to fix UaF

 - Remove w83791d fan/pwm 4-5 sysfs group on remove to fix UaF

* tag 'hwmon-for-v7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (hp-wmi-sensors) Improve raw WMI string handling
  hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
  hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
  hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
  hwmon: (w83793) release probe data through kref
  hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
  hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler
  hwmon: (pmbus/core) increase number of phases and add new mask
  hwmon: (cgbc-hwmon) Add missing sensors
  hwmon: (cgbc-hwmon) Fix current sensors ID lookup
  hwmon: (pwm-fan) Stop RPM timer before freeing tach data
  hwmon: (k10temp) Fix model id range of Zen5 Turin
 2026-09-18 10:27:23 -07:00
Shawn Guo
b0be01f133 pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions 
QUP1 SE2 and SE3 pack all four of their lanes pair-wise onto only two
pins each: lanes 0/1 (I2C SDA/SCL) at mux value 2 and lanes 2/3 (UART
TX/RX) at mux value 1, on gpio127/gpio128 and gpio129/gpio130
respectively.

Both mux values were named "qup1_se2" (respectively "qup1_se3"), so the
two distinct lane pairs became indistinguishable. msm_pinmux_set_mux()
stops at the first entry matching the requested function, which means
mux value 1 was always selected and the I2C lanes could never be muxed
out. In practice i2c9 and i2c10 got the UART lanes and did not work,
while uart9 and uart10 happened to be muxed correctly.

Give each lane pair its own function, following the _01/_23 naming
already used for the same hardware arrangement by the shikra, eliza,
hawi and maili TLMM drivers. Both functions still cover the full pin
pair, so a single pinctrl state per protocol remains sufficient.

Drop gpio129/gpio130 from the SE2 group list, since those pins
belong to SE3 and were never reachable through the SE2 function.

Also rename QUP1 SE2/SE3 functions in the binding doc accordingly.

While at it, add missing "gpio", "qup3_se0_mira" and "qup3_se0_mirb"
to the binding function enum to get the list complete.

Fixes: c24dd0826f ("pinctrl: qcom: add the TLMM driver for the Nord platforms")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260830030201.135637-1-shengchao.guo@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
 2026-09-18 19:00:14 +02:00
Linus Torvalds
a077be4fde arm64 fixes for -rc4 
- Fix hypercall arguments when resetting EL2 vectors during hibernation
 
 - Fix hibernation with 52-bit capable kernels on machines without
   52-bit addressing, similarly to the recent kexec fix
 
 - Fix a bunch of clumsy codegen issues with our per-cpu accessors
 
 - Fix MTE ptrace documentation to reflect the de-facto ABI behaviour
 
 - Fix pthread_join() usage in MTE selftest
 
 - Fix port selection in the Arm CMN PMU driver
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmqtMZ4QHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNNujB/4pa4pdivXRMOH39HSDu+8i3KlREGpTA9dq
 LJvwUjlgoIw0d8/b5sMSAxJi8RA29IENJPqrU97eBBLKgC2gq1oMwjOaHNTV8XUj
 gal9hwuZcfO5NIJi61TkyLxn++ysVYXD3J0tbhSXbqz2oeg/jxwj9SsFfQux34GY
 GeGb2cWvEXznLgN0h+vZiNh6+FsQRN+dizpiHKLh+wpbZ/vIzuVTQEo6w/+BEUWg
 R4YQlvpj/2yAC0BBdPb9gALUWFbjea6zpX5gM5/PgLoqW0CIJvGXahZ7T5kDoXBT
 Xp5zsKvcC8dxM5nCJIJ7xRPg75v97toYrrl2AoNQN9bgOynQAI5k
 =j0NQ
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
 "In this batch we've got a couple of hibernation fixes, a couple of
  minor MTE fixes, some per-cpu codegen fixes (which were found as part
  of Mark's series adding preemptible this_cpu_*() operations) and a fix
  for the Arm CMN PMU driver.

  Summary:

   - Fix hypercall arguments when resetting EL2 vectors during
     hibernation

   - Fix hibernation with 52-bit capable kernels on machines without
     52-bit addressing, similarly to the recent kexec fix

   - Fix a bunch of clumsy codegen issues with our per-cpu accessors

   - Fix MTE ptrace documentation to reflect the de-facto ABI behaviour

   - Fix pthread_join() usage in MTE selftest

   - Fix port selection in the Arm CMN PMU driver"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation
  kselftest/arm64: Fix size of thread_data values for pthread_join()
  arm64: percpu: Fix LSE operations on {8,16}-bit types
  arm64: percpu: Fix this_cpu_and() mask generation
  arm64: percpu: Fix this_cpu_write() casting
  arm64: hibernate: clone only the linear map that exists at runtime
  perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
  arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
 2026-09-18 09:28:30 -07:00
Yureka Lilian
baaa9b126b arm64: Add override for WFxT 
Add an override for WFxT support within ID_AA64ISAR2_EL1 to allow
it to be disabled using the new arm64.nowfxt command line parameter.

This accompanies the idle=nop param introduced in a previous patch
series [1] in dealing with misbehaving WFI and WFIT instructions on
Apple Silicon SoCs, and eases debugging of other quirky WFxT
implementations.

Link[1]: https://lore.kernel.org/all/20260804-arm64-idle-param-v3-1-d10f8159062b@cyberchaos.dev/
Suggested-by: Will Deacon <will@kernel.org>
Signed-off-by: Yureka Lilian <yureka@cyberchaos.dev>
Signed-off-by: Will Deacon <will@kernel.org>
 2026-09-18 11:17:02 +00:00
Linus Torvalds
b5a051f6b8 Including fixes from Netfilter, Bluetooth, IPSec and WiFi. 
Previous releases - regressions:
 
   - netfilter: hold reference on ct until flow is released
 
   - bridge:
     - move switchdev call outside rcu
     - vlan: fix bugs caused by switchdev deletion errors
 
   - wifi:
     - mac80211: reset state when starting AP fails
     - cfg80211: don't free driver-owned scan requests
 
   - tcp: don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
 
   - mptcp: return sk_wait_data() errors from recvmsg()
 
   - xfrm: serialize state GC with device state flush
 
   - drop_monitor: synchronize tracepoint unregistration on error path
 
   - bluetooth:
     - eir: validate service data length before reading UUID
     - hci_sync: serialize local codec list cleanup
     - RFCOMM: avoid socket lock inversion in listener cleanup
 
   - eth: lan743x: fix RX checksum use-after-free
 
   - eth: mvpp2: prevent buffer overflow in page_pool allocation
 
 Previous releases - always broken:
 
   - core: lock the socket in sock_gettstamp()
 
   - neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
 
   - sched: codel: bound the dropping loop per dequeue call
 
   - wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic
 
   - psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
 
   - xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk()
 
   - bluetooth: hci_qca: do not write to the serial port after it is closed
 
   - dsa: mxl862xx: disable the stats poll on teardown
 
   - eth: stmmac: fix TSO header length truncation
 
   - eth: ip_tunnel: initialize `options_len` before referencing options
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmqsEOsWHHBhb2xvLmFi
 ZW5pQGdtYWlsLmNvbQAKCRApJHmNzI8TpKMnD/4vxx/YloxnyDssUB95WcTfiHau
 XD+YDfTTf4Qy3DwKnMiesZ4w2547FXG+LwJZGpAGWpRSE99OawFHvx5gyn3Vf4IU
 HEsOuZEYMwhSeeMJxGdCg8K6McNEQx+aAD7D8gLoisnJr/DCKBJtxFgKVEjaKUfP
 aCG+FmbBqdS7hwBVbYREwmqwQSMnNzRWLd7/10/oYMcLfvgEsIkZisRErAW2BgZj
 mzGw/IcG+QRldDPGDwLwLzfEG9o1a2JctSRrQ3uLHZ3VOdmpnSkmf25s2IaEFAn6
 xfIhGPMgYIBDrakn/Ci4fAF0L98FtBq4Sa21HlvPMBst7rcce5x49ddSlIUWxRVZ
 Fbvs/0IMN0cEpYGbVJxE8iF3yo+t8XvsMdGS1JXd/ycaL9lpF+9gCzNvChSxba3N
 ik7BGAmlg76rqMuzeeMbWqMCmOcCBhQsb7iZXjNStJoiVY+UT2QfgvJ1TqF8Qrar
 Eu/xFkaqk8i/7jrx4ujceg9XpRt1Y3Y3Pq0sgdzlzTm162AV/kg1fvwHc6ORIML7
 71XpBSGvjyTHoh95ob/w3/5fec/ekzvWlCBL/cYIwBJ4R6n7Vk5e0Y1yZDffPSo3
 xQR0r4YdLewkjQdtnGEih6FSyWsu6nYpVSuwHbof1bQSzvlIM6TAabJmtJckFTld
 1bR2C9UVw5mQYMy8PA==
 =Gw4S
 -----END PGP SIGNATURE-----

Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Netfilter, Bluetooth, IPSec and WiFi.

  Previous releases - regressions:

   - netfilter: hold reference on ct until flow is released

   - bridge:
      - move switchdev call outside rcu
      - vlan: fix bugs caused by switchdev deletion errors

   - wifi:
      - mac80211: reset state when starting AP fails
      - cfg80211: don't free driver-owned scan requests

   - tcp: don't call skb_clone_and_charge_r() for close()d listener in
     tcp_v6_do_rcv()

   - mptcp: return sk_wait_data() errors from recvmsg()

   - xfrm: serialize state GC with device state flush

   - drop_monitor: synchronize tracepoint unregistration on error path

   - bluetooth:
      - eir: validate service data length before reading UUID
      - hci_sync: serialize local codec list cleanup
      - RFCOMM: avoid socket lock inversion in listener cleanup

   - eth:
      - lan743x: fix RX checksum use-after-free
      - mvpp2: prevent buffer overflow in page_pool allocation

  Previous releases - always broken:

   - core: lock the socket in sock_gettstamp()

   - neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

   - sched: codel: bound the dropping loop per dequeue call

   - wifi: mac80211: include TIM bitmap control for buffered S1G mcast
     traffic

   - psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()

   - xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk()

   - bluetooth: hci_qca: do not write to the serial port after it is
     closed

   - dsa: mxl862xx: disable the stats poll on teardown

   - eth:
      - stmmac: fix TSO header length truncation
      - ip_tunnel: initialize `options_len` before referencing options"

* tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (159 commits)
  mptcp: fix bad accounting in __mptcp_subflow_push_pending()
  mptcp: close race between scheduler and state change
  mptcp: avoid unneeded actions on subflow reset
  net: skbuff: do not leave stale header offsets after pskb_carve()
  selftests: net: packetdrill: test exclusion of old ACK from TCP fast path
  tcp: exclude old ACKs from tcp fast path
  dpll: reject a reference sync pin which is not on the pin's dpll
  net: mvpp2: prevent buffer overflow in page_pool allocation
  net: macb: fix ordering around PTP timestamp read
  selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion
  net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
  net: stmmac: preserve real_num_tx_queues on mqprio setup failure
  net: stmmac: propagate FPE preemption-class mapping errors
  net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
  net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
  net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
  net: ethernet: cortina: Ack RX overrun interrupt correctly
  net: lock the socket in sock_gettstamp()
  eth: fbnic: ring the doorbell if a burst ends in a drop
  net: netsec: fix device_node reference leak on phy_np
  ...
 2026-09-17 10:40:48 -07:00
Dave Airlie
b15e54761a Merge tag 'drm-msm-fixes-2026-09-16' of https://gitlab.freedesktop.org/drm/msm into drm-fixes 
Fixes for v7.3-rc4:

DT:
- Corrected indentation

Core:
- Marked fbdev as system memory

GPU:
- Fixed autosuspend cleanup on teardown
- a750: fix timestamps
- Increase GMU fw init timeout
- Misc fixes/cleanups

DPU:
- Fixed clock rounding, unbreaking newest platforms
- Cleared pending flush state

DP:
- Skip PUSH_IDLE when link was never enabled
- Fixed bandwidth checks

HDMI:
- Fixed runtime PM cleanup on probe failure

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <rob.clark@oss.qualcomm.com>
Link: https://patch.msgid.link/CACSVV021rZsjmiPEyR_LR7L=k7=DRV0QdsA50BF_Gd0s2DXaCw@mail.gmail.com
 2026-09-17 19:05:21 +10:00
Karl Mehltretter
4525a91104 s390/pci/docs: Fix sriov_numvfs attribute name 
The attribute is sriov_numvfs (drivers/pci/iov.c); the document names it
sriov_numvf, which does not exist.

Use sriov_numvfs.

Fixes: de267a7c71 ("s390/pci: Documentation for zPCI")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
 2026-09-17 06:59:41 +02:00
Eric Dumazet
83a945a529 tcp: do not let tcp_rmem be set below 4096 
We can hit a division by zero crash in tcp_rcvbuf_grow()
and tcp_rcv_space_adjust():

divide error: 0000 [#1] PREEMPT SMP
RIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939
...
grow = div_u64(((u64)rcvwin << 1) * (newval - oldval), oldval);

The division uses oldval = tp->rcvq_space.space as divisor.
When tp->rcvq_space.space is zero, this leads to a divide-by-zero
exception.

tp->rcvq_space.space is initialized in tcp_init_buffer_space():
    tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,
                                (u32)TCP_INIT_CWND * tp->advmss);

If tcp_rmem[1] is configured to very small values (such as 1),
sk->sk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which
computes (sk->sk_rcvbuf * scaling_ratio) >> 8, truncates to 0.
This sets tp->window_clamp = 0, tp->rcv_ssthresh = 0, and
tp->rcvq_space.space = 0. Later, when data arrives and DRS is invoked,
tcp_rcvbuf_grow() divides by oldval == 0.

Back in 2015, commit b1cb59cf2e ("net: sysctl_net_core: check SNDBUF
and RCVBUF for min length") ensured that net.core.rmem_default and
net.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly,
SO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF).

However, net.ipv4.tcp_rmem still had .extra1 = SYSCTL_ONE, allowing
arbitrarily small values.

Because SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline
alignment, its value varies across architectures and configuration options.
Using a fixed constant of 4096 ensures a predictable, architecture-
independent lower bound that is safely above SOCK_MIN_RCVBUF everywhere
and matches the documented 4K default.

Fix this by setting tcp_rmem.extra1 to 4096 and updating the documentation.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260912144848.3448026-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2026-09-15 15:21:17 +02:00
Krzysztof Kozlowski
a15fac810c dt-bindings: display/msm: Use consistent indentation in the example 
Correct indentation in the examples to consistent 2- or 4-spaces
indentation to fix dt-check-style warnings ("example 0
[indent-consistent] indent mismatch ...").  Preferred is 4-spaces, but
re-indenting entire example just for that is too much churn.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/753054/
Link: https://lore.kernel.org/r/20260913123331.100293-4-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
 2026-09-15 02:09:28 +03:00
Thomas Richard (congatec GmbH)
3550d1dbbc hwmon: (cgbc-hwmon) Add missing sensors 
Add the following sensors:
- Alternate Board Temperature (temp11_input)
- Top DIMM 1-7 Temperature (temp12_input to temp18_input)
- Bottom DIMM 1 Temperature (temp19_input)
- 12V Standby Voltage (in14_input)

This fixes the following warning on conga-SA7:

  Board Controller returned an unknown sensor (bc_type=1, bc_id=11), ignore it

Also update existing labels to match Congatec documentation.

Cc: stable@kernel.org
Fixes: 08ebc9def7 ("hwmon: Add Congatec Board Controller monitoring driver")
Signed-off-by: Thomas Richard (congatec GmbH) <thomas.richard@bootlin.com>
Link: https://patch.msgid.link/20260911-cgbc-hwmon-fix-and-new-sensors-v2-2-0c6bf078d173@bootlin.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 2026-09-13 21:19:48 -07:00
Karl Mehltretter
45b0037899 Input: trackpoint - fix the inertia attribute name in the ABI document 
The attribute is created as "inertia" (TRACKPOINT_INT_ATTR(inertia, ...)
in drivers/input/mouse/trackpoint.c); the ABI file spells the path
"intertia". The description below it already says inertia.

Fix the spelling.

Fixes: aebb47d4e7 ("Input: trackpoint: document sysfs interface")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260905102038.42882-1-kmehltretter@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 2026-09-13 18:14:15 -07:00
Linus Torvalds
4d85a45df0 Changes since last update: 
- Fix the missing sysfs feature entry for xattr prefixes
 
  - Fix invalid LZMA decoders on resize failure
 
  - Disable LZ4 rolling decompression for now due to the uncontrolled
    LZ4 implementation
 
  - Rearrange the inode_share cache key to avoid potential collisions
 
  - Fix erofs_bread() when fsoffset is used on sub-page-block EROFS
    filesystems
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmqlRUkRHHhpYW5nQGtl
 cm5lbC5vcmcACgkQUXZn5Zlu5qpHEg/8C9Ih/XK8spRppF+rWGUnhf+9iARJE4aP
 31NJgvs8h5R8tfxu3vOhOlhOT3pybxAuPI2qkx+c5kZRlo1wtCN2HQPH5NeZ7nUn
 JhA99YHs7UTz8FYa2gKO4F9gTqorEOJO4R3jrSPNFT2V5Ae3ApgLhvfjZfSv4+4X
 zQox+fdmzKT3G4sOuCPhTz4Fo5NleiJSrA+sVBn8lPcT3xCJZiUsJb7hK31rco0J
 tnAVJsbhy9Yq7FZiUDIdbAQl9ukPoYbF8rYXVkcbXGFE8Qq1Gmm1Ep1OndmB3k0U
 JFOub70cp4x/T8EKjc+W7Ft1mhq9yZkGlVMUb3otb3cFIOYBfl/8ClO3i0xltBXG
 4uafbtc5Lfs7tSOaYoJ0JHDzgIx91hFbCXEM0QW+WYXh9bLTpSZv3FG93tQ4QSHN
 1m8jqjF5i4eGnp/xEFFSltrgqtwmiyIgeSg8tHyTG7pIao5zengZiysdcmZi2Akl
 /0txH8hSx3qldt69PadotW2rGROPb8SOgDpFvlcfitSwOoN2RF0R+Mq/afog+WkY
 99EmJ32okgGN9LK8scX1cynW30X065pWzWpLm3WvbBDNmKl+jX+i4RkuEOKFV3zQ
 IqOZjmHCDHv2NJq7EzC8XE18Z6LewXXX1nw6iO/5UneZgrODltlDfuq9f4pdwYI2
 UugUZKgygoU=
 =fmjB
 -----END PGP SIGNATURE-----

Merge tag 'erofs-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

Pull erofs updates from Gao Xiang:
 "The most impactful fix here is to disable LZ4 rolling decompression
  for now.

  AWS folks recently found their systems could get corrupted data with
  some rare, specific LZ4 datasets, and after a deeper analysis, I found
  the root cause is that there could be uncontrolled backward memory
  copies in the current LZ4 implementation and it breaks the assumption
  of the rolling decompression optimization, since the kernel LZ4
  codebase is out of our control and it needs more time to plan how to
  do next, so disable LZ4 rolling decompression for now to ensure data
  correctness for real production on these rare cases first. The
  technical details also see the corresponding commit.

  Other changes are random minor fixes.

  Summary:

   - Disable LZ4 rolling decompression for now due to the uncontrolled
     LZ4 implementation

   - Fix missing sysfs feature entry for xattr prefixes

   - Fix invalid LZMA decoders on resize failure

   - Rearrange the inode_share cache key to avoid potential collisions

   - Fix erofs_bread() when fsoffset is used on sub-page-block EROFS
     filesystems"

* tag 'erofs-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: add missing buf->off in erofs_bread()
  erofs: delimit inode_share cache key components
  erofs: disable LZ4 rolling decompression for now
  erofs: preserve LZMA decoders on resize failure
  erofs: add sysfs feature entry for xattr prefixes
 2026-09-12 08:18:50 -07:00
Kuniyuki Iwashima
6d79b223ec neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. 
NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses
.validation_type, so no validation is applied:

  # ynl --family rt-neigh --do setneightbl \
  --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 0}}'

  # ynl --family rt-neigh --dump getneightbl --output-json | \
  jq '.[] | select(.name == "arp_cache" and has("config"))
          | .parms["interval-probe-time-ms"]'
  0

Moreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is
silently cast to u32, so a larger value can bypass the min check:

  e.g. 4294967296 == 0x100000000

  # ynl --family rt-neigh --do setneightbl \
  --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 4294967296}}'

  # ynl --family rt-neigh --dump getneightbl --output-json | \
  jq '.[] | select(.name == "arp_cache" and has("config"))
          | .parms["interval-probe-time-ms"]'
  0

msecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is
larger than INT_MAX.  Also, INT_MAX ms overflows int NEIGH_VAR()
when HZ > 1000 (Alpha, MIPS), and passing a negative integer to
queue_delayed_work(unsigned long delay) causes sign extension,
which wraps around the expiry time to the past, resulting in it
being handled as 0 delay in the timer wheel.

Let's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.

The same max check is applied to sysctl as well.

Note that this controls the probe interval for NTF_MANAGED
entries, so the max of 1 day is unlikely to break any
deployments.

Fixes: 211da42eaa ("net, neigh: introduce interval_probe_time_ms for periodic probe")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260909233143.2401847-3-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-09-11 17:25:13 -07:00
Linus Torvalds
114f73092b regulator: Fixes for v7.2 
One fix for pf1550 which checked for errors on multiple regulators but
 always notified via one of them regardless of which one had the problem,
 plus one device ID addition in the fan53555 DT bindings.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmqkbckACgkQJNaLcl1U
 h9Dfewf+PacEx4Rc51FaF9OGmniMQ5wLU8W7maJv8L/68hghxhwGQZL/KxgYZAjU
 HuniSGz6GMbsJ+S1HVYVqA5GPzJgjf6CpCc8WvHZnyCNQ+R5zrAW2e9tylWJniwu
 7ngrImiRdtRJkyyTv01j5KSORc7jGqXJR/Iea2nqe5IAdNxYVAbl5Jar6vynF3wA
 rOJ5s2WTMu7J/ygRAVdqH0yIDbpqKaLTBn9IrCzFYxGllMkNMnKmjNICKI7OpQGu
 hP8Dghe1TSFCJUPCuWMG9O8GjRZZNkYOQakr52pClhBCvI2vJPCY5D5yRCp7CDoY
 5bQtDEv+we+FsuuVxvCJ60NhH8zH7A==
 =fjiq
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "One fix for pf1550 which checked for errors on multiple regulators
  but always notified via one of them regardless of which one had the
  problem, plus one device ID addition in the fan53555 DT bindings"

* tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: pf1550: fix which regulator is notified
  regulator: dt-bindings: fan53555: add tcs,tcs4526
 2026-09-11 15:24:21 -07:00
Linus Torvalds
0fb234ce37 spi: New device ID for v7.3 
Update the DesignWare DT binding to say how to describe the UltraRISC
 DP1000 instance of the controller.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmqkbi8ACgkQJNaLcl1U
 h9AmXwf/fx62hiA+UOPrKA1d4hjMI1s828iif4dgo2WPfZLkAeMnd4ibFgf/gIYv
 gLKJHmdtLAJ0z1JY+01cOEvRw4UvSiPLuwaM9+tR/jWc+KhF711IJBFRba8aKH0Q
 GHjbooYTkmJotx70V6MkACRgJSQjoHizHgHQoYF/UdG9YO6S8Ee0ya9XC3jMbvaZ
 0cRhKPtZozuJrrra7IvNVANt0KR4W8mKcuYFWaXmtwIP8wZyL4FilGcnLfNZiz7B
 GfrZ9GLJcoRbSq4gnQx4/I/8GTS8J7AaEQo69dNiexYWs+fOgDCSclLcR/GznVAU
 bawIajipjKNi3pZcaoaSrgKjAWMu5Q==
 =ta0L
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fix from Mark Brown:
 "New device ID for v7.3: update the DesignWare DT binding to say how to
  describe the UltraRISC DP1000 instance of the controller"

* tag 'spi-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: snps,dw-apb-ssi: Add compatible for UltraRISC DP1000 SoC
 2026-09-11 15:10:31 -07:00
Linus Torvalds
827751b699 RISC-V updates for v7.3-rc3 
- Revert a bad fix, likely LLM-generated, in the pointer masking code
   that confused the RISC-V hardware pointer masking implementation
   with the Linux kernel tagged address feature
 
 - Fix unexpected faults caused by kprobe instruction slot writes when
   !CONFIG_STRICT_MODULE_RWX
 
 - Fix unexpected faults on minimal configurations during runtime code
   patching on !CONFIG_STRICT_MODULE_RWX systems
 
 - Fix a misplaced variable clear causing incorrect reuse of previous
   values in the RISC-V hardware feature probing code
 
 - Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
   than BIT on 64-bit masks; and use a bitmap rather than an unsigned
   long on a quantity that can exceed 32 bits
 
 And a few miscellaneous cleanups:
 
 - Avoid a potential dereference-before-NULL-pointer-check bug in the
   PMU SBI perf driver
 
 - Simplify the rv32 bug table code by using
   CONFIG_GENERIC_BUG_RELATIVE_POINTERS (following x86 and PPC)
 
 - Report the RISC-V standard ISA extensions Z[v]fhmin when support is
   claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
   simplify our FPU test code to only check for the presence of the D
   extension
 
 - Use an existing kernel string helper in place of some open-coded
   code in kernel/usercfi.c
 
 - Fix some yamllint issues in the RISC-V DT bindings for CPUs
 
 - Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into the
   RISC-V CFI selftest code
 
 - Update the translation for the simplified Chinese translation of the
   RISC-V kernel patch acceptance policy
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmqghcoACgkQx4+xDQu9
 KkvmEQ/7BVmPFuoR6OLNk2Eu8Exqen6a41KxdM/B91NJBEbBM60GAyejjWDXWmm0
 K21yhRu58RGbfg2kKUJMvawzwIfuDswxCS31VtpDKnTrmP4HQz1Yvnh2M7jH9D2d
 /wJCIYcJ0hJx0yDIZOUhU24aoy63ZXRygp8nTOgjkAxhkF31w+MJxTPDD0Ir7Eai
 y4sRMTCabMonmyA0qozfnMoXaO3FkPv9l7pw/LHfqUYjaLNQyMHiiDPrRj1oNZPD
 GQFUWykRgMccMW6kIgTJrjmzn7+vEJ7UZ/fvOD97+rGeaoyE19vcW8owUQWp6Hgb
 Jq3WyS9HImrpCBTr079ht5lhu3ZucpAEP6sK5v/m4GOlBv1HdYHUS6JH0qo4DnXZ
 aFrxg7WXxaFZ8dD3P8ErZkXy5Vid3+ZlpK//AOfWAqxX7q6c4K1w3lJm4bPKyNBX
 vh3ASQr5oEj3KpGbihsrX2lVB/5LVP3pWTcH5f6rBBYiVFMMhWKLJXA3pjiRFN7v
 ZXClKh5MznvS6ycMp5pXVYpVn2Kk+Y/mywsDqNRUigHwppkxI9MTJBq8+qcOiM9I
 a7mHna4XHVVu0+B4/JMhkWgnGYRjFD6bsGzxPZODLFcmBUxmsoa5+HOENLAGdQ1w
 s/Z2HmDO8yL37DxLq5O2aF3KNPSkXNBl+upQwj5lTTzR/bmghjc=
 =oMU+
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V fixes from Paul Walmsley:
 "From a RISC-V point of view, there's one notable fix here, reverting
  an earlier bogus fix to the pointer masking code. Fortunately the
  practical impact appears to be small.

   - Revert a bad fix, likely LLM-generated, in the pointer masking code
     that confused the RISC-V hardware pointer masking implementation
     with the Linux kernel tagged address feature

   - Fix unexpected faults caused by kprobe instruction slot writes when
     !CONFIG_STRICT_MODULE_RWX

   - Fix unexpected faults on minimal configurations during runtime code
     patching on !CONFIG_STRICT_MODULE_RWX systems

   - Fix a misplaced variable clear causing incorrect reuse of previous
     values in the RISC-V hardware feature probing code

   - Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
     than BIT on 64-bit masks; and use a bitmap rather than an unsigned
     long on a quantity that can exceed 32 bits

  And a few miscellaneous cleanups:

   - Avoid a potential dereference-before-NULL-pointer-check bug in the
     PMU SBI perf driver

   - Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug
     table code (like x86 and PPC)

   - Report the RISC-V standard ISA extensions Z[v]fhmin when support is
     claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
     simplify our FPU test code to only check for the presence of the D
     extension

   - Use an existing kernel string helper in place of some open-coded
     code in kernel/usercfi.c

   - Fix some yamllint issues in the RISC-V DT bindings for CPUs

   - Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into
     the RISC-V CFI selftest code

   - Update the translation for the simplified Chinese translation of
     the RISC-V kernel patch acceptance policy"

* tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
  kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__
  docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation
  dt-bindings: riscv: cpus: Fix yamllint style issues
  riscv: hwprobe: simplify has_fpu() to check D extension only
  perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
  riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
  perf: RISC-V: store available counter mask as bitmap
  perf: RISC-V: use BIT_ULL for u64 overflow masks
  riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
  riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
  riscv: use string helper in setup_global_riscv_enable()
  Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
  riscv: patch: skip fixmap mapping when kernel text is already writable
  riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
 2026-09-11 13:15:13 -07:00
Linus Torvalds
707662b40a ata fix for 7.3-rc3 
- Drop documentation for no longer existing pata_legacy kernel
    parameters (Ethan)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCaqRQ0QAKCRDJZDGjmcZN
 ct1FAP96qnI8tDPHzWU+1znXhDEBXl3aVw8lvSBokR4yvqyDVQEAs3Jeaq38mZTQ
 C3jV+RbN4YUC/St8AFt7t73soEOb8wc=
 =zZKx
 -----END PGP SIGNATURE-----

Merge tag 'ata-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fix from Niklas Cassel:

 - Drop documentation for no longer existing pata_legacy kernel
   parameters (Ethan)

* tag 'ata-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: pata_legacy: remove documentation for removed module parameters
 2026-09-11 12:44:11 -07:00
Catalin Marinas
fdb9ebc7fb arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation 
PTRACE_{PEEK,POKE}MTETAGS return -EIO rather than -EOPNOTSUPP (as
documented) when no tags are copied from/to a mapping without PROT_MTE.
This has been the behaviour since the interface was introduced, though
the original intent was to distinguish between address not being
accessible and mapped as untagged.

Update the documentation to match the implementation (de-facto ABI).
Since -EOPNOTSUPP was never returned, change the error assignment to
-EIO as well to avoid confusion.

Fixes: df9d7a22dd ("arm64: mte: Add Memory Tagging Extension documentation")
Fixes: 18ddbaa02b ("arm64: mte: ptrace: Add PTRACE_{PEEK,POKE}MTETAGS support")
Reported-by: Yury Khrustalev <yury.khrustalev@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
 2026-09-11 12:50:02 +00:00
Daniel Borkmann
88ce88e933 bpf: Add KF_PERFMON kfunc flag 
Tracing related BPF helpers e.g. under bpf_base_func_proto() are gated
behind CAP_PERFMON. However, the same is currently not true for kfuncs
and they are accessible via plain CAP_BPF. Add a new KF_PERFMON flag
which can be used such that check_kfunc_call() ensures env->allow_ptr_leaks
is permitted. This follows similar pattern to existing KF_DESTRUCTIVE flag.

The rejection returns -EPERM to match the other CAP_PERFMON gates in the
verifier, that is, check_ptr_to_btf_access() and check_ptr_to_map_access(),
which report the very same policy to user space.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260910213510.49358-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-09-10 16:55:47 -07:00
Linus Torvalds
aa416593f3 hwmon fixes for v7.3-rc3 
* Core
 
   - Fix potential UAF in pec_store
 
   - Ensure that 'dev' passed to hwmon_notify_event() is a hwmon device
 
   - Document hwmon_notify_event()
 
 * applesmc: Fix key backlight workqueue leak on register failure
 
 * aspeed-pwm-tacho: Propagate reset deassert errors
 
 * asus_rog_ryujin: HID report fixes
 
 * chipcap2: Fix channels in humidity alarm notifications
 
 * corsair-cpro: debugfs fixes
 
 * gpd-fan: Documentation: replace full-width colon by a standard ASCII colon
 
 * gpio-fan: Take fan_data->lock in gpio_fan_shutdown(), and fix
   use-after-free in alarm work
 
 * ina2xx: Fix in0 and curr1 alarm handling, and acquire hwmon_lock in
   shunt_resistor_show()
 
 * ltc4282: Fully initializeclk_init_data
 
 * mcp9982: Propagate one-shot polling errors
 
 * nct6694: Do not expose enable on DTIN temperature channels
 
 * PMBus core: Clear generic status alarms with CLEAR_FAULTS
 
 * sht4x: Fix return value from heater_enable_store(), and add missing locks
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmqi9qsACgkQyx8mb86f
 mYGWTQ/9Gb8TEBQIK5thUZqmJ/MQ1o23brRrsQmRn1zuCxlgo5CnLXD3ym/icadR
 c98J2MTJNCf+03lahMDMEwuAOmymuiu0uGHOhiXKIRK/ermIercPZKOhzu3EsVMS
 f+sDZbjyjEir/5SxqD6QGuuBaTLOSy1HYCfp/YKWyW5TOj8Gf+8VDmgdClBM9Y2m
 YlJmlhZi54XZWYSeIrozq4Sw8a2utmM7PYvlQiiV6a/b/FvYd1vsWxe5l8XoQT8n
 b0WVtFS/qnICFpt7bon6eq6QGRZDgn8rFphv3zBc9Wtoxqnx5rKtlrXQclfjhmtI
 /ekSOdgxr2wMzMBL+mB6l3k4oD4J5yt43/KCR/Qap4JGPNG3NOlxEbUJ+jGN2C96
 kTuDuxq/HuoJWmWgiotB3bAoTm+izvJkO4hpj57X5HCaQYC8pmlQL1RXWy6d/tAS
 jPiC/Xd2Eo01EWgIT8JT1RSHUPV9dI/x4uU+My6w8++B2X4y5eqzFQYBO5EVu00W
 1HDThX9Nqp0mI/09IliHp+MexXJO2NUj8SbRn2TmPM6cy4o4RxwBfdx+ZMJazert
 0adW4rG3IF2xiRuc8yxaQA8toUK5hSLaknZ4SoxTjwy9kXjRCrFMU4TCJnJUUYY6
 CWQWaHCSs2IPfsDdy7blnL7uT810/9GwzLT8nRAKAe3s86QCE2k=
 =omwO
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - Core
     - Fix potential UAF in pec_store
     - Ensure that 'dev' passed to hwmon_notify_event() is a hwmon device
     - Document hwmon_notify_event()

 - applesmc: Fix key backlight workqueue leak on register failure

 - aspeed-pwm-tacho: Propagate reset deassert errors

 - asus_rog_ryujin: HID report fixes

 - chipcap2: Fix channels in humidity alarm notifications

 - corsair-cpro: debugfs fixes

 - gpd-fan: Documentation: replace full-width colon by a standard ASCII
   colon

 - gpio-fan: Take fan_data->lock in gpio_fan_shutdown(), and fix
   use-after-free in alarm work

 - ina2xx: Fix in0 and curr1 alarm handling, and acquire hwmon_lock in
   shunt_resistor_show()

 - ltc4282: Fully initializeclk_init_data

 - mcp9982: Propagate one-shot polling errors

 - nct6694: Do not expose enable on DTIN temperature channels

 - PMBus core: Clear generic status alarms with CLEAR_FAULTS

 - sht4x: Fix return value from heater_enable_store(), and add missing
   locks

* tag 'hwmon-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (24 commits)
  hwmon: (nct6694) do not expose enable on DTIN temperature channels
  hwmon: (asus_rog_ryujin) Synchronize HID command and report handling
  hwmon: (asus_rog_ryujin) Validate HID report lengths
  hwmon: (corsair-cpro) Remove debugfs entries when probe fails
  hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
  hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
  hwmon: (corsair-cpro) Create debugfs entries after hwmon registration
  hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
  hwmon: (chipcap2) fix channels in humidity alarm notifications
  hwmon: (applesmc) fix key backlight workqueue leak on register failure
  hwmon: (sht4x) Fix return value from heater_enable_store()
  hwmon: (sht4x) Add missing locks
  hwmon: (yogafan) fix non-kernel-doc comment
  Documentation: hwmon: replace full-width colon by a standard ASCII colon
  hwmon: (ina2xx) Decouple in0 and curr1 alarms
  hwmon: (ina2xx) Replace masks with enum in alert functions
  hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()
  hwmon: Ensure that 'dev' passed to hwmon_notify_event() is a hwmon device
  hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show()
  hwmon: Fix potential UAF in pec_store
  ...
 2026-09-10 14:37:53 -07:00
Linus Torvalds
7844502343 Nothing too exciting, usual stream of fixes. 
Including fixes from Netfilter, Bluetooth and WPAN.
 
 Current release - new code bugs:
 
  - Bluetooth: hci_sync: fix not setting CE length properly
 
  - eth: enic: match mailbox replies to request numbers
 
 Previous releases - regressions:
 
  - tunnels: drop stale dst when building an ICMP error for PMTUD
 
  - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
    (bug in the rtnl_lock -> RCU conversion)
 
  - eth: bnxt_en: fix crashes on Thor2 due to OOB coalescing buffer accesses
 
  - eth: bnxt_en: prevent queue stop with deferred completions
 
 Previous releases - always broken:
 
  - eth: ice: don't dereference pointers from TP_printk()
 
  - eth: fix OOB writes on ethtool flow rule dump in 3 drivers
 
  - eth: mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD
 
  - dsa: tag_brcm: legacy FCS: request needed tailroom
 
 Misc:
 
  - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc
 
  - ipv6: flowlabel: cap duplicate leases per socket
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmqi3pQACgkQMUZtbf5S
 IrvUIg//X9nIxY2F5PzJ5jD9p5ccXrQMLe7kT5AW2tP5PDC8d5PIv4Q5XzFKQPU7
 XElAUKvBxmofwU2lqILYGi8AeUpqHZtKPY7XzKeqd6i72KOD6mGzzYNijqttBXcM
 vFVtIeKExXjAwvNc2as1SeXVEAAAkBtrCFuMNHMq0C56yK4md/XVkCDHaJkomNit
 geke1U8gut3rZddWKxp4WDbL8Wmx9yM0uDMBznO/+cwITObA0Hme3IgRndglzz7n
 n4Ih+EG4tRrD3kUf6oePzKQ47cd+qnSVlVTCZUwB5E/HKqWJFXxSN4Sv+mez0sAS
 rrI5hl+luNKUYrZ8/jiNlvajgAL4+AYpCKPDJbXrOW+z+x4BC2VYZBAHLoUr5ZAq
 Z5OYU9SgD1oGntqkI8mAEiRTEu+4gjhIEhjENHEzqdjUogaBIp7MWwCrNBAnFWvs
 2McmNfZZMVhxKpyYnndUStsVQySVPASb0CXeqTIO6PJsAp/HBjoMYKYKPhhwk0Gp
 lE8zHjEnPVofRfXfT+oZnbS8is2nC9FjBy9ksIGcC7vyTOdPsoIBoB8JY0x/INRM
 SOJvyxrdnVkMjiBejkdOa5X9HbD1cA/NVyzT2WEaZBGPmIqfNBgUIOxnXD4CShuy
 9zX8qtHsUmmYxPteF30Uhfe0kyLQ9OnjUz2Bl++EruxpIE3+i48=
 =f9J9
 -----END PGP SIGNATURE-----

Merge tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Nothing too exciting, usual stream of fixes. Including fixes from
  Netfilter, Bluetooth and WPAN.

  Current release - new code bugs:

   - Bluetooth: hci_sync: fix not setting CE length properly

   - eth: enic: match mailbox replies to request numbers

  Previous releases - regressions:

   - tunnels: drop stale dst when building an ICMP error for PMTUD

   - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
     (bug in the rtnl_lock -> RCU conversion)

   - eth: bnxt_en:
       - fix crashes on Thor2 due to OOB coalescing buffer accesses
       - prevent queue stop with deferred completions

  Previous releases - always broken:

   - eth:
       - ice: don't dereference pointers from TP_printk()
       - fix OOB writes on ethtool flow rule dump in 3 drivers
       - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD

   - dsa: tag_brcm: legacy FCS: request needed tailroom

  Misc:

   - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc

   - ipv6: flowlabel: cap duplicate leases per socket"

* tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits)
  selftests: tc-testing: test action batch failure cleanup
  net/sched: act_api: release all action references on NEWACTION failure
  openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
  ipmr: account multicast table and route memory
  net: phy: dp83td510: handle the active-high LED polarity mode
  net: macb: initialize PTP state before registering clock
  net: hsr: enable promiscuous mode on interlink port with fwd offload
  ipv6: fix fib6 walker UAF on seq stop
  net: stmmac: fix TX descriptor availability check for TSO traffic
  net/rds: fix tcp stream corruption with large pages
  net: mana: restore the XDP program pointer when pre-allocation fails
  net: phy: dp83867: handle the active-high LED polarity mode
  octeontx2-af: fix PF/CGX debugfs PCI bus lookup
  net: net_failover: Fix the deadlock in net_failover_slave_name_change()
  net: phy: mediatek-ge: disable EEE on the MT7530 PHY
  tcp: reject non zerocopy devmem tx
  net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support
  net: dsa: mt7530: populate lpi_interfaces to fix EEE support
  net: hinic: fix mailbox segment buffer overflow
  net: sun4i-emac: fix missing of_node_put() for phy_node
  ...
 2026-09-10 14:07:48 -07:00
Ethan Nelson-Moore
a19d4f9b8b ata: pata_legacy: remove documentation for removed module parameters 
Commit 3c4d783f69 ("ata: pata_legacy: remove VLB support") removed
several module parameters from the pata_legacy driver, but neglected to
remove their documentation. Remove it.

Fixes: 3c4d783f69 ("ata: pata_legacy: remove VLB support")
Cc: stable@vger.kernel.org # 7.0+
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20260607064053.195166-1-enelsonmoore@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
 2026-09-10 19:25:48 +02:00
Jia Wang
f77de4c33f
 		spi: dt-bindings: snps,dw-apb-ssi: Add compatible for UltraRISC DP1000 SoC 
Add the SoC-specific compatible string and use the generic one as fallback
for the UltraRISC DP1000 SPI controller.

The DP1000 integrates two SPI controllers. SPI0 supports standard, dual
and quad transfers with three native chip-select signals. SPI1 supports
standard transfers with four native chip-select signals.

Both controllers have one register range and separate reference and APB
interface clocks.

Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260907-ultrarisc-dts-v2-5-5eb4c97477c5@ultrarisc.com
Signed-off-by: Mark Brown <broonie@kernel.org>
 2026-09-08 16:23:17 +01:00
Antonin Godard
013c5a93e8 Documentation: hwmon: replace full-width colon by a standard ASCII colon 
It prevented the pdfdocs target to complete, prompting the following
error:

  Latexmk: ====Problematic refs and citations with line #s in .tex file:
  Missing character: There is no ： (U+FF1A) in font DejaVu Serif/OT:script=latn;l

Fixes: 69001f21de ("hwmon: document: add gpd-fan")
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Link: https://patch.msgid.link/20260818-doc-hwmon-remove-confusable-v2-1-c1dff1ec01cd@bootlin.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 2026-09-07 07:22:19 -07:00
Guenter Roeck
b4fffa75c1 Documentation/hwmon: Document hwmon_notify_event() 
The hwmon core provides hwmon_notify_event() for drivers to report events
such as alarm or fault conditions to userspace via sysfs notifications
and uevents, as well as to the thermal subsystem for temperature sensors.
However, this function is not documented in the hwmon kernel API guide.

Add the function prototype and description of hwmon_notify_event() to
Documentation/hwmon/hwmon-kernel-api.rst.

Cc: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Fixes: 1597b374af ("hwmon: Add notification support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 2026-09-07 07:22:19 -07:00
Karl Mehltretter
353a95f1cd syscall_user_dispatch: Use CONFIG_SYSCTL for sysctl guard 
Commit 8d75c338f0 ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors
CONFIG_SYSCTL") removed CONFIG_PROC_SYSCTL, but the sysctl added by
commit 5b6e32ba7b ("syscall_user_dispatch: Add
kernel.syscall_user_dispatch sysctl") is still guarded by it. Now that
both commits are merged, kernel.syscall_user_dispatch is no longer
registered.

syscall_user_dispatch_allowed defaults to true. SUD therefore remains
available, but administrators cannot disable new activations.

Use CONFIG_SYSCTL for the guard and documentation.

Fixes: 5b6e32ba7b ("syscall_user_dispatch: Add kernel.syscall_user_dispatch sysctl")
Assisted-by: Codex:gpt-5.6-sol
Acked-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Joel Granados <joel.granados@kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Bradley Morgan <include@grrlz.net>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
 2026-09-07 14:00:56 +02:00
Linus Torvalds
b485131995 Miscellaneous IRQ subsystem fixes: 
- Revert a commit to the mbigen irqchip driver that caused
    a regression on two-port Hi1616 chips (Caina)
 
  - Fix a too-long-preemption-off bug in the stm32mp-exti
    irqchip driver, caused by a time unit ambiguity & mismatch (Ju Nan)
 
  - Remove the now completely unused irq_domain_add_linear()
    inline function (Jiri Slaby)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdRScRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hPZhAAtKTux+xrKNQ2AsJsVoQFpf/B3EHodf9C
 7SPLROhmYYTpOTAdjB0ZP6jxssCmu+Q5NtZzXxX9QU5D3l9aIG6RYQsKd0hQ2tPm
 2Gb5dwFw4Ozfh1OrJKbFTC/nFsmAZETzF8bm9gfsfWoYIcblNNJ6Fp8yya0q04/g
 qupnXpY9XLZtgFVG4tgJSH5ICxCa/1vTYukU5vdDMkHRyN9ENVWTbTTUqFHiBbeO
 1V2oT3q2sM3tLGHifg1RWQ9uC3Vo3M+kS/bAZFlWcu0ZuIcW0WjU4pxjQjfviB8w
 zFLY+erKIUIDt6JQ8E9Iapa+EMMIR4CKqfjMoYWoYTrzXX1X6XRtnGpTDZ8t3wl9
 HrvR4eO/IqiUgR54lpE/J9eysBqo3+UbN6qVAo0jCo+D+z13AOTp5Rdz5CPD2zKr
 7KUURB5SvkaTMz4zoOGNI3NTARKoEac6eAZgUXfWR/+94W1f2fM+lLyC7cUiDTyA
 A/eoy1Kcj5sTiTgVtR+pDKi9enSD6etJkvEeJvThZ3yjcUVPjUGDh5IFahq8dR57
 J018f1q8yBZ6rAr4q0oOMkWscYIK2WBeXbdUc7+IPreFPoooRzHeNSa7abLaKiX5
 MBidcgHBL7XE1HEpTz/1rL6F226IqEfAtWuMuMWyuHQ5uYTCzoJ2sELjH/++XOdV
 k1qP+93K1dI=
 =54qE
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull IRQ subsystem fixes from Ingo Molnar:

 - Revert a commit to the mbigen irqchip driver that caused
   a regression on two-port Hi1616 chips (Caina)

 - Fix a too-long-preemption-off bug in the stm32mp-exti
   irqchip driver, caused by a time unit ambiguity & mismatch
   (Ju Nan)

 - Remove the now completely unused irq_domain_add_linear()
   inline function (Jiri Slaby)

* tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
  Revert "irqchip/mbigen: Fix mbigen node address layout"
  irqdomain: Delete irq_domain_add_linear()
 2026-09-06 10:35:24 -07:00
Linus Torvalds
9f0346dcbe Driver core fixes for 7.3-rc2 
- Fix kernfs listxattr() not returning security xattr names (e.g.
   SELinux labels) when the kernfs node has no allocated kernfs_iattrs
 
 - Fix silent truncation of IRQ vector indices in the Rust PCI
   abstractions
 
 - Don't select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is
   disabled instead of silently enabling extra kernel functionality
 
 - Russ Weight is retiring from kernel development; update the Firmware
   Loader sysfs contact to the driver-core mailing list, add a CREDITS
   entry for Firmware Upload, and update MAINTAINERS accordingly
 -----BEGIN PGP SIGNATURE-----
 
 iHQEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCapxQTQAKCRBFlHeO1qrK
 Lr1NAQD09hhWzsAkRvdDgf/rd3iUW4Fxro/KOIf+OThNRgWpRQD4+hMNQqxzk3OB
 QT3xFMqLPFtLf+voWTcWniC6UsLfCA==
 =k/Gx
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Fix kernfs listxattr() not returning security xattr names (e.g.
   SELinux labels) when the kernfs node has no allocated kernfs_iattrs

 - Fix silent truncation of IRQ vector indices in the Rust PCI
   abstractions

 - Don't select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is
   disabled instead of silently enabling extra kernel functionality

 - Russ Weight is retiring from kernel development; update the Firmware
   Loader sysfs contact to the driver-core mailing list, add a CREDITS
   entry for Firmware Upload, and update MAINTAINERS accordingly

* tag 'driver-core-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  MAINTAINERS: Remove Russ Weight from Firmware Loader
  CREDITS: Add CREDITS entry for Firmware Upload
  firmware_loader: Change contact for sysfs nodes
  rust: pci: reject IRQ vector indices that do not fit in u32
  kernfs: preserve security xattrs without allocating iattrs
  drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF
 2026-09-05 11:59:05 -07:00
Linus Torvalds
d0fc310b4d block-7.3-20260905 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqb+cYQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpjBkEACTFzHAVopJbtKT6+Rg9esQNPUDfeJkJy/L
 3v8Vi4R7tozAB0IKc58RxV2YFMvga5teWJkAnd33983/MbwCzj9B0oRjSmnHf8K5
 pq4gu1f5pdyfRXGGAnI6ZMom1MNsfuWWiZmD8vQuQ+q4qNVSnQBg0UjrDggDlcW6
 o6EtyjgqAwaaGs+sWgxgy0sYWV7TMiCx4+AZR0TDm8cN3LXyOkOp2abgR35/tnDB
 fs3kUPTkBC4rCZK2uVUhgF6Wctcd2qIF6AEP+bBbWifSCI/jmqAYHk/0IM1xpn8e
 XXPO43X5Iad5iiMWMHlku9G7ZjTo/K2bLc1n9F4IlNZgVPAcF9qtYok5Uc3ghldg
 /qOsclI8D2feQ5j6u060FdnN99+TSHcS3h4roa8jIPNojmh5orw2xRiDCvSVG3au
 +UfEUWnf0JjsmJfX9HCQyV6oTB/7IeiSI+4akHXobCnsG4n9BL8kZ1HR8qwPWsYj
 HPeLHraPljX2slDj+X9EFA8AyxgU33HC9JbjvLlN4L2amX+7Jtwb3A7MlKrGEuUP
 gzybtHk5g17/mcYVj9N2k4tHECR1aZChTQcfNdCctMVB3vXk3KKkFsZstJapCVmT
 fSKx7pdrrNwo3WoKzn8xp/+2gcrRRo4AhSCg9oVfloc5nSFkyfPpq0vPspsUj3ib
 4ze4Sy2TiQ==
 =4ZE+
 -----END PGP SIGNATURE-----

Merge tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - NVMe fixes via Keith:
     - nvme-tcp fixes for an out-of-bounds write on an over-long PDU
     - nvmet-tcp, nvmet-rdma and nvme-rdma leak and cleanup-ordering
       fixes
     - FDP placement id array racy access fix
     - nvme-fc double free of fabrics options on nvme_add_ctrl()
       failure, and a secret leak failure
     - Fault injection opcode filtering
     - stale namespace removal during scan
     - Various other smaller fixes and cleanups

 - Flag zoned disks with GENHD_FL_NO_PART

 - Save the page offset gaps in a cloned bio

 - Fix dma_alignment for large or unreported limits in loop and zloop

 - Clear VM_MAYWRITE on a read-only ublk char device mmap

* tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (25 commits)
  nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
  nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
  nvmet: reject namespace enable without device path
  nvmet-auth: Synchronize timeout work during SQ teardown
  MAINTAINERS: update nvme entry
  nvmet-tcp: reject unsolicited H2CData PDUs
  nvme-tcp: defer TLS inline send to io_work
  nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
  nvme-tcp: return -EPROTO for a C2HData on a write
  nvmet: print namespace IDs as unsigned 32bit value
  nvme: print namespace IDs as unsigned 32bit value
  nvme: remove stale namespaces by NSID range during scan
  nvme: add missing SRCU grace period in error path
  nvme-fabrics: fix DHCHAP secret leak on parse failure
  ublk: clear VM_MAYWRITE on read-only ublk char device mmap
  loop, zloop: fix dma_alignment for large or unreported limits
  block: save page offset gaps in cloned bio
  block: flag zoned disks with GENHD_FL_NO_PART
  nvmet-rdma: fix queue leak when connect backlog is exceeded
  nvme: add opcode filtering for fault injection
  ...
 2026-09-05 08:58:55 -07:00
Linus Torvalds
4d7d9486c0 integrity-v7.3-rc2 
-----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQQdXVVFGN5XqKr1Hj7LwZzRsCrn5QUCapsP/BQcem9oYXJAbGlu
 dXguaWJtLmNvbQAKCRDLwZzRsCrn5b2gAQC3ms2HRoZolscMWqnUNoi5SmPpwcV2
 v/ojwDc1TnS9HAEA/604QYihEvRQzKQwEyF6W6b83w22tyWKhDW1a0d7KQ4=
 =/Hd6
 -----END PGP SIGNATURE-----

Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull IMA fixes from Mimi Zohar:

 - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks
   resulted in configfs locking issues.

   configfs files should not be measured, appraised, or audited in the
   first place, so the builtin policies are updated to exclude them.

 - IMA audit messages include the filename, which could result in a page
   fault when the filename doesn't exist

 - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt

* tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX
  ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
  ima: don't measure/appraise files on configfs
  configfs: move CONFIGFS_MAGIC definition to magic.h
 2026-09-04 19:36:11 -07:00
Jamal Hadi Salim
1aa9e143bf net: reject oversized tx_queue_len at netlink parse time 
rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len
without going through netif_change_tx_queue_len(), so a device created
with "ip link add ... txqueuelen 500000" bypasses the S16_MAX cap and
still triggers the oversized ring allocations in pfifo_fast, tun and
tap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the
RTM_NEWLINK-on-existing-device path reach the same sinks.

Enforce the cap in ifla_policy instead: IFLA_TXQLEN becomes
NLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with
txqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers
parse against this policy - rtnl_setlink(), rtnl_newlink() (create
and change), and the veth peer nest - so every netlink path is capped
at parse time and rejects the attribute with -ERANGE plus a proper
"integer out of range" extack message before any device state is
modified (the RTM_SETLINK half-application wart is gone with it).

Document the bound in the rt-link.yaml netlink spec.

Conditions to recreate the bug:
- CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.
- Unprivileged user in a fresh user+net namespace (unshare -Urn):
  ip link add v0 txqueuelen 500000 type veth peer name v1
  -> on the fixed kernel this is rejected with -ERANGE ("integer out
  of range" extack) instead of installing an oversized tx_queue_len
  that later inflates pfifo_fast/tun/tap ring allocations.
- ip link set v0 txqueuelen 500000 is likewise rejected at parse time.

Fixes: 38f7b870d4 ("[RTNETLINK]: Link creation API")
Reported-by: Vega <vega@nebusec.ai>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/QDISC-2899.v2.20260901233641@mojatatu.com.2
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-09-04 16:30:49 -07:00
Jiri Slaby (SUSE)
797b13a7de irqdomain: Delete irq_domain_add_linear() 
7.3-rc1 is free of calls to irq_domain_add_linear(), so it can be finally
deleted.

According to Dongliang Mu, the related paragraph in the Chinese docs is now
obsolete. So drop it completely.

Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Reviewed-by: Yanteng Si <si.yanteng@linux.dev>
Link: https://patch.msgid.link/20260901070450.255507-1-jirislaby@kernel.org
 2026-09-04 08:40:07 +02:00
Jens Axboe
00ef2248c5 nvme fixes for Linux 7.3 
- Harden the tcp host and target against malformed PDUs: reject C2HData
    for a non-read command, bound an over-long PDU before copying it, and
    reject unsolicited H2CData (Yehyeong, Shivam)
  - Fix circular locking on TLS queues (Xixin)
  - Fix a soft lockup when scanning sparse namespace ID space (Mohamed)
  - Fix racy access to the FDP placement id array (Kanchan)
  - RDMA host and target fixes for a double cleanup on the queue_rq
    error path and a queue leak when the connect backlog is exceeded
    (Xixin)
  - Authentication fixes: drain the target's expiry work before the SQ
    is freed, and release the DH-CHAP secret when parsing fails (Kazuki,
    Xu Rao)
  - Fix nvme-fc options double free when nvme_add_ctrl() fails (Niklas)
  - Add missing SRCU grace period to nvme_alloc_ns() error path (Tristan)
  - Skip zoned limits update when the zone info query failed (Chao)
  - Reject enabling a target namespace with no device path (Seokgyu)
  - Add opcode filtering for fault injection (Mohamed)
  - Drop the kernel-doc comments from nvme-tcp.h (Randy)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE3Fbyvv+648XNRdHTPe3zGtjzRgkFAmqZ46MACgkQPe3zGtjz
 RglHuRAAhB+37HZ4wsYuwIud6IwF4rrXMv/EU1C87Nt6ORXiTG892ECT+4G4ruZo
 GTxFl6UB+i8GRw+RivMpZAWoLtEclU1GZ/ijPpgQ4+QKva60q29/2oQQiqT+x5us
 Nhez9uuC1hywxY+HfVDfvx44ISXwPG/8ZTrGMfuEO8kbmiczY8X5LxnSicgWLTc8
 PTdXvSDw5mtinzCPozRDVuFRTcDwUhM3NzVIv7MVXgEyY1sCwcPbmj8GdCkFco1G
 WnIpWP3WplnO7yNcwMN+sSFvq8PjBFfW+LJ/25WRLQFvTpF5zwejPXNWPt90USU4
 hA9kXua1CRHuApKUeNSLMQ3PG2pbB+NjIN31ZpBnveXplmIudoQuT+wLwltBg3te
 9doRCqCGLMCNu+qPFquUOOr9+6+36pBlFTynNy5WGqen0YwY4/UEG4PEU649J3Ve
 N10KY+ttHgi3bY6JdcCVlDhdzGW/rSobNz1GL4IpqPcYdZsvMqSyLrQpZfdKfp5m
 4KWYyiVmydq6ixHpZF1yEM9y2+RZGi9AtOi6CCY5pNDt7lS257htsNSTX9T3pWcH
 IeknLIuseNEW1IgUa7RPUrEkQJsiQx7eb6wI13otJULA60T40rISshuC8yGZblni
 4zu5PQiaecjqXSWQfenEi6tvPuu9jV7YsuvK5x5qs21DnFy7pUo=
 =YJ4v
 -----END PGP SIGNATURE-----

Merge tag 'nvme-7.3-2026-09-03' of git://git.infradead.org/nvme into block-7.3

Pull NVMe fixes from Keith:

"- Harden the tcp host and target against malformed PDUs: reject C2HData
   for a non-read command, bound an over-long PDU before copying it, and
   reject unsolicited H2CData (Yehyeong, Shivam)
 - Fix circular locking on TLS queues (Xixin)
 - Fix a soft lockup when scanning sparse namespace ID space (Mohamed)
 - Fix racy access to the FDP placement id array (Kanchan)
 - RDMA host and target fixes for a double cleanup on the queue_rq
   error path and a queue leak when the connect backlog is exceeded
   (Xixin)
 - Authentication fixes: drain the target's expiry work before the SQ
   is freed, and release the DH-CHAP secret when parsing fails (Kazuki,
   Xu Rao)
 - Fix nvme-fc options double free when nvme_add_ctrl() fails (Niklas)
 - Add missing SRCU grace period to nvme_alloc_ns() error path (Tristan)
 - Skip zoned limits update when the zone info query failed (Chao)
 - Reject enabling a target namespace with no device path (Seokgyu)
 - Add opcode filtering for fault injection (Mohamed)
 - Drop the kernel-doc comments from nvme-tcp.h (Randy)"

* tag 'nvme-7.3-2026-09-03' of git://git.infradead.org/nvme: (21 commits)
  nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
  nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
  nvmet: reject namespace enable without device path
  nvmet-auth: Synchronize timeout work during SQ teardown
  MAINTAINERS: update nvme entry
  nvmet-tcp: reject unsolicited H2CData PDUs
  nvme-tcp: defer TLS inline send to io_work
  nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
  nvme-tcp: return -EPROTO for a C2HData on a write
  nvmet: print namespace IDs as unsigned 32bit value
  nvme: print namespace IDs as unsigned 32bit value
  nvme: remove stale namespaces by NSID range during scan
  nvme: add missing SRCU grace period in error path
  nvme-fabrics: fix DHCHAP secret leak on parse failure
  nvmet-rdma: fix queue leak when connect backlog is exceeded
  nvme: add opcode filtering for fault injection
  nvme: fix racy access to FDP placement id array
  nvme: set ns->head in nvme_alloc_ns_head
  nvme-rdma: fix -EIO cleanup order in queue_rq
  nvme: skip the zoned limits update if the zone info query failed
  ...
 2026-09-03 19:48:07 -06:00
Linus Torvalds
bc35965f69 18 hotfixes. 13 are cc:stable. 15 are for MM. 
All are singletons - please see the changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCapoUuQAKCRDdBJ7gKXxA
 jgscAP9iRyonROgpsNKC9H8EsAL7QhZNxjwc5PWs0bN6J50LOwD/Um6G7b1P8cxs
 j7kGpxbQYI0RWxxLUBLTQiPbDrvn6wY=
 =TJzY
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2026-09-03-17-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "18 hotfixes.  13 are cc:stable.  15 are for MM.

  All are singletons - please see the changelogs for details.

  There are no fixes (yet) for all the stuff we added in the most recent
  merge window. Hopefully a good sign"

* tag 'mm-hotfixes-stable-2026-09-03-17-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/secretmem: properly account locked pages
  mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
  MAINTAINERS: add Kiryl as a THP reviewer
  MAINTAINERS: cover all of RAID
  MAINTAINERS: mailmap: update entries for Thorsten Blum
  MAINTAINERS: remove Lorenzo as THP co-maintainer
  Revert "once: don't use a work queue to reset sleepable static key"
  mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
  mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
  mm/huge_memory: transfer the pmd dirty bit to the folio on zap
  MAINTAINERS: add Lance Yang as a hung task detector co-maintainer
  userfaultfd: reset err to be 0 when move_pages_ptes succeeded
  mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
  mm/hugetlb: keep max_huge_pages when dissolving surplus folios
  mm/migrate_device: avoid out-of-bounds writes for compound folios
  mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
  memcg: make the v1 soft limit knob inert
  mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
 2026-09-03 17:59:19 -07:00
Linus Torvalds
adf50c47a4 Including fixes from bluetooth. 
Previous releases - regressions:
 
   - page_pool: keep frag_offset aligned for odd-sized requests
 
   - sched: fix u32 duplicate handle when node ID pool is exhausted
 
   - udp: create exceptions before socket matching
 
   - igmp: convert struct ip_sf_list to RCU
 
   - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
 
   - rds: acquire the fastpath locks in rds_conn_shutdown()
 
   - tipc:
     - protect node reset trace dump with node lock
     - fix NULL deref in tipc_named_node_up() on empty publication list
 
   - bluetooth:
       L2CAP: fix out-of-bounds write in l2cap_ecred_connect
       hci_core: fix race condition during device registration
 
   - eth: mlx5e: prevent stale XSK buffer release on refill retries
 
   - eth: bridge: don't truncate the port group walk on teardown
 
 Previous releases - always broken:
 
   - gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()
 
   - sched: fix skb sizing and action leak on reoffload delete
 
   - tcp: fix use-after-free in do_tcp_getsockopt()
 
   - af_packet: don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
 
   - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
 
   - iptunnel: fix stale transport header during tunnel decapsulation
 
   - eth: vxlan: fix use-after-free in vxlan_mdb_remote_src_del()
 
   - eth: bonding: fix uninitialized transport header access in alb_determine_nd()
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmqZp4kSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkEjkQALMGg903vZ4TfGlzKayFzyhcd5ZC8G4F
 R4M+UgTGRfNuas/1YwjpyOpvOYyFgGZ9xBmYNFdsW0YCzZwu8PxpXgu6WTZ+F4gu
 sDtWoAbN5V6CfY3fdC7IbXTp8t4CX+shQAsVvEp39Y8SJF4AZeMn8N0+Lnu4DlD3
 DAPo/lYSSfvv7RK/5Jvr9FWo7vyoEylfG+LekzGASmWGwhC3h7kWGB4RB4PhJmyq
 vRIj2ZjnzdDxu4N7ZGh+EEu5SBCcLP0e/dIMCDg++HAghDqPJ+7pzbWC1kFtQ0ss
 qOSyws/xMW3D0Rb68tkiikYWRwgvXUsfEL7Jdf2lhC1xDI8ZpxrrnPYYSZS4rsjb
 hjeBwtzRZhv5R0PnNlaZyNpFICIW3XwqP0bYqH/Z/CgwwkKYd+Rp6Tm7hkLpafNx
 Py607x2Ff/L2Aydp8csJEyqFP33QOHAfeW+X/YCo4jTc0zBTMSsOblG/EsPPBdNX
 fvhVkx4NdqAvIdLYm65cdvhe5dZtIhOAhwAMcrGiMIia4vCIsXq3fWbAe6Phtu8T
 KHpQ7Esg/if6blNPpflBuVPsoU+5N6mL7a+zsurqvilJBC5DgYaxwbMlgRSUmJzg
 2rR6IlrOsb0FFITNUv+xgPEGzMGV1rL4wnaMSmVN0tjmFQvcu24XQ17D+ug27+eG
 rD+E2lrX5rNn
 =0sv8
 -----END PGP SIGNATURE-----

Merge tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from bluetooth.

  Previous releases - regressions:

    - page_pool: keep frag_offset aligned for odd-sized requests

    - sched: fix u32 duplicate handle when node ID pool is exhausted

    - udp: create exceptions before socket matching

    - igmp: convert struct ip_sf_list to RCU

    - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit

    - rds: acquire the fastpath locks in rds_conn_shutdown()

    - tipc:
        - protect node reset trace dump with node lock
        - fix NULL deref in tipc_named_node_up() on empty publication
          list

    - bluetooth:
        - L2CAP: fix out-of-bounds write in l2cap_ecred_connect
        - hci_core: fix race condition during device registration

    - eth:
        - mlx5e: prevent stale XSK buffer release on refill retries
        - bridge: don't truncate the port group walk on teardown

  Previous releases - always broken:

    - gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()

    - sched: fix skb sizing and action leak on reoffload delete

    - tcp: fix use-after-free in do_tcp_getsockopt()

    - af_packet: don't cast tpacket_hdr.tp_len to int in
      tpacket_parse_header()

    - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

    - iptunnel: fix stale transport header during tunnel decapsulation

    - eth:
        - vxlan: fix use-after-free in vxlan_mdb_remote_src_del()
        - bonding: fix uninitialized transport header access in
          alb_determine_nd()"

* tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)
  net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
  net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
  net: airoha: enable RX_DONE interrupt for RX queue 31
  net/rds: don't let rds_conn_shutdown() consume a concurrent drop
  net/rds: acquire the fastpath locks in rds_conn_shutdown()
  net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
  net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
  net/rds: clear cp_flags bits individually in rds_conn_path_reset()
  net/rds: use clear_bit_unlock() in release_refill()
  net/rds: use wq_has_sleeper() in release_in_xmit()
  net: usb: qmi_wwan: add Compal EXM-G1x support
  net: macb: exclude software FCS from TX byte statistics
  net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
  net: bridge: mcast: don't truncate the port group walk on teardown
  bonding: do not clear curr_active_slave prematurely when releasing all slaves
  net: qrtr: Send HELLO message on endpoint register
  octeontx2-af: Fix limiting SRIOV VF count logic
  bonding: alb: fix uninitialized transport header access in alb_determine_nd()
  s390/ctcm: Prevent XID null dereference
  net: psp: do not inherit the Rx association on clone
  ...
 2026-09-03 10:18:12 -07:00
Shakeel Butt
a3417097fb memcg: make the v1 soft limit knob inert 
The v1 soft limit has been deprecated since v6.12 and nobody has reported
depending on it.  Start the removal by decoupling the interface from the
implementation: keep memory.soft_limit_in_bytes, but ignore writes to it
and always report the maximum value on read similar to what
memory.kmem.limit_in_bytes already does.

Writes are still parsed, so malformed input keeps returning -EINVAL.  The
knob now also behaves the same everywhere: it used to return -EOPNOTSUPP
on PREEMPT_RT, where soft limit reclaim has always been disabled.

This also fixes the syzbot report linked below.  Soft limit reclaim is the
only caller that runs shrink_lruvec() from kswapd against a specific
memcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn
set_mm_walk(), which warns when called from kswapd.

Link: https://lore.kernel.org/20260811203203.3456029-2-shakeel.butt@linux.dev
Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
Reported-by: syzbot+12ee2725d5fde63a9c96@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a7a6929.b50370da.49fe0.005e.GAE@google.com/
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-09-01 20:26:20 -07:00