7.0.10-rc1 review

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ming Lei <[email protected]>

[ Upstream commit 3dbaacf6ab68f81e3375fe769a2ecdbd3ce386fd ]

When a queue is shared across disk rebind (e.g., SCSI unbind/bind), the previous disk's blkcg state is cleaned up asynchronously via disk_release() -> blkcg_exit_disk(). If the new disk's blkcg_init_disk() runs before that cleanup finishes, we may overwrite q->root_blkg while the old one is still alive, and radix_tree_insert() in blkg_create() fails with -EEXIST because the old blkg entries still occupy the same queue id slot in blkcg->blkg_tree. This causes the sd probe to fail with -ENOMEM.

Fix it by waiting in blkcg_init_disk() for root_blkg to become NULL, which indicates the previous disk's blkcg cleanup has completed.

---
 block/blk-cgroup.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

index b70096497d389..2d7b18eb72915 100644
@@ -24,6 +24,7 @@
 #include <linux/backing-dev.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
+#include <linux/wait_bit.h>
 #include <linux/atomic.h>
 #include <linux/ctype.h>
 #include <linux/resume_user_mode.h>

@@ -611,6 +612,8 @@ static void blkg_destroy_all(struct gendisk *disk)
 
 	q->root_blkg = NULL;
 	spin_unlock_irq(&q->queue_lock);
+
+	wake_up_var(&q->root_blkg);
 }
 
 static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)

@@ -1498,6 +1501,18 @@ int blkcg_init_disk(struct gendisk *disk)
 	struct blkcg_gq *new_blkg, *blkg;
 	bool preloaded;
 
+	/*
+	 * If the queue is shared across disk rebind (e.g., SCSI), the
+	 * previous disk's blkcg state is cleaned up asynchronously via
+	 * disk_release() -> blkcg_exit_disk(). Wait for that cleanup to
+	 * finish (indicated by root_blkg becoming NULL) before setting up
+	 * new blkcg state. Otherwise, we may overwrite q->root_blkg while
+	 * the old one is still alive, and radix_tree_insert() in
+	 * blkg_create() will fail with -EEXIST because the old entries
+	 * still occupy the same queue id slot in blkcg->blkg_tree.
+	 */
+	wait_var_event(&q->root_blkg, !READ_ONCE(q->root_blkg));
+
 	new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);
 	if (!new_blkg)
 		return -ENOMEM;

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deepanshu Kartikey <[email protected]>

[ Upstream commit be3e5d10643d3be1cbac9d9939f220a99253f980 ]

nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks by comparing it with the current block number bd_blocknr. If they differ, the block is considered dead and skipped.

However, bd_oblocknr should never be 0 since block 0 typically stores the primary superblock and is never a valid GC target block. A corrupted ioctl request with bd_oblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering the WARN_ON(ret == -ENOENT).

Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the beginning of each iteration.

[ryusuke: slightly modified the commit message and comments for accuracy]

---
 fs/nilfs2/ioctl.c | 6 ++++++
 1 file changed, 6 insertions(+)

index e17b8da664913..e0a606643e879 100644
@@ -736,6 +736,12 @@ static int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
 	int ret, i;
 
 	for (i = 0; i < nmembs; i++) {
+		/*
+		 * bd_oblocknr must never be 0 as block 0
+		 * is never a valid GC target block
+		 */
+		if (unlikely(!bdescs[i].bd_oblocknr))
+			return -EINVAL;
 		/* XXX: use macro or inline func to check liveness */
 		ret = nilfs_bmap_lookup_at_level(bmap,
 						 bdescs[i].bd_offset,

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jackie Liu <[email protected]>

[ Upstream commit 23308af722fefed00af5f238024c11710938fba3 ]

Add the missing put_disk() on the error path in blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label which only calls rcu_read_unlock() but does not release the disk reference acquired by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk is already set to NULL before the lookup, blkcg_exit() cannot release this reference either, causing the disk to never be freed.

Restore the reference release that was present as blk_put_queue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk.

---
 block/blk-cgroup.c | 1 +
 1 file changed, 1 insertion(+)

index 2d7b18eb72915..554c87bb4a865 100644
@@ -2037,6 +2037,7 @@ void blkcg_maybe_throttle_current(void)
 	return;
 out:
 	rcu_read_unlock();
+	put_disk(disk);
 }
 
 /**

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cole Leavitt <[email protected]>

[ Upstream commit 2ddb69f686ef7a621645e97fc7329c50edf5d0e5 ]

In persistent_ram_iomap(), ioremap() or ioremap_wc() may return NULL on failure. Currently, if this happens, the function returns NULL without releasing the memory region acquired by request_mem_region().

This leads to a resource leak where the memory region remains reserved but unusable.

Additionally, the caller persistent_ram_buffer_map() handles NULL correctly by returning -ENOMEM, but without this check, a NULL return combined with request_mem_region() succeeding leaves resources in an inconsistent state.

This is the ioremap() counterpart to commit 05363abc7625 ("pstore:
ram_core: fix incorrect success return when vmap() fails") which fixed a similar issue in the vmap() path.

---
 fs/pstore/ram_core.c | 4 ++++
 1 file changed, 4 insertions(+)

index ed97494abf60f..0713ef986c204 100644
@@ -488,6 +488,10 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
 	else
 		va = ioremap_wc(start, size);
 
+	/* We must release the mem region if ioremap fails. */
+	if (!va)
+		release_mem_region(start, size);
+
 	/*
 	 * Since request_mem_region() and ioremap() are byte-granularity
 	 * there is no need handle anything special like we do when the

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

[ Upstream commit 307210c262a29f41d7177851295ea1703bd04175 ]

For file-backed mounts, metadata is fetched via the page cache of backing inodes to avoid double caching and redundant copy ops out of RO uptodate folios, which is used by Android APEXes, ComposeFS, containerd. However, rw_verify_area() was missing prior to metadata accesses.

Similar to vfs_iocb_iter_read(), fix this by:
- Enabling fanotify pre-content hooks on metadata accesses;
- security_file_permission() for security modules.

Verified that fanotify pre-content hooks now works correctly.

---
 fs/erofs/data.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

index f79ee80627d95..132a27deb2f3b 100644
@@ -30,6 +30,20 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
 {
 	pgoff_t index = (buf->off + offset) >> PAGE_SHIFT;
 	struct folio *folio = NULL;
+	loff_t fpos;
+	int err;
+
+	/*
+	 * Metadata access for file-backed mounts reuses page cache of backing
+	 * fs inodes (only folio data will be needed) to prevent double caching.
+	 * However, the data access range must be verified here in advance.
+	 */
+	if (buf->file) {
+		fpos = index << PAGE_SHIFT;
+		err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
+		if (err < 0)
+			return ERR_PTR(err);
+	}
 
 	if (buf->page) {
 		folio = page_folio(buf->page);

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhan Xusheng <[email protected]>

[ Upstream commit d6250d49da4d8f11afc0d8991c84e0307949f92e ]

erofs_ioctl_get_volume_label() passes strlen(sbi->volume_name) as the length to copy_to_user(), which copies the label string without the trailing NUL byte. Since FS_IOC_GETFSLABEL callers expect a NUL-terminated string in the FSLABEL_MAX-sized buffer and may not pre-zero the buffer, this can cause userspace to read past the label into uninitialised stack memory.

Fix this by using strlen() + 1 to include the NUL terminator, consistent with how ext4 and xfs implement FS_IOC_GETFSLABEL.

---
 fs/erofs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 4b3d21402e101..a188c570087ae 100644
@@ -351,7 +351,7 @@ static int erofs_ioctl_get_volume_label(struct inode *inode, void __user *arg)
 		ret = clear_user(arg, 1);
 	else
 		ret = copy_to_user(arg, sbi->volume_name,
-				   strlen(sbi->volume_name));
+				   strlen(sbi->volume_name) + 1);
 	return ret ? -EFAULT : 0;
 }
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email protected]>

[ Upstream commit 2aa72276fab9851dbd59c2daeb4b590c5a113908 ]

When "clear" is written to array_state, md_attr_store() breaks sysfs active protection so the array can delete itself from its own sysfs store method.

However, md_attr_store() currently drops the mddev reference before calling sysfs_unbreak_active_protection(). Once do_md_stop(..., 0) has made the mddev eligible for delayed deletion, the temporary kobject reference taken by sysfs_break_active_protection() can become the last kobject reference protecting the md kobject.

That allows sysfs_unbreak_active_protection() to drop the last kobject reference from the current sysfs writer context. kobject teardown then recurses into kernfs removal while the current sysfs node is still being unwound, and lockdep reports recursive locking on kn->active with kernfs_drain() in the call chain.

Reproducer on an existing level:
1. Create an md0 linear array and activate it:
mknod /dev/md0 b 9 0
echo none > /sys/block/md0/md/metadata_version
echo linear > /sys/block/md0/md/level
echo 1 > /sys/block/md0/md/raid_disks
echo "$(cat /sys/class/block/sdb/dev)" > /sys/block/md0/md/new_dev

   echo "$(($(cat /sys/class/block/sdb/size) / 2))" > \
	/sys/block/md0/md/dev-sdb/size

echo 0 > /sys/block/md0/md/dev-sdb/slot echo active > /sys/block/md0/md/array_state
2. Wait briefly for the array to settle, then clear it:
sleep 2
echo clear > /sys/block/md0/md/array_state

The warning looks like:

WARNING: possible recursive locking detected bash/588 is trying to acquire lock:
(kn->active#65) at __kernfs_remove+0x157/0x1d0
but task is already holding lock:
(kn->active#65) at sysfs_unbreak_active_protection+0x1f/0x40
...

  Call Trace:
   kernfs_drain
   __kernfs_remove
   kernfs_remove_by_name_ns
   sysfs_remove_group
   sysfs_remove_groups
   __kobject_del
   kobject_put
   md_attr_store
   kernfs_fop_write_iter
   vfs_write
   ksys_write

Restore active protection before mddev_put() so the extra sysfs kobject reference is dropped while the mddev is still held alive. The actual md kobject deletion is then deferred until after the sysfs write path has fully returned.

---
 drivers/md/md.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

index c2cc2302d727d..ecb9bd0e1b8f7 100644
@@ -6130,10 +6130,16 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
 	}
 	spin_unlock(&all_mddevs_lock);
 	rv = entry->store(mddev, page, length);
-	mddev_put(mddev);
 
+	/*
+	 * For "array_state=clear", dropping the extra kobject reference from
+	 * sysfs_break_active_protection() can trigger md kobject deletion.
+	 * Restore active protection before mddev_put() so deletion happens
+	 * after the sysfs write path fully unwinds.
+	 */
 	if (kn)
 		sysfs_unbreak_active_protection(kn);
+	mddev_put(mddev);
 
 	return rv;
 }

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Uday Shankar <[email protected]>

[ Upstream commit 0842186d2c4e67d2f8c8c2d1d779e8acffd41b5b ]

If a ublk server starts recovering devices but dies before issuing fetch commands for all IOs, cancellation of the fetch commands that were successfully issued may never complete. This is because the per-IO canceled flag can remain set even after the fetch for that IO has been submitted - the per-IO canceled flags for all IOs in a queue are reset together only once all IOs for that queue have been fetched. So if a nonempty proper subset of the IOs for a queue are fetched when the ublk server dies, the IOs in that subset will never successfully be canceled, as their canceled flags remain set, and this prevents ublk_cancel_cmd from actually calling io_uring_cmd_done on the commands, despite the fact that they are outstanding.

Fix this by resetting the per-IO cancel flags immediately when each IO is fetched instead of waiting for all IOs for the queue (which may never happen).

---
 drivers/block/ublk_drv.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

index 63aeb7a76a8c9..0bdb804fca839 100644
@@ -2910,22 +2910,26 @@ static void ublk_stop_dev(struct ublk_device *ub)
 	ublk_cancel_dev(ub);
 }
 
+static void ublk_reset_io_flags(struct ublk_queue *ubq, struct ublk_io *io)
+{
+	/* UBLK_IO_FLAG_CANCELED can be cleared now */
+	spin_lock(&ubq->cancel_lock);
+	io->flags &= ~UBLK_IO_FLAG_CANCELED;
+	spin_unlock(&ubq->cancel_lock);
+}
+
 /* reset per-queue io flags */
 static void ublk_queue_reset_io_flags(struct ublk_queue *ubq)
 {
-	int j;
-
-	/* UBLK_IO_FLAG_CANCELED can be cleared now */
 	spin_lock(&ubq->cancel_lock);
-	for (j = 0; j < ubq->q_depth; j++)
-		ubq->ios[j].flags &= ~UBLK_IO_FLAG_CANCELED;
 	ubq->canceling = false;
 	spin_unlock(&ubq->cancel_lock);
 	ubq->fail_io = false;
 }
 
 /* device can only be started after all IOs are ready */
-static void ublk_mark_io_ready(struct ublk_device *ub, u16 q_id)
+static void ublk_mark_io_ready(struct ublk_device *ub, u16 q_id,
+	struct ublk_io *io)
 	__must_hold(&ub->mutex)
 {
 	struct ublk_queue *ubq = ublk_get_queue(ub, q_id);

@@ -2934,6 +2938,7 @@ static void ublk_mark_io_ready(struct ublk_device *ub, u16 q_id)
 		ub->unprivileged_daemons = true;
 
 	ubq->nr_io_ready++;
+	ublk_reset_io_flags(ubq, io);
 
 	/* Check if this specific queue is now fully ready */
 	if (ublk_queue_ready(ubq)) {

@@ -3196,7 +3201,7 @@ static int ublk_fetch(struct io_uring_cmd *cmd, struct ublk_device *ub,
 	if (!ret)
 		ret = ublk_config_io_buf(ub, io, cmd, buf_addr, NULL);
 	if (!ret)
-		ublk_mark_io_ready(ub, q_id);
+		ublk_mark_io_ready(ub, q_id, io);
 	mutex_unlock(&ub->mutex);
 	return ret;
 }

@@ -3604,7 +3609,7 @@ static int ublk_batch_prep_io(struct ublk_queue *ubq,
 	ublk_io_unlock(io);
 
 	if (!ret)
-		ublk_mark_io_ready(data->ub, ubq->q_id);
+		ublk_mark_io_ready(data->ub, ubq->q_id, io);
 
 	return ret;
 }

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yuto Ohnuki <[email protected]>

[ Upstream commit e9b004ff83067cdf96774b45aea4b239ace99a2f ]

wbt_init_enable_default() uses WARN_ON_ONCE to check for failures from wbt_alloc() and wbt_init(). However, both are expected failure paths:

- wbt_alloc() can return NULL under memory pressure (-ENOMEM)
- wbt_init() can fail with -EBUSY if wbt is already registered

syzbot triggers this by injecting memory allocation failures during MTD partition creation via ioctl(BLKPG), causing a spurious warning.

wbt_init_enable_default() is a best-effort initialization called from blk_register_queue() with a void return type. Failure simply means the disk operates without writeback throttling, which is harmless.

Replace WARN_ON_ONCE with plain if-checks, consistent with how wbt_set_lat() in the same file already handles these failures. Add a pr_warn() for the wbt_init() failure to retain diagnostic information without triggering a full stack trace.

---
 block/blk-wbt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

index 33006edfccd44..dcc2438ca16dc 100644
@@ -782,10 +782,11 @@ void wbt_init_enable_default(struct gendisk *disk)
 		return;
 
 	rwb = wbt_alloc();
-	if (WARN_ON_ONCE(!rwb))
+	if (!rwb)
 		return;
 
-	if (WARN_ON_ONCE(wbt_init(disk, rwb))) {
+	if (wbt_init(disk, rwb)) {
+		pr_warn("%s: failed to enable wbt\n", disk->disk_name);
 		wbt_free(rwb);
 		return;
 	}

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhan Xusheng <[email protected]>

[ Upstream commit 63c2f06198ca7513433f1c92f2c654869d72417e ]

erofs_init_device() only reads blocks_lo and uniaddr_lo from the on-disk device slot, ignoring blocks_hi and uniaddr_hi that were introduced alongside the 48-bit block addressing feature.

For the primary device (dif0), erofs_read_superblock() already handles this correctly by combining blocks_lo with blocks_hi when 48-bit layout is enabled. But the same logic was not applied to extra devices.

With a 48-bit EROFS image using extra devices whose uniaddr or blocks exceed 32-bit range, the truncated values cause erofs_map_dev() to compute wrong physical addresses, leading to silent data corruption.

Fix this by reading blocks_hi and uniaddr_hi in erofs_init_device() when 48-bit layout is enabled, consistent with the primary device handling. Also fix the erofs_deviceslot on-disk definition where blocks_hi was incorrectly declared as __le32 instead of __le16.

---
 fs/erofs/erofs_fs.h | 4 ++--
 fs/erofs/super.c    | 8 ++++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

index b80c6bb33a58c..7871b16c1d333 100644
@@ -44,9 +44,9 @@ struct erofs_deviceslot {
 	u8 tag[64];		/* digest(sha256), etc. */
 	__le32 blocks_lo;	/* total blocks count of this device */
 	__le32 uniaddr_lo;	/* unified starting block of this device */
-	__le32 blocks_hi;	/* total blocks count MSB */
+	__le16 blocks_hi;	/* total blocks count MSB */
 	__le16 uniaddr_hi;	/* unified starting block MSB */
-	u8 reserved[50];
+	u8 reserved[52];
 };
 #define EROFS_DEVT_SLOT_SIZE	sizeof(struct erofs_deviceslot)
 

index 972a0c82198d7..802add6652fda 100644
@@ -129,6 +129,7 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
 	struct erofs_fscache *fscache;
 	struct erofs_deviceslot *dis;
 	struct file *file;
+	bool _48bit;
 
 	dis = erofs_read_metabuf(buf, sb, *pos, false);
 	if (IS_ERR(dis))

@@ -175,8 +176,11 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
 		dif->file = file;
 	}
 
-	dif->blocks = le32_to_cpu(dis->blocks_lo);
-	dif->uniaddr = le32_to_cpu(dis->uniaddr_lo);
+	_48bit = erofs_sb_has_48bit(sbi);
+	dif->blocks = le32_to_cpu(dis->blocks_lo) |
+		(_48bit ? (u64)le16_to_cpu(dis->blocks_hi) << 32 : 0);
+	dif->uniaddr = le32_to_cpu(dis->uniaddr_lo) |
+		(_48bit ? (u64)le16_to_cpu(dis->uniaddr_hi) << 32 : 0);
 	sbi->total_blocks += dif->blocks;
 	*pos += EROFS_DEVT_SLOT_SIZE;
 	return 0;

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Abd-Alrhman Masalkhi <[email protected]>

[ Upstream commit e4979f4fac4d6bbe757be50441b45e28e6bf7360 ]

The md_wq workqueue is defined as static and initialized in md_init(), but it is not used anywhere within md.c.

All asynchronous and deferred work in this file is handled via md_misc_wq or dedicated md threads.

---
 drivers/md/md.c | 8 --------
 1 file changed, 8 deletions(-)

index ecb9bd0e1b8f7..159af8d7ccf0b 100644
@@ -84,7 +84,6 @@ static DEFINE_XARRAY(md_submodule);
 static const struct kobj_type md_ktype;
 
 static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
-static struct workqueue_struct *md_wq;
 
 /*
  * This workqueue is used for sync_work to register new sync_thread, and for

@@ -10511,10 +10510,6 @@ static int __init md_init(void)
 		goto err_bitmap;
 
 	ret = -ENOMEM;
-	md_wq = alloc_workqueue("md", WQ_MEM_RECLAIM | WQ_PERCPU, 0);
-	if (!md_wq)
-		goto err_wq;
-
 	md_misc_wq = alloc_workqueue("md_misc", WQ_PERCPU, 0);
 	if (!md_misc_wq)
 		goto err_misc_wq;

@@ -10539,8 +10534,6 @@ static int __init md_init(void)
 err_md:
 	destroy_workqueue(md_misc_wq);
 err_misc_wq:
-	destroy_workqueue(md_wq);
-err_wq:
 	md_llbitmap_exit();
 err_bitmap:
 	md_bitmap_exit();

@@ -10849,7 +10842,6 @@ static __exit void md_exit(void)
 	spin_unlock(&all_mddevs_lock);
 
 	destroy_workqueue(md_misc_wq);
-	destroy_workqueue(md_wq);
 	md_bitmap_exit();
 }
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chen Cheng <[email protected]>

[ Upstream commit eff0d74c6c8fd358bc9474c05002e51fa5aa56ad ]

dm-raid has external metadata management (mddev->external = 1) and no persistent superblock (mddev->persistent = 0). For these arrays, there's no superblock to update, so the error message is spurious.

The error appears as:
md_update_sb: can't update sb for read-only array md0

---
 drivers/md/md.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

index 3ce6f9e9d38e6..c2cc2302d727d 100644
@@ -2788,7 +2788,9 @@ void md_update_sb(struct mddev *mddev, int force_change)
 	if (!md_is_rdwr(mddev)) {
 		if (force_change)
 			set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);
-		pr_err("%s: can't update sb for read-only array %s\n", __func__, mdname(mddev));
+		if (!mddev_is_dm(mddev))
+			pr_err_ratelimited("%s: can't update sb for read-only array %s\n",
+					   __func__, mdname(mddev));
 		return;
 	}
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email protected]>

[ Upstream commit cf86bb53b9c92354904a328e947a05ffbfdd1840 ]

During raid456 reshape, direct IO across the reshape position can sleep in raid5_make_request() waiting for reshape progress while still holding an active_io reference. If userspace then freezes reshape and writes md/suspend_lo or md/suspend_hi, mddev_suspend() kills active_io and waits for all in-flight IO to drain.

This can deadlock: the IO needs reshape progress to continue, but the reshape thread is already frozen, so the active_io reference is never dropped and suspend never completes.

raid5_prepare_suspend() already wakes wait_for_reshape for dm-raid. Do the same for normal md suspend when reshape is already interrupted, so waiting raid456 IO can abort, drop its reference, and let suspend finish.

The mdadm test tests/25raid456-reshape-deadlock reproduces the hang.

---
 drivers/md/md.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

index 159af8d7ccf0b..9c552904a5ddc 100644
@@ -488,6 +488,17 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
 	}
 
 	percpu_ref_kill(&mddev->active_io);
+
+	/*
+	 * RAID456 IO can sleep in wait_for_reshape while still holding an
+	 * active_io reference. If reshape is already interrupted or frozen,
+	 * wake those waiters so they can abort and drop the reference instead
+	 * of deadlocking suspend.
+	 */
+	if (mddev->pers && mddev->pers->prepare_suspend &&
+	    reshape_interrupted(mddev))
+		mddev->pers->prepare_suspend(mddev);
+
 	if (interruptible)
 		err = wait_event_interruptible(mddev->sb_wait,
 				percpu_ref_is_zero(&mddev->active_io));

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Aleksa Sarai <[email protected]>

[ Upstream commit 97b67e64affb0e709eeecc50f6a9222fc20bd14b ]

dynamic_dname() has had an implicit limit of 64 characters since it was introduced in commit c23fbb6bcb3e ("VFS: delay the dentry name generation on sockets and pipes"), however it seems that this was a fairly arbitrary number (suspiciously it was double the previously hardcoded buffer size).

NAME_MAX seems like a more reasonable and consistent limit for d_name lengths. While we're at it, we can also remove the unnecessary stack-allocated array and just memmove() the formatted string to the end of the buffer.

It should also be noted that at least one driver (in particular, liveupdate's usage of anon_inode for session files) already exceeded this limit without noticing that readlink(/proc/self/fd/$n) always returns -ENAMETOOLONG, so this fixes those drivers as well.

---
 fs/d_path.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

index bb365511066b2..a48957c0971ef 100644
@@ -301,18 +301,19 @@ EXPORT_SYMBOL(d_path);
 char *dynamic_dname(char *buffer, int buflen, const char *fmt, ...)
 {
 	va_list args;
-	char temp[64];
+	char *start;
 	int sz;
 
 	va_start(args, fmt);
-	sz = vsnprintf(temp, sizeof(temp), fmt, args) + 1;
+	sz = vsnprintf(buffer, buflen, fmt, args) + 1;
 	va_end(args);
 
-	if (sz > sizeof(temp) || sz > buflen)
+	if (sz > NAME_MAX || sz > buflen)
 		return ERR_PTR(-ENAMETOOLONG);
 
-	buffer += buflen - sz;
-	return memcpy(buffer, temp, sz);
+	/* Move the formatted d_name to the end of the buffer. */
+	start = buffer + (buflen - sz);
+	return memmove(start, buffer, sz);
 }
 
 char *simple_dname(struct dentry *dentry, char *buffer, int buflen)

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email protected]>

[ Upstream commit 883adb6dcff0f96dbbdb6488842a38b121ebd68c ]

[BUG]
Since commit 59615e2c1f63 ("btrfs: reject single block sized compression early"), the following script will result the inode to have NOCOMPRESS flag, meanwhile old kernels don't:

  # mkfs.btrfs -f $dev
  # mount $dev $mnt -o max_inline=2k,compress=zstd
  # truncate -s 8k $mnt/foobar
  # xfs_io -f -c "pwrite 0 2k" $mnt/foobar
  # sync

Before that commit, the inode will not have NOCOMPRESS flag:

	item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160
		generation 9 transid 9 size 8192 nbytes 4096
		block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0
		sequence 3 flags 0x0(none)

But after that commit, the inode will have NOCOMPRESS flag:

	item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160
		generation 9 transid 10 size 8192 nbytes 4096
		block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0
		sequence 3 flags 0x8(NOCOMPRESS)

This will make a lot of files no longer to be compressed.

[CAUSE]
The old compressed inline check looks like this:

	if (total_compressed <= blocksize &&
	   (start > 0 || end + 1 < inode->disk_i_size))
		goto cleanup_and_bail_uncompressed;

That inline part check is equal to "!(start == 0 && end + 1 >= inode->disk_i_size)", but the new check no longer has that disk_i_size check.

Thus it means any single block sized write at file offset 0 will pass the inline check, which is wrong.

Furthermore, since we have merged the old check into inode_need_compress(), there is no disk_i_size based inline check anymore, we will always try compressing that single block at file offset 0, then later find out it's not a net win and go to the mark_incompressible tag.

This results the inode to have NOCOMPRESS flag.

[FIX]
Add back the missing disk_i_size based check into inode_need_compress().

Now the same script will no longer cause NOCOMPRESS flag.

---
 fs/btrfs/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 2ad2d503e79af..c5b291ddb4776 100644
@@ -811,7 +811,8 @@ static inline int inode_need_compress(struct btrfs_inode *inode, u64 start,
 	 * do not even bother try compression, as there will be no space saving
 	 * and will always fallback to regular write later.
 	 */
-	if (start != 0 && end + 1 - start <= fs_info->sectorsize)
+	if (end + 1 - start <= fs_info->sectorsize &&
+	    (start > 0 || end + 1 < inode->disk_i_size))
 		return 0;
 	/* Defrag ioctl takes precedence over mount options and properties. */
 	if (inode->defrag_compress == BTRFS_DEFRAG_DONT_COMPRESS)

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Filipe Manana <[email protected]>

[ Upstream commit b48c980b6a7e409050bb3067165db31cc6205e3e ]

When using the flushoncommit mount option, we can have a deadlock between a transaction commit and a reflink operation that copied an inline extent to an offset beyond the current i_size of the destination node.

The deadlock happens like this:

1) Task A clones an inline extent from inode X to an offset of inode Y that is beyond Y's current i_size. This means we copied the inline extent's data to a folio of inode Y that is beyond its EOF, using a call to copy_inline_to_page();

2) Task B starts a transaction commit and calls btrfs_start_delalloc_flush() to flush delalloc;

3) The delalloc flushing sees the new dirty folio of inode Y and when it attempts to flush it, it ends up at extent_writepage() and sees that the offset of the folio is beyond the i_size of inode Y, so it attempts to invalidate the folio by calling folio_invalidate(), which ends up at btrfs' folio invalidate callback - btrfs_invalidate_folio(). There it tries to lock the folio's range in inode Y's extent io tree, but it blocks since it's currently locked by task A - during a reflink we lock the inodes and the source and destination ranges after flushing all delalloc and waiting for ordered extent completion - after that we don't expect to have dirty folios in the ranges, the exception is if we have to copy an inline extent's data (because the destination offset is not zero);

4) Task A then attempts to start a transaction to update the inode item, and then it's blocked since the current transaction is in the TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the current transaction to become unblocked (its state >= TRANS_STATE_UNBLOCKED).

So task A is waiting for the transaction commit done by task B, and the later waiting on the extent lock of inode Y that is currently held by task A.

Syzbot recently reported this with the following stack traces:

  INFO: task kworker/u8:7:1053 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:kworker/u8:7    state:D stack:23520 pid:1053  tgid:1053  ppid:2      task_flags:0x4208060 flags:0x00080000
  Workqueue: writeback wb_workfn (flush-btrfs-46)
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline]
   btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914
   btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]
   btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704
   extent_writepage fs/btrfs/extent_io.c:1852 [inline]
   extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline]
   btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713
   do_writepages+0x32e/0x550 mm/page-writeback.c:2554
   __writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750
   writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042
   wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227
   wb_do_writeback fs/fs-writeback.c:2374 [inline]
   wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414
   process_one_work kernel/workqueue.c:3276 [inline]
   process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
   worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
   kthread+0x388/0x470 kernel/kthread.c:436
   ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
   </TASK>
  INFO: task syz.4.64:6910 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:syz.4.64        state:D stack:22752 pid:6910  tgid:6905  ppid:5944   task_flags:0x400140 flags:0x00080002
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wait_current_trans+0x39f/0x590 fs/btrfs/transaction.c:535
   start_transaction+0x6a7/0x1650 fs/btrfs/transaction.c:705
   clone_copy_inline_extent fs/btrfs/reflink.c:299 [inline]
   btrfs_clone+0x128a/0x24d0 fs/btrfs/reflink.c:529
   btrfs_clone_files+0x271/0x3f0 fs/btrfs/reflink.c:750
   btrfs_remap_file_range+0x76b/0x1320 fs/btrfs/reflink.c:903
   vfs_copy_file_range+0xda7/0x1390 fs/read_write.c:1600
   __do_sys_copy_file_range fs/read_write.c:1683 [inline]
   __se_sys_copy_file_range+0x2fb/0x480 fs/read_write.c:1650
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  RIP: 0033:0x7f5f73afc799
  RSP: 002b:00007f5f7315e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000146
  RAX: ffffffffffffffda RBX: 00007f5f73d75fa0 RCX: 00007f5f73afc799
  RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000005
  RBP: 00007f5f73b92c99 R08: 0000000000000863 R09: 0000000000000000
  R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000000
  R13: 00007f5f73d76038 R14: 00007f5f73d75fa0 R15: 00007fff138a5068
   </TASK>
  INFO: task syz.4.64:6975 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:syz.4.64        state:D stack:24736 pid:6975  tgid:6905  ppid:5944   task_flags:0x400040 flags:0x00080002
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227
   __writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2838
   try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2886
   btrfs_start_delalloc_flush fs/btrfs/transaction.c:2175 [inline]
   btrfs_commit_transaction+0x82e/0x31a0 fs/btrfs/transaction.c:2364
   btrfs_ioctl+0xca7/0xd00 fs/btrfs/ioctl.c:5206
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:597 [inline]
   __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  RIP: 0033:0x7f5f73afc799
  RSP: 002b:00007f5f7313d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
  RAX: ffffffffffffffda RBX: 00007f5f73d76090 RCX: 00007f5f73afc799
  RDX: 0000000000000000 RSI: 0000000000009408 RDI: 0000000000000004
  RBP: 00007f5f73b92c99 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
  R13: 00007f5f73d76128 R14: 00007f5f73d76090 R15: 00007fff138a5068
   </TASK>

Fix this by updating the i_size of the destination inode of a reflink operation after we copy an inline extent's data to an offset beyond the i_size and before attempting to start a transaction to update the inode's item.

---
 fs/btrfs/reflink.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

index 314cb95ba846d..55d8d238e5862 100644
@@ -322,6 +322,51 @@ static int clone_copy_inline_extent(struct btrfs_inode *inode,
 
 	ret = copy_inline_to_page(inode, new_key->offset,
 				  inline_data, size, datal, comp_type);
+
+	/*
+	 * If we copied the inline extent data to a page/folio beyond the i_size
+	 * of the destination inode, then we need to increase the i_size before
+	 * we start a transaction to update the inode item. This is to prevent a
+	 * deadlock when the flushoncommit mount option is used, which happens
+	 * like this:
+	 *
+	 * 1) Task A clones an inline extent from inode X to an offset of inode
+	 *    Y that is beyond Y's current i_size. This means we copied the
+	 *    inline extent's data to a folio of inode Y that is beyond its EOF,
+	 *    using the call above to copy_inline_to_page();
+	 *
+	 * 2) Task B starts a transaction commit and calls
+	 *    btrfs_start_delalloc_flush() to flush delalloc;
+	 *
+	 * 3) The delalloc flushing sees the new dirty folio of inode Y and when
+	 *    it attempts to flush it, it ends up at extent_writepage() and sees
+	 *    that the offset of the folio is beyond the i_size of inode Y, so
+	 *    it attempts to invalidate the folio by calling folio_invalidate(),
+	 *    which ends up at btrfs' folio invalidate callback -
+	 *    btrfs_invalidate_folio(). There it tries to lock the folio's range
+	 *    in inode Y's extent io tree, but it blocks since it's currently
+	 *    locked by task A - during reflink we lock the inodes and the
+	 *    source and destination ranges after flushing all delalloc and
+	 *    waiting for ordered extent completion - after that we don't expect
+	 *    to have dirty folios in the ranges, the exception is if we have to
+	 *    copy an inline extent's data (because the destination offset is
+	 *    not zero);
+	 *
+	 * 4) Task A then does the 'goto out' below and attempts to start a
+	 *    transaction to update the inode item, and then it's blocked since
+	 *    the current transaction is in the TRANS_STATE_COMMIT_START state.
+	 *    Therefore task A has to wait for the current transaction to become
+	 *    unblocked (its state >= TRANS_STATE_UNBLOCKED).
+	 *
+	 * This leads to a deadlock - the task committing the transaction
+	 * waiting for the delalloc flushing which is blocked during folio
+	 * invalidation on the inode's extent lock and the reflink task waiting
+	 * for the current transaction to be unblocked so that it can start a
+	 * a new one to update the inode item (while holding the extent lock).
+	 */
+	if (ret == 0 && new_key->offset + datal > i_size_read(&inode->vfs_inode))
+		i_size_write(&inode->vfs_inode, new_key->offset + datal);
+
 	goto out;
 }
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email protected]>

[ Upstream commit 3c0c45a4dff73845ba93d41365fc14e45ee32bd7 ]

[BUG]
There is a bug report that a btrfs with running dev-replace got rejected with the following messages:

BTRFS error (device sdk1): devid 0 path /dev/sdk1 is registered but not found in chunk tree
BTRFS error (device sdk1): remove the above devices or use 'btrfs device scan --forget <dev>' to unregister them before mount BTRFS error (device sdk1): open_ctree failed: -117

[CAUSE]
The tree and super block dumps show the fs is completely sane, except one thing, there is no dev item for devid 0 in chunk tree.

However this is not a bug, as we do not insert dev item for devid 0 in the first place.
Since the devid 0 is only there temporarily we do not really need to insert a dev item for it and then later remove it again.

It is the commit 34308187395f ("btrfs: add extra device item checks at mount") adding a overly strict check that triggers a false alert and rejected the valid filesystem.

[FIX]
Add a special handling for devid 0, and doesn't require devid 0 to have a device item in chunk tree.

---
 fs/btrfs/volumes.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index 6b8e810a35ce1..fd400fbc654d9 100644
@@ -8457,7 +8457,12 @@ bool btrfs_verify_dev_items(const struct btrfs_fs_info *fs_info)
 
 	mutex_lock(&uuid_mutex);
 	list_for_each_entry(dev, &fs_info->fs_devices->devices, dev_list) {
-		if (!test_bit(BTRFS_DEV_STATE_ITEM_FOUND, &dev->dev_state)) {
+		/*
+		 * Replace target dev item (devid 0) is not inserted into chunk tree.
+		 * So skip the DEV_STATE_ITEM check.
+		 */
+		if (dev->devid != BTRFS_DEV_REPLACE_DEVID &&
+		    !test_bit(BTRFS_DEV_STATE_ITEM_FOUND, &dev->dev_state)) {
 			btrfs_err(fs_info,
 			"devid %llu path %s is registered but not found in chunk tree",
 				  dev->devid, btrfs_dev_name(dev));

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Manivannan Sadhasivam <[email protected]>

[ Upstream commit e560083c0467f86b72aecac377b27bd1e7d16c49 ]

Some OPP tables have entries with same rate and different performance level. For these entries, using only the rate as the debugfs directory name causes below error:

debugfs: 'opp:5000000' already exists in '[email protected]'

Fix it by appending the performance level to the dir name if available.

---
 drivers/opp/debugfs.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

index 8fc6238b17284..61506d30d5ff0 100644
@@ -130,22 +130,24 @@ void opp_debug_create_one(struct dev_pm_opp *opp, struct opp_table *opp_table)
 {
 	struct dentry *pdentry = opp_table->dentry;
 	struct dentry *d;
-	unsigned long id;
-	char name[25];	/* 20 chars for 64 bit value + 5 (opp:\0) */
+	char name[36];	/* "opp:"(4) + u64(20) + "-" (1) + u32(10) + NULL(1) */
 
 	/*
 	 * Get directory name for OPP.
 	 *
-	 * - Normally rate is unique to each OPP, use it to get unique opp-name.
+	 * - Normally rate is unique to each OPP, use it to get unique opp-name,
+	 *   together with performance level if available.
 	 * - For some devices rate isn't available or there are multiple, use
 	 *   index instead for them.
 	 */
-	if (likely(opp_table->clk_count == 1 && opp->rates[0]))
-		id = opp->rates[0];
-	else
-		id = _get_opp_count(opp_table);
-
-	snprintf(name, sizeof(name), "opp:%lu", id);
+	if (likely(opp_table->clk_count == 1 && opp->rates[0])) {
+		if (opp->level == OPP_LEVEL_UNSET)
+			snprintf(name, sizeof(name), "opp:%lu", opp->rates[0]);
+		else
+			snprintf(name, sizeof(name), "opp:%lu-%u", opp->rates[0], opp->level);
+	} else {
+		snprintf(name, sizeof(name), "opp:%u", _get_opp_count(opp_table));
+	}
 
 	/* Create per-opp directory */
 	d = debugfs_create_dir(name, pdentry);

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viresh Kumar <[email protected]>

[ Upstream commit 3d2398f44a2d48fb1c575a6e0bc6b38f3e689e22 ]

The commit ff9c512041f2 ("OPP: Use mutex locking guards") unintentionally made the for loop run longer than required.

scoped_guard() is implemented as a for loop. The break statement now breaks out out the scoped_guard() and not out of the outer for loop. The outer loop always iterates to completion.

Fix it.

---
 drivers/opp/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 866641666e410..da3f5eba43419 100644
@@ -2742,8 +2742,8 @@ struct dev_pm_opp *dev_pm_opp_xlate_required_opp(struct opp_table *src_table,
 					break;
 				}
 			}
-			break;
 		}
+		break;
 	}
 
 	if (IS_ERR(dest_opp)) {

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

[ Upstream commit ba0b236736dde4059bdcb8e99beaa50d6e5b6e7e ]

Make multiple changes that do not alter functionality to the CMOS RTC ACPI address space handler driver, including the following:

- Drop the unused .detach() callback from cmos_rtc_handler.

- Rename acpi_cmos_rtc_attach_handler() to acpi_cmos_rtc_attach().

- Rearrange acpi_cmos_rtc_space_handler() to reduce the number of redundant checks and make white space follow the coding style.

- Adjust an error message in acpi_install_cmos_rtc_space_handler() and make the white space follow the coding style.

- Rearrange acpi_remove_cmos_rtc_space_handler() and adjust an error message in it.

No intentional functional impact.

Stable-dep-of: 6cee29ad9d7e ("ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver")

---
 drivers/acpi/x86/cmos_rtc.c | 61 +++++++++++++++++++------------------
 1 file changed, 32 insertions(+), 29 deletions(-)

index 51643ff6fe5fc..977234da9fc11 100644
@@ -24,31 +24,35 @@ static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
 	{}
 };
 
-static acpi_status
-acpi_cmos_rtc_space_handler(u32 function, acpi_physical_address address,
-		      u32 bits, u64 *value64,
-		      void *handler_context, void *region_context)
+static acpi_status acpi_cmos_rtc_space_handler(u32 function,
+					       acpi_physical_address address,
+					       u32 bits, u64 *value64,
+					       void *handler_context,
+					       void *region_context)
 {
-	int i;
+	unsigned int i, bytes = DIV_ROUND_UP(bits, 8);
 	u8 *value = (u8 *)value64;
 
 	if (address > 0xff || !value64)
 		return AE_BAD_PARAMETER;
 
-	if (function != ACPI_WRITE && function != ACPI_READ)
-		return AE_BAD_PARAMETER;
+	guard(spinlock_irq)(&rtc_lock);
+
+	if (function == ACPI_WRITE) {
+		for (i = 0; i < bytes; i++, address++, value++)
+			CMOS_WRITE(*value, address);
 
-	spin_lock_irq(&rtc_lock);
+		return AE_OK;
+	}
 
-	for (i = 0; i < DIV_ROUND_UP(bits, 8); ++i, ++address, ++value)
-		if (function == ACPI_READ)
+	if (function == ACPI_READ) {
+		for (i = 0; i < bytes; i++, address++, value++)
 			*value = CMOS_READ(address);
-		else
-			CMOS_WRITE(*value, address);
 
-	spin_unlock_irq(&rtc_lock);
+		return AE_OK;
+	}
 
-	return AE_OK;
+	return AE_BAD_PARAMETER;
 }
 
 int acpi_install_cmos_rtc_space_handler(acpi_handle handle)

@@ -56,11 +60,11 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 	acpi_status status;
 
 	status = acpi_install_address_space_handler(handle,
-			ACPI_ADR_SPACE_CMOS,
-			&acpi_cmos_rtc_space_handler,
-			NULL, NULL);
+						    ACPI_ADR_SPACE_CMOS,
+						    acpi_cmos_rtc_space_handler,
+						    NULL, NULL);
 	if (ACPI_FAILURE(status)) {
-		pr_err("Error installing CMOS-RTC region handler\n");
+		pr_err("Failed to install CMOS-RTC address space handler\n");
 		return -ENODEV;
 	}
 

@@ -70,26 +74,25 @@ EXPORT_SYMBOL_GPL(acpi_install_cmos_rtc_space_handler);
 
 void acpi_remove_cmos_rtc_space_handler(acpi_handle handle)
 {
-	if (ACPI_FAILURE(acpi_remove_address_space_handler(handle,
-			ACPI_ADR_SPACE_CMOS, &acpi_cmos_rtc_space_handler)))
-		pr_err("Error removing CMOS-RTC region handler\n");
+	acpi_status status;
+
+	status = acpi_remove_address_space_handler(handle,
+						   ACPI_ADR_SPACE_CMOS,
+						   acpi_cmos_rtc_space_handler);
+	if (ACPI_FAILURE(status))
+		pr_err("Failed to remove CMOS-RTC address space handler\n");
 }
 EXPORT_SYMBOL_GPL(acpi_remove_cmos_rtc_space_handler);
 
-static int acpi_cmos_rtc_attach_handler(struct acpi_device *adev, const struct acpi_device_id *id)
+static int acpi_cmos_rtc_attach(struct acpi_device *adev,
+				const struct acpi_device_id *id)
 {
 	return acpi_install_cmos_rtc_space_handler(adev->handle);
 }
 
-static void acpi_cmos_rtc_detach_handler(struct acpi_device *adev)
-{
-	acpi_remove_cmos_rtc_space_handler(adev->handle);
-}
-
 static struct acpi_scan_handler cmos_rtc_handler = {
 	.ids = acpi_cmos_rtc_ids,
-	.attach = acpi_cmos_rtc_attach_handler,
-	.detach = acpi_cmos_rtc_detach_handler,
+	.attach = acpi_cmos_rtc_attach,
 };
 
 void __init acpi_cmos_rtc_init(void)

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

[ Upstream commit 6cee29ad9d7e400d39ae0b1a54447fedcb62eecd ]

If a CMOS RTC (PNP0B00/PNP0B01/PNP0B02) device coexists with an ACPI TAD (timer and event alarm device, ACPI000E), the ACPI TAD driver will attempt to install the CMOS RTC address space hanlder that has been installed already and the TAD probing will fail.

Avoid that by changing acpi_install_cmos_rtc_space_handler() to return zero and acpi_remove_cmos_rtc_space_handler() to do nothing if the CMOS RTC address space handler has been installed already.

---
 drivers/acpi/x86/cmos_rtc.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

index 977234da9fc11..45db7e51cbe60 100644
@@ -24,6 +24,8 @@ static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
 	{}
 };
 
+static bool cmos_rtc_space_handler_present __read_mostly;
+
 static acpi_status acpi_cmos_rtc_space_handler(u32 function,
 					       acpi_physical_address address,
 					       u32 bits, u64 *value64,

@@ -59,6 +61,9 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 {
 	acpi_status status;
 
+	if (cmos_rtc_space_handler_present)
+		return 0;
+
 	status = acpi_install_address_space_handler(handle,
 						    ACPI_ADR_SPACE_CMOS,
 						    acpi_cmos_rtc_space_handler,

@@ -68,6 +73,8 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 		return -ENODEV;
 	}
 
+	cmos_rtc_space_handler_present = true;
+
 	return 1;
 }
 EXPORT_SYMBOL_GPL(acpi_install_cmos_rtc_space_handler);

@@ -76,6 +83,9 @@ void acpi_remove_cmos_rtc_space_handler(acpi_handle handle)
 {
 	acpi_status status;
 
+	if (cmos_rtc_space_handler_present)
+		return;
+
 	status = acpi_remove_address_space_handler(handle,
 						   ACPI_ADR_SPACE_CMOS,
 						   acpi_cmos_rtc_space_handler);

@@ -87,7 +97,13 @@ EXPORT_SYMBOL_GPL(acpi_remove_cmos_rtc_space_handler);
 static int acpi_cmos_rtc_attach(struct acpi_device *adev,
 				const struct acpi_device_id *id)
 {
-	return acpi_install_cmos_rtc_space_handler(adev->handle);
+	int ret;
+
+	ret = acpi_install_cmos_rtc_space_handler(adev->handle);
+	if (ret < 0)
+		return ret;
+
+	return 1;
 }
 
 static struct acpi_scan_handler cmos_rtc_handler = {

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit f813ec9e84b4d0ca81ec1da94ab07bfb4a29266c ]

Fix missing call to set_node_dbginfo() for new devres nodes created by devm_krealloc().

---
 drivers/base/devres.c | 2 ++
 1 file changed, 2 insertions(+)

index 171750c1f6918..ce519b98a1898 100644
@@ -940,6 +940,8 @@ void *devm_krealloc(struct device *dev, void *ptr, size_t new_size, gfp_t gfp)
 	if (!new_dr)
 		return NULL;
 
+	set_node_dbginfo(&new_dr->node, "devm_krealloc_release", new_size);
+
 	/*
 	 * The spinlock protects the linked list against concurrent
 	 * modifications but not the resource itself.

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: HyungJung Joo <[email protected]>

[ Upstream commit 0621c385fda1376e967f37ccd534c26c3e511d14 ]

omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).

Later, omfs_make_empty() uses

    sbi->s_sys_blocksize - OMFS_DIR_START

as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer.

Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

---
 fs/omfs/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 90ae07c69349e..834cae1e62233 100644
@@ -513,6 +513,12 @@ static int omfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto out_brelse_bh;
 	}
 
+	if (sbi->s_sys_blocksize < OMFS_DIR_START) {
+		printk(KERN_ERR "omfs: sysblock size (%d) is too small\n",
+			sbi->s_sys_blocksize);
+		goto out_brelse_bh;
+	}
+
 	if (sbi->s_blocksize < sbi->s_sys_blocksize ||
 	    sbi->s_blocksize > OMFS_MAX_BLOCK_SIZE) {
 		printk(KERN_ERR "omfs: block size (%d) is out of range\n",

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gopi Krishna Menon <[email protected]>

[ Upstream commit da2c4f332a0504d9c284e7626a561d343c8d6f57 ]

of_property_read_u32 returns 0 on success. The current check returns -EINVAL if the property is read successfully.

Fix the check by removing ! from of_property_read_u32

---
 drivers/thermal/spear_thermal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 603dadcd3df58..5e3e9c1f32f8e 100644
@@ -93,7 +93,7 @@ static int spear_thermal_probe(struct platform_device *pdev)
 	struct device_node *np = pdev->dev.of_node;
 	int ret = 0, val;
 
-	if (!np || !of_property_read_u32(np, "st,thermal-flags", &val)) {
+	if (!np || of_property_read_u32(np, "st,thermal-flags", &val)) {
 		dev_err(&pdev->dev, "Failed: DT Pdata not passed\n");
 		return -EINVAL;
 	}

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 31de83980d3764d784f79ff1bc93c42b324f4013 ]

Passing a NULL pointer to debugfs_create_str() leads to a NULL pointer dereference when the debugfs file is read. Following upstream discussions, forbid the creation of debugfs string files with NULL pointers. Add a WARN_ON() to expose offending callers and return early.

---
 fs/debugfs/file.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 3376ab6a519d1..a941d73251b06 100644
@@ -1127,7 +1127,7 @@ static const struct file_operations fops_str_wo = {
  *          directory dentry if set.  If this parameter is %NULL, then the
  *          file will be created in the root of the debugfs filesystem.
  * @value: a pointer to the variable that the file should read to and write
- *         from.
+ *         from. This pointer and the string it points to must not be %NULL.
  *
  * This function creates a file in debugfs with the given name that
  * contains the value of the variable @value.  If the @mode variable is so

@@ -1136,6 +1136,9 @@ static const struct file_operations fops_str_wo = {
 void debugfs_create_str(const char *name, umode_t mode,
 			struct dentry *parent, char **value)
 {
+	if (WARN_ON(!value || !*value))
+		return;
+
 	debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str,
 				   &fops_str_ro, &fops_str_wo);
 }

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 4afc929c0f74c4f22b055a82b371d50586da58ca ]

The EXPORT_SYMBOL_GPL() for debugfs_create_str was placed incorrectly away from the function definition. Move it immediately below the debugfs_create_str() function where it belongs.

---
 fs/debugfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a941d73251b06..edd6aafbfbaaf 100644
@@ -1047,7 +1047,6 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
 
 	return ret;
 }
-EXPORT_SYMBOL_GPL(debugfs_create_str);
 
 static ssize_t debugfs_write_file_str(struct file *file, const char __user *user_buf,
 				      size_t count, loff_t *ppos)

@@ -1142,6 +1141,7 @@ void debugfs_create_str(const char *name, umode_t mode,
 	debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str,
 				   &fops_str_ro, &fops_str_wo);
 }
+EXPORT_SYMBOL_GPL(debugfs_create_str);
 
 static ssize_t read_file_blob(struct file *file, char __user *user_buf,
 			      size_t count, loff_t *ppos)

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 7215e4552f31e53595eae56a834f7e286beecccc ]

Passing NULL to debugfs_create_str() causes a NULL pointer dereference, and creating debugfs nodes with NULL string pointers is no longer permitted.

Additionally, firmware_file is a global pointer. Previously, adding every new slave blindly overwrote it with NULL.

Fix these issues by initializing firmware_file to an allocated empty string once in the subsystem init path (sdw_debugfs_init), and freeing it in the exit path. Existing driver code handles empty strings correctly.

---
 drivers/soundwire/debugfs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

index ccc9670ef77ce..2905ec19b8384 100644
@@ -358,8 +358,8 @@ void sdw_slave_debugfs_init(struct sdw_slave *slave)
 	debugfs_create_file("go", 0200, d, slave, &cmd_go_fops);
 
 	debugfs_create_file("read_buffer", 0400, d, slave, &read_buffer_fops);
-	firmware_file = NULL;
-	debugfs_create_str("firmware_file", 0200, d, &firmware_file);
+	if (firmware_file)
+		debugfs_create_str("firmware_file", 0200, d, &firmware_file);
 
 	slave->debugfs = d;
 }

@@ -371,10 +371,15 @@ void sdw_slave_debugfs_exit(struct sdw_slave *slave)
 
 void sdw_debugfs_init(void)
 {
+	if (!firmware_file)
+		firmware_file = kstrdup("", GFP_KERNEL);
+
 	sdw_debugfs_root = debugfs_create_dir("soundwire", NULL);
 }
 
 void sdw_debugfs_exit(void)
 {
 	debugfs_remove_recursive(sdw_debugfs_root);
+	kfree(firmware_file);
+	firmware_file = NULL;
 }

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gautham R. Shenoy <[email protected]>

[ Upstream commit beda3b363546a423e4e29a7395e04c0ac4ff677e ]

On failure to set the epp, the function amd_pstate_epp_cpu_init() returns with an error code without freeing the cpudata object that was allocated at the beginning of the function.

Ensure that the cpudata object is freed before returning from the function.

This memory leak was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts
(https://github.com/masoncl/review-prompts/tree/main/kernel).

---
 drivers/cpufreq/amd-pstate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 5aa9fcd80cf51..d57969c72c9dc 100644
@@ -1533,7 +1533,7 @@ static int amd_pstate_epp_cpu_init(struct cpufreq_policy *policy)
 
 	ret = amd_pstate_set_epp(policy, cpudata->epp_default);
 	if (ret)
-		return ret;
+		goto free_cpudata1;
 
 	current_pstate_driver->adjust_perf = NULL;
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: HyungJung Joo <[email protected]>

[ Upstream commit d227786ab1119669df4dc333a61510c52047cce4 ]

mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first.

If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free.

This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.

Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.

---
 fs/mbcache.c | 1 +
 1 file changed, 1 insertion(+)

index 480d02d6ebf03..2a6319b4072cc 100644
@@ -406,6 +406,7 @@ void mb_cache_destroy(struct mb_cache *cache)
 {
 	struct mb_cache_entry *entry, *next;
 
+	cancel_work_sync(&cache->c_shrink_work);
 	shrinker_free(cache->c_shrink);
 
 	/*

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiao Ni <[email protected]>

[ Upstream commit de3544d2e5ea99064498de3c21ba490155864657 ]

Interval tree uses [start, end] as a region which stores in the tree. In raid1, it uses the wrong end value. For example:
bio(A,B) is too big and needs to be split to bio1(A,C-1), bio2(C,B). The region of bio1 is [A,C] and the region of bio2 is [C,B]. So bio1 and bio2 overlap which is not right.

Fix this problem by using right end value of the region.

---
 drivers/md/raid1.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 181400e147c0d..be2565dee4202 100644
@@ -62,7 +62,7 @@ static int check_and_add_serial(struct md_rdev *rdev, struct r1bio *r1_bio,
 	unsigned long flags;
 	int ret = 0;
 	sector_t lo = r1_bio->sector;
-	sector_t hi = lo + r1_bio->sectors;
+	sector_t hi = lo + r1_bio->sectors - 1;
 	struct serial_in_rdev *serial = &rdev->serial[idx];
 
 	spin_lock_irqsave(&serial->serial_lock, flags);

@@ -452,7 +452,7 @@ static void raid1_end_write_request(struct bio *bio)
 	int mirror = find_bio_disk(r1_bio, bio);
 	struct md_rdev *rdev = conf->mirrors[mirror].rdev;
 	sector_t lo = r1_bio->sector;
-	sector_t hi = r1_bio->sector + r1_bio->sectors;
+	sector_t hi = r1_bio->sector + r1_bio->sectors - 1;
 	bool ignore_error = !raid1_should_handle_error(bio) ||
 		(bio->bi_status && bio_op(bio) == REQ_OP_DISCARD);
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <[email protected]>

[ Upstream commit e43dce8a0bc09083ea1145a1a0c61d83cbe72d97 ]

The "small" argument to do_sys_ftruncate indicates if > 32-bit size should be reject, but all the arch-specific compat ftruncate64 implementations get this wrong. Merge do_sys_ftruncate and ksys_ftruncate, replace the integer as boolean small flag with a descriptive one about LFS semantics, and use it correctly in the architecture-specific ftruncate64 implementations.

---
 arch/arm64/kernel/sys32.c       |  2 +-
 arch/mips/kernel/linux32.c      |  2 +-
 arch/parisc/kernel/sys_parisc.c |  4 ++--
 arch/powerpc/kernel/sys_ppc32.c |  2 +-
 arch/sparc/kernel/sys_sparc32.c |  2 +-
 arch/x86/kernel/sys_ia32.c      |  3 ++-
 fs/internal.h                   |  1 -
 fs/open.c                       | 12 ++++++------
 include/linux/syscalls.h        |  8 ++------
 9 files changed, 16 insertions(+), 20 deletions(-)

index 96bcfb9074430..12a948f3a5043 100644
@@ -89,7 +89,7 @@ COMPAT_SYSCALL_DEFINE4(aarch32_truncate64, const char __user *, pathname,
 COMPAT_SYSCALL_DEFINE4(aarch32_ftruncate64, unsigned int, fd, u32, __pad,
 		       arg_u32p(length))
 {
-	return ksys_ftruncate(fd, arg_u64(length));
+	return ksys_ftruncate(fd, arg_u64(length), FTRUNCATE_LFS);
 }
 
 COMPAT_SYSCALL_DEFINE5(aarch32_readahead, int, fd, u32, __pad,

index a0c0a7a654e94..fe9a787db5694 100644
@@ -60,7 +60,7 @@ SYSCALL_DEFINE4(32_truncate64, const char __user *, path,
 SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy,
 	unsigned long, a2, unsigned long, a3)
 {
-	return ksys_ftruncate(fd, merge_64(a2, a3));
+	return ksys_ftruncate(fd, merge_64(a2, a3), FTRUNCATE_LFS);
 }
 
 SYSCALL_DEFINE5(32_llseek, unsigned int, fd, unsigned int, offset_high,

index b2cdbb8a12b16..fcb0d80691392 100644
@@ -216,7 +216,7 @@ asmlinkage long parisc_truncate64(const char __user * path,
 asmlinkage long parisc_ftruncate64(unsigned int fd,
 					unsigned int high, unsigned int low)
 {
-	return ksys_ftruncate(fd, (long)high << 32 | low);
+	return ksys_ftruncate(fd, (long)high << 32 | low, FTRUNCATE_LFS);
 }
 
 /* stubs for the benefit of the syscall_table since truncate64 and truncate 

@@ -227,7 +227,7 @@ asmlinkage long sys_truncate64(const char __user * path, unsigned long length)
 }
 asmlinkage long sys_ftruncate64(unsigned int fd, unsigned long length)
 {
-	return ksys_ftruncate(fd, length);
+	return ksys_ftruncate(fd, length, FTRUNCATE_LFS);
 }
 asmlinkage long sys_fcntl64(unsigned int fd, unsigned int cmd, unsigned long arg)
 {

index d451a8229223a..03fa487f26147 100644
@@ -101,7 +101,7 @@ PPC32_SYSCALL_DEFINE4(ppc_ftruncate64,
 		       unsigned int, fd, u32, reg4,
 		       unsigned long, len1, unsigned long, len2)
 {
-	return ksys_ftruncate(fd, merge_64(len1, len2));
+	return ksys_ftruncate(fd, merge_64(len1, len2), FTRUNCATE_LFS);
 }
 
 PPC32_SYSCALL_DEFINE6(ppc32_fadvise64,

index f84a02ab6bf90..04432b82b9e3e 100644
@@ -58,7 +58,7 @@ COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, path, u32, high, u32, lo
 
 COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd, u32, high, u32, low)
 {
-	return ksys_ftruncate(fd, ((u64)high << 32) | low);
+	return ksys_ftruncate(fd, ((u64)high << 32) | low, FTRUNCATE_LFS);
 }
 
 static int cp_compat_stat64(struct kstat *stat,

index 6cf65397d2257..610a1c2f45191 100644
@@ -61,7 +61,8 @@ SYSCALL_DEFINE3(ia32_truncate64, const char __user *, filename,
 SYSCALL_DEFINE3(ia32_ftruncate64, unsigned int, fd,
 		unsigned long, offset_low, unsigned long, offset_high)
 {
-	return ksys_ftruncate(fd, ((loff_t) offset_high << 32) | offset_low);
+	return ksys_ftruncate(fd, ((loff_t) offset_high << 32) | offset_low,
+			FTRUNCATE_LFS);
 }
 
 /* warning: next two assume little endian */

index 77e90e4124e09..8c1f6c548dbfd 100644
@@ -200,7 +200,6 @@ extern int build_open_flags(const struct open_how *how, struct open_flags *op);
 struct file *file_close_fd_locked(struct files_struct *files, unsigned fd);
 
 int do_ftruncate(struct file *file, loff_t length, int small);
-int do_sys_ftruncate(unsigned int fd, loff_t length, int small);
 int chmod_common(const struct path *path, umode_t mode);
 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
 		int flag);

index 91f1139591abe..412d0d6fbaa75 100644
@@ -197,7 +197,7 @@ int do_ftruncate(struct file *file, loff_t length, int small)
 				   ATTR_MTIME | ATTR_CTIME, file);
 }
 
-int do_sys_ftruncate(unsigned int fd, loff_t length, int small)
+int ksys_ftruncate(unsigned int fd, loff_t length, unsigned int flags)
 {
 	if (length < 0)
 		return -EINVAL;

@@ -205,18 +205,18 @@ int do_sys_ftruncate(unsigned int fd, loff_t length, int small)
 	if (fd_empty(f))
 		return -EBADF;
 
-	return do_ftruncate(fd_file(f), length, small);
+	return do_ftruncate(fd_file(f), length, !(flags & FTRUNCATE_LFS));
 }
 
 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length)
 {
-	return do_sys_ftruncate(fd, length, 1);
+	return ksys_ftruncate(fd, length, 0);
 }
 
 #ifdef CONFIG_COMPAT
 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length)
 {
-	return do_sys_ftruncate(fd, length, 1);
+	return ksys_ftruncate(fd, length, 0);
 }
 #endif
 

@@ -229,7 +229,7 @@ SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
 
 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
 {
-	return do_sys_ftruncate(fd, length, 0);
+	return ksys_ftruncate(fd, length, FTRUNCATE_LFS);
 }
 #endif /* BITS_PER_LONG == 32 */
 

@@ -245,7 +245,7 @@ COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname,
 COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd,
 		       compat_arg_u64_dual(length))
 {
-	return ksys_ftruncate(fd, compat_arg_u64_glue(length));
+	return ksys_ftruncate(fd, compat_arg_u64_glue(length), FTRUNCATE_LFS);
 }
 #endif
 

index 02bd6ddb62782..8787b3511c86c 100644
@@ -1283,12 +1283,8 @@ static inline long ksys_lchown(const char __user *filename, uid_t user,
 			     AT_SYMLINK_NOFOLLOW);
 }
 
-int do_sys_ftruncate(unsigned int fd, loff_t length, int small);
-
-static inline long ksys_ftruncate(unsigned int fd, loff_t length)
-{
-	return do_sys_ftruncate(fd, length, 1);
-}
+#define FTRUNCATE_LFS	(1u << 0)	/* allow truncating > 32-bit */
+int ksys_ftruncate(unsigned int fd, loff_t length, unsigned int flags);
 
 int do_sys_truncate(const char __user *pathname, loff_t length);
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <[email protected]>

[ Upstream commit 2b31e86387e60b3689339f0f0fbb4d3623d9d494 ]

Make drbd_adm_dump_devices() call rcu_read_lock() before rcu_read_unlock() is called. This has been detected by the Clang thread-safety analyzer.

---
 drivers/block/drbd/drbd_nl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

index e201f0087a0f7..728ecc431b38d 100644
@@ -3378,8 +3378,10 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 			cb->args[0] = (long)resource;
 		}
 	}

@@ -3628,8 +3630,10 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 		}
 		cb->args[0] = (long)resource;
 	}

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daan De Meyer <[email protected]>

[ Upstream commit 267ec4d7223a783f029a980f41b93c39b17996da ]

When LOOP_CONFIGURE is called with LO_FLAGS_PARTSCAN, the following sequence occurs:

1. disk_force_media_change() sets GD_NEED_PART_SCAN
2. Uevent suppression is lifted and a KOBJ_CHANGE uevent is sent
3. loop_global_unlock() releases the lock
4. loop_reread_partitions() calls bdev_disk_changed() to scan

There is a race between steps 2 and 4: when udev receives the uevent and opens the device before loop_reread_partitions() runs, blkdev_get_whole() in bdev.c sees GD_NEED_PART_SCAN set and calls bdev_disk_changed() for a first scan. Then loop_reread_partitions() does a second scan. The open_mutex serializes these two scans, but does not prevent both from running.

The second scan in bdev_disk_changed() drops all partition devices from the first scan (via blk_drop_partitions()) before re-adding them, causing partition block devices to briefly disappear. This breaks any systemd unit with BindsTo= on the partition device: systemd observes the device going dead, fails the dependent units, and does not retry them when the device reappears.

Fix this by removing the GD_NEED_PART_SCAN set from disk_force_media_change() entirely. None of the current callers need the lazy on-open partition scan triggered by this flag:

- floppy: sets GENHD_FL_NO_PART, so disk_has_partscan() is always false and GD_NEED_PART_SCAN has no effect.
- loop (loop_configure, loop_change_fd): when LO_FLAGS_PARTSCAN is set, loop_reread_partitions() performs an explicit scan. When not set, GD_SUPPRESS_PART_SCAN prevents the lazy scan path.
- loop (__loop_clr_fd): calls bdev_disk_changed() explicitly if LO_FLAGS_PARTSCAN is set.
- nbd (nbd_clear_sock_ioctl): capacity is set to zero immediately after; nbd manages GD_NEED_PART_SCAN explicitly elsewhere.

With GD_NEED_PART_SCAN no longer set by disk_force_media_change(), udev opening the loop device after the uevent no longer triggers a redundant scan in blkdev_get_whole(), and only the single explicit scan from loop_reread_partitions() runs.

A regression test for this bug has been submitted to blktests:
https://github.com/linux-blktests/blktests/pull/240.

---
 block/disk-events.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 9f9f9f8a2d6b1..074731ecc3d25 100644
@@ -290,13 +290,14 @@ EXPORT_SYMBOL(disk_check_media_change);
  * Should be called when the media changes for @disk.  Generates a uevent
  * and attempts to free all dentries and inodes and invalidates all block
  * device page cache entries in that case.
+ *
+ * Callers that need a partition re-scan should arrange for one explicitly.
  */
 void disk_force_media_change(struct gendisk *disk)
 {
 	disk_event_uevent(disk, DISK_EVENT_MEDIA_CHANGE);
 	inc_diskseq(disk);
 	bdev_mark_dead(disk->part0, true);
-	set_bit(GD_NEED_PART_SCAN, &disk->state);
 }
 EXPORT_SYMBOL_GPL(disk_force_media_change);
 

2.53.0

7.0-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jackie Liu <[email protected]>

[ Upstream commit 2a2f520fda824b5a25c93f2249578ea150c24e06 ]

When blk_revalidate_disk_zones() fails after disk_revalidate_zone_resources() has allocated args.zones_cond, the memory is leaked because no error path frees it.

---
 block/blk-zoned.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

index 7aae3c236cad6..a4d82342e37ac 100644
@@ -1877,6 +1877,7 @@ static int disk_revalidate_zone_resources(struct gendisk *disk,
 {
 	struct queue_limits *lim = &disk->queue->limits;
 	unsigned int pool_size;
+	int ret = 0;
 
 	args->disk = disk;
 	args->nr_zones =

@@ -1899,10 +1900,13 @@ static int disk_revalidate_zone_resources(struct gendisk *disk,
 		pool_size =
 			min(BLK_ZONE_WPLUG_DEFAULT_POOL_SIZE, args->nr_zones);
 
-	if (!disk->zone_wplugs_hash)
-		return disk_alloc_zone_resources(disk, pool_size);
+	if (!disk->zone_wplugs_hash) {
+		ret = disk_alloc_zone_resources(disk, pool_size);
+		if (ret)
+			kfree(args->zones_cond);
+	}
 
-	return 0;
+	return ret;
 }
 
 /*

@@ -1934,6 +1938,7 @@ static int disk_update_zone_resources(struct gendisk *disk,
 	disk->zone_capacity = args->zone_capacity;
 	disk->last_zone_capacity = args->last_zone_capacity;
 	disk_set_zones_cond_array(disk, args->zones_cond);
+	args->zones_cond = NULL;
 
 	/*
 	 * Some devices can advertise zone resource limits that are larger than

@@ -2216,21 +2221,30 @@ int blk_revalidate_disk_zones(struct gendisk *disk)
 	}
 	memalloc_noio_restore(noio_flag);
 
+	if (ret <= 0)
+		goto free_resources;
+
 	/*
 	 * If zones where reported, make sure that the entire disk capacity
 	 * has been checked.
 	 */
-	if (ret > 0 && args.sector != capacity) {
+	if (args.sector != capacity) {
 		pr_warn("%s: Missing zones from sector %llu\n",
 			disk->disk_name, args.sector);
 		ret = -ENODEV;
+		goto free_resources;
 	}
 
-	if (ret > 0)
-		return disk_update_zone_resources(disk, &args);
+	ret = disk_update_zone_resources(disk, &args);
+	if (ret)
+		goto free_resources;
+
+	return 0;
 
+free_resources:
 	pr_warn("%s: failed to revalidate zones\n", disk->disk_name);
 
+	kfree(args.zones_cond);
 	memflags = blk_mq_freeze_queue(q);
 	disk_free_zone_resources(disk);
 	blk_mq_unfreeze_queue(q, memflags);

2.53.0

This is the start of the stable review cycle for the 7.0.10 release. There are 1146 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 22 May 2026 16:20:16 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.10-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 7.0.10-rc1

Johan Hovold <[email protected]>
spi: sifive: fix controller deregistration

Pei Xiao <[email protected]>
spi: sifive: Simplify clock handling with devm_clk_get_enabled()

Piyush Sachdeva <[email protected]>
smb: client: Use FullSessionKey for AES-256 encryption key derivation

David Carlier <[email protected]>
eventfs: Use list_add_tail_rcu() for SRCU-protected children list

Steven Rostedt <[email protected]>
eventfs: Simplify code using guard()s

James Morse <[email protected]>
arm_mpam: Check whether the config array is allocated before destroying it

James Morse <[email protected]>
arm_mpam: Fix false positive assert failure during mpam_disable()

Ben Horgan <[email protected]>
arm_mpam: Improve check for whether or not NRDY is hardware managed

Ben Horgan <[email protected]>
arm_mpam: Pretend that NRDY is always hardware managed

Ben Horgan <[email protected]>
arm_mpam: Fix monitor instance selection when checking for hardware NRDY

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix hang on init failure

Johan Hovold <[email protected]>
drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup

Thomas Hellström <[email protected]>
drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC

Thomas Hellström <[email protected]>
drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure

Matthew Auld <[email protected]>
drm/xe/dma-buf: fix UAF with retry loop

Matthew Auld <[email protected]>
drm/xe/dma-buf: handle empty bo and UAF races

Gyeyoung Baek <[email protected]>
drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

Sebastian Brzezinka <[email protected]>
drm/i915: skip __i915_request_skip() for already signaled requests

Nicolin Chen <[email protected]>
iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid()

Nicolin Chen <[email protected]>
iommu: Fix nested pci_dev_reset_iommu_prepare/done()

Nicolin Chen <[email protected]>
iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done()

Nicolin Chen <[email protected]>
iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset

Nicolin Chen <[email protected]>
iommu: Replace per-group resetting_domain with per-gdev blocked flag

Nicolin Chen <[email protected]>

    iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()

Zhenzhong Duan <[email protected]>
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix oops due to out of scope access

Naval Alcalá <[email protected]>
iommu/vt-d: Disable DMAR for Intel Q35 IGFX

Raphael Zimmer <[email protected]>
libceph: handle rbtree insertion error in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in crush_decode()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()

Raphael Zimmer <[email protected]>
libceph: Fix potential null-ptr-deref in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in osdmap_decode()

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Allocate ITS parent LPIs as a range

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Support range allocation for LPIs

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Move LPI allocation into the LPI domain

Xianwei Zhao <[email protected]>
irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type()

Yong-Xuan Wang <[email protected]>
irqchip/riscv-imsic: Clear interrupt move state during CPU offlining

Olga Kornievskaia <[email protected]>
nfsd: update mtime/ctime on COPY in presence of delegated attributes

Olga Kornievskaia <[email protected]>
nfsd: update mtime/ctime on CLONE in presense of delegated attributes

Scott Mayhew <[email protected]>
nfsd: fix file change detection in CB_GETATTR

Olga Kornievskaia <[email protected]>
nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled

Paulo Alcantara <[email protected]>
netfs: fix error handling in netfs_extract_user_iter()

Ma Ke <[email protected]>
powerpc/warp: Fix error handling in pika_dtm_thread

Vivian Wang <[email protected]>
riscv: misaligned: Make enabling delegation depend on NONPORTABLE

Carlos López <[email protected]>
virt: sev-guest: Do not use host-controlled page order in cleanup path

Wilfred Mallawa <[email protected]>
xfs: fix memory leak on error in xfs_alloc_zone_info()

David Woodhouse <[email protected]>
x86/kexec: Push kjump return address even for non-kjump kexec

Jose Fernandez (Anthropic) <[email protected]>
iommu/amd: Bounds-check devid in __rlookup_amd_iommu()

Nicholas Carlini <[email protected]>
io-wq: check that the predecessor is hashed in io_wq_remove_pending()

Hristo Venev <[email protected]>
ceph: put folios not suitable for writeback

Viacheslav Dubeyko <[email protected]>
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size

Viacheslav Dubeyko <[email protected]>
ceph: fix a buffer leak in __ceph_setxattr()

Qu Wenruo <[email protected]>
btrfs: only release the dirty pages io tree after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: qcom: Check offload mapping failures

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Bound MIDI endpoint descriptor scans

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

Markus Kramer <[email protected]>
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone

Adrien Burnett <[email protected]>

    ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx

Gyeyoung Baek <[email protected]>
accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout()

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-other: Limit adding attributes to supported devices

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-other: Add Attribute ID helper functions

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-other: Zero initialize WMI arguments

Rong Zhang <[email protected]>
platform/x86: lenovo-wmi-other: Balance component bind and unbind

Rong Zhang <[email protected]>
platform/x86: lenovo-wmi-other: Balance IDA id allocation and free

Rong Zhang <[email protected]>
platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers

Srinivas Pandruvada <[email protected]>
platform/x86: intel: Move debugfs register before creating devices

Thomas Hellström <[email protected]>
drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure

Mikhail Gavrilov <[email protected]>
drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED

Chaitanya Kumar Borah <[email protected]>
drm/i915/dp: Fix VSC dynamic range signaling for RGB formats

Guangshuo Li <[email protected]>
drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup

Edward Adam Davis <[email protected]>
drm: Replace old pointer to new idr

Myeonghun Pak <[email protected]>
drm/loongson: Use managed KMS polling

Ye Bin <[email protected]>
smb/client: fix possible infinite loop and oob read in symlink_data()

Nick Chan <[email protected]>

    nvme-apple: Reset q->sq_tail during queue init

Pauli Virtanen <[email protected]>
Bluetooth: btmtk: accept too short WMT FUNC_CTRL events

Michael Tretter <[email protected]>
media: staging: imx: configure src_mux in csi_start

Igor Pylypiv <[email protected]>
ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands

Nathan Chancellor <[email protected]>
HID: core: Fix size_t specifier in hid_report_raw_event()

Thomas Gleixner <[email protected]>
rseq: Reenable performance optimizations conditionally

Thomas Gleixner <[email protected]>
rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode

Thomas Gleixner <[email protected]>
rseq: Revert to historical performance killing behaviour

Benjamin Tissoires <[email protected]>
HID: core: introduce hid_safe_input_report()

Benjamin Tissoires <[email protected]>
HID: pass the buffer size to hid_report_raw_event

Qiang Ma <[email protected]>
KVM: x86: Fix Xen hypercall tracepoint argument assignment

Junrui Luo <[email protected]>
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

Aaron Sacks <[email protected]>
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()

Sean Christopherson <[email protected]>
KVM: x86: Swap the dst and src operand for MOVNTDQA

sunshaojie <[email protected]>
cgroup/cpuset: Return only actually allocated CPUs during partition invalidation

Sergio Correia <[email protected]>
audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV

Zoran Ilievski <[email protected]>
net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled

Li Xiasong <[email protected]>
netfilter: nft_ct: fix missing expect put in obj eval

Mario Limonciello <[email protected]>
Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn"

Guopeng Zhang <[email protected]>
cgroup/cpuset: Reserve DL bandwidth only for root-domain moves

Greg Kroah-Hartman <[email protected]>
idpf: fix double free and use-after-free in aux device error paths

Guopeng Zhang <[email protected]>
cgroup/dmem: Return -ENOMEM on failed pool preallocation

Arthur Kiyanovski <[email protected]>
net: ena: PHC: Check return code before setting timestamp output

Sergio Correia <[email protected]>
audit: fix incorrect inheritable capability in CAPSET records

Li Xiasong <[email protected]>
netfilter: nf_conntrack_sip: get helper before allocating expectation

Guopeng Zhang <[email protected]>
cgroup/cpuset: Reset DL migration state on can_attach() failure

Arthur Kiyanovski <[email protected]>
net: ena: PHC: Fix potential use-after-free in get_timestamp

Breno Leitao <[email protected]>

    workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path

Matt Vollrath <[email protected]>
i40e: Cleanup PTP pins on probe failure

Herbert Xu <[email protected]>

    crypto: af_alg - Cap AEAD AD length to 0x80000000

Vincent Guittot <[email protected]>
sched/fair: Fix wakeup_preempt_fair() for not waking up task

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate more data-races in pie_dump_stats()

Breno Leitao <[email protected]>
workqueue: fix devm_alloc_workqueue() va_list misuse

Samiullah Khawaja <[email protected]>
PCI: Initialize temporary device in new_id_store()

Davidlohr Bueso <[email protected]>
futex: Drop CLONE_THREAD requirement for private default hash alloc

Zhaoyang Huang <[email protected]>
arm64: Reserve an extra page for early kernel mapping

Leo Yan <[email protected]>
kselftest/arm64: Include <asm/ptrace.h> for user_gcs definition

Paolo Abeni <[email protected]>
net/sched: cls_flower: revert unintended changes

Dan Carpenter <[email protected]>
sfc: fix error code in efx_devlink_info_running_versions()

Jakub Kicinski <[email protected]>
net: tls: fix strparser anchor skb leak on offload RX setup failure

Petr Oros <[email protected]>
ice: add dpll peer notification for paired SMA and U.FL pins

Ivan Vecera <[email protected]>
dpll: export __dpll_pin_change_ntf() for use under dpll_lock

Petr Oros <[email protected]>
ice: fix missing dpll notifications for SW pins

Petr Oros <[email protected]>
ice: fix SMA and U.FL pin state changes affecting paired pin

Petr Oros <[email protected]>
ice: fix missing SMA pin initialization in DPLL subsystem

Petr Oros <[email protected]>
ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw

Petr Oros <[email protected]>
ice: fix NULL pointer dereference in ice_reset_all_vfs()

Petr Oros <[email protected]>
iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler

Petr Oros <[email protected]>
iavf: wait for PF confirmation before removing VLAN filters

Petr Oros <[email protected]>
iavf: stop removing VLAN filters from PF on interface down

Petr Oros <[email protected]>
iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING

Hasan Basbunar <[email protected]>
page_pool: fix memory-provider leak in page_pool_create_percpu() error path

Eric Dumazet <[email protected]>

    bonding: 3ad: implement proper RCU rules for port->aggregator

Hangbin Liu <[email protected]>
bonding: print churn state via netlink

Lorenzo Bianconi <[email protected]>
net: airoha: Do not return err in ndo_stop() callback

Tvrtko Ursulin <[email protected]>

    drm/xe/xelp: Fix Wa_18022495364

Shuicheng Lin <[email protected]>
drm/xe/gsc: Fix BO leak on error in query_compatibility_version()

Shuicheng Lin <[email protected]>
drm/xe/eustall: Fix drm_dev_put called before stream disable in close

Shuicheng Lin <[email protected]>
drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

Shuicheng Lin <[email protected]>
drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked

Matt Roper <[email protected]>
drm/xe/debugfs: Correct printing of register whitelist ranges

Matthew Brost <[email protected]>
drm/xe: Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge()

Zhanjun Dong <[email protected]>
drm/xe: Use XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET enum instead of magic number

Timur Kristóf <[email protected]>
drm/amd/display: Use EDID from VBIOS embedded panel info

Timur Kristóf <[email protected]>
drm/amd/display: Read EDID from VBIOS embedded panel info

Timur Kristóf <[email protected]>
drm/amd/display: Allow constructing DCE8 link encoder without DDC

Timur Kristóf <[email protected]>
drm/amd/display: Allow constructing DCE6 link encoder without DDC

Timur Kristóf <[email protected]>
drm/amd/display: Allow DCE link encoder without AUX registers

Timur Kristóf <[email protected]>
drm/amd/display: Allow embedded connectors without DDC

Sebastian Andrzej Siewior <[email protected]>
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup

Shenghao Ding <[email protected]>
ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages >1

Richard Fitzgerald <[email protected]>
ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()

wangdicheng <[email protected]>
ALSA: hda/conexant: Fix missing error check for jack detection

Breno Leitao <[email protected]>
netconsole: restore userdatum value on update_userdata() failure

Breno Leitao <[email protected]>
netconsole: propagate device name truncation in dev_name_store()

Breno Leitao <[email protected]>
netconsole: avoid clobbering userdatum value on truncated write

Breno Leitao <[email protected]>
netconsole: return count instead of strnlen(buf, count) from store callbacks

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (IV)

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (II)

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (I)

Weiming Shi <[email protected]>
bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

Xin Long <[email protected]>
sctp: discard stale INIT after handshake completion

Xin Long <[email protected]>
netfilter: skip recording stale or retransmitted INIT

Christian A. Ehrhardt <[email protected]>
ASoC: codecs: ab8500: Fix casting of private data

Jakub Kicinski <[email protected]>
net: psp: require admin permission for dev-set and key-rotate

Jakub Kicinski <[email protected]>
net: psp: check for device unregister when creating assoc

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Fix illegal writes to OTP_MEM registers

Jens Axboe <[email protected]>
io_uring/napi: cap busy_poll_to 10 msec

Lijo Lazar <[email protected]>
drm/amd/pm: Add fine grained flag to SMU v13.0.6

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings

Alex Deucher <[email protected]>
drm/amd/display: properly handle family setting for early GC 11.5.4

Heiko Schocher <[email protected]>
net: phy: dp83869: fix setting CLK_O_SEL field.

Heiko Carstens <[email protected]>
s390/mm: Fix phys_to_folio() usage in do_secure_storage_access()

Yu Kuai <[email protected]>
md/md-bitmap: add a none backend for bitmap grow

Yu Kuai <[email protected]>
md/md-bitmap: split bitmap sysfs groups

Yu Kuai <[email protected]>
md: factor bitmap creation away from sysfs handling

Yu Kuai <[email protected]>
md: add fallback to correct bitmap_ops on version mismatch

Keith Busch <[email protected]>
md/raid1,raid10: don't fail devices for invalid IO errors

William A. Kennington III <[email protected]>
net: mctp i2c: check length before marking flow active

Zicheng Qu <[email protected]>
sched/fair: Clear rel_deadline when initializing forked entities

Vincent Guittot <[email protected]>
sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue

Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams

Breno Leitao <[email protected]>
netpoll: fix IPv6 local-address corruption

Altan Hacigumus <[email protected]>
tcp: make probe0 timer handle expired user timeout

Florian Westphal <[email protected]>
neigh: let neigh_xmit take skb ownership

Morduan Zang <[email protected]>
net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind

Weiming Shi <[email protected]>
net/sched: taprio: fix NULL pointer dereference in class dump

Paul Geurts <[email protected]>
NFC: trf7970a: Ignore antenna noise when checking for RF field

Felix Gu <[email protected]>
spi: amlogic-spisg: initialize completion before requesting IRQ

Morduan Zang <[email protected]>
net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit

Zhan Jun <[email protected]>

    net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

Ido Schimmel <[email protected]>
vrf: Fix a potential NPD when removing a port from a VRF

Eric Dumazet <[email protected]>
net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_choke: annotate data-races in choke_dump_stats()

Lorenzo Bianconi <[email protected]>
net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

Lorenzo Bianconi <[email protected]>
net: airoha: Do not wake all netdev TX queues in airoha_qdma_wake_netdev_txqs()

Zhengping Zhang <[email protected]>
net: airoha: fix typo in function name

Lorenzo Bianconi <[email protected]>
net: airoha: stop net_device TX queue before updating CPU index

Lorenzo Bianconi <[email protected]>
net: airoha: fix BQL imbalance in TX path

Stephen Hemminger <[email protected]>
net/sched: netem: check for negative latency and jitter

Stephen Hemminger <[email protected]>
net/sched: netem: fix slot delay calculation overflow

Stephen Hemminger <[email protected]>
net/sched: netem: validate slot configuration

Stephen Hemminger <[email protected]>
net/sched: netem: only reseed PRNG when seed is explicitly provided

Stephen Hemminger <[email protected]>
net/sched: netem: fix queue limit check to include reordered packets

Stephen Hemminger <[email protected]>
net/sched: netem: fix probability gaps in 4-state loss model

Nikola Z. Ivanov <[email protected]>
netdevsim: zero initialize struct iphdr in dummy sk_buff

Felix Gu <[email protected]>
spi: axiado: replace usleep_range() with udelay() in IRQ path

Daan De Meyer <[email protected]>
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()

Tony Luck <[email protected]>
ACPI: APEI: EINJ: Fix EINJV2 memory error injection

Tony Luck <[email protected]>
ACPICA: Provide #defines for EINJV2 error types

Miquel Raynal <[email protected]>
mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW

Miquel Raynal <[email protected]>
mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW

Miquel Raynal <[email protected]>
mtd: spinand: Add support for packed read data ODTR commands

Miquel Raynal <[email protected]>
spi: spi-mem: Add a packed command operation

Wentao Guan <[email protected]>
arm64/scs: Fix potential sign extension issue of advance_loc4

Geert Uytterhoeven <[email protected]>

    drm/color-mgmt: Typo s/R332/RGB332/

Yuho Choi <[email protected]>
drm/sysfb: ofdrm: fix PCI device reference leaks

James Calligeros <[email protected]>
ASoC: tas2770: Fix order of operations for temperature calculation

James Calligeros <[email protected]>
ASoC: tas2764: Mark die temp register as volatile

John Madieu <[email protected]>
spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ

Bard Liao <[email protected]>
ASoC: SOF: Intel: add an empty adr_link

Guilherme G. Piccoli <[email protected]>
ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED

John Madieu <[email protected]>
spi: rzv2h-rspi: Fix silent failure in clock setup error path

Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: don't use simple_strtoul

Jiexun Wang <[email protected]>
netfilter: xt_policy: fix strict mode inbound policy matching

Kent Russell <[email protected]>
drm/amdgpu: Only send RMA CPER when threshold is exceeded

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)

Timur Kristóf <[email protected]>
drm/amdgpu/uvd3.1: Don't validate the firmware when already validated

Christian König <[email protected]>
drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG

Yang Wang <[email protected]>
drm/amd/pm: fix missing fine-grained dpm table flag on aldebaran

Timur Kristóf <[email protected]>
drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM

Hongyan Xu <[email protected]>
drm/amdgpu: avoid double drm_exec_fini() in userq validate

Keith Busch <[email protected]>
nvme-pci: fix missed admin queue sq doorbell write

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: add hook transactions for device deletions

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase

Pablo Neira Ayuso <[email protected]>
rculist: add list_splice_rcu() for private lists

Florian Westphal <[email protected]>
netfilter: nf_tables: use list_del_rcu for netlink hooks

Pablo Neira Ayuso <[email protected]>
netfilter: arp_tables: fix IEEE1394 ARP payload parsing

Maurizio Lombardi <[email protected]>
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

Breno Leitao <[email protected]>
tracing: branch: Fix inverted check on stat tracer registration

Mark Harmstone <[email protected]>
btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()

Mark Harmstone <[email protected]>
btrfs: don't clobber errors in add_remap_tree_entries()

Mark Harmstone <[email protected]>
btrfs: fix bytes_may_use leak in do_remap_reloc_trans()

Mark Harmstone <[email protected]>
btrfs: fix bytes_may_use leak in move_existing_remap()

Amir Goldstein <[email protected]>
fsnotify: fix inode reference leak in fsnotify_recalc_mask()

Wolfram Sang <[email protected]>
mailbox: mailbox-test: make data_ready a per-instance variable

Wolfram Sang <[email protected]>
mailbox: mailbox-test: initialize struct earlier

Wolfram Sang <[email protected]>
mailbox: mailbox-test: don't free the reused channel

Wolfram Sang <[email protected]>
mailbox: mailbox-test: handle channel errors consistently

Wolfram Sang <[email protected]>
mailbox: add sanity check for channel array

Guopeng Zhang <[email protected]>
cgroup/cpuset: record DL BW alloc CPU for attach rollback

cuitao <[email protected]>
cgroup/rdma: fix integer overflow in rdmacg_try_charge()

Edward Adam Davis <[email protected]>
sched/psi: fix race between file release and pressure write

Wolfram Sang <[email protected]>
mailbox: mailbox-test: free channels on probe error

Jason-JH Lin <[email protected]>
mailbox: mtk-cmdq: Fix CURR and END addr for task insert case

Felix Gu <[email protected]>
mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate()

Thomas Weißschuh <[email protected]>
kbuild: Never respect CONFIG_WERROR / W=e to fixdep

Len Brown <[email protected]>
tools/power turbostat: Fix --cpu-set 1 regression on HT systems

Len Brown <[email protected]>
tools/power turbostat: Fix --cpu-set 0 regression on HT systems

David Arcari <[email protected]>
tools/power turbostat: Fix unrecognized option '-P'

Yuho Choi <[email protected]>
fbdev: offb: fix PCI device reference leak on probe failure

Len Brown <[email protected]>
tools/power turbostat: Fix AMD RAPL regression on big systems

Mathias Krause <[email protected]>
kbuild: builddeb - avoid recompiles for non-cross-compiles

Anthony Pighin (Nokia) <[email protected]>

    rtc: abx80x: Disable alarm feature if no interrupt attached

Bae Yeonju <[email protected]>
fs/adfs: validate nzones in adfs_validate_bblk()

Christian Brauner <[email protected]>
eventpoll: fix ep_remove struct eventpoll / struct file UAF

Christian Brauner <[email protected]>
eventpoll: move epi_fget() up

Christian Brauner <[email protected]>
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

Christian Brauner <[email protected]>
eventpoll: kill __ep_remove()

Christian Brauner <[email protected]>
eventpoll: split __ep_remove()

Christian Brauner <[email protected]>
eventpoll: use hlist_is_singular_node() in __ep_remove()

Randy Dunlap <[email protected]>
nstree: fix func. parameter kernel-doc warnings

Kohei Enju <[email protected]>
vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()

Lee Jones <[email protected]>
tipc: fix double-free in tipc_buf_append()

Jiayuan Chen <[email protected]>
tcp: send a challenge ACK on SEG.ACK > SND.NXT

Alexey Kodanev <[email protected]>
nfp: fix swapped arguments in nfp_encode_basic_qdr() calls

Brett Creeley <[email protected]>
virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET

Stefano Garzarella <[email protected]>
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting

Erni Sri Satya Vennela <[email protected]>
net: mana: Fix EQ leak in mana_remove on NULL port

Erni Sri Satya Vennela <[email protected]>
net: mana: Don't overwrite port probe error with add_adev result

Erni Sri Satya Vennela <[email protected]>
net: mana: Guard mana_remove against double invocation

Erni Sri Satya Vennela <[email protected]>
net: mana: Init gf_stats_work before potential error paths in probe

Erni Sri Satya Vennela <[email protected]>
net: mana: Init link_change_work before potential error paths in probe

Lorenzo Bianconi <[email protected]>
net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup()

Lorenzo Bianconi <[email protected]>
net: airoha: Rework the code flow in airoha_remove() and in airoha_probe() error path

Lorenzo Bianconi <[email protected]>
net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()

Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: fix mode mask calculation

Lorenzo Bianconi <[email protected]>
net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()

Lorenzo Bianconi <[email protected]>
net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()

Eric Dumazet <[email protected]>
net/sched: sch_sfb: annotate data-races in sfb_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_red: annotate data-races in red_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate data-races in pie_dump_stats()

Eric Dumazet <[email protected]>
net_sched: sch_hhf: annotate data-races in hhf_dump_stats()

Jacob Keller <[email protected]>
ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g

Jacob Keller <[email protected]>
ice: fix ready bitmap check for non-E822 devices

Grzegorz Nitka <[email protected]>
ice: perform PHY soft reset for E825C ports at initialization

Grzegorz Nitka <[email protected]>
ice: fix timestamp interrupt configuration for E825C

Michael Bommarito <[email protected]>
net/rds: zero per-item info buffer before handing it to visitors

Xin Long <[email protected]>
sctp: fix sockets_allocated imbalance after sk_clone()

Vikas Gupta <[email protected]>
bnge: remove unsupported backing store type

Vikas Gupta <[email protected]>
bnge: fix initial HWRM sequence

Kohei Enju <[email protected]>

    net: validate skb->napi_id in RX tracepoints

Hyunwoo Kim <[email protected]>

    ksmbd: scope conn->binding slowpath to bound sessions only

DaeMyung Kang <[email protected]>
ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open

DaeMyung Kang <[email protected]>
ksmbd: destroy async_ida in ksmbd_conn_free()

DaeMyung Kang <[email protected]>
ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()

Sangyun Kim <[email protected]>
pwm: atmel-tcb: Cache clock rates and mark chip as atomic

Matt Evans <[email protected]>
vfio/pci: Clean up DMABUFs before disabling function

Jun Yan <[email protected]>
arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number

Anand Moon <[email protected]>
arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0

Chia-Yu Chang <[email protected]>
net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()

Weiming Shi <[email protected]>
slip: bound decode() reads against the compressed packet length

Weiming Shi <[email protected]>
slip: reject VJ receive packets on instances with no rstate array

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Yingnan Zhang <[email protected]>
ipvs: fix MTU check for GSO packets in tunnel mode

Pablo Neira Ayuso <[email protected]>
netfilter: nat: use kfree_rcu to release ops

Pablo Neira Ayuso <[email protected]>
netfilter: xtables: restrict several matches to inet family

Florian Westphal <[email protected]>
netfilter: conntrack: remove sprintf usage

Xiang Mei <[email protected]>
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

Pablo Neira Ayuso <[email protected]>
netfilter: nft_osf: restrict it to ipv4

Lorenzo Bianconi <[email protected]>
net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()

Weiming Shi <[email protected]>
openvswitch: cap upcall PID array size and pre-size vport replies

Prathamesh Deshpande <[email protected]>
net/mlx5: Fix HCA caps leak on notifier init failure

Qingfang Deng <[email protected]>
pppoe: drop PFC frames

Michael Bommarito <[email protected]>
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks

Kuniyuki Iwashima <[email protected]>
af_unix: Drop all SCM attributes for SOCKMAP.

Eric Dumazet <[email protected]>
ipv6: fix possible UAF in icmpv6_rcv()

Matt Vollrath <[email protected]>
e1000e: Unroll PTP in probe error handling

Petr Oros <[email protected]>
iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

Kohei Enju <[email protected]>
i40e: don't advertise IFF_SUPP_NOFCS

Kohei Enju <[email protected]>
ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

Keita Morisaki <[email protected]>
ice: fix race condition in TX timestamp ring cleanup

Paul Greenwalt <[email protected]>
ice: fix ICE_AQ_LINK_SPEED_M for 200G

Paul Greenwalt <[email protected]>
ice: fix PHY config on media change with link-down-on-close

Michal Schmidt <[email protected]>
ice: fix double-free of tx_buf skb

Grzegorz Nitka <[email protected]>
ice: update PCS latency settings for E825 10G/25Gb modes

Grzegorz Nitka <[email protected]>
ice: fix 'adjust' timer programming for E830 devices

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->plb_rehash

Eric Dumazet <[email protected]>

    tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->timeout_rehash

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->srtt_us

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->reord_seen

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->dsack_dups

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_retrans

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_sent

Eric Dumazet <[email protected]>
tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->delivered and tp->delivered_ce

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->snd_ssthresh

Eric Dumazet <[email protected]>

    tcp: add data-races annotations around tp->reordering, tp->snd_cwnd

Eric Dumazet <[email protected]>

    tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans

Eric Dumazet <[email protected]>
tcp: annotate data-races in tcp_get_info_chrono_stats()

Eric Dumazet <[email protected]>
tcp: inline tcp_chrono_start()

Eric Dumazet <[email protected]>

    tcp: move tp->chrono_type next tp->chrono_stat[]

Akif <[email protected]>
ksmbd: fix use-after-free in smb2_open during durable reconnect

Wei Fang <[email protected]>
net: enetc: fix NTMP DMA use-after-free issue

Wei Fang <[email protected]>
net: enetc: correct the command BD ring consumer index

Stanislav Fomichev <[email protected]>
net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops

Vinicius Costa Gomes <[email protected]>
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

Lorenzo Bianconi <[email protected]>
net: airoha: Wait for NPU PPE configuration to complete in airoha_ppe_offload_setup()

Jiayuan Chen <[email protected]>
nexthop: fix IPv6 route referencing IPv4 nexthop

Dudu Lu <[email protected]>
net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys

Dudu Lu <[email protected]>
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF

Dudu Lu <[email protected]>
net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

Uwe Kleine-König <[email protected]>
pwm: stm32: Fix rounding issue for requests with inverted polarity

Gabor Juhos <[email protected]>
arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names

Peng Fan <[email protected]>
arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT

Ronald Claveau <[email protected]>
reset: amlogic: t7: Fix null reset ops

René Rebe <[email protected]>
PCMCIA: Fix garbled log messages for KERN_CONT

Peng Fan <[email protected]>
arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT

Jork Loeser <[email protected]>
Drivers: hv: vmbus: fix hyperv_cpuhp_online variable shadowing

Aditya Garg <[email protected]>
tools: hv: Fix cross-compilation

Gao Xiang <[email protected]>
erofs: unify lcn as u64 for 32-bit platforms

Gao Xiang <[email protected]>
erofs: fix offset truncation when shifting pgoff on 32-bit platforms

Thomas Zimmermann <[email protected]>
sh: Include <linux/io.h> in dac.h

Paul Moses <[email protected]>
crypto: ccp - copy IV using skcipher ivsize

T Pratham <[email protected]>
crypto: sa2ul - Fix AEAD fallback algorithm names

Aleksander Jan Bajkowski <[email protected]>
crypto: eip93 - fix hmac setkey algo selection

Sami Mujawar <[email protected]>
virt: arm-cca-guest: fix error check for RSI_INCOMPLETE

Ville Syrjälä <[email protected]>
drm/i915/wm: Verify the correct plane DDB entry

Yongpeng Yang <[email protected]>
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

Jaegeuk Kim <[email protected]>
f2fs: allow empty mount string for Opt_usr|grp|projjquota

Brian Masney <[email protected]>
clk: visconti: pll: initialize clk_init_data to zero

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix parameter mismatch in panel self-refresh helper

Pengpeng Hou <[email protected]>
scsi: hpsa: Enlarge controller and IRQ name buffers

Zhiguo Niu <[email protected]>
f2fs: fix to preserve previous reserve_{blocks,node} value when remount

Yongpeng Yang <[email protected]>
f2fs: fix data loss caused by incorrect use of nat_entry flag

Geert Uytterhoeven <[email protected]>
lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()

Vladimir Zapolskiy <[email protected]>
clk: qcom: gdsc: Fix error path on registration of multiple pm subdomains

John Ogness <[email protected]>
printk_ringbuffer: Fix get_data() size sanity check

Jianan Huang <[email protected]>
f2fs: avoid reading already updated pages during GC

Shuwei Wu <[email protected]>
clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()

Geert Uytterhoeven <[email protected]>
clk: xgene: Fix mapping leak in xgene_pllclk_init()

Arnd Bergmann <[email protected]>
clk: qoriq: avoid format string warning

Thomas Weißschuh <[email protected]>
x86/um: fix vDSO installation

Tiwei Bie <[email protected]>
um: Fix potential race condition in TLB sync

Sebastian Krzyszkowiak <[email protected]>
clk: imx8mq: Correct the CSI PHY sels

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Enable parents for pixel clocks

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for PCIe power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for USB power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Add missing GDSCs

Val Packett <[email protected]>

    dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs

Shawn Lin <[email protected]>
scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item

Junrui Luo <[email protected]>
scsi: target: core: Fix integer overflow in UNMAP bounds check

Nilesh Javali <[email protected]>
scsi: qla2xxx: Add support to report MPI FW state

Fabrizio Castro <[email protected]>

    clk: renesas: r9a09g057: Remove entries for WDT{0,2,3}

Konrad Dybcio <[email protected]>
clk: qcom: dispcc[01]-sa8775p: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-milos: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-kaanapali: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-glymur: Fix DSI byte clock rate setting

White Lewis <[email protected]>

    clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers

Yang Erkun <[email protected]>
scsi: sg: Resolve soft lockup issue when opening /dev/sgX

Yang Erkun <[email protected]>
scsi: sg: Fix sysctl sg-big-buff register during sg_init()

Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock

Ovidiu Panait <[email protected]>
clk: renesas: r9a09g056: Fix ordering of module clocks array

Ovidiu Panait <[email protected]>
clk: renesas: r9a09g057: Fix ordering of module clocks array

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-glymur: use RCG2 ops for DPTX1 AUX clock source

Taniya Das <[email protected]>
clk: qcom: gcc-glymur: Add video axi clock resets for glymur

Taniya Das <[email protected]>
dt-bindings: clock: qcom: Add GCC video axi reset clock for Glymur

Krishna Chomal <[email protected]>
platform/x86: hp-wmi: fix fan table parsing

Florian Westphal <[email protected]>
RDMA/core: Prefer NLA_NUL_STRING

Pengpeng Hou <[email protected]>
platform/x86: dell-wmi-sysman: bound enumeration string aggregation

Fedor Pchelkin <[email protected]>
platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()

Emre Cecanpunar <[email protected]>
platform/x86: hp-wmi: add locking for concurrent hwmon access

Emre Cecanpunar <[email protected]>
platform/x86: hp-wmi: fix u8 underflow in gpu_delta calculation

Emre Cecanpunar <[email protected]>
platform/x86: hp-wmi: use mod_delayed_work to reset keep-alive timer

Emre Cecanpunar <[email protected]>
platform/x86: hp-wmi: avoid cancel_delayed_work_sync from work handler

Emre Cecanpunar <[email protected]>
platform/x86: hp-wmi: fix ignored return values in fan settings

Pengpeng Hou <[email protected]>
fs/ntfs3: terminate the cached volume label after UTF-8 conversion

Thomas Bogendoerfer <[email protected]>
tty: serial: ip22zilog: Fix section mispatch warning

Denis Benato <[email protected]>
platform/x86: asus-wmi: fix screenpad brightness range

Denis Benato <[email protected]>
platform/x86: asus-wmi: adjust screenpad power/brightness handling

Damien Riégel <[email protected]>
greybus: raw: fix use-after-free if write is called after disconnect

Damien Riégel <[email protected]>
greybus: raw: fix use-after-free on cdev close

Leon Romanovsky <[email protected]>
RDMA/umem: Use consistent DMA attributes when unmapping entries

Chuck Lever <[email protected]>
nfsd: use dynamic allocation for oversized NFSv4.0 replay cache

Dai Ngo <[email protected]>
NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

Andy Shevchenko <[email protected]>
sunrpc: Fix compilation error (make W=1) when dprintk() is no-op

Andy Shevchenko <[email protected]>
sunrpc: Kill RPC_IFDEBUG()

Andy Shevchenko <[email protected]>
nfs/blocklayout: Fix compilation error (make W=1) in bl_write_pagelist()

Abdun Nihaal <[email protected]>
mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()

Deepanshu Kartikey <[email protected]>
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

Dmitry Torokhov <[email protected]>
platform/x86: barco-p50-gpio: normalize return value of gpio_get

Rafael J. Wysocki <[email protected]>
platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup

Mostafa Saleh <[email protected]>
usb: typec: ps883x: Fix Oops at unbind

Randy Dunlap <[email protected]>
tty: hvc_iucv: fix off-by-one in number of supported devices

Ethan Tidmore <[email protected]>
usb: typec: Fix error pointer dereference

Chen Ni <[email protected]>

    leds: lgm-sso: Remove duplicate assignments for priv->mmap

Rafael J. Wysocki <[email protected]>
platform/surface: surfacepro3_button: Drop wakeup source on remove

Chen Ni <[email protected]>
backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()

Edward Adam Davis <[email protected]>
fs/ntfs3: prevent uninitialized lcn caused by zero len

Billy Tsai <[email protected]>
i3c: mipi-i3c-hci: fix IBI payload length calculation for final status

Jorge Marques <[email protected]>
i3c: master: adi: Fix error propagation for CCCs

Jorge Marques <[email protected]>
i3c: master: Fix error codes at send_ccc_cmd

Felix Gu <[email protected]>
i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()

Felix Gu <[email protected]>
i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()

Felix Gu <[email protected]>
i3c: master: dw-i3c: Balance PM runtime usage count on probe failure

Felix Gu <[email protected]>
i3c: master: dw-i3c: Fix missing reset assertion in remove() callback

Arnaldo Carvalho de Melo <[email protected]>
perf util: Kill die() prototype, dead for a long time

Ian Rogers <[email protected]>
perf maps: Fix copy_from that can break sorted by name order

Ian Rogers <[email protected]>
perf maps: Fix fixup_overlap_and_insert that can break sorted by name order

Inochi Amaoto <[email protected]>
pinctrl: sophgo: pinctrl-sg2044: Fix wrong module description

Inochi Amaoto <[email protected]>
pinctrl: sophgo: pinctrl-sg2042: Fix wrong module description

Ian Rogers <[email protected]>
perf cgroup: Update metric leader in evlist__expand_cgroup

Jian Zhang <[email protected]>
ipmi: ssif_bmc: change log level to dbg in irq callback

Jian Zhang <[email protected]>
ipmi: ssif_bmc: fix message desynchronization after truncated response

Jian Zhang <[email protected]>
ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure

Ian Rogers <[email protected]>
perf metrics: Make common stalled metrics conditional on having the event

Leo Yan <[email protected]>
perf expr: Return -EINVAL for syntax error in expr__find_ids()

Thomas Richter <[email protected]>
perf test: Skip perf data type profiling tests for s390

Thomas Falcon <[email protected]>
perf test: Fix ratio_to_prev event parsing test

Chuck Lever <[email protected]>
perf tools: Fix module symbol resolution for non-zero .text sh_addr

Breno Leitao <[email protected]>
perf stat: Fix crash on arm64

Mike Rapoport (Microsoft) <[email protected]>
memblock: reserve_mem: fix end caclulation in reserve_mem_release_by_name()

Ian Rogers <[email protected]>

    perf stat: Fix opt->value type for parse_cache_level

Ian Rogers <[email protected]>
perf lock: Fix option value type in parse_max_stack

Leo Yan <[email protected]>
tools build: Correct link flags for libopenssl

Biju Das <[email protected]>
pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers

Yu-Chun Lin <[email protected]>
pinctrl: abx500: Fix type of 'argument' variable

Yu-Chun Lin <[email protected]>
pinctrl: realtek: Fix function signature for config argument

Andy Shevchenko <[email protected]>
pinctrl: pinconf-generic: Fully validate 'pinmux' property

Mike Leach <[email protected]>
perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace

Ian Rogers <[email protected]>
perf branch: Avoid incrementing NULL

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Avoid returning positive values to user space

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()

Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: remove duplicate error message

Ian Rogers <[email protected]>
perf test type profiling: Remote typedef on struct

Felix Gu <[email protected]>
pinctrl: microchip-mssio: Fix missing return in probe

Ian Rogers <[email protected]>
perf trace: Avoid an ERR_PTR in syscall_stats

Ethan Tidmore <[email protected]>
pinctrl: pinctrl-pic32: Fix resource leak

Gabor Juhos <[email protected]>
dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: add missing items keyword

wangguangju <[email protected]>
perf trace: Fix IS_ERR() vs NULL check bug

Puranjay Mohan <[email protected]>
bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT

Puranjay Mohan <[email protected]>
bpf: Validate node_id in arena_alloc_pages()

Jiri Olsa <[email protected]>
libbpf: Prevent double close and leak of btf objects

Yihan Ding <[email protected]>
bpf: allow UTF-8 literals in bpf_bprintf_prepare()

Mykyta Yatsenko <[email protected]>
bpf: Fix NULL deref in map_kptr_match_type for scalar regs

Daniel Borkmann <[email protected]>
bpf: Fix precedence bug in convert_bpf_ld_abs alignment check

Michal Luczaj <[email protected]>
bpf, sockmap: Take state lock for af_unix iter

Michal Luczaj <[email protected]>
bpf, sockmap: Fix af_unix null-ptr-deref in proto update

Michal Luczaj <[email protected]>
bpf, sockmap: Fix af_unix iter deadlock

Puranjay Mohan <[email protected]>
bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize

Puranjay Mohan <[email protected]>
bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator finalize

Daniel Borkmann <[email protected]>
bpf, arm64: Fix off-by-one in check_imm signed range check

Daniel Borkmann <[email protected]>
bpf, arm64: Reject out-of-range B.cond targets

Ye Bin <[email protected]>
ext4: fix possible null-ptr-deref in mbt_kunit_exit()

Ye Bin <[email protected]>
ext4: fix possible null-ptr-deref in extents_kunit_exit()

Ye Bin <[email protected]>
ext4: fix the error handling process in extents_kunit_init).

Ye Bin <[email protected]>
ext4: call deactivate_super() in extents_kunit_exit()

Ye Bin <[email protected]>

    ext4: fix miss unlock 'sb->s_umount' in extents_kunit_init()

Oliver Neukum <[email protected]>
HID: usbhid: fix deadlock in hid_post_reset()

Miquel Raynal <[email protected]>
mtd: spinand: winbond: Clarify when to enable the HS bit

Richard Genoud <[email protected]>
mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob

Li Ming <[email protected]>
cxl/pci: Check memdev driver binding status in cxl_reset_done()

Cosmin Tanislav <[email protected]>
mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions

Cosmin Tanislav <[email protected]>
mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path

Shiji Yang <[email protected]>
mtd: spi-nor: swp: check SR_TB flag when getting tb_mask

Haibo Chen <[email protected]>
mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR sfdp fixup for mt35xu512aba

Jonas Gorski <[email protected]>
mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation

Haibo Chen <[email protected]>
mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations

Geert Uytterhoeven <[email protected]>
dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range

Dmitry Safonov <[email protected]>
ima_fs: Correctly create securityfs files for unsupported hash algos

Chen Ni <[email protected]>
mtd: physmap_of_gemini: Fix disabled pinctrl state check

Krzysztof Kozlowski <[email protected]>
power: supply: max77705: Free allocated workqueue and fix removal order

Krzysztof Kozlowski <[email protected]>
power: supply: max77705: Drop duplicated IRQ error message

Krzysztof Kozlowski <[email protected]>
workqueue: devres: Add device-managed allocate workqueue

Denis Benato <[email protected]>
HID: asus: do not abort probe when not necessary

Denis Benato <[email protected]>
HID: asus: make asus_resume adhere to linux kernel coding standards

Daniel Hodges <[email protected]>
ima: check return value of crypto_shash_final() in boot aggregate

Chen Ni <[email protected]>
remoteproc: imx_rproc: Check return value of regmap_attach_dev() in imx_rproc_mmio_detect_mode()

Thomas Weißschuh <[email protected]>
stop_machine: Fix the documentation for a NULL cpus argument

Tim Michals <[email protected]>
remoteproc: xlnx: Fix sram property parsing

Francesco Lavra <[email protected]>
hte: tegra194: remove Kconfig dependency on Tegra194 SoC

Pengpeng Hou <[email protected]>
tracing: Rebuild full_name on each hist_field_name() call

Arnd Bergmann <[email protected]>
tracing: move __printf() attribute on __ftrace_vbprintk()

Richard Fitzgerald <[email protected]>
soundwire: cadence: Clear message complete before signaling waiting thread

Frank Li <[email protected]>
dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()

Bard Liao <[email protected]>
soundwire: Intel: test bus.bpt_stream before assigning it

Cole Leavitt <[email protected]>
soundwire: bus: demote UNATTACHED state warnings to dev_dbg()

Janne Grunau <[email protected]>
phy: apple: apple: Use local variable for ioremap return value

Khairul Anuar Romli <[email protected]>
dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function

Khairul Anuar Romli <[email protected]>
dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis

ZhengYuan Huang <[email protected]>
ocfs2: validate group add input before caching

ZhengYuan Huang <[email protected]>
ocfs2: validate bg_bits during freefrag scan

ZhengYuan Huang <[email protected]>
ocfs2: fix listxattr handling when the buffer is full

Richard Cheng <[email protected]>
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

Sebastian Ene <[email protected]>
firmware: arm_ffa: Use the correct buffer size during RXTX_MAP

Frank Li <[email protected]>
ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended

Christian A. Ehrhardt <[email protected]>
lib: kunit_iov_iter: fix memory leaks

Christoph Hellwig <[email protected]>
arm64/xor: fix conflicting attributes for xor_block_template

Aaro Koskinen <[email protected]>
ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX

Alexander Koskovich <[email protected]>

    arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP

Abel Vesa <[email protected]>
arm64: dts: qcom: milos: Add missing CX power domain to GCC

Alok Tiwari <[email protected]>
soc: qcom: aoss: compare against normalized cooling state

Alok Tiwari <[email protected]>
soc: qcom: llcc: fix v1 SB syndrome register offset

Junrui Luo <[email protected]>
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

Junrui Luo <[email protected]>
ocfs2/dlm: validate qr_numregions in dlm_match_regions()

Michal Grzedzicki <[email protected]>
unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure

Jon Hunter <[email protected]>
soc/tegra: pmc: Add kerneldoc for wake-up variables

Jon Hunter <[email protected]>
soc/tegra: pmc: Correct function names in kerneldoc

Jon Hunter <[email protected]>
soc/tegra: pmc: Add kerneldoc for reboot notifier

Jon Hunter <[email protected]>
arm64: tegra: Fix RTC aliases

Sumit Gupta <[email protected]>
soc/tegra: cbb: Fix cross-fabric target timeout lookup

Sumit Gupta <[email protected]>
soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables

Sumit Gupta <[email protected]>
soc/tegra: cbb: Set ERD on resume for err interrupt

Xu Yang <[email protected]>
arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual

Xu Yang <[email protected]>
arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual

Josua Mayer <[email protected]>
arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word

Josua Mayer <[email protected]>
arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes

Josua Mayer <[email protected]>
arm64: dts: lx2160a: add sda gpio references for i2c bus recovery

Josua Mayer <[email protected]>
arm64: dts: lx2160a: rename pinmux nodes for readability

Josua Mayer <[email protected]>
arm64: dts: lx2160a: remove duplicate pinmux nodes

Josua Mayer <[email protected]>
arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit

Liu Ying <[email protected]>
arm64: dts: imx8mp-evk: Specify ADV7535 register addresses

Shengjiu Wang <[email protected]>

    arm64: dts: imx8dxl-evk: Use audio-graph-card2 for wm8960-2 and wm8960-3

Annette Kobou <[email protected]>
arm64: dts: imx8mp-kontron: Fix boot order for PMIC and RTC

Alexander Stein <[email protected]>
arm64: dts: imx91: Remove TMU's superfluous sensor ID

Nora Schiffer <[email protected]>
arm64: dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS muxing

Francesco Dolcini <[email protected]>
arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label

Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins

Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62l3-evm: Disable MMC1 internal pulls on data pins

Judith Mendez <[email protected]>
arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins

Barnabás Czémán <[email protected]>
arm64: dts: qcom: msm8917-xiaomi-riva: Fix board-id for all bootloader

David Heidelberg <[email protected]>
arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot

Luca Weiss <[email protected]>
arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: hamoa: Fix xo clock supply of platform SD host controller

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8750: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8650: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8550: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm8450: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: milos: Fix GIC_ITS range length

Konrad Dybcio <[email protected]>
arm64: dts: qcom: kaanapali: Fix GIC_ITS range length

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8750: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8650: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8550: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: monaco: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: lemans: correct Iris corners for the MXC rail

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: hamoa: correct Iris corners for the MXC rail

Tobias Heider <[email protected]>
arm64: dts: qcom: add missing denali-oled.dtb to Makefile

Riccardo Mereu <[email protected]>
arm64: dts: qcom: arduino-imola: fix faulty spidev node

Gatien Chevallier <[email protected]>
bus: rifsc: fix RIF configuration check for peripherals

Shawn Lin <[email protected]>
arm64: dts: rockchip: Add mphy reset to ufshc node

谢致邦 (XIE Zhibang) <[email protected]>
arm64: dts: rockchip: Fix RK3562 EVB2 model name

Aurelien Jarno <[email protected]>
riscv: dts: spacemit: drop incorrect pinctrl for combo PHY

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: register reasons for probe deferrals

Dmitry Baryshkov <[email protected]>
soc: qcom: ocmem: make the core clock optional

Chris Morgan <[email protected]>
arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace

Chris Morgan <[email protected]>
arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace

Robin Murphy <[email protected]>
Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1"

Ming Wang <[email protected]>
arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi

Dmitry Baryshkov <[email protected]>
soc: qcom: ubwc: disable bank swizzling for Glymur platform

Mukesh Ojha <[email protected]>
firmware: qcom_scm: don't opencode kmemdup

Barnabás Czémán <[email protected]>
arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight

Barnabás Czémán <[email protected]>
arm64: dts: qcom: msm8937-xiaomi-land: correct wled ovp value

Barnabás Czémán <[email protected]>
arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value

Miquel Raynal <[email protected]>
ARM: dts: BCM5301X: Drop extra NAND controller compatible

Josua Mayer <[email protected]>
arm64: dts: imx8mp-hummingboard-pulse: fix mini-hdmi dsi port reference

Josua Mayer <[email protected]>
arm64: dts: imx8mp-hummingboard-pulse/cubox-m: fix vmmc gpio polarity

Frieder Schrempf <[email protected]>
arm64: dts: imx8mp-kontron: Drop vmmc-supply to fix SD card on SMARC eval carrier

Frieder Schrempf <[email protected]>
arm64: dts: imx8mp-kontron: Fix touch reset configuration on DL devices

Thorsten Blum <[email protected]>

    iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count

Akari Tsuyukusa <[email protected]>
arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count

Kendall Willis <[email protected]>
arm64: dts: ti: k3-am62l: include WKUP_UART0 in wakeup peripheral window

Konrad Dybcio <[email protected]>
arm64: dts: qcom: talos: Add missing clock-names to GCC

Hongyang Zhao <[email protected]>

    arm64: dts: qcom: qcs6490-rubikpi3: Use lt9611 DSI Port B

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Fix reserved gpio ranges

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove extcon

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Correct reserved memory ranges

Barnabás Czémán <[email protected]>
arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove board-id

Jacob Pan <[email protected]>
iommufd: vfio compatibility extension check for noiommu mode

Sherry Sun <[email protected]>
arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1)

Heiko Stuebner <[email protected]>
arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config

Frank Wunderlich <[email protected]>
arm64: dts: mediatek: mt7988a-bpi-r4pro: fix model string

Yixun Lan <[email protected]>
riscv: dts: spacemit: pcie: fix missing power regulator

Luke Wang <[email protected]>
arm64: dts: imx91-11x11-evk: change usdhc tuning step for eMMC and SD

Francesco Dolcini <[email protected]>
arm64: dts: imx8-apalis: Fix LEDs name collision

Mikko Perttunen <[email protected]>
memory: tegra30-emc: Fix dll_change check

Mikko Perttunen <[email protected]>
memory: tegra124-emc: Fix dll_change check

Rafał Miłecki <[email protected]>
ARM: dts: mediatek: mt7623: fix efuse fallback compatible

Nícolas F. R. A. Prado <[email protected]>
arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon

Joshua Klinesmith <[email protected]>
ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

Thomas Huth <[email protected]>
efi/capsule-loader: fix incorrect sizeof in phys array reallocation

Andreas Gruenbacher <[email protected]>
gfs2: prevent NULL pointer dereference during unmount

Andreas Gruenbacher <[email protected]>
gfs2: add some missing log locking

Arnd Bergmann <[email protected]>

    vfio: unhide vdev->debug_root

Jan Kara <[email protected]>
quota: Fix race of dquot_scan_active() with quota deactivation

Andreas Gruenbacher <[email protected]>
gfs2: less aggressive low-memory log flushing

Ted Logan <[email protected]>
vfio: selftests: Build tests on aarch64

Tomas Glozar <[email protected]>
rtla: Fix segfault on multiple SIGINTs

Costa Shulyupin <[email protected]>
tools/rtla: Generate optstring from long options

Wander Lairson Costa <[email protected]>
rtla/utils: Fix resource leak in set_comm_sched_attr()

Wander Lairson Costa <[email protected]>
rtla/trace: Fix write loop in trace_event_save_hist()

Wander Lairson Costa <[email protected]>
rtla: Use str_has_prefix() for prefix checks

Wander Lairson Costa <[email protected]>
rtla: Simplify code by caching string lengths

Alex Mastro <[email protected]>
vfio: selftests: fix crash in vfio_dma_mapping_mmio_test

Ricardo B. Marlière <[email protected]>
ktest: Run POST_KTEST hooks on failure and cancellation

Ricardo B. Marlière <[email protected]>
ktest: Honor empty per-test option overrides

Ricardo B. Marlière <[email protected]>
ktest: Avoid undef warning when WARNINGS_FILE is unset

Luis Henriques <[email protected]>
fuse: fix uninit-value in fuse_dentry_revalidate()

Jingbo Xu <[email protected]>
fuse: fix premature writetrhough request for large folio

Ondrej Mosnacek <[email protected]>
fanotify: call fanotify_events_supported() before path_permission() and security_path_notify()

Ondrej Mosnacek <[email protected]>
fanotify: avoid/silence premature LSM capability checks

Andreas Gruenbacher <[email protected]>
gfs2: Call unlock_new_inode before d_instantiate

Kailang Yang <[email protected]>
ALSA: hda/realtek - fixed speaker no sound update

Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP

Haixin Xu <[email protected]>
crypto: jitterentropy - replace long-held spinlock with mutex

Miquel Raynal <[email protected]>
spi: cadence-qspi: Revert the filtering of certain opcodes in ODTR

Tejun Heo <[email protected]>
sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking

Tejun Heo <[email protected]>

    sched_ext: Track @p's rq lock across set_cpus_allowed_scx -> ops.set_cpumask

Ming-Hung Tsai <[email protected]>
dm cache: fix missing return in invalidate_committed's error path

Cássio Gabriel <[email protected]>
ALSA: sc6000: Keep the programmed board state in card-private data

Pei Xiao <[email protected]>
spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

Lad Prabhakar <[email protected]>
spi: rzv2h-rspi: Fix invalid SPR=0/BRDV=0 clock configuration

Richard Fitzgerald <[email protected]>
ASoC: SDCA: Fix cleanup inversion in class driver

Yao Zi <[email protected]>
PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports

Yao Zi <[email protected]>
PCI: cadence: Add flags for disabling ASPM capability for broken Root Ports

Bart Van Assche <[email protected]>
drm/fb-helper: Fix a locking bug in an error path

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on

Vidya Sagar <[email protected]>
PCI: tegra194: Disable L1.2 capability of Tegra234 EP

Manikanta Maddireddy <[email protected]>
PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Use DWC IP core version

Vidya Sagar <[email protected]>
PCI: tegra194: Free up Endpoint resources during remove()

Vidya Sagar <[email protected]>
PCI: tegra194: Allow system suspend when the Endpoint link is not up

Vidya Sagar <[email protected]>
PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Disable direct speed change for Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Disable PERST# IRQ only in Endpoint mode

Vidya Sagar <[email protected]>
PCI: tegra194: Don't force the device into the D0 state before L2

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down

Manikanta Maddireddy <[email protected]>
PCI: tegra194: Increase LTSSM poll time on surprise link down

Vidya Sagar <[email protected]>
PCI: tegra194: Fix polling delay for L2 state

songxiebing <[email protected]>
ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_stream

Syed Saba Kareem <[email protected]>
ASoC: amd: ps: fix the pcm device numbering for acp pdm dmic

Kuninori Morimoto <[email protected]>
ASoC: amd: name back to pcm_new()/pcm_free()

Kuninori Morimoto <[email protected]>
ASoC: soc-component: re-add pcm_new()/pcm_free()

Cheng-Yang Chou <[email protected]>
tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing

Richard Cheng <[email protected]>
PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports

Cássio Gabriel <[email protected]>
ASoC: SOF: compress: return the configured codec from get_params

Ravi Hothi <[email protected]>
ASoC: qcom: audioreach: explicitly enable speaker protection modules

Panagiotis Petrakopoulos <[email protected]>
ALSA: scarlett2: Add missing sentinel initializer field

David Carlier <[email protected]>
gpu: nova-core: fix missing colon in SEC2 boot debug message

Gary Guo <[email protected]>
gpu: nova-core: remove redundant .as_ref() for dev_* print

Waiman Long <[email protected]>
selftest: memcg: skip memcg_sock test if address family not supported

Sergey Senozhatsky <[email protected]>
zram: do not permit params change after init

SeongJae Park <[email protected]>

    Docs/mm/damon/index: fix typo: autoamted -> automated

SeongJae Park <[email protected]>
Docs/admin-guide/mm/damn/lru_sort: fix intervals autotune parameter name

Jane Chu <[email protected]>
Documentation: fix a hugetlbfs reservation statement

AnishMulay <[email protected]>
selftests/mm: skip migration tests if NUMA is unavailable

Eliot Courtney <[email protected]>
gpu: nova-core: bitfield: fix broken Default implementation

Chen-Yu Tsai <[email protected]>
PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

Richard Zhu <[email protected]>
dt-bindings: PCI: imx6q-pcie: Fix maxItems of clocks and clock-names

Felix Gu <[email protected]>
PCI: aspeed: Fix IRQ domain leak on platform_get_irq() failure

Richard Zhu <[email protected]>
PCI: imx6: Keep Root Port MSI capability with iMSI-RX to work around hardware bug

Gerd Bayer <[email protected]>
PCI: Enable AtomicOps only if Root Port supports them

Denis Rastyogin <[email protected]>

    ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]

Cássio Gabriel <[email protected]>
ALSA: hda: Notify IEC958 Default PCM switch state changes

Giovanni Cabiddu <[email protected]>
crypto: qat - use swab32 macro

Giovanni Cabiddu <[email protected]>
crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table()

Giovanni Cabiddu <[email protected]>
crypto: qat - fix type mismatch in RAS sysfs show functions

Giovanni Cabiddu <[email protected]>
crypto: qat - fix compression instance leak

Ahsan Atta <[email protected]>

    crypto: qat - disable 420xx AE cluster when lead engine is fused off

Ahsan Atta <[email protected]>
crypto: qat - disable 4xxx AE cluster when lead engine is fused off

Hans Zhang <[email protected]>
PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value

Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: topology: check widget type before accessing data

Jason Gunthorpe <[email protected]>
iommu/riscv: Remove overflows on the invalidation path

Vasant Hegde <[email protected]>
iommu/amd: Fix clone_alias() to use the original device's devid

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Change the type for iec958 channel status controls

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()

Shengjiu Wang <[email protected]>
ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()

Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()

Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in micfil_quality_set()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in micfil_range_set()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()

Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: Add access property for "VAD Detected"

Dmitry Baryshkov <[email protected]>

    drm/msm/dpu: drop INTF_0 on MSM8953

Dmitry Baryshkov <[email protected]>
PM: domains: De-constify fields in struct dev_pm_domain_attach_data

Felix Gu <[email protected]>

    pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()

Felix Gu <[email protected]>
pmdomain: ti: omap_prm: Fix a reference leak on device node

wangdicheng <[email protected]>
ALSA: hda/cmedia: Remove duplicate pin configuration parsing

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix gpu init from secure world

Akhil P Oommen <[email protected]>
drm/msm/adreno: Implement gx_is_on() for A8x

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Correct OOB usage

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Switch to preemption safe AO counter

Akhil P Oommen <[email protected]>
drm/msm/a8xx: Fix the ticks used in submit traces

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Use barriers while updating HFI Q headers

Connor Abbott <[email protected]>
drm/msm/a6xx: Fix dumping A650+ debugbus blocks

Rob Clark <[email protected]>
drm/msm/shrinker: Fix can_block() logic

Rob Clark <[email protected]>
drm/msm/a6xx: Fix HLSQ register dumping

Rob Clark <[email protected]>
drm/msm: Fix VM_BIND UNMAP locking

Rob Clark <[email protected]>
drm/msm: Reject fb creation from _NO_SHARE objs

Rob Clark <[email protected]>
drm/msm/a6xx: Add missing aperture_lock init

Rob Clark <[email protected]>
drm/msm/vma: Avoid lock in VM_BIND fence signaling path

Ethan Tidmore <[email protected]>
ASoC: SOF: Intel: hda: Place check before dereference

Lei Huang <[email protected]>
ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')

Lei Huang <[email protected]>
ALSA: hda/realtek: fix bad indentation for alc269

Billy Tsai <[email protected]>
hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback

Kuppuswamy Sathyanarayanan <[email protected]>
PCI/DPC: Log AER error info for DPC/EDR uncorrectable errors

Timur Kristóf <[email protected]>
drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled

Timur Kristóf <[email protected]>
drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Fill DW8 fields from SMC

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Clear EnabledForActivity field for memory levels

Timur Kristóf <[email protected]>

    drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0

Timur Kristóf <[email protected]>
drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs

Timur Kristóf <[email protected]>
drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled

Vijendar Mukunda <[email protected]>
ASoC: amd: acp: update dmic_num logic for acp pdm dmic

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

Cássio Gabriel <[email protected]>
ALSA: core: Validate compress device numbers without dynamic minors

Ethan Tidmore <[email protected]>
iommu/riscv: Fix signedness bug

Ilpo Järvinen <[email protected]>
PCI: Fix alignment calculation for resource size larger than align

Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - prevent req used-after-free for sec

Ilpo Järvinen <[email protected]>
PCI: Fix premature removal from realloc_head list during resource assignment

Ilpo Järvinen <[email protected]>
PCI: Prevent shrinking bridge window from its required size

Krishna Chaitanya Chundru <[email protected]>
PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support

Sebastian Reichel <[email protected]>
drm/panel: simple: Correct G190EAN01 prepare timing

Dmitry Baryshkov <[email protected]>
drm/panel: sharp-ls043t1le01: make use of prepare_prev_first

Zhao Mengmeng <[email protected]>
tools/sched_ext: scx_pair: fix pair_ctx indexing for CPU pairs

Alexey Charkov <[email protected]>
ASoC: rockchip: rockchip_sai: Set slot width for non-TDM mode

Alexander Koskovich <[email protected]>

    drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0

Pengyu Luo <[email protected]>
drm/msm/dsi: fix hdisplay calculation for CMD mode panel

Pengyu Luo <[email protected]>
drm/msm/dsi: fix bits_per_pclk

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: don't try using 2 LMs if only one DSC is available

Pengyu Luo <[email protected]>
drm/msm/dsi: add the missing parameter description

Yuanjie Yang <[email protected]>
drm/msm/dpu: fix mismatch between power and frequency

Dmitry Baryshkov <[email protected]>
drm/msm: add missing MODULE_DEVICE_ID definitions

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()

Alexandru Dadu <[email protected]>
drm/imagination: Switch reset_reason fields from enum to u32

Felix Gu <[email protected]>
PCI: sky1: Fix missing cleanup of ECAM config on probe failure

Pei Xiao <[email protected]>
spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo

Alex Deucher <[email protected]>
drm/amdgpu/gfx11: look at the right prop for gfx queue priority

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: look at the right prop for gfx queue priority

Srinivasan Shanmugam <[email protected]>
drm/amd/ras: Remove redundant NULL check in pending bad-bank list iteration

haoyu.lu <[email protected]>
accel/amdxdna: fix missing newline in pr_err message

Koichiro Den <[email protected]>
PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation

Daniel Jordan <[email protected]>
padata: Put CPU offline callback in ONLINE section to allow failure

Chuyi Zhou <[email protected]>
padata: Remove cpu online check from cpu add and removal

Thorsten Blum <[email protected]>
crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs

Herbert Xu <[email protected]>
crypto: tegra - Disable softirqs before finalizing request

Wesley Atwell <[email protected]>
crypto: simd - reject compat registrations without __ prefixes

Andy Shevchenko <[email protected]>
fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break

Guillaume Gonnet <[email protected]>
dm init: ensure device probing has finished in dm-mod.waitfor=

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Remove dead negative offset check in amdgpu_virt_init_critical_region()

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Drop redundant queue NULL check in hang detect worker

Srinivasan Shanmugam <[email protected]>
drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp()

Robby Cai <[email protected]>
regulator: fp9931: Fix handling of mandatory "vin" supply

Robby Cai <[email protected]>
regulator: dt-bindings: fp9931: Make vin-supply property as required

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Add default case in DVI mode validation

Srinivasan Shanmugam <[email protected]>
drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected()

Philip Yang <[email protected]>
drm/amdkfd: Update queue properties for metadata ring

Fangyu Yu <[email protected]>
iommu/riscv: Stop polling when CQCSR reports an error

Jason Gunthorpe <[email protected]>
iommu/riscv: Add missing GENERIC_MSI_IRQ

Yaxing Guo <[email protected]>
iommu/riscv: Skip IRQ count check when using MSI interrupts

Fangyu Yu <[email protected]>
iommu/riscv: Add IOTINVAL after updating DDT/PDT entries

John Madieu <[email protected]>
dt-bindings: PCI: renesas,r9a08g045s33-pcie: Fix naming properties

John Madieu <[email protected]>
PCI: rzg3s-host: Reorder reset assertion during suspend

John Madieu <[email protected]>
PCI: rzg3s-host: Fix reset handling in probe error path

Aleksander Jan Bajkowski <[email protected]>
crypto: inside-secure/eip93 - register hash before authenc algorithms

Ethan Tidmore <[email protected]>
drm/sun4i: Fix resource leaks

Maíra Canal <[email protected]>
drm/v3d: Handle error from drm_sched_entity_init()

David Carlier <[email protected]>
selftests/sched_ext: Add missing error check for exit__load()