)]}'
{
  "log": [
    {
      "commit": "93f51579e7df248780214094418f205253383cc5",
      "tree": "1dc395d6d136932cfcd4ece435ef4f1bb22ad539",
      "parents": [
        "6a5719cc3ef2e4d9857cc4ae18e6db09d59a8cc9"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 13:48:15 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 13:48:15 2026 -0700"
      },
      "message": "Linux 7.3-rc4\n"
    },
    {
      "commit": "6a5719cc3ef2e4d9857cc4ae18e6db09d59a8cc9",
      "tree": "33b21a45a2f266faa82537c72bb626ead10d5c61",
      "parents": [
        "a10a019dd4c7c57bef6b8dda962c8881ad220af2"
      ],
      "author": {
        "name": "Daniel J Blueman",
        "email": "daniel@quora.org",
        "time": "Sun Sep 20 16:16:08 2026 +0200"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 11:21:10 2026 -0700"
      },
      "message": "net: qrtr: resend HELLO on MHI resume\n\nSince the MHI HELLO exchange was relocated, it is sent only at device\nregistration. During a suspend-resume cycle, the firmware in WiFi\ncards such as WCN7850 indefinitely waits for another HELLO,\ntriggering:\n\n  ath12k_wifi7_pci 0004:01:00.0: timeout while waiting for restart complete\n  ath12k_wifi7_pci 0004:01:00.0: failed to resume core: -110\n\nFix this by triggering the handshake from resume_early in the MHI\ntransport.\n\nValidated on Qualcomm X1E-801800 on Lenovo Slim 7x across 10\nsuspend-resume cycles.\n\nFixes: 544d85de4dc2 (\"net: qrtr: Send HELLO message on endpoint register\")\nSigned-off-by: Daniel J Blueman \u003cdaniel@quora.org\u003e\nReviewed-by: Manivannan Sadhasivam \u003cmanivannan.sadhasivam@oss.qualcomm.com\u003e\nReported-by: Jeff Johnson \u003cjeff.johnson@oss.qualcomm.com\u003e\nLink: https://lore.kernel.org/all/6257c447-788d-4362-851e-0d552bcf7c56@oss.qualcomm.com/\nTested-by: Jeff Johnson \u003cjeff.johnson@oss.qualcomm.com\u003e\nReported-by: Vlastimil Babka (SUSE) \u003cvbabka@suse.com\u003e\nLink: https://lore.kernel.org/all/ab1491bb-cca5-4145-ac7d-31c966abf7b4@suse.com/\nTested-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nReported-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://lore.kernel.org/all/87a4plsg4w.wl-tiwai@suse.de/\nTested-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Thorsten Leemhuis \u003clinux@leemhuis.info\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a10a019dd4c7c57bef6b8dda962c8881ad220af2",
      "tree": "c4eb799cc42f73f3efa4bca8328a02ffde94be94",
      "parents": [
        "60ee24f055f87c74d3fccdedcb761df9253fd5c0",
        "075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 10:45:22 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 10:45:22 2026 -0700"
      },
      "message": "Merge tag \u0027dmaengine-fix-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine\n\nPull dmaengine fixes from Vinod Koul:\n\n - A couple of fixes in core around dma_chan_put() for kref underflow,\n   use-after-free and waiting for rcu readers for dma devices\n\n - mmp sg length and wrong extended DRCMR base for SpacemiT K3\n\n - hardware buffer descriptor chain fix for xilinx dma\n\n - sun6i fixes for status behaviour and dma position registers\n\n - runtime pm reference leak fix for sprd driver\n\n* tag \u0027dmaengine-fix-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:\n  dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()\n  dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA\n  dmaengine: pxa: fix double counting of the hw descriptors\n  dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status\n  dmaengine: sun6i: fix non-atomic read of DMA position registers\n  dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order\n  dmaengine: wait for RCU readers before releasing dma_device\n  dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()\n  dmaengine: Fix device kref underflow in dma_chan_put()\n  dmaengine: add dma_device_get() helper\n  dmaengine: sprd: Fix runtime PM reference leak in probe\n  dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()\n  dmaengine: mmp_pdma: fix wrong extended DRCMR base for SpacemiT K3\n"
    },
    {
      "commit": "60ee24f055f87c74d3fccdedcb761df9253fd5c0",
      "tree": "77b6835c8c1b44aece706f0bafa207dffc6f05db",
      "parents": [
        "0a885f68d0e90dcef77e575b09104df7263e2aca",
        "486a70ef848264dcf9a57f0bb0452848db9537de"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 10:43:12 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 10:43:12 2026 -0700"
      },
      "message": "Merge tag \u0027phy-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy\n\nPull phy fixes from Vinod Koul:\n\n - avoid atomic context delay in renesas driver\n\n - TMDS and PLL rate calculation fixes for mediatek driver\n\n* tag \u0027phy-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:\n  phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting\n  phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow\n  phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context\n"
    },
    {
      "commit": "0a885f68d0e90dcef77e575b09104df7263e2aca",
      "tree": "a31a168b4f46533e2099b1db0f58b7b8042f1ebd",
      "parents": [
        "156fa7417fac89fd9dcf3a4ee88785ff90ab6411",
        "aba7b41faeecb7692458095ce6fafc341fe0b80e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 10:22:37 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 10:22:37 2026 -0700"
      },
      "message": "Merge tag \u0027soundwire-7.3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire\n\nPull soundwire fixes from Vinod Koul:\n\n - Cadence: ensure work completion before clock stop\n\n - Disable ghost Realtek on Asus GX651AX\n\n* tag \u0027soundwire-7.3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:\n  soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop\n  soundwire: dmi-quirks: Disable ghost Realtek on Asus GX651AX\n"
    },
    {
      "commit": "156fa7417fac89fd9dcf3a4ee88785ff90ab6411",
      "tree": "fe4933b8aeef301f1920991701f86e3b2260b55c",
      "parents": [
        "0a15ba6b0c3adec5842d4252c3e5d2ca935e9948",
        "63edf5a009ae366369a1b484cd9ae4ee7c51946c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:49:10 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:49:10 2026 -0700"
      },
      "message": "Merge tag \u0027x86-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Reject the loading of a potentially problematic microcode version\n   on Intel Granite Rapids systems (Chang S. Bae)\n\n - On FRED, reconstruct the proper #GP context for rejected INT\n   instructions, to fix a signal ABI regression (Matthew Schwartz)\n\n - Add a test for this signal ABI regression the x86\n   self-test suite (Matthew Schwartz)\n\n - Don\u0027t emit the new and not yet properly supported EGPR instructions\n   (%r16-%r31) on CONFIG_X86_NATIVE_CPU\u003dy builds (Chang S. Bae)\n\n* tag \u0027x86-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  x86/build/64: Prevent native builds from generating EGPR use\n  selftests/x86: Check signal state for rejected software interrupts\n  x86/fred: Reconstruct the #GP context for rejected INT instructions\n  x86/microcode/intel: Reject problematic loading on Granite Rapids systems\n"
    },
    {
      "commit": "0a15ba6b0c3adec5842d4252c3e5d2ca935e9948",
      "tree": "2c9c55b35d6544250b389bed5dfbfe96a12e6717",
      "parents": [
        "fecbe78ac0e7bb5cdae232444e649a3103d9a917",
        "c21eaa72f02fc6e85621cbe09d303d8fb8bd39cd"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:41:00 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:41:00 2026 -0700"
      },
      "message": "Merge tag \u0027timers-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer race fixes from Ingo Molnar:\n\n - Fix timer signal \u003c-\u003e exec() race, to prevent UAF (Thomas Gleixner)\n\n - Clean up POSIX CPU timers right after de_thread(), to prevent UAF\n   (Hyunwoo Kim)\n\n - Fix POSIX CPU timers race between expiry and timer_settime(),\n   to prevent UAF (Thomas Gleixner)\n\n* tag \u0027timers-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list\n  exec: Cleanup POSIX timers right after de_thread()\n  signal: Prevent exec() race\n"
    },
    {
      "commit": "fecbe78ac0e7bb5cdae232444e649a3103d9a917",
      "tree": "26ae413b78b265dc26615360641dededcaf8eb3b",
      "parents": [
        "abb91eed948fcdabc7360d57cc3d3a7fba75db67",
        "fe3c73d7bc769e7afc252f867a3421fe168b898d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:37:27 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:37:27 2026 -0700"
      },
      "message": "Merge tag \u0027sched-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n\n - Avoid false positive migration warning for proxy donors\n   (Andrea Righi)\n\n* tag \u0027sched-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  sched/core: Avoid false migration warning for proxy donors\n"
    },
    {
      "commit": "abb91eed948fcdabc7360d57cc3d3a7fba75db67",
      "tree": "6d348e52b6f8bc893ab4c838d2a56e7f645e6797",
      "parents": [
        "2f7ff5f5479b020df69feb7493d4012685a8fc96",
        "88aed0422f39b22406f35f1e758cea25e7bbcfb5"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:26:22 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 09:26:22 2026 -0700"
      },
      "message": "Merge tag \u0027perf-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix crash when probing CS CALL instructions (Jinke Han)\n\n - Fix NULL pointer crash during module unload (Vinay Belgaumkar)\n\n* tag \u0027perf-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  perf: Fix null pointer access in is_include_guest_event()\n  x86/kprobes: Fix crash when probing CS CALL instructions\n"
    },
    {
      "commit": "2f7ff5f5479b020df69feb7493d4012685a8fc96",
      "tree": "53fcfe396a1091edc7f189886d2a523825e86d27",
      "parents": [
        "bdab18633a302c82b5e5d5dbc4e38b0baf9c0837",
        "7e61560628d17ea6b1d8ee370f6d42694cff8758"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 08:41:19 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 08:41:19 2026 -0700"
      },
      "message": "Merge tag \u0027objtool-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull objtool fix from Ingo Molnar:\n\n - Fix objtool build error on systems where libopcodes is\n   present, but development headers (binutils-dev) are not\n   (Ulises Mendez Martinez)\n\n* tag \u0027objtool-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  objtool: Validate disassembler headers in libopcodes probe\n"
    },
    {
      "commit": "bdab18633a302c82b5e5d5dbc4e38b0baf9c0837",
      "tree": "0446500af9a76d4e8b2a72a0a41391ceede73a10",
      "parents": [
        "5bf70485f96b927d706a0db66825e4e3b2dd66fc",
        "b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 08:15:23 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 08:15:23 2026 -0700"
      },
      "message": "Merge tag \u0027locking-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull futex fix from Ingo Molnar:\n\n - Also allocate a default private futex hash on vfork() as well, to\n   avoid races with (private) futex waiters (Peter Zijlstra)\n\n* tag \u0027locking-urgent-2026-09-20\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  futex: Also allocate private hash on vfork()\n"
    },
    {
      "commit": "5bf70485f96b927d706a0db66825e4e3b2dd66fc",
      "tree": "b44a170da4c6f208becc89bb786efdea19fdd562",
      "parents": [
        "aa211c7a5837f20f0995691c036a4b22d0360737",
        "3d743adf090cd4c9a2120c1e02b0482e88aa0d2d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 08:08:54 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 08:08:54 2026 -0700"
      },
      "message": "Merge tag \u0027spi-fix-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A few driver specific fixes, none of them particularly severe or\n  unusual\"\n\n* tag \u0027spi-fix-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n  spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes\n  spi: spi-zynqmp-gqspi: stop the controller on shutdown\n  spi: virtio: Use the per-transfer bits per word\n  spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register\n"
    },
    {
      "commit": "aa211c7a5837f20f0995691c036a4b22d0360737",
      "tree": "58663fa9dd9a6e794ffeff8a0219dcfd4a54f490",
      "parents": [
        "b12dd0fa481f6914f9375155865a04c3f9f9d800",
        "7362a1553eb09a8cdf8be7e509bd5309a8342486"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 07:57:47 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 07:57:47 2026 -0700"
      },
      "message": "Merge tag \u0027i2c-fixes-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fixes from Andi Shyti:\n \"Fixes mainly for cleanup and error handling, a good part of them\n  around DMA resource management:\n\n   - at91: ensure DMA channels are released on all exit paths\n\n   - imx: fix autosuspend cleanup on remove\n\n   - qcom-cci: fix device node reference leak\n\n   - atr, imx, qcom-geni: set adapter slot to NULL on registration\n     failure\"\n\n* tag \u0027i2c-fixes-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n  i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()\n  i2c: qcom-geni: release DMA channels on probe error\n  i2c: imx: release DMA channels on probe error\n  i2c: at91: release DMA channels on remove and probe error\n  i2c: atr: fix dangling adapter pointer on add failure\n  i2c: imx: disable autosuspend on remove\n"
    },
    {
      "commit": "b12dd0fa481f6914f9375155865a04c3f9f9d800",
      "tree": "d130a24ffd8719be0b6974da0795ea4a25408f74",
      "parents": [
        "4a910e594aae615fcc8e0f840549659e13641529",
        "309731e95917125bbd13626a7a5600490a5bf44f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 07:02:34 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 07:02:34 2026 -0700"
      },
      "message": "Merge tag \u0027input-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - Fixes for evdev and input compat handling to zero-initialize on-stack\n   absinfo and force-feedback effect structures before partial or compat\n   copies from userspace, preventing kernel stack memory disclosure\n\n - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read\n   when writing multi-chunk blocks over SMBus and to avoid a NULL\n   pointer dereference during suspend/resume when the RMI device is\n   unbound\n\n - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on\n   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume\n   buttons on the Microsoft Surface Pro 11) and to validate the ACPI\n   package element count before dereferencing\n\n - A fix for the adp5588-keys driver to cache the initial GPIO hardware\n   state before registering the gpiochip so pre-configured pin states\n   are not clobbered by GPIO hogs during registration\n\n - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied\n   HID report size before copying into the response buffer, preventing a\n   buffer overflow\n\n - A fix for the HP SDC serio driver to use timer_shutdown_sync() on\n   module exit so the periodic kicker timer cannot rearm itself during\n   teardown\n\n - A fix for the eeti_ts touchscreen driver to export its OF module\n   alias so the module autoloads on Device Tree platforms\n\n - Updates to the xpad joystick driver adding support for the Victrix\n   Pro BFG controller and Azeron devices, and fixing the device type\n   classification for the PDP Marvel Xbox 360 controller\n\n - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards\n   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book\n   Pro 16 2026\n\n - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus\n   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the\n   touchpad and TrackPoint respond immediately at boot\n\n - Other minor updates and documentation fixes, including reading the\n   \"ti,poll-period\" property as u32 in tsc2007, adding the mt6572\n   compatible to the MediaTek keypad Device Tree binding, fixing an\n   attribute name typo in the trackpoint sysfs ABI documentation, and\n   documenting that no new LED codes should be added to the input\n   subsystem\n\n* tag \u0027input-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n  Input: hp_sdc - shut down kicker timer on module exit\n  Input: xpad - add support for Victrix Pro BFG Controller\n  Input: tsc2007 - read \"ti,poll-period\" as u32\n  Input: trackpoint - fix the inertia attribute name in the ABI document\n  Input: eeti_ts - publish the OF module alias\n  Input: xpad - add support for Azeron devices\n  Input: xpad - fix PDP Marvel Xbox 360 controller\n  Input: document that no new LED codes should be added\n  Input: soc_button_array - check btns_desc-\u003epackage.count\n  Input: soc_button_array - fix MS Surface Pro 11 probe failure\n  Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P\n  Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)\n  Input: cyttsp5 - clamp the HID report size before memcpy\n  Input: zero ff_effect before compat copy in input_ff_effect_from_user\n  Input: evdev - zero absinfo before partial copy in EVIOCSABS\n  Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound\n  Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()\n  Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026\n  dt-bindings: input: mediatek,mt6779-keypad: add mt6572\n  Input: adp5588-keys - cache GPIO state before registering the gpiochip\n"
    },
    {
      "commit": "4a910e594aae615fcc8e0f840549659e13641529",
      "tree": "6e58bf97eb53a40579a118aad9eca0dc32a6db22",
      "parents": [
        "518e5b794c06c0f0eb40df3e202274a66202c137",
        "78fc54b934bfb2c18aad8154c7302067146946f9"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 06:50:31 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Sep 20 06:50:31 2026 -0700"
      },
      "message": "Merge tag \u0027selinux-pr-20260919\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fixes from Paul Moore:\n\n - Ensure that the cached SELinux access decisions are correct\n\n - Fix the SELinux overlayfs code to properly track the top-level/user\n   information on multiple stacked overlayfs filesystems\n\n - Fix the SELinux overlayfs code to properly enforce mprotect() access\n   control policy on all of the different layers in multiple stacked\n   overlayfs filesystems\n\n* tag \u0027selinux-pr-20260919\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n  selinux: recheck intermediate backing files on mprotect()\n  selinux: preserve user SID across nested backing files\n  selinux: always fill AVC decision in avc_has_perm_noaudit()\n"
    },
    {
      "commit": "7362a1553eb09a8cdf8be7e509bd5309a8342486",
      "tree": "7f5dffb195f4850e7a5a1e4fa36daf7f58c84e81",
      "parents": [
        "268aacb2e2a5c94d08e23194961234d0710c8407"
      ],
      "author": {
        "name": "Liu Zhenlong",
        "email": "dragonliu2018@gmail.com",
        "time": "Wed Aug 19 01:57:50 2026 +0800"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Sun Sep 20 09:40:29 2026 +0200"
      },
      "message": "i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()\n\nThe of_node_put() matching of_node_get() runs after i2c_del_adapter(),\nwhose trailing memset() zeroes adap-\u003edev and thus adap-\u003edev.of_node,\nmaking the put a no-op and leaking the node on every adapter removal\nand error cleanup.\n\nUse a devm action: the pointer is captured at registration, out of\nreach of that memset(), and devres runs the put once on probe failure\nand detach, replacing the three manual of_node_put() calls.  The\nsetup loop uses the scoped iterator form so the child node is released\nautomatically if devm_add_action_or_reset() fails mid-loop.\n\nSuggested-by: Konrad Dybcio \u003ckonrad.dybcio@oss.qualcomm.com\u003e\nFixes: 02a4a69667a2 (\"i2c: qcom-cci: don\u0027t put a device tree node before i2c_add_adapter()\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Liu Zhenlong \u003cdragonliu2018@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v5.17+\nReviewed-by: Vladimir Zapolskiy \u003cvladimir.zapolskiy@linaro.org\u003e\nReviewed-by: Konrad Dybcio \u003ckonrad.dybcio@oss.qualcomm.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260818175750.4205-1-dragonliu2018@gmail.com\n"
    },
    {
      "commit": "268aacb2e2a5c94d08e23194961234d0710c8407",
      "tree": "0fcfe2fb0ec0083bd63371c8fd1f4a454d9e2d25",
      "parents": [
        "e9f03b9625e2eeaca357b065c92d5b14064a1583"
      ],
      "author": {
        "name": "Shengzhuo Wei",
        "email": "me@cherr.cc",
        "time": "Thu Aug 27 23:43:03 2026 +0800"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Sun Sep 20 09:40:29 2026 +0200"
      },
      "message": "i2c: qcom-geni: release DMA channels on probe error\n\ngeni_i2c_init() grabs exclusive GPI tx/rx DMA channels when the serial\nengine runs in GPI mode. If i2c_add_adapter() subsequently fails, probe\nreturns without releasing the channels, because the remove callback is\nnot invoked after a failed probe.\n\nThe adapter-registration failure path used to release the channels via\nits err_dma label; that release was dropped when the probe tail was\nrestructured into geni_i2c_init().\n\nRelease the channels on the adapter-registration failure path, mirroring\ngeni_i2c_remove().\n\nFixes: d8d3bb127ad1 (\"i2c: qcom-geni: Isolate serial engine setup\")\nAssisted-by: GLM:5.3\nSigned-off-by: Shengzhuo Wei \u003cme@cherr.cc\u003e\nReviewed-by: Konrad Dybcio \u003ckonrad.dybcio@oss.qualcomm.com\u003e\nReviewed-by: Mukesh Kumar Savaliya \u003cmukesh.savaliya@oss.qualcomm.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260827-i2c-dma-channel-leak-v1-3-271d4adc03a0@cherr.cc\n"
    },
    {
      "commit": "e9f03b9625e2eeaca357b065c92d5b14064a1583",
      "tree": "1ee69a3d3d614f3c7651264b7943333b02bb421f",
      "parents": [
        "f7eeb1af8537b05953fb1c88ab8b59d94059a381"
      ],
      "author": {
        "name": "Shengzhuo Wei",
        "email": "me@cherr.cc",
        "time": "Thu Aug 27 23:43:02 2026 +0800"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Sun Sep 20 09:40:28 2026 +0200"
      },
      "message": "i2c: imx: release DMA channels on probe error\n\ni2c_imx_dma_request() acquires exclusive tx/rx DMA channels and is\noptional: on errors other than -EPROBE_DEFER the driver falls back to\nPIO mode and probe continues. If i2c_add_numbered_adapter() then fails,\nprobe returns through clk_notifier_unregister without releasing the\nchannels, because the remove callback is not invoked after a failed\nprobe.\n\nRelease the channels on the probe error path, mirroring\ni2c_imx_remove().\n\nFixes: ce1a78840ff7 (\"i2c: imx: add DMA support for freescale i2c driver\")\nAssisted-by: GLM:5.3\nSigned-off-by: Shengzhuo Wei \u003cme@cherr.cc\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v3.19+\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260827-i2c-dma-channel-leak-v1-2-271d4adc03a0@cherr.cc\n"
    },
    {
      "commit": "f7eeb1af8537b05953fb1c88ab8b59d94059a381",
      "tree": "c755bc605433ce0223e599073573693e6352aed3",
      "parents": [
        "ad34235808b63a70ca4989b7a2852923193d06ef"
      ],
      "author": {
        "name": "Shengzhuo Wei",
        "email": "me@cherr.cc",
        "time": "Thu Aug 27 23:43:01 2026 +0800"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Sun Sep 20 09:40:28 2026 +0200"
      },
      "message": "i2c: at91: release DMA channels on remove and probe error\n\nat91_twi_configure_dma() requests exclusive tx/rx DMA channels, but\nnothing ever releases them on driver detach, and the probe error path\nafter the channels are acquired (i2c_add_numbered_adapter() failure)\nreturns without releasing them either, because the remove callback is\nnot invoked after a failed probe.\n\nMove the release into a helper, call it from the existing\nconfigure-failure path, the adapter-registration failure path, and\nat91_twi_remove().\n\nFixes: 60937b2cdbf9 (\"i2c: at91: add dma support\")\nAssisted-by: GLM:5.3\nSigned-off-by: Shengzhuo Wei \u003cme@cherr.cc\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v3.8+\nAcked-by: Mukesh Kumar Savaliya \u003cmukesh.savaliya@oss.qualcomm.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260827-i2c-dma-channel-leak-v1-1-271d4adc03a0@cherr.cc\n"
    },
    {
      "commit": "c21eaa72f02fc6e85621cbe09d303d8fb8bd39cd",
      "tree": "bb4818f1f6127cdb05e08fe1869ece2e14465fed",
      "parents": [
        "acb03d3881818581052924a9bbbe92b8741ed448"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@kernel.org",
        "time": "Wed Sep 16 20:48:30 2026 +0200"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@kernel.org",
        "time": "Sat Sep 19 22:56:22 2026 +0200"
      },
      "message": "posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list\n\nKijo analyzed another race in the POSIX CPU timer code:\n\nCommit bf635681c906 converted cpu_timer::firing from a tristate value to a\nboolean. This lost the distinction between \"not owned by the firing list\"\nand \"still owned, but delivery was canceled\". The resulting race is:\n\n    expiry handler              timer_settime()        timer_delete()\n    --------------              ---------------        --------------\n    collect timer onto\n    private firing list\n    firing \u003d true\n                                observes firing \u003d true\n                                firing \u003d false\n                                return TIMER_RETRY\n                                wait for handler\n                                                       observes firing \u003d false\n                                                       finish deletion\n                                                       unhash and free timer\n    resume list traversal\n    read freed elist.next\n    -\u003e UAF\n\nThe firing bit is clearly the wrong indicator since that commit.\n\nCheck whether the timer is queued on the expiry list or not instead. If it\nis queued clear the firing bit to prevent signal delivery as before and\nreturn TIMER_RETRY so the caller unlocks the timer which allows the expiry\ncode to make progress and remove it from the list.\n\nFixes: bf635681c906 (\"posix-cpu-timers: Cleanup the firing logic\")\nReported-by: Kijo Park \u003cred993688@gmail.com\u003e\nDebugged-by: Kijo Park \u003cred993688@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nTested-by: Kijo Park \u003cred993688@gmail.com\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "518e5b794c06c0f0eb40df3e202274a66202c137",
      "tree": "619425e2b5b9b63dda6eeec4d0eded4ad96be5b1",
      "parents": [
        "40288c9206c17eb66a603262e06a58d300d0f279",
        "72de4807ba84da485dda1a91572d66da9149e95a"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Sep 19 13:48:20 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Sep 19 13:48:20 2026 -0700"
      },
      "message": "Merge tag \u0027for-7.3-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"Among the regular fixes, there are two that were reported recently and\n  have user impact:\n\n   - filesystem id is now stable again on the default and common case\n     (it broke openconnect key derivation, while this is not secure,\n     it\u0027s still in use), the intention was to change id for the\n     temp_fsid use case\n\n   - fix detection of /dev/root and rename it after device scan, this\n     broke booting of initramdisk-less system with grub2 as the probe\n     needs the real device\n\n  Regular fixes:\n\n   - don\u0027t store compressed inline extent if the size is larger than\n     uncompressed\n\n   - in zoned mode, handle activation of zones for all supported block\n     group profiles in case there are still free ones left\n\n   - check space for a chunk item when reading sys array from superblock\n\n   - allow using space reserves when removing verity items fails\n\n   - fix error handling after free space tree rebuild fails\n\n   - abort transaction if reflink or hole punching fails and it\u0027s not\n     possible to update the inode\n\n   - properly protect block group iteration during device replace start\n\n   - error message fixups\"\n\n* tag \u0027for-7.3-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n  btrfs: derive f_fsid with dev_t only when temp_fsid is active\n  btrfs: add \"/dev/root\" exception for device path update\n  btrfs: check if there is space for chunk item when validating sys chunk array\n  btrfs: abort transaction on failure to update inode for hole punching and reflinking\n  btrfs: clear free space tree creation state on rebuild failure\n  btrfs: handle lack of space when cleaning up verity items\n  btrfs: fix creation of compressed inline extents that don\u0027t save space\n  btrfs: tree-checker: fix error message regarding free space extent items\n  btrfs: tree-checker: print dev extent offset in error message\n  btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()\n  btrfs: zoned: handle RAID profiles in btrfs_can_activate_zone()\n"
    },
    {
      "commit": "63edf5a009ae366369a1b484cd9ae4ee7c51946c",
      "tree": "6aeb55001f4dc896927a5a2763fc0da72c37178c",
      "parents": [
        "96443a53bc3ef4b67dab0c497878fc8d56f799f3"
      ],
      "author": {
        "name": "Chang S. Bae",
        "email": "chang.seok.bae@intel.com",
        "time": "Wed Sep 16 23:00:03 2026 +0000"
      },
      "committer": {
        "name": "Borislav Petkov (AMD)",
        "email": "bp@alien8.de",
        "time": "Fri Sep 18 21:43:38 2026 -0700"
      },
      "message": "x86/build/64: Prevent native builds from generating EGPR use\n\nOmar reports that CONFIG_X86_NATIVE_CPU\u003dy allows builds to opportunistically\nemit instructions using %r16-%r31 (EGPRs) when the build host supports APX\nsince the commit:\n\n  ea1dcca1de12 (\"x86/kbuild/64: Add the CONFIG_X86_NATIVE_CPU option to locally optimize the kernel with \u0027-march\u003dnative\u0027\")\n\nBut the kernel is not yet prepared to use new registers internally. For\nexample, there is no context-switch support for general in-kernel use.\n\nExplicitly disable EGPR use when building with -march\u003dnative.\n\nFor C, since GCC 14 and Clang 18, both compilers support suppressing EGPR\nuse with -mno-apx-features\u003degpr, whose availability can be detected via\ncc-option.\n\nFor Rust, pass features\u003d-apxf through the generated JSON to avoid\nunstable-feature warnings, see\n\n  https://github.com/rust-lang/rust/issues/139284\n\nNote Rust only accepts the option to disable APX instructions entirely or not.\n\nSupport for this gating also depends on the Rust/LLVM combination. Rust\n1.88 introduced the `apxf` feature option, but versions prior to 1.93 may\nemit an `apxf` attribute to the backend that only LLVM 23 or later can\ninterpret. Restrict native Rust builds accordingly.\n\nFixes: ea1dcca1de12 (\"x86/kbuild/64: Add the CONFIG_X86_NATIVE_CPU option to locally optimize the kernel with \u0027-march\u003dnative\u0027\")\nReported-by: Omar Avelar \u003comar.avelar@intel.com\u003e\nSigned-off-by: Chang S. Bae \u003cchang.seok.bae@intel.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nAcked-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260916230003.1144622-1-chang.seok.bae@intel.com\n"
    },
    {
      "commit": "40288c9206c17eb66a603262e06a58d300d0f279",
      "tree": "ec09d7b43e853fca3cdaf6e3236c61e903df66fa",
      "parents": [
        "17e7b8eacf4cac800a4fc89a28729df72a2dabda",
        "71f370e9ee1bdfe1f916547089d93b5265a918e7"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 16:37:37 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 16:37:37 2026 -0700"
      },
      "message": "Merge tag \u0027drm-fixes-2026-09-19\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Things have picked back up a bit this week, mostly amdgpu, xe and msm\n  this time. There are a bunch of scattered changes across the rest of\n  drivers and core stuff, nouveau, i915.\n\n  core:\n   - fix vblank pending event leak\n\n  ttm:\n   - swapout fixes\n\n  dma-buf:\n   - scattergather fixes\n   - enable dma-buf debug on debug kernels\n\n  dma-fence:\n   - fix signaling bit checks\n\n  sched:\n   - fix virtual runtime race\n\n  msm:\n   - DT:\n      - Corrected indentation\n   - Core:\n      - Marked fbdev as system memory\n   - GPU:\n      - Fixed autosuspend cleanup on teardown\n      - a750: fix timestamps\n      - Increase GMU fw init timeout\n      - Misc fixes/cleanups\n   - DPU:\n      - Fixed clock rounding, unbreaking newest platforms\n      - Cleared pending flush state\n   - DP:\n      - Skip PUSH_IDLE when link was never enabled\n      - Fixed bandwidth checks\n   - HDMI:\n      - Fixed runtime PM cleanup on probe failure\n\n  xe:\n   - shrinker related fixes\n   - xe_mmio_gem fault handler and destroy fixes\n   - xe disable i2c irq on unbind\n\n  i915:\n   - Revert a commit touching registers that don\u0027t necessarily exist\n   - Check for negative numbers before passing to BIT()\n\n  amdgpu:\n   - SMU 14.x fix\n   - DC IRQ fix\n   - Runtime PM fix for P2P\n   - RAS fix\n   - PCIe reporting fix\n   - DCN 6 fix\n   - Device removal fix\n   - DC MALL fix\n\n  amdkfd:\n   - GC 12.x fixes\n   - Boundary checks\n   - Mapping clear fix\n\n  nouveau:\n   - suspend/resume fixes\n\n  gud:\n   - out of bounds access fix\n   - ignore damage clips in full update\n\n  vc4:\n   - use-after-free fix\n\n  versilicon:\n   - plane format fix\n\n  longsoon:\n   - blend mode property fix\"\n\n* tag \u0027drm-fixes-2026-09-19\u0027 of https://gitlab.freedesktop.org/drm/kernel: (59 commits)\n  drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates\n  drm/amdgpu: fix rmmio iounmap skipped on device removal\n  drm/amdgpu: Skip KFD mapping clear before initialization\n  drm/amd/display: Fix NULL dereference in dcn50/dcn60 init_hw\n  drm/amdkfd: Avoid integer underflow in EOP ring size calculation.\n  drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\n  drm/amdgpu: Fix GPU PCIe link capability reporting\n  drm/amdgpu: check ras and obj before dereference\n  drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments\n  drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1\n  drm/amd/display: Atomize IRQ register read/modify/write ops\n  drm/amd/pm: report energy accumulator for smu 14.0.3\n  drm/loongson: Create blend mode property for cursor plane\n  drm/xe/i2c: Disable IRQ on unbind\n  Revert \"drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable\"\n  drm/verisilicon: remove ARGB formats from primary plane\n  drm/verisilicon: add primary modifier for format tables\n  drm/verisilicon: set blend mode for the cursor plane\n  drm/sched: Fix virtual runtime race\n  drm/i915/display: check configuration index before shifting\n  ...\n"
    },
    {
      "commit": "71f370e9ee1bdfe1f916547089d93b5265a918e7",
      "tree": "3c7a1dc43a6c045491ebe57a52c5df2be7b937cc",
      "parents": [
        "94f69bfa1897c9d5a14bb54e3ecc5188a00daf6e",
        "5535d5e61a77ad79118ea7665ce1c14f857f0f12"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Sep 19 06:48:28 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Sep 19 06:49:36 2026 +1000"
      },
      "message": "Merge tag \u0027drm-misc-fixes-2026-09-17\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nTwo ttm fixes for ttm_tt_swapout(), one page-alignment and one overflow\nfix for dma-buf, a drm_pending_vblank_event leak fix for drm,\nsuspend/resume fixes for nouveau, one out-of-bounds access fix for gud,\na use-after-free fix for vc4, a fence signaling fix, a race condition\nfix for sched, planes formats fixes for verisilicon, and add the blend\nmode property for loongson\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cself@mripard.dev\u003e\nLink: https://patch.msgid.link/aqvVENQ4ksJEIcdb@houat\n"
    },
    {
      "commit": "17e7b8eacf4cac800a4fc89a28729df72a2dabda",
      "tree": "4a89d1072604d9ee1de3bf340ae19d394fdcac7b",
      "parents": [
        "925724c0816e327b6d3a47388cec1203d108ebe7",
        "717e0a25036b6c92cecace30913b2d874a4c22b8"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 13:44:59 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 13:44:59 2026 -0700"
      },
      "message": "Merge tag \u0027cifs-fixes-7.3-rc4\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n \"A batch of bug fixes for the smb client:\n\n   - Fix multiple out-of-bounds reads and use-after-frees in the SMB2/3\n     receive path that are reachable from a malicious or compromised\n     server: a stale next_buffer pointer and an integer overflow in\n     compound encrypted frame handling, missing minimum-PDU-size and\n     per-sub-PDU length validation before parsing command-specific\n     response fields, missing bounds checks in DFS referral, server\n     interface list, EA list, POSIX SID, snapshot enumeration and SMB1\n     reparse point parsing\n\n   - Fix use-after-frees and races in multichannel and connection\n     teardown, including an interface freed while still in use when\n     adding channels, a server used after its channel reference was\n     dropped, a reconnect work item left queued after the server is\n     freed and an uninitialized reconnect list node\n\n   - Fix a heap overflow in the native symlink parser: an absolute\n     target without an NT drive prefix caused out-of-bounds writes and a\n     u16 length underflow leading to a 64K memcpy into a small buffer,\n     triggerable by a user with write access to a mounted share under\n     default settings\n\n   - Fix WSL reparse point parsing: use unaligned accessors for the\n     packed extended-attribute payload to avoid alignment faults on some\n     architectures and stop leaving partially mutated fattr fields on\n     parse failure\n\n   - Fix lease break ACKs being sent through the wrong session on\n     multiuser mounts, which caused read failures (e.g. on NetApp\n     ONTAP/Azure Files) when copying files\n\n   - Fix an smbd_connection leak when cifs_get_tcp_session() fails after\n     an RDMA connection was already established\"\n\n* tag \u0027cifs-fixes-7.3-rc4\u0027 of https://git.manguebit.org/linux:\n  cifs: Fix server use-after-free in cifs_chan_skip_or_disable()\n  smb: client: fix reparse buffer bounds in cifs_query_reparse_point()\n  smb: client: fix potential OOB read in smb3_enum_snapshots()\n  smb: client: fix missing iov bounds check in parse_posix_sids()\n  smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()\n  smb: client: reject short Next offsets in parse_server_interfaces()\n  smb: client: fix missing lower-bound check on DFS referral string offsets\n  smb: client: fix server-\u003etotal_read for compound encrypted PDUs\n  smb: client: validate minimum PDU size before smb2_get_data_area_len()\n  smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs\n  smb: client: fix use-after-free of iface in cifs_try_adding_channels()\n  smb: client: fix fattr leaking on wsl_to_fattr() failure\n  smb: client: fix unaligned access in WSL reparse point parser\n  smb: client: fix smbd_connection leak on cifs_get_tcp_session() error\n  smb: client: fix rlist race and missing initialization\n  smb: client: cancel reconnect work in clean_demultiplex_info()\n  smb/client: send lease break ACKs thru correct session for multiuser mounts\n  smb: client: validate absolute native symlink targets before NT fixups\n"
    },
    {
      "commit": "925724c0816e327b6d3a47388cec1203d108ebe7",
      "tree": "14191e6e41b82c3b4c89c019adf61fc9765d3db6",
      "parents": [
        "ef31d04b6d8adfc971fc6b9ff76a1d6dc9aeefab",
        "3d676e458fe0c566f5a62753dc696b6a862fc412"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 13:10:29 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 13:10:29 2026 -0700"
      },
      "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Four driver fixes, three of which are minor and one of which (fnic)\n  tries to add some logic to try to avoid MSI-X being ineffective if\n  hyperthreading is disabled.\n\n  The core fix adds validation to mode sense buffer sizes because it is\n  used by ATA and could, theoretically, be exploited by a specially\n  crafted USB device that can simply be plugged in to any laptop or\n  server\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n  scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()\n  scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU\n  scsi: ibmvfc: Add Kconfig dependency to fix link failure when NVME_FC\u003dm\n  scsi: qla2xxx: Fix the ql2xfc2target parameter description\n  scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions\n"
    },
    {
      "commit": "ef31d04b6d8adfc971fc6b9ff76a1d6dc9aeefab",
      "tree": "0bb6b9890f9bccc960558df97b0943e043cb8370",
      "parents": [
        "c3d85c669d09007aeb9eb9f3d28d8c863401f83f",
        "c9dc7d730319ad64b51570c5387f1fee7b07b510"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 12:16:25 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 12:16:25 2026 -0700"
      },
      "message": "Merge tag \u0027pci-v7.3-fixes-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fix from Bjorn Helgaas:\n\n - Enable clock after core reset is asserted to fix enumeration\n   regression on i.MX6Q Apalis platforms with ASM1061/ASM1062 SATA\n   controllers (Richard Zhu)\n\n* tag \u0027pci-v7.3-fixes-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n  PCI: imx6: Move clock enable after core reset assertion\n"
    },
    {
      "commit": "c3d85c669d09007aeb9eb9f3d28d8c863401f83f",
      "tree": "b24a7e99a2c0fb35e0cf3f9c559d91200b44fcc7",
      "parents": [
        "bfda5a01aa99c5c363ac9967b81cbd5902d6c940",
        "9fa26285ae70ac2d3d1b47459a6b4463ab053e1c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 11:05:55 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 11:05:55 2026 -0700"
      },
      "message": "Merge tag \u0027ksmbd-for-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server fixes from Namjae Jeon:\n\n - Fix session expiration so that valid sessions are no longer removed\n   after ten seconds of inactivity when a new session setup request is\n   received.\n\n   Sessions now expire only after credential expiration, while stale\n   unauthenticated sessions are cleaned up after a 45-second timeout.\n\n - Keep earlier responses in compound requests when Query Info fails\n   because the output buffer is too small. The error response is\n   appended without truncating preceding responses.\n\n - Return STATUS_BUFFER_OVERFLOW for partial\n   FILE_NORMALIZED_NAME_INFORMATION responses instead of incorrectly\n   returning STATUS_INFO_LENGTH_MISMATCH.\n\n* tag \u0027ksmbd-for-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:\n  ksmbd: keep compound responses on query info errors\n  ksmbd: fix partial normalized name responses\n  ksmbd: follow SMB2 session expiration semantics\n"
    },
    {
      "commit": "bfda5a01aa99c5c363ac9967b81cbd5902d6c940",
      "tree": "595c01db3db79bf765ea84e84bd6d1a71465ddcd",
      "parents": [
        "8cb0606271a9102f1ccac34e9fc9ee76f350a2ab",
        "229e8188307b9724cc676a49e9600c4acd24b571"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 11:02:08 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 11:02:08 2026 -0700"
      },
      "message": "Merge tag \u0027ntfs-for-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - Make MFT extension work on existing Windows-created volumes by\n   dynamically reserving MFT tail records, accounting for records added\n   during allocation, and avoiding false -ENOSPC failures\n\n - Repack non-resident $MFT/$ATTRIBUTE_LIST when its mapping pairs no\n   longer fit in the base MFT record, while propagating allocation and\n   writeback errors\n\n - Serialize runlist updates with the runlist lock and restore both the\n   in-memory runlist and on-disk mapping pairs when allocation rollback\n   is required\n\n - Propagate folio errors and harden inode failure handling by treating\n   interrupted reads as transient failures and discarding and unhashing\n   inodes whose initialization fails\n\n - Fix the $MFTMirr write offset when mirror records span multiple\n   folios, preventing mirror records from overwriting the first record\n   with large MFT record sizes\n\n* tag \u0027ntfs-for-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n  ntfs: fix $MFTMirr write offset when it spans multiple folios\n  ntfs: unhash failed inode reads\n  ntfs: discard inodes that fail initialization\n  ntfs: ignore interrupted inode reads as corruption\n  ntfs: propagate folio errors\n  ntfs: protect runlist updates with the runlist lock\n  ntfs: account for MFT records added during allocation\n  ntfs: repack $MFT/$ATTRIBUTE LIST\n  ntfs: use dynamic MFT tail reservation\n"
    },
    {
      "commit": "8cb0606271a9102f1ccac34e9fc9ee76f350a2ab",
      "tree": "b88e6e95e0d7c361f64a4698789d2cb41340aad9",
      "parents": [
        "ae09f35bd358b926916bd2b9f1d409b0d1924344",
        "4396d70bb7fec531bcf934fed016b2f3300c670b"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:53:42 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:53:42 2026 -0700"
      },
      "message": "Merge tag \u0027mmc-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC/MEMSTICK fixes from Ulf Hansson:\n \"MMC core:\n   - Prevent potential use-after-free for SDIO IRQ work\n   - Fix OF node reference leak on card add failure\n   - Fix memory lea when the port table is full for sdio_uart\n\n  MMC host:\n   - hsq: Fix use-after-free in retry work\n   - mmci: Fix use-after-free in busy-timeout work\n   - mmc_spi: Reset bytes_xfered before retrying CRC failures\n   - mxcmmc: Cancel data work and watchdog on remove\n   - rtsx_pci_sdmmc: Ignore broken write-protect on ThinkPad X260\n   - sdhci_am654: A couple of fixes for the tuning sequence\n   - sdhci-of-aspeed: Remove children before releasing SDC resources\n   - sh_mmcif: Initialize IRQ-thread mutex before requesting interrupt\n\n  MEMSTICK:\n   - ms_block: Destroy io_queue workqueue on removal\n\n* tag \u0027mmc-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n  mmc: sdhci-of-aspeed: Remove children before releasing SDC resources\n  mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt\n  mmc: core: Fix OF node reference leak on card add failure\n  mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260\n  mmc: sdio_uart: fix xmit_fifo leak when the port table is full\n  mmc: spi: reset bytes_xfered before retrying CRC failures\n  mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure\n  mmc: sdhci_am654: Clear ITAPDLY on tuning failure\n  mmc: sdhci_am654: Reset command and data lines on failed tuning\n  mmc: sdhci_am654: Move tuning_loop to local variable\n  mmc: hsq: Fix use-after-free in retry work\n  mmc: mxcmmc: cancel data work and watchdog on remove\n  mmc: mmci: Fix use-after-free in busy-timeout work\n  mmc: core: Cancel SDIO IRQ work before freeing host\n  memstick: ms_block: destroy io_queue workqueue on removal\n"
    },
    {
      "commit": "ae09f35bd358b926916bd2b9f1d409b0d1924344",
      "tree": "3b0bd07ae004e47a829819cce89f01b60081faab",
      "parents": [
        "d24e3bf4c5484b29432837269ded253480fa8928",
        "8d836581f9b1f57ceaa2b47654754ef1260b410b"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:51:14 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:51:14 2026 -0700"
      },
      "message": "Merge tag \u0027ata-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Explicitly clear upper address bits on quirked AHCI controllers\n\n   AHCI controllers that claim to support 64-bit DMA, but which have\n   been quirked to only do 32-bit DMA, could start the DMA engine with a\n   non-zero value in the upper address bits registers (me)\n\n - Fix a resource leak in ahci_platform_get_resources() (Wentao)\n\n - Fix invalid kernel-doc formatting for ata_dsm_trim_pages() (me)\n\n* tag \u0027ata-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n  ata: libata-scsi: fix ata_dsm_trim_pages() kernel-doc\n  ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources()\n  ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY\n"
    },
    {
      "commit": "d24e3bf4c5484b29432837269ded253480fa8928",
      "tree": "c386f263907bdd0c0a024290e8fc5689cbb4f26b",
      "parents": [
        "928ba50514ac0a7b20ac83e6681583c2584c528d",
        "92b68492eae701e5b0e9d142ffe229921af7b1fa"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:27:23 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:27:23 2026 -0700"
      },
      "message": "Merge tag \u0027hwmon-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - Add missing sensors, and fix current sensors ID lookup (cgbc-hwmon)\n\n - Return IRQ_HANDLED from the shared alarm IRQ handler to fix possible\n   interrupt storm (gpioufan)\n\n - Improve raw WMI string handling, and fix UaF in show function\n   (hp-wmi-sensors)\n\n - Fix k10temp model id range of Zen5 Turin to stop reporting\n   temperature data for non-existing CCDs\n\n - pmbus:\n     - Increase number of phases to fix UaF problems\n     - Fix TPS53676 phase page decoding, and select page 0 for\n       single-page applications\n\n - Stop pwm-fan RPM timer before freeing tach data to fix UaF\n\n - Release w83793 probe data through kref to fix UaF\n\n - Remove w83791d fan/pwm 4-5 sysfs group on remove to fix UaF\n\n* tag \u0027hwmon-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n  hwmon: (hp-wmi-sensors) Improve raw WMI string handling\n  hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676\n  hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding\n  hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()\n  hwmon: (w83793) release probe data through kref\n  hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove\n  hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler\n  hwmon: (pmbus/core) increase number of phases and add new mask\n  hwmon: (cgbc-hwmon) Add missing sensors\n  hwmon: (cgbc-hwmon) Fix current sensors ID lookup\n  hwmon: (pwm-fan) Stop RPM timer before freeing tach data\n  hwmon: (k10temp) Fix model id range of Zen5 Turin\n"
    },
    {
      "commit": "928ba50514ac0a7b20ac83e6681583c2584c528d",
      "tree": "04dca2c09511fc65df0541a7b7a5f7aa2c487ab4",
      "parents": [
        "5ad17a9760cd00c53d4a932a840e59af3a8f960e",
        "7cb575b71ab98194d2e040bded3a7281e089c5ed"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:18:32 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:18:32 2026 -0700"
      },
      "message": "Merge tag \u0027watchdog-fixes-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull watchdog fixes from Guenter Roeck:\n\n - Fix suspend/resume handling of HW_RUNNING watchdog (da9062, da9063)\n\n - Avoid division by zero if clock rate is 0 (digicolor, rtd119x, and\n   rzv2h)\n\n - Fix premature reset during timeout update, and propagate error code\n   in msc313e resume()\n\n - Fix pci_dev reference leak in sp5100_tco_init()\n\n - Fix runtime PM leak in starfive_wdt_pm_start()\n\n* tag \u0027watchdog-fixes-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n  watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog\n  watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()\n  watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog\n  watchdog: msc313e: Fix premature reset during timeout update\n  watchdog: msc313e: Propagate error code in resume()\n  watchdog: rzv2h: Avoid division by zero\n  watchdog: rtd119x: Avoid division by zero\n  watchdog: digicolor: Avoid division by zero\n  watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()\n"
    },
    {
      "commit": "5ad17a9760cd00c53d4a932a840e59af3a8f960e",
      "tree": "cc01b2f8ece53cf418b20555afc342c0879ed2cb",
      "parents": [
        "f259f446f5198d98e13756d2cd531812a0ad3064",
        "53cf0f26eece095a3752642151150404bc3351cc"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:01:31 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 10:01:31 2026 -0700"
      },
      "message": "Merge tag \u0027v7.3-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fix from Herbert Xu:\n \"Fix a regression in caam\"\n\n* tag \u0027v7.3-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n  crypto: caam - map job ring registers without claiming region\n"
    },
    {
      "commit": "f259f446f5198d98e13756d2cd531812a0ad3064",
      "tree": "9ca151f47347dac1e89c7fa7d298d9f6ef75be5b",
      "parents": [
        "a077be4fde21ee6e751fa70eb641ef5d9bf2fc48",
        "4dd1999783d7d12434006289338373e49492dc96"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 09:34:57 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 09:34:57 2026 -0700"
      },
      "message": "Merge tag \u0027soc-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"The driver fixes are all for simple mistakes: a use-after-free bug on\n  Samsung Exynos, error handling and reference counting on Arm SCMI\n  firmware and a problem dealing with inconsistent firmware information.\n\n  The rest are devicetree fixes for arm64 platforms from Altera, Renesas\n  and Amlogic. On the Renesas platform, one patch addresses a boot time\n  regression, the rest address minor performance and correctness issues\"\n\n* tag \u0027soc-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits)\n  soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node\n  arm64: dts: renesas: r8a779f0: Set UFS lane count\n  firmware: arm_scmi: Fix typo \"upto\" in comment\n  arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR\n  arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR\n  arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR\n  arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR\n  arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR\n  firmware: arm_ffa: Tear down driver during shutdown\n  clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq\n  clk: scpi: register scpi-cpufreq once and clear on failure\n  clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate\n  firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS\n  firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id\n  arm64: dts: socfpga: change access permission from 755 to 644\n  ARM: socfpga: select the PL310 erratum 753970 workaround\n  arm64: dts: amlogic: t7: fix the pin groups of the vsync PWM\n  arm64: dts: amlogic: t7: khadas-vim4: add the PWM-driven supplies\n  arm64: dts: amlogic: t7: fix the pin groups of two PWM outputs\n  arm64: dts: amlogic: t7: khadas-vim4: allow the SD card to be power cycled\n  ...\n"
    },
    {
      "commit": "a077be4fde21ee6e751fa70eb641ef5d9bf2fc48",
      "tree": "fe745d779086af44bde9af2db11f2f864e305ed3",
      "parents": [
        "5023f5b861d50e43b25a3b1de47808023243484a",
        "fdb9ebc7fb7788b8371fbef6c17dc5c8291e1429"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 09:28:30 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 09:28:30 2026 -0700"
      },
      "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"In this batch we\u0027ve got a couple of hibernation fixes, a couple of\n  minor MTE fixes, some per-cpu codegen fixes (which were found as part\n  of Mark\u0027s series adding preemptible this_cpu_*() operations) and a fix\n  for the Arm CMN PMU driver.\n\n  Summary:\n\n   - Fix hypercall arguments when resetting EL2 vectors during\n     hibernation\n\n   - Fix hibernation with 52-bit capable kernels on machines without\n     52-bit addressing, similarly to the recent kexec fix\n\n   - Fix a bunch of clumsy codegen issues with our per-cpu accessors\n\n   - Fix MTE ptrace documentation to reflect the de-facto ABI behaviour\n\n   - Fix pthread_join() usage in MTE selftest\n\n   - Fix port selection in the Arm CMN PMU driver\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n  arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation\n  kselftest/arm64: Fix size of thread_data values for pthread_join()\n  arm64: percpu: Fix LSE operations on {8,16}-bit types\n  arm64: percpu: Fix this_cpu_and() mask generation\n  arm64: percpu: Fix this_cpu_write() casting\n  arm64: hibernate: clone only the linear map that exists at runtime\n  perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations\n  arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc\n"
    },
    {
      "commit": "5023f5b861d50e43b25a3b1de47808023243484a",
      "tree": "08c5ec7c89ed003216958747c04717b5aed1b5a6",
      "parents": [
        "5dd1818b15d98d4a20806cd00b1b40320b06004f",
        "126f16e0a1b353c2ba5c7e2c8626cfa865934f9f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 09:25:07 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 18 09:25:07 2026 -0700"
      },
      "message": "Merge tag \u0027mips-fixes_7.3_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux\n\nPull MIPS fixes from Thomas Bogendoerfer:\n\n - Fix kconfig dependencies for ECONET\n\n - Enable weak reordering for EYEQ\n\n - Include USB FDT fixup for Octeon even when USB is modular\n\n* tag \u0027mips-fixes_7.3_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:\n  MIPS: Octeon: apply USB FDT fixups also when USB is modular\n  mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ\n  MIPS: config: Add EcoNet EN751221 defconfig\n  mips: econet: fix unmet dependencies for ECONET\n"
    },
    {
      "commit": "7cb575b71ab98194d2e040bded3a7281e089c5ed",
      "tree": "794d4d211b745dfbc4f4f7213d149e39fab6c037",
      "parents": [
        "8f0ca55016a7647109ae2bc91bcb346fc8b13785"
      ],
      "author": {
        "name": "Li Jun",
        "email": "lijun01@kylinos.cn",
        "time": "Thu Sep 17 09:37:10 2026 +0800"
      },
      "committer": {
        "name": "Guenter Roeck",
        "email": "linux@roeck-us.net",
        "time": "Fri Sep 18 08:10:45 2026 -0700"
      },
      "message": "watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog\n\nda9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(),\nwhen the watchdog is left running by the driver sets\nWDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the\ndevice, so WDOG_ACTIVE remains cleared, the wdt_disable() will not be\nexecuted in da9063_wdt_suspend. In this case, the suspend callback is\na no-op and the watchdog keeps counting during system suspend,\nleading to an unexpected system reset.\nCheck WDOG_HW_RUNNING and wdd，can fix this issue.\n\nFixes: a7ceca4398bc8 (\"watchdog: da9063: optionally disable watchdog during suspend\")\nCc: stable@vger.kernel.org\nSigned-off-by: Li Jun \u003clijun01@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260917013710.2754679-1-lijun01@kylinos.cn\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n"
    },
    {
      "commit": "4dd1999783d7d12434006289338373e49492dc96",
      "tree": "7964b0e50a5ea97469b1e7c5ef8c3b2473d2dc62",
      "parents": [
        "2d5061ff3762a71dac6809a9bd9013fd785aab28"
      ],
      "author": {
        "name": "Alexey Klimov",
        "email": "alexey.klimov@linaro.org",
        "time": "Thu Sep 17 10:16:42 2026 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Sep 18 14:39:19 2026 +0200"
      },
      "message": "soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node\n\nThe setup_cpuhp_and_cpuidle() parses the device tree node for the\ninterrupt generation block via of_parse_phandle() and decrements its\nreference count using of_node_put() immediately after fetching the resource\naddress. However, later the intr_gen_node pointer is passed into\nof_syscon_register_regmap().\n\nFix this by declaring intr_gen_node with __free() and removing\nof_node_put().\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part\u003d3\nFixes: 78b72897a5c8 (\"soc: samsung: exynos-pmu: Enable CPU Idle for gs101\")\nCc: stable@vger.kernel.org\nSigned-off-by: Alexey Klimov \u003calexey.klimov@linaro.org\u003e\nLink: https://patch.msgid.link/20260828-exynos-pmu-cpuhp-idle-fixes-v2-1-06bce6107bd6@linaro.org\nSigned-off-by: Krzysztof Kozlowski \u003ckrzk@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260917081641.72291-2-krzk@kernel.org\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n"
    },
    {
      "commit": "2d5061ff3762a71dac6809a9bd9013fd785aab28",
      "tree": "b3272bfe58e6a8c2dfd556e92c458cddbb860f0d",
      "parents": [
        "ce55a6545a375563983ef83eb48915a11493b64e",
        "8dc2615d5702059b2b71fca6f93c0d7d10ae54cb"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Sep 18 14:33:55 2026 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Sep 18 14:34:03 2026 +0200"
      },
      "message": "Merge tag \u0027renesas-fixes-for-v7.3-tag2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes\n\nRenesas fixes for v7.3 (take two)\n\n  - Fix UFS regression on R-Car S4.\n\n* tag \u0027renesas-fixes-for-v7.3-tag2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:\n  arm64: dts: renesas: r8a779f0: Set UFS lane count\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n"
    },
    {
      "commit": "96443a53bc3ef4b67dab0c497878fc8d56f799f3",
      "tree": "e3c802d0a9f36ef0f30d53373ab500fecba2a849",
      "parents": [
        "93f53499d0b945e8ae447f497faf743d60069f61"
      ],
      "author": {
        "name": "Matthew Schwartz",
        "email": "matthew.schwartz@linux.dev",
        "time": "Thu Sep 17 16:09:07 2026 -0700"
      },
      "committer": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Fri Sep 18 12:33:18 2026 +0200"
      },
      "message": "selftests/x86: Check signal state for rejected software interrupts\n\nAdd a test of the signal ABI for INT instructions in both 32-bit and\n64-bit processes. Check the signal number, trap number, error code,\nsi_code, si_addr, instruction pointer and RF/TF state against legacy\nIDT behavior. Include a 15-byte prefixed INT to check that IP uses the\nhardware instruction length. Exercise both INT3 encodings, INT4, UD2\nand HLT to cover the unchanged trap and fault paths.\n\nRun each instruction with TF clear and set. Resume at a known NOP after\nhandling the signal and check that single-stepping traps after the NOP.\n\nAlso drive INT 0x2d under ptrace, which resumes through the fault frame\nrather than sigreturn and so exposes a stale FRED software event flag.\nStart from an INT3 stop, whose FRED frame has no software event flag,\ninstead of the syscall frame of raise(SIGSTOP). Single-step into the INT\nand check that the fault reports its address. Then suppress SIGSEGV and\nresume at the NOP, once with PTRACE_SINGLESTEP and once with PTRACE_CONT\nand TF set. Section 6.2.3 of the Intel FRED specification [1] specifies\nthe immediate single-step trap caused by returning with both that flag\nand TF set. Check that each trap occurs after the NOP, rather than at\nits address.\n\nReport whether the CPU supports FRED, since a pass looks the same on\neither entry path. INT 0x80 with IA32 emulation disabled and a 64-bit\ntracer of a 32-bit tracee are not covered.\n\nBoth variants pass all 29 checks on a non-FRED AMD host and on Panther\nLake with FRED enabled and the fix applied. With the same binaries on\nunpatched Panther Lake, 16 signal-context checks fail and the first\nptrace check reports the IP after the INT. The two dependent ptrace\nresume checks are not reached.\n\n[1] Intel Flexible Return and Event Delivery (FRED) Specification,\nrevision 9.0 (346446-009US), section 6.2.3.\n\nSigned-off-by: Matthew Schwartz \u003cmatthew.schwartz@linux.dev\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://cdrdv2.intel.com/v1/dl/getContent/678938 # [1]\nLink: https://patch.msgid.link/20260917230907.2080792-3-matthew.schwartz@linux.dev\n"
    },
    {
      "commit": "93f53499d0b945e8ae447f497faf743d60069f61",
      "tree": "86846221061d2b70b4f6945f9806d3b6dc2ae908",
      "parents": [
        "e7d3e2f46dd5a69046e6d95a0f189155a5516b93"
      ],
      "author": {
        "name": "Matthew Schwartz",
        "email": "matthew.schwartz@linux.dev",
        "time": "Thu Sep 17 16:09:06 2026 -0700"
      },
      "committer": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Fri Sep 18 12:33:17 2026 +0200"
      },
      "message": "x86/fred: Reconstruct the #GP context for rejected INT instructions\n\nFRED event delivery does not use the IDT, so the gate DPL check that\nrejects a user INT n falls to software (Intel FRED specification [1],\nsection 8.3). fred_intx() rejects the same vectors as IDT delivery, but\nreports a zero error code and the IP after the INT. This breaks the\nsignal ABI. Wine uses the error code to recognize INT 0x2d, so the\nchanged context turns a handled breakpoint into an access violation in\nElden Ring.\n\nRewind IP using the instruction length in the augmented SS and\nsynthesize the IDT selector error code, (vector \u003c\u003c 3) | 2. Set RF in the\nsaved flags, as the CPU does for a #GP fault. Section 5.2.1 defines the\nsaved vector, instruction length and RF state. The supplied length\nhandles prefixes without reading user memory. Limit the changes to\nalready-rejected software interrupts, preserving the accepted INT3, INT4\nand enabled INT80 paths and hardware exceptions. With IA32 emulation\ndisabled, INT 0x80 now reports the same #GP as the DPL 0 gate IDT\ninstalls there. The rewound IP also stops fixup_iopl_exception() from\ninspecting the byte after the INT.\n\nAlso clear the software event flag. Section 6.2.3 specifies that ERETU\nwith this flag and TF set traps before executing any user instruction. A\ntracer that suppresses SIGSEGV and resumes with TF set expects the next\ninstruction to run first, as after IRET. The sigreturn path clears the\nsame flag for this reason in prevent_single_step_upon_eretu().\n\n[1] Intel Flexible Return and Event Delivery (FRED) Specification,\nrevision 9.0 (346446-009US), sections 5.2.1, 6.2.3 and 8.3.\n\nFixes: 14619d912b65 (\"x86/fred: FRED entry/exit and dispatch code\")\nCloses: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/15745\nCloses: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/16132\nReported-by: Paul Gofman \u003cpgofman@codeweavers.com\u003e\nSigned-off-by: Matthew Schwartz \u003cmatthew.schwartz@linux.dev\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: H. Peter Anvin \u003chpa@zytor.com\u003e\nLink: https://cdrdv2.intel.com/v1/dl/getContent/678938 # [1]\nLink: https://patch.msgid.link/20260917230907.2080792-2-matthew.schwartz@linux.dev\n"
    },
    {
      "commit": "fe3c73d7bc769e7afc252f867a3421fe168b898d",
      "tree": "e3ea58cbeeca2df1d4e1bfc7239469c929a4d04a",
      "parents": [
        "fd73f4a6659897191fa0d40695fe370925dd3780"
      ],
      "author": {
        "name": "Andrea Righi",
        "email": "arighi@nvidia.com",
        "time": "Tue Sep 15 20:41:01 2026 +0200"
      },
      "committer": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Fri Sep 18 12:19:43 2026 +0200"
      },
      "message": "sched/core: Avoid false migration warning for proxy donors\n\nProxy execution can move a blocked donor\u0027s scheduling context to the\nlock owner\u0027s CPU even when the donor is migration-disabled. The donor\ndoes not execute there, and its original execution CPU remains recorded\nin wake_cpu.\n\nset_task_cpu() warns unconditionally for migration-disabled tasks, so a\nsubsequent proxy migration or the wakeup path returning the donor home\ntriggers a false positive: moving a blocked scheduling context does not\nviolate the migration-disabled execution context.\n\nFor example, creating a mutex owner on CPU1 and a migration-disabled\nwaiter on CPU0 can trigger the following warning:\n\n  proxy_migrate_repro: donor blocking on CPU0 with migration disabled\n  proxy_migrate_repro: donor moved from CPU0 to CPU1\n  WARNING: kernel/sched/core.c:3389 at set_task_cpu+0x1d3/0x280\n  ...\n  Call Trace:\n   try_to_wake_up+0x43f/0x780\n   __mutex_unlock_slowpath+0x330/0x540\n   owner_fn+0x9f/0xc0 [proxy_migrate_repro]\n  ...\n  proxy_migrate_repro: donor woke on CPU0, task_cpu\u003d0\n  proxy_migrate_repro: completed\n\nExclude blocked proxy donors from the warning. The proxy wakeup path\nrestores an executable placement before clearing the blocked state.\n\nFixes: b049b81bdff6 (\"sched: Handle blocked-waiter migration (and return migration)\")\nSigned-off-by: Andrea Righi \u003carighi@nvidia.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nAcked-by: John Stultz \u003cjstultz@google.com\u003e\nLink: https://patch.msgid.link/20260915184101.2621252-1-arighi@nvidia.com\n"
    },
    {
      "commit": "88aed0422f39b22406f35f1e758cea25e7bbcfb5",
      "tree": "1a85c1427a685efa7260a8d3794abe78dd2a1ad7",
      "parents": [
        "a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255"
      ],
      "author": {
        "name": "Vinay Belgaumkar",
        "email": "vinay.belgaumkar@intel.com",
        "time": "Fri Sep 04 11:16:24 2026 -0700"
      },
      "committer": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Fri Sep 18 12:19:43 2026 +0200"
      },
      "message": "perf: Fix null pointer access in is_include_guest_event()\n\nA typical module unload occurring event when there is an active perf\nconnection leads to freeing of the pmu pointer. The call log is something\nlike:\n ..\n __pmu_detach_event\n pmu_detach_event\n pmu_detach_events\n perf_pmu_unregister\n ..\n\n__pmu_detach_event() sets event-\u003epmu to null. When the perf connection\nfinally is closed, the following stack trace is observed:\n\n Oops: general protection fault, kernel NULL pointer dereference\n ...\n RIP: 0010:_free_event+0x3e/0x370\n ...\n Call Trace:\n ...\n perf_event_release_kernel+0x260/0x2d0\n perf_release+0x12/0x20\n\nA call to mediated_pmu_unaccount_event() inside _free_event() is the root\ncause of this crash. Adding a check inside is_include_guest_event() ensures\nwe don\u0027t accidentally access a null pmu ptr. In addition to this, we will\nnow call mediated_pmu_unaccount_event() before clearing the pmu ptr so that\nnr_include_guest_events counts are maintained correctly.\n\nFixes: eff95e170275 (\"perf: Add APIs to create/release mediated guest vPMUs\")\nAssisted-by: Claude:Claude-Sonnet-5\nSigned-off-by: Vinay Belgaumkar \u003cvinay.belgaumkar@intel.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Dapeng Mi \u003cdapeng1.mi@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260904181625.1394082-1-vinay.belgaumkar@intel.com\n"
    },
    {
      "commit": "94f69bfa1897c9d5a14bb54e3ecc5188a00daf6e",
      "tree": "97436e0b6286cf307077b9f1678dde2f086c032e",
      "parents": [
        "cd011719ba564a5d72ee6474cec2ecd66362d150",
        "2ac2fe765ef475f409616ac0b57c4a3922749b0f"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Sep 18 11:22:42 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Sep 18 11:24:43 2026 +1000"
      },
      "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-09-17\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-09-17:\n\namdgpu:\n- SMU 14.x fix\n- DC IRQ fix\n- Runtime PM fix for P2P\n- RAS fix\n- PCIe reporting fix\n- DCN 6 fix\n- Device removal fix\n- DC MALL fix\n\namdkfd:\n- GC 12.x fixes\n- Boundary checks\n- Mapping clear fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260917201213.3880863-1-alexander.deucher@amd.com\n"
    },
    {
      "commit": "cd011719ba564a5d72ee6474cec2ecd66362d150",
      "tree": "b033e2aa1d9c4cb636d0b74175df42e421aa2e1d",
      "parents": [
        "c24f824f0bbfd6e9ab376795d8e5862c66766cfa",
        "a26204be587c57bd5c54fa513be26c4fd7bf252d"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Sep 18 11:08:18 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Sep 18 11:08:19 2026 +1000"
      },
      "message": "Merge tag \u0027drm-intel-fixes-2026-09-17\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for 7.3-rc4:\n- Revert a commit touching registers that don\u0027t necessarily exist\n- Check for negative numbers before passing to BIT()\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/3f86e0ede95fb3d52053934ac43c5271812428f5@intel.com\n"
    },
    {
      "commit": "c24f824f0bbfd6e9ab376795d8e5862c66766cfa",
      "tree": "431e76f83147087cdf2cd60f97b970dbd2340eda",
      "parents": [
        "b15e54761a0dd5fdf3dc790a031ab0e4185b7612",
        "f0e9f963a3d209d7dc7ddd61116118ab5da2797d"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Sep 18 10:54:57 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Sep 18 11:08:01 2026 +1000"
      },
      "message": "Merge tag \u0027drm-xe-fixes-2026-09-17\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nCouple shrinker related fixes plus a series of patches fixing several\nxe_mmio_gem issues around fault handler and destroy path.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/aqvoKaPuLLPBGayA@intel.com\n"
    },
    {
      "commit": "e7d3e2f46dd5a69046e6d95a0f189155a5516b93",
      "tree": "4b19a1599dde664b99c0bf2821e081621fa4295f",
      "parents": [
        "27600805e62f800bacf990354632eae4e487d34c"
      ],
      "author": {
        "name": "Chang S. Bae",
        "email": "chang.seok.bae@intel.com",
        "time": "Wed Sep 16 22:59:39 2026 +0000"
      },
      "committer": {
        "name": "Borislav Petkov (AMD)",
        "email": "bp@alien8.de",
        "time": "Thu Sep 17 16:54:20 2026 -0700"
      },
      "message": "x86/microcode/intel: Reject problematic loading on Granite Rapids systems\n\nMicrocode updates can usually jump revisions. However, there is an erratum on\nGranite Rapids systems. If they \"jump over\" revision 0x1000405, they result in\nan #MC. Avoid it.\n\nSigned-off-by: Chang S. Bae \u003cchang.seok.bae@intel.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260916225939.1144524-1-chang.seok.bae@intel.com\n"
    },
    {
      "commit": "5dd1818b15d98d4a20806cd00b1b40320b06004f",
      "tree": "691abe8db32739093fdbcd0fa054776a3b55a257",
      "parents": [
        "b5a051f6b840d48f159166ef073d3021989bfb50",
        "8697c431e297eb0d0ab13dda6bc172b48a34f05c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 16:53:26 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 16:53:26 2026 -0700"
      },
      "message": "Merge tag \u0027for-next-keys-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull key fixes from Jarkko Sakkinen.\n\n* tag \u0027for-next-keys-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n  KEYS: encrypted: fix integer overflow of datablob_len\n  KEYS: trusted: Fix tpm2_load_cmd() boundary check\n  keys: translate request_key_auth pid for the reading procfs instance\n  keys: fix lost wakeup when reaping a dead key type\n"
    },
    {
      "commit": "717e0a25036b6c92cecace30913b2d874a4c22b8",
      "tree": "32363e9fdd9a75ee9eef2c6a9ca9205406d3aab2",
      "parents": [
        "5f0306e731e2f46e91419eae57eee3a241c055e0"
      ],
      "author": {
        "name": "Wentao Liang",
        "email": "vulab@iscas.ac.cn",
        "time": "Thu Sep 17 16:34:39 2026 +0000"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 19:29:25 2026 -0300"
      },
      "message": "cifs: Fix server use-after-free in cifs_chan_skip_or_disable()\n\nWhen a secondary channel is no longer supported by the server,\ncifs_chan_skip_or_disable() drops the channel reference with\ncifs_put_tcp_session() and then continues to use the server pointer by\ncalling cifs_signal_cifsd_for_reconnect() on it and reading its\nprimary_server pointer. cifs_put_tcp_session() can drop the last\nreference of the channel and tear it down, so both the channel and the\nprimary server (whose reference is also dropped by\ncifs_put_tcp_session()) can be freed before they are signaled for\nreconnect.\n\nSignal the channel and the primary server and capture the primary\nserver pointer before dropping the channel reference with\ncifs_put_tcp_session().\n\nFixes: f591062bdbf4 (\"cifs: handle servers that still advertise multichannel after disabling\")\nCc: stable@vger.kernel.org\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "c9dc7d730319ad64b51570c5387f1fee7b07b510",
      "tree": "d92f00c063321d87c81674fa25962938b0c67969",
      "parents": [
        "cee9395acd8043be0644b25c34bfa86623f2b935"
      ],
      "author": {
        "name": "Richard Zhu",
        "email": "hongxing.zhu@nxp.com",
        "time": "Thu Aug 13 17:50:03 2026 +0800"
      },
      "committer": {
        "name": "Bjorn Helgaas",
        "email": "bhelgaas@google.com",
        "time": "Thu Sep 17 16:54:34 2026 -0500"
      },
      "message": "PCI: imx6: Move clock enable after core reset assertion\n\nCommit 610fa91d9863 (\"PCI: imx6: Assert PERST# before enabling regulators\")\ninadvertently moved clock enablement before core reset assertion, breaking\nPCI device initialization on i.MX6Q Apalis platforms with\nASM1061/ASM1062 SATA controllers connected:\n\n  imx6q-pcie 1ffc000.pcie: host bridge /soc/pcie@1ffc000 ranges:\n  imx6q-pcie 1ffc000.pcie:       IO 0x0001f80000..0x0001f8ffff -\u003e 0x0000000000\n  imx6q-pcie 1ffc000.pcie:      MEM 0x0001000000..0x0001efffff -\u003e 0x0001000000\n  imx6q-pcie 1ffc000.pcie: config reg[1] 0x01f00000 \u003d\u003d cpu 0x01f00000\n  imx6q-pcie 1ffc000.pcie: iATU: unroll F, 4 ob, 4 ib, align 64K, limit 4G\n  imx6q-pcie 1ffc000.pcie: Link: Only Gen1 is enabled\n  imx6q-pcie 1ffc000.pcie: Link failed to come up. LTSSM: POLL_CONFIG\n  imx6q-pcie 1ffc000.pcie: probe with driver imx6q-pcie failed with error -110\n\nNOTE: It is not 100% clear if the issue is specific to the ASM1061/ASM1062\ndevice or on the specific power-up sequence (reset vs cold-power-on).\n\nTo fix this regression, restore the original sequence where clocks are\nenabled after asserting core reset and configuring the controller type.\n\nFixes: 610fa91d9863 (\"PCI: imx6: Assert PERST# before enabling regulators\")\nReported-by: Leonardo Costa \u003cleoreis.costa@gmail.com\u003e\nCloses: https://lore.kernel.org/all/bl7i3obu2clzsgeoct2a4mtfhv6typcjdqmgneropf3hpgwve6@n2m5uhlduw57/T/#u\nReported-by: Franz Schnyder \u003cfra.schnyder@gmail.com\u003e\nCloses: https://lore.kernel.org/all/t65y5d54axtksbfs7r4olcefqhwm6m4dz3njgnrnf7fcotj74i@o7avoznlafbj/\nSigned-off-by: Richard Zhu \u003chongxing.zhu@nxp.com\u003e\nSigned-off-by: Manivannan Sadhasivam \u003cmanivannan.sadhasivam@oss.qualcomm.com\u003e\n[bhelgaas: move to pci/for-linus for v7.3]\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nCc: stable@vger.kernel.org # 7.2+\nLink: https://patch.msgid.link/20260813095003.356062-1-hongxing.zhu@oss.nxp.com\n"
    },
    {
      "commit": "3d743adf090cd4c9a2120c1e02b0482e88aa0d2d",
      "tree": "bdf434c24c497bfbbf6c938d5fc0fd54f592f69b",
      "parents": [
        "e922bad8b2d5028c51a096d083fea41cd0987154"
      ],
      "author": {
        "name": "Frieder Schrempf",
        "email": "frieder.schrempf@kontron.de",
        "time": "Thu Sep 17 16:10:15 2026 +0200"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Thu Sep 17 19:46:29 2026 +0100"
      },
      "message": "spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes\n\nfsl_qspi_select_mem() returns early when the chip select has not changed,\nwhich happens before it reaches clk_set_rate(). Since the rate is now\ntaken from the spi-mem operation rather than from the SPI device, the\ncontroller honours op-\u003emax_freq exactly once per chip select and ignores\nit for every operation after that.\n\nq-\u003eselected is only reset to -1 in fsl_qspi_default_setup(), i.e. at probe\nand on resume, so on the common single chip select board the very first\noperation latches a rate that all subsequent operations inherit, whatever\nfrequency they asked for.\n\nThis results in operations being issued with the wrong frequency.\n\nCache the operation frequency the clock was programmed for next to the\nselected chip select, and redo the clock setup when either changes.\n\nFixes: 2438db5253eb (\"spi: fsl-qspi: Support per spi-mem operation frequency switches\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Frieder Schrempf \u003cfrieder.schrempf@kontron.de\u003e\nAcked-by: Han Xu \u003chan.xu@nxp.com\u003e\nLink: https://patch.msgid.link/20260917-fsl-qspi-freq-op-fix-v1-1-5fbe6b02f738@kontron.de\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "5f0306e731e2f46e91419eae57eee3a241c055e0",
      "tree": "62625befaa583caf0bd6aaed2344182ee9757a71",
      "parents": [
        "4775c3b7a597907e0b97556c7986fda238a377ae"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:34:00 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:04:26 2026 -0300"
      },
      "message": "smb: client: fix reparse buffer bounds in cifs_query_reparse_point()\n\nIn cifs_query_reparse_point(), the start \u003e\u003d end check before casting to\nstruct reparse_data_buffer * only ensures the start pointer is within the\nresponse. It fails to verify that there is enough space remaining for the\nfixed 8-byte header of the structure.\n\nIf a server provides a DataOffset that leaves less than 8 bytes remaining,\nthe check passes, but subsequent reads of ReparseTag and ReparseDataLength\nwill occur out-of-bounds.\n\nFix this by ensuring the remaining space is at least the size of the\nreparse_data_buffer structure before accessing its fields.\n\nFixes: 56e84c64fc25 (\"cifs: Fix validation of SMB1 query reparse point response\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "4775c3b7a597907e0b97556c7986fda238a377ae",
      "tree": "04f20af20784918ee812e8a331674dfc0429fbae",
      "parents": [
        "b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:59 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:04:20 2026 -0300"
      },
      "message": "smb: client: fix potential OOB read in smb3_enum_snapshots()\n\nIf snapshot_array_size is smaller than GMT_TOKEN_SIZE,\nsmb3_enum_snapshots() sets ret_data_len to\nsizeof(struct smb_snapshot_array) without verifying the actual length\nof the server\u0027s reply.\n\nBecause SMB2_ioctl() places no lower bound on the server-supplied\nOutputCount and allocates retbuf to exactly that length, a short reply\nresults in ret_data_len exceeding the size of retbuf. The subsequent\ncopy_to_user() then reads past the end of retbuf, leaking adjacent slab\nmemory to userspace.  The subsequent clamp check is ineffective as it\nonly reduces ret_data_len.\n\nFix this by rejecting replies shorter than\nsizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set\nto the 12-byte struct size rather than the 16-byte\nMIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes\nis exactly what copy_to_user() attempts to read.\n\nFixes: e02789a53d71 (\"smb3: enumerating snapshots was leaving part of the data off end\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc",
      "tree": "702c02e0fecc22e9ef800176a2ceb191c1584e8a",
      "parents": [
        "eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:58 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:04:12 2026 -0300"
      },
      "message": "smb: client: fix missing iov bounds check in parse_posix_sids()\n\nIn parse_posix_sids(), sidsbuf_end is calculated using the server-supplied\nout_len without being validated against the actual length of the received\niov (iov_len).\n\nIf a server provides an inflated out_len, sidsbuf_end will point past the\nend of the iov. This defeats the bounds guards in posix_info_sid_size(),\nallowing out-of-bounds reads into adjacent kernel memory.\n\nFix this by rejecting responses where the calculated sidsbuf_end would\nexceed the received iov boundaries or cause pointer wraparound.\n\nFixes: a90f37e3d7ac (\"smb: client: parse owner/group when creating reparse points\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb",
      "tree": "3d3c7a7e15646409f9bf8d060ce2ecdaef5850ce",
      "parents": [
        "1b3221bb121079ad79a1f3c3aa360ba649832e7a"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:57 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:04:07 2026 -0300"
      },
      "message": "smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()\n\nIn move_smb2_ea_to_cifs(), the while (src_size \u003e 0) loop condition is\ninsufficient. It allows iteration to continue even if the remaining\nsrc_size is too small to contain a complete smb2_ea_info structure.\nConsequently, reads of ea_name_length and ea_value_length can occur\nout-of-bounds.\n\nFix this by ensuring src_size \u003e\u003d sizeof(*src) before attempting to read\nany structure fields. Additionally, reject any next_entry_offset that is\nsmaller than sizeof(*src) or that would advance the pointer beyond the\navailable buffer.\n\nNote that for calls where the server returns a malformed EA list, the\nerror returned to userspace changes from -ENODATA (getxattr) or\n-ERANGE (listxattr) to -EIO. This correctly signals a server protocol\nerror rather than misleadingly indicating \"attribute not present\" or\n\"output buffer too small\".\n\nFixes: 95907fea4fd8 (\"cifs: Add support for reading attributes on SMB2+\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "1b3221bb121079ad79a1f3c3aa360ba649832e7a",
      "tree": "51fbba82cde3ed4972940b7e1c3e66a6051affc9",
      "parents": [
        "e83330c55edc0c3ac08aa6c95e49e4694c65523b"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:56 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:04:03 2026 -0300"
      },
      "message": "smb: client: reject short Next offsets in parse_server_interfaces()\n\nIn parse_server_interfaces(), the server-supplied Next offset is\nvalidated against bytes_left, but not against the size of the interface\nstructure itself.\n\nA small, non-zero Next value can pass the bounds check but advance the\npointer by less than sizeof(*p). This causes the next iteration of the\nloop to read misaligned, overlapping structure fields.\n\nFix this by ensuring the Next offset is at least sizeof(*p).\n\nFixes: 7d34ec36abb8 (\"smb3: fix for slab out of bounds on mount to ksmbd\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "e83330c55edc0c3ac08aa6c95e49e4694c65523b",
      "tree": "2d96eb63894d0c07650352feac5b4b6350868656",
      "parents": [
        "f73726b83e4756fdaa099e1bc1143293bd57ad79"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:55 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:03:59 2026 -0300"
      },
      "message": "smb: client: fix missing lower-bound check on DFS referral string offsets\n\nparse_dfs_referrals() checks that DfsPathOffset and NetworkAddressOffset\ndo not exceed the buffer end, but fails to check that they don\u0027t point\ninside the referral header itself.\n\nIf a server provides an offset smaller than\nsizeof(struct dfs_referral_level_3), the derived string pointer overlaps\nwith the struct fields, causing cifs_strndup_from_utf16() to interpret\nheader data as UTF-16 strings.\n\nFix this by enforcing that string offsets are at least sizeof(*ref).\n\nFixes: 4ecce920e13a (\"CIFS: move DFS response parsing out of SMB1 code\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "f73726b83e4756fdaa099e1bc1143293bd57ad79",
      "tree": "e8f688bef4c26a8a61ce3c64d2e9480c3abcb339",
      "parents": [
        "b4694f269e66dfcd66991446375285723b6957bd"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:54 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:03:53 2026 -0300"
      },
      "message": "smb: client: fix server-\u003etotal_read for compound encrypted PDUs\n\nIn receive_encrypted_standard(), server-\u003etotal_read is left at the\nfull decrypted frame size when walking sub-PDUs of a compound encrypted\nframe. As a result, cifs_handle_standard() passes this full size\nto smb2_check_message(), causing the PDU length guards to incorrectly\nvalidate the entire compound frame instead of the current sub-PDU.\n\nThis allows truncated non-last sub-PDUs to bypass length validation,\nleading to out-of-bounds reads in smb2_get_data_area_len().\n\nFix this by setting server-\u003etotal_read to the true length of the\ncurrent sub-PDU: next_cmd for non-last sub-PDUs, and the remaining\npdu_length for the last one.\n\nFixes: b24df3e30cbf (\"cifs: update receive_encrypted_standard to handle compounded responses\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "b4694f269e66dfcd66991446375285723b6957bd",
      "tree": "e8a006925955edca758f296e49e01752dfd2941f",
      "parents": [
        "05762c5bc1cfdcac36747994fde2c04387a457f1"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:53 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:03:49 2026 -0300"
      },
      "message": "smb: client: validate minimum PDU size before smb2_get_data_area_len()\n\n__smb2_calc_size() calls smb2_get_data_area_len(), which reads\ncommand-specific struct fields to locate the data area. However,\nsmb2_check_message() only validates StructureSize2, meaning a truncated\nresponse could cause smb2_get_data_area_len() to read out-of-bounds.\n\nReplace has_smb2_data_area[] with smb2_min_pdu_len[], which is now\nused to indicate both whether a command\u0027s response has a data area\nand the size of that fixed response struct.  A non-zero entry means\nthe command has a data area, and is the minimum length required\nbefore the struct is read.\n\nFor each command with a data area, PDUs shorter than this minimum size\nare rejected instead of parsed.\n\nThe minimum is not applied to SMB2 error responses, which carry only\nthe 9-byte error body, the same exemption the StructureSize2 check\nabove it already makes.  STATUS_MORE_PROCESSING_REQUIRED is\ntreated as a normal reply, since an in-progress SESSION_SETUP\nresponse carries a full body and a security blob.\n\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "05762c5bc1cfdcac36747994fde2c04387a457f1",
      "tree": "ea934861ba0adbef380fdfe4b7cf6ca8c934f8bc",
      "parents": [
        "d034e836eefd7ce75e588f7031cffbeec594f5ac"
      ],
      "author": {
        "name": "Frank Sorenson",
        "email": "sorenson@redhat.com",
        "time": "Wed Sep 16 16:33:52 2026 -0500"
      },
      "committer": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Thu Sep 17 15:03:27 2026 -0300"
      },
      "message": "smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs\n\nFix several related bounds checking and pointer lifecycle issues in\nreceive_encrypted_standard()\u0027s handling of compound encrypted frames:\n\n- Clear next_buffer after assigning it to server-\u003ebigbuf. A stale\n  next_buffer pointer can lead to a use-after-free on subsequent\n  error paths.\n- Update pdu_length to the decrypted plaintext size (buf_size). Using\n  the pre-decryption length allows NextCommand to point into stale\n  ciphertext residue.\n- Reject next_cmd values smaller than MID_HEADER_SIZE(server).\n- Fix an integer overflow in the upper bound check by verifying\n  pdu_length - next_cmd \u003c MID_HEADER_SIZE(server), ensuring the\n  trailing slice is large enough for a header.\n\nFixes: b24df3e30cbf (\"cifs: update receive_encrypted_standard to handle compounded responses\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n"
    },
    {
      "commit": "72de4807ba84da485dda1a91572d66da9149e95a",
      "tree": "799c2120f5bda3ba9fecd040b08148f1fb79efe6",
      "parents": [
        "b797b52e88a66598a972111b02ef13edd8d03ed2"
      ],
      "author": {
        "name": "Anand Jain",
        "email": "asj@kernel.org",
        "time": "Sun Sep 13 02:06:28 2026 +0800"
      },
      "committer": {
        "name": "David Sterba",
        "email": "dsterba@suse.com",
        "time": "Thu Sep 17 19:45:12 2026 +0200"
      },
      "message": "btrfs: derive f_fsid with dev_t only when temp_fsid is active\n\nCommit c2a74ed0494c (\"btrfs: derive f_fsid from on-disk fsid and dev_t\")\nmixed dev_t into f_fsid for all single-device setups to avoid f_fsid\ncollisions with cloned filesystems.\n\nHowever, doing this unconditionally breaks backward compatibility.\nstatfs(2) f_fsid changes after a kernel upgrade, and also can shift\nacross reboots or dev re-attaches as dev_t values change.\n\nFix this by only mixing dev_t when temp_fsid is active.  This means for\nnon-temp_fsid setups or the original mount, we use the old method of\nderiving fsid based on the UUID.\n\nSo in the case of a cloned Btrfs filesystem, we won\u0027t be able to\nmaintain the same fsid across mount recycle if the mount order changes.\n\nReported-by: Dave Hansen \u003cdave.hansen@intel.com\u003e\nLink: https://lore.kernel.org/linux-btrfs/be0c08f5-2f31-40f5-8a3b-f2f58b3e00ff@intel.com\nFixes: c2a74ed0494c (\"btrfs: derive f_fsid from on-disk fsid and dev_t\")\nCC: stable@vger.kernel.org # 7.2\nSigned-off-by: Anand Jain \u003casj@kernel.org\u003e\nReviewed-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n"
    },
    {
      "commit": "b797b52e88a66598a972111b02ef13edd8d03ed2",
      "tree": "d4286ba07d1f117492d6911510e1bceb3e93d900",
      "parents": [
        "aeab4c62875748ecfd390a47ac1d91ea7c9a6abb"
      ],
      "author": {
        "name": "Qu Wenruo",
        "email": "wqu@suse.com",
        "time": "Sat Sep 12 18:12:06 2026 +0930"
      },
      "committer": {
        "name": "David Sterba",
        "email": "dsterba@suse.com",
        "time": "Thu Sep 17 19:45:08 2026 +0200"
      },
      "message": "btrfs: add \"/dev/root\" exception for device path update\n\n[BEHAVIOR CHANGE]\nSince commit 108cc8733989 (\"btrfs: fix a lockdep caused by path\nresolution during device scan\"), users with btrfs rootfs but without an\ninitramfs are complaining that grub2 can no longer detect the rootfs\ndevice:\n\n  /usr/sbin/grub-probe: error: cannot find a device for / (is /dev mounted?).\n\n[CAUSE]\nAlthough using btrfs without an initramfs is not recommended (if a new\ndevice is added to the rootfs, the system can no longer boot, as there\nis no way to register all devices), there is still a minority of users\ndoing this.\n\nIf there is no initramfs but the rootfs is on a block-device-based\nfilesystem, the kernel boot sequence initializes a minimal ramfs/tmpfs,\ncreates \"/dev/root\" with the proper device number for the rootfs, and\nthen invokes mount using \"/dev/root\".\n\nThat\u0027s why the end user will get the mount output:\n\n  /dev/root on / rw\n\nTo be honest, this is a user space problem: no one should trust the\ndevice path shown in mount, only the device number.\n\nE.g. one can even use \"/proc/self/fd/*\" to mount an fs, and that proc\npath will be registered, and no one else can mount that fs using that\npath.\n\nBefore commit 108cc8733989 (\"btrfs: fix a lockdep caused by path\nresolution during device scan\"), btrfs had an internal path lookup\nworkaround to address such weird paths, it works by checking if the\nexisting device path can still resolve to the device number.\n\nBut that path resolution is deadlock prone, thus it\u0027s replaced by a\nsimple devt check.\n\nThis works fine in most cases, as a btrfs device is registered by udev at\nboot time, thus all paths are sane.\n\nHowever this will not work for systems without an initramfs, causing the\nunreachable \"/dev/root\" path to exist forever without a way to rename it.\n\n[WORKAROUND]\nAdd an exception to the device path rename requirement.\n\nIf the device has the name \"/dev/root\", we know it\u0027s booted without an\ninitramfs, and only for that case we allow device path update.\n\nAnd if someone intentionally created \"/dev/root\" after boot, the\nexisting devt checks will reject that weird name as usual.\n\nThis should satisfy the minority of users, and still keep most of the\nexisting guards preventing unexpected/unnecessary device path updates.\n\nFixes: 108cc8733989 (\"btrfs: fix a lockdep caused by path resolution during device scan\")\nLink: https://lore.kernel.org/linux-btrfs/CAKLYgeL7nrA4nXcewdv9Fqg_s\u003d3GS\u003dvmoypnEiZBKQ7rySZFuQ@mail.gmail.com/\nLink: https://lore.kernel.org/linux-btrfs/dfbe1e27-dab8-4d55-8cf3-0b28eeac5df4@gmail.com/\nSigned-off-by: Qu Wenruo \u003cwqu@suse.com\u003e\nReviewed-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n"
    },
    {
      "commit": "aeab4c62875748ecfd390a47ac1d91ea7c9a6abb",
      "tree": "1cc3cfb82b0b82df38ec4887ce4ab1138f1d2f9e",
      "parents": [
        "97fcd34aa9fd73cefe3120ac9a82ca9d7763922f"
      ],
      "author": {
        "name": "Filipe Manana",
        "email": "fdmanana@suse.com",
        "time": "Wed Sep 16 16:49:37 2026 +0100"
      },
      "committer": {
        "name": "David Sterba",
        "email": "dsterba@suse.com",
        "time": "Thu Sep 17 19:44:58 2026 +0200"
      },
      "message": "btrfs: check if there is space for chunk item when validating sys chunk array\n\nWe checked if have enough remaining space for a key before dereferencing a\nkey, but we then dereference a chunk item, to get the number of stripes,\nwithout checking if there is space for the item. So add a check to see if\nthere is enough space for a chunk item before dereferencing the item to\nextract the stripe count.\n\nFixes: 2a9bb78cfd36 (\"btrfs: validate system chunk array at btrfs_validate_super()\")\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nReviewed-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n"
    },
    {
      "commit": "b5a051f6b840d48f159166ef073d3021989bfb50",
      "tree": "229bce3a2790a4729d84907859da1b888a695c99",
      "parents": [
        "4982d3552a3bf94de503acf93433277d08421de6",
        "3b95a04eb5f95bf6a016a1bb9ff37d3eee48de63"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 10:40:48 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 10:40:48 2026 -0700"
      },
      "message": "Merge tag \u0027net-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from Netfilter, Bluetooth, IPSec and WiFi.\n\n  Previous releases - regressions:\n\n   - netfilter: hold reference on ct until flow is released\n\n   - bridge:\n      - move switchdev call outside rcu\n      - vlan: fix bugs caused by switchdev deletion errors\n\n   - wifi:\n      - mac80211: reset state when starting AP fails\n      - cfg80211: don\u0027t free driver-owned scan requests\n\n   - tcp: don\u0027t call skb_clone_and_charge_r() for close()d listener in\n     tcp_v6_do_rcv()\n\n   - mptcp: return sk_wait_data() errors from recvmsg()\n\n   - xfrm: serialize state GC with device state flush\n\n   - drop_monitor: synchronize tracepoint unregistration on error path\n\n   - bluetooth:\n      - eir: validate service data length before reading UUID\n      - hci_sync: serialize local codec list cleanup\n      - RFCOMM: avoid socket lock inversion in listener cleanup\n\n   - eth:\n      - lan743x: fix RX checksum use-after-free\n      - mvpp2: prevent buffer overflow in page_pool allocation\n\n  Previous releases - always broken:\n\n   - core: lock the socket in sock_gettstamp()\n\n   - neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\n\n   - sched: codel: bound the dropping loop per dequeue call\n\n   - wifi: mac80211: include TIM bitmap control for buffered S1G mcast\n     traffic\n\n   - psp: avoid conflicts with skb-\u003edecrypted and sk_validate_xmit_skb()\n\n   - xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk()\n\n   - bluetooth: hci_qca: do not write to the serial port after it is\n     closed\n\n   - dsa: mxl862xx: disable the stats poll on teardown\n\n   - eth:\n      - stmmac: fix TSO header length truncation\n      - ip_tunnel: initialize `options_len` before referencing options\"\n\n* tag \u0027net-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (159 commits)\n  mptcp: fix bad accounting in __mptcp_subflow_push_pending()\n  mptcp: close race between scheduler and state change\n  mptcp: avoid unneeded actions on subflow reset\n  net: skbuff: do not leave stale header offsets after pskb_carve()\n  selftests: net: packetdrill: test exclusion of old ACK from TCP fast path\n  tcp: exclude old ACKs from tcp fast path\n  dpll: reject a reference sync pin which is not on the pin\u0027s dpll\n  net: mvpp2: prevent buffer overflow in page_pool allocation\n  net: macb: fix ordering around PTP timestamp read\n  selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion\n  net: psp: avoid conflicts with skb-\u003edecrypted and sk_validate_xmit_skb()\n  net: stmmac: preserve real_num_tx_queues on mqprio setup failure\n  net: stmmac: propagate FPE preemption-class mapping errors\n  net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()\n  net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value\n  net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain\n  net: ethernet: cortina: Ack RX overrun interrupt correctly\n  net: lock the socket in sock_gettstamp()\n  eth: fbnic: ring the doorbell if a burst ends in a drop\n  net: netsec: fix device_node reference leak on phy_np\n  ...\n"
    },
    {
      "commit": "97fcd34aa9fd73cefe3120ac9a82ca9d7763922f",
      "tree": "1353a8401ccb99399a01e0fc890be619bf297619",
      "parents": [
        "3565893cc72cdf6b795cf6a33e7ff9605322334d"
      ],
      "author": {
        "name": "Filipe Manana",
        "email": "fdmanana@suse.com",
        "time": "Wed Sep 16 15:43:41 2026 +0100"
      },
      "committer": {
        "name": "David Sterba",
        "email": "dsterba@suse.com",
        "time": "Thu Sep 17 19:39:41 2026 +0200"
      },
      "message": "btrfs: abort transaction on failure to update inode for hole punching and reflinking\n\nIf we fail to update the inode we error out without aborting the\ntransaction, which can result in a persistent inconsistency if after\nthe failure the transaction is committed, as we have dropped file\nextent items from a range and either punched a hole or insert a new file\nextent item for that range (for reflinks).\n\nSo add the missing transaction abort.\n\nFixes: 2aaa66558172 (\"Btrfs: add hole punching\")\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n"
    },
    {
      "commit": "3565893cc72cdf6b795cf6a33e7ff9605322334d",
      "tree": "8afa6c8c49ad1ef6e3c2d99f4fa41297c0511c22",
      "parents": [
        "76bf149cd0298544631e756670b89c399c7acbca"
      ],
      "author": {
        "name": "Guanghui Yang",
        "email": "3497809730@qq.com",
        "time": "Wed Sep 16 05:16:38 2026 +0000"
      },
      "committer": {
        "name": "David Sterba",
        "email": "dsterba@suse.com",
        "time": "Thu Sep 17 19:32:11 2026 +0200"
      },
      "message": "btrfs: clear free space tree creation state on rebuild failure\n\nbtrfs_rebuild_free_space_tree() sets BTRFS_FS_CREATING_FREE_SPACE_TREE\nbefore rebuilding the free space tree.  Several error paths return\nwithout clearing this flag.\n\nThe transaction restart failure path can leave the flag set on a live\nfilesystem, causing delayed reference processing to be skipped. Clear it\non all free space tree rebuild failure paths. Keep\nBTRFS_FS_FREE_SPACE_TREE_UNTRUSTED set, since a failed rebuild leaves\nthe free space tree untrusted. Callers must fall back to extent-tree\ncaching.\n\nFixes: 882af9f13e83 (\"btrfs: handle free space tree rebuild in multiple transactions\")\nCC: stable@vger.kernel.org # 6.14+\nAssisted-by: LLM\nReviewed-by: Boris Burkov \u003cboris@bur.io\u003e\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: Guanghui Yang \u003c3497809730@qq.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n"
    },
    {
      "commit": "4982d3552a3bf94de503acf93433277d08421de6",
      "tree": "94956c7fb806cee3dd376119b19f0df2fa5be69f",
      "parents": [
        "f143ea21cf834b4d57d70b47b99e582461f2dfaf",
        "546b928da0427b0d6c663cbb992bd7bfa9ac7971"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 09:57:09 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 09:57:09 2026 -0700"
      },
      "message": "Merge tag \u0027sound-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes. Most of them are device-specific fixes\n  while there are a few core fixes. The continued flux, but not too\n  scaring yet. Some highlights below.\n\n  ALSA Core:\n   - Fix potential UAF after asynchronous card release\n   - Fix a race condition in PCM timer initialization order\n\n  USB-Audio:\n   - Hardening fixes for issues reported by fuzzer for 6fire, bcd2000,\n     and implicit FB packets\n   - Fix double list addition in implicit FB handling\n   - Quirks for AVerMedia GC553Pro and Behringer FCA1616\n\n  HD-Audio:\n   - Quirks / fixes for HP OmniBook 7, OMEN 15, and Victus 15 laptops\n\n  ASoC:\n   - Support for DAI link codec channel mask to avoid mismatches\n   - Fix HDMI-codec channel status change report\n   - Fixes for various codecs and platforms: Realtek rt712/rt721\n     (calibration, reset fixes), Cirrus Logic (empty EFI variable\n     validation, capture channel fixup), AMD ACP SoundWire (bounds\n     checks, refactorings), ADAU1977 (OF match table support, SPI\n     cleanups), ES8336 (Huawei Matebook B3-420 quirk), UX500 (macro\n     fix)\"\n\n* tag \u0027sound-7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (33 commits)\n  ASoC: adau1977-i2c: add OF match table for I2C\n  ASoC: adau1977-spi: drop __maybe_unused and of_match_ptr()\n  ASoC: adau1977: make the Kconfig symbols user selectable\n  ASoC: amd: acp: fix card name length warning in SOF SoundWire machine driver\n  ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID\n  ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver\n  ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers\n  ASoC: cs-amp-lib: Prevent NULL pointer if efi variable is zero length\n  ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype\n  ASoC: hdmi-codec: Report a change when the channel status moves\n  ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments\n  ASoC: rt721: Reset codec to fix abnormal sound\n  ALSA: usb-audio: fix list_add double-add in push_back_to_ready_list\n  ALSA: hda: trace PCM open only after assigning a stream\n  ALSA: usb-audio: skip the broken mute control on AVerMedia GC553Pro\n  ALSA: hda/realtek: Enable mute LEDs on HP OmniBook 7 17-dc0xxx\n  ALSA: 6fire: fix OOB write from device-reported iso length\n  ALSA: usb-audio: Add capture quirk for Behringer FCA1616\n  ALSA: hda/realtek: Add mute LED quirk for HP OMEN 15-ax\n  ASoC: Intel: sof_es8336: Add a quirk for Huawei Matebook B3-420\n  ...\n"
    },
    {
      "commit": "f143ea21cf834b4d57d70b47b99e582461f2dfaf",
      "tree": "f1920242738109f1ae5b52f770ca3d07430bbb27",
      "parents": [
        "61cc777ca7a4280568ec3a8f730651d482f46e55",
        "242da4318d97380741516b595af3920207b2f0f1"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 09:40:25 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 09:40:25 2026 -0700"
      },
      "message": "Merge tag \u0027pwrseq-fixes-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull power sequencing fixes from Bartosz Golaszewski:\n\n - fix kconfig issue in pwrseq-thread-gpu\n\n - fix error path logic in pwrseq_unit_enable()\n\n - fix two NULL-pointer dereference bugs in power sequencing core\n\n* tag \u0027pwrseq-fixes-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n  power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()\n  power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()\n  power: sequencing: don\u0027t call .post_enable() if pwrseq_unit_enable() failed\n  power: sequencing: Fix build issue with COMPILE_TEST\n"
    },
    {
      "commit": "61cc777ca7a4280568ec3a8f730651d482f46e55",
      "tree": "6d956ff214f9ffe0fba921ad3c6f726d3c99e461",
      "parents": [
        "4aec9ad1c668755b253bff4d95a9d82a17d2d434",
        "50fd0ada8d37587223001600933270b59cb30e19"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 09:08:20 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 09:08:20 2026 -0700"
      },
      "message": "Merge tag \u0027gpio-fixes-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix fwnode reference leak on failure in shared GPIO handling\n\n - fix regression in OF_POPULATED logic after the unification of GPIO\n   hog handling between OF, ACPI and machine variants\n\n - don\u0027t call free_irq() if no IRQ is installed in gpio-virtuser\n\n* tag \u0027gpio-fixes-for-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n  gpio: virtuser: skip free_irq when no IRQ is installed\n  gpiolib: of: don\u0027t mark hog nodes OF_POPULATED before a chip is found\n  gpiolib: Put fwnode reference on failure\n"
    },
    {
      "commit": "2ac2fe765ef475f409616ac0b57c4a3922749b0f",
      "tree": "220fcc00c04752717923d23f5a94d0b913d87835",
      "parents": [
        "5155002b03b24ba3ef91c5c313b8cf0171b24904"
      ],
      "author": {
        "name": "Francis Marlou Pacaro",
        "email": "pacaro.francis.marlou.n@gmail.com",
        "time": "Fri Sep 04 08:20:21 2026 +0800"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:59:24 2026 -0400"
      },
      "message": "drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates\n\ndcn30_apply_idle_power_optimizations() derives the MALL frame cache\nhysteresis timer with\n\n\ttmr_delay \u003d (uint32_t)(div_u64(..., denom) - 64LL);\n\ndiv_u64() returns a u64, so when the quotient is smaller than 64 the\nsubtraction wraps instead of going negative and tmr_delay ends up huge.\nThe loop that follows tries to squeeze it into the 6 bit register field\nby doubling denom, but that only makes the quotient smaller, so tmr_delay\ncan never converge.  tmr_scale is bumped past 3 and the function gives up\nwith\n\n\t/* Delay exceeds range of hysteresis timer */\n\tASSERT(false);\n\neven though the requested delay is too *short* to encode, not too long.\n\nWith mall_additional_timer_percent left at its default of 0, the quotient\ndrops below 64 once the refresh rate used for the calculation goes above\n~243 Hz.  Every DCN 3.0 display above that loses MALL static screen\nentirely and splats a WARN once per boot.  Reproduced on Navi 23\n(RX 6600) driving 1920x1080, resetting /sys/kernel/debug/clear_warn_once\nbetween modes:\n\n\trefresh   MALL       ASSERT\n\t144 Hz    enabled    no\n\t240 Hz    enabled    no\n\t280 Hz    skipped    yes\n\t360 Hz    skipped    yes\n\nCommit 3bb68cec4db8 (\"drm/amd/display: Add Overflow check to skip MALL\")\nalready covered the other end of the range, where a large stutter period\nmakes the delay too long to encode.  Cover the short end by clamping to\n0, which selects the shortest hysteresis the register can express,\n65.28us * 64 \u003d ~4.18ms.  That is marginally longer than what the formula\nasks for at these refresh rates, and erring long is the safe direction:\nit only delays MALL entry, it can never enter early.\n\nThe numerator does not change between iterations, only denom does, so\ncompute it once and keep both call sites inside 100 columns.\n\nThe genuinely out of range case at very low refresh rates still reaches\nthe ASSERT, which is where it belongs.\n\nFixes: 52f2e83e2fe5 (\"drm/amdgpu/display: add MALL support (v2)\")\nSigned-off-by: Francis Marlou Pacaro \u003cpacaro.francis.marlou.n@gmail.com\u003e\nReviewed-by: Leo Li \u003csunpeng.li@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 387550e53e1405f1f960b62b22f8783db17c8e1d)\n"
    },
    {
      "commit": "5155002b03b24ba3ef91c5c313b8cf0171b24904",
      "tree": "2b7b0e2cf2d4867f77210b02c24505692a974f1a",
      "parents": [
        "7f9caa70aef0950e06d395ca0035831214d88187"
      ],
      "author": {
        "name": "Chengjun Yao",
        "email": "Chengjun.Yao@amd.com",
        "time": "Tue Sep 08 10:15:43 2026 +0800"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:58:48 2026 -0400"
      },
      "message": "drm/amdgpu: fix rmmio iounmap skipped on device removal\n\namdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so\ndrm_dev_enter() is already false there and the iounmap() guarded by it\nis skipped. This .remove path runs on both hot-unplug and plain rmmod,\nso the register BAR ioremap mapping leaks one instance per unload.\n\nUnmap rmmio unconditionally (guard only on non-NULL) and drop the now\nunused idx.\n\nFixes: 62d5f9f7110a (\"drm/amdgpu: Unmap MMIO mappings when device is not unplugged\")\nSigned-off-by: Chengjun Yao \u003cChengjun.Yao@amd.com\u003e\nReviewed-by: Asad Kamal \u003casad.kamal@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit dd6f86a97260e5207d3329ad03aa89fdad61b1e6)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "7f9caa70aef0950e06d395ca0035831214d88187",
      "tree": "2d61a77a5db35669f753793dbe6a0eac5ec6450c",
      "parents": [
        "0d2f4cfa564355fcbbc71498fd8ec09243036109"
      ],
      "author": {
        "name": "Mario Limonciello",
        "email": "mario.limonciello@amd.com",
        "time": "Tue Sep 15 12:51:24 2026 -0500"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:58:04 2026 -0400"
      },
      "message": "drm/amdgpu: Skip KFD mapping clear before initialization\n\namdgpu_amdkfd_clear_kfd_mapping() assumes that a non-NULL kfd_dev\nhas a fully populated node array. This is not true when KFD device\ninitialization fails after probe.\n\nFor example, kgd2kfd_device_init() sets num_nodes before checking\nPCIe atomics support. On Polaris systems without the required atomics,\nit returns before allocating nodes[0], but the kfd_dev remains attached\nto the amdgpu device. A later GPU reset then dereferences nodes[0]-\u003eid.\n\nRequire the authoritative KFD initialization flag before walking the\nnode array, matching the existing KFD reset and teardown paths.\n\nFixes: 70cadefcc616 (\"drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset\")\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5833\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 4ac1835823c47903fbb278bbf474773c46f59edc)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "0d2f4cfa564355fcbbc71498fd8ec09243036109",
      "tree": "0b83db026db1de0e32a7ef05e02d599ee3bee3cf",
      "parents": [
        "8ee521b8b189799e361d4233c5180ba56656d4d4"
      ],
      "author": {
        "name": "Srinivasan Shanmugam",
        "email": "srinivasan.shanmugam@amd.com",
        "time": "Tue Sep 15 14:07:39 2026 +0530"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:57:29 2026 -0400"
      },
      "message": "drm/amd/display: Fix NULL dereference in dcn50/dcn60 init_hw\n\ndc-\u003eclk_mgr is checked for NULL earlier in dcn50_init_hw() and\ndcn60_init_hw(), but dcn50_initialize_min_clocks() and\ndcn401_initialize_min_clocks() are called without any guard,\ncausing Smatch to report potential NULL dereferences.\n\nGuard both call sites with the same pattern used throughout\nboth functions:\n\n  if (dc-\u003eclk_mgr \u0026\u0026 dc-\u003eclk_mgr-\u003efuncs)\n\nAlso fix dcn50_initialize_min_clocks() which calls\nget_dispclk_from_dentist without checking the function pointer,\nunlike the dcn401 equivalent which guards that call.\n\nFix kernel-doc in dcn60_hwseq.c by adding missing parameter descriptions\nfor @probe in dcn60_update_probe_status() and @type in\nis_probe_measurement_type_for_hubbub().\n\nFixes: 7f7d7ea1fa51 (\"drm/amd/display: Add new sources for DCN6\")\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCc: Aurabindo Pillai \u003caurabindo.pillai@amd.com\u003e\nCc: Ivan Lipski \u003civan.lipski@amd.com\u003e\nCc: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nCc: Roman Li \u003croman.li@amd.com\u003e\nCc: Alex Hung \u003calex.hung@amd.com\u003e\nCc: Tom Chung \u003cchiahsuan.chung@amd.com\u003e\nSigned-off-by: Srinivasan Shanmugam \u003csrinivasan.shanmugam@amd.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 325c9a827cdd748e126eafeadaffc556204773d2)\n"
    },
    {
      "commit": "8ee521b8b189799e361d4233c5180ba56656d4d4",
      "tree": "c1a06c284971ad572cbbb0e3fc5c25cf738bfbd6",
      "parents": [
        "c883d0a132d430ef7ebb23fd94323be94d0fbdb8"
      ],
      "author": {
        "name": "David Francis",
        "email": "David.Francis@amd.com",
        "time": "Wed Aug 05 09:16:51 2026 -0400"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:56:45 2026 -0400"
      },
      "message": "drm/amdkfd: Avoid integer underflow in EOP ring size calculation.\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\norder_base_2(q-\u003eeop_ring_buffer_size / 4) - 1\n\nBut order_base_2 can in theory return 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\norder_base_2(q-\u003eeop_ring_buffer_size / 8)\n\nusing properties of logarithms.\n\nAlso add to the above comment to make the mathematics more clear.\n\nReviewed-by: Kent Russell \u003ckent.russell@amd.com\u003e\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "c883d0a132d430ef7ebb23fd94323be94d0fbdb8",
      "tree": "b434f8ad8e3951dbc5cf9bd088367a74983657b4",
      "parents": [
        "04de4007d32385b8b6a5dd72bff3146dfdc592c3"
      ],
      "author": {
        "name": "David Francis",
        "email": "David.Francis@amd.com",
        "time": "Wed Aug 05 09:51:35 2026 -0400"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:56:02 2026 -0400"
      },
      "message": "drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\nffs(q-\u003eeop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1\n\nBut ffs can in theory return 1 or 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\nffs(q-\u003eeop_ring_buffer_size / sizeof(unsigned int) / 4)\n\nusing properties of logarithms.\n\nReviewed-by: Kent Russell \u003ckent.russell@amd.com\u003e\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "04de4007d32385b8b6a5dd72bff3146dfdc592c3",
      "tree": "a777d15fec2d2d21bd80884bb4793675b7dbf20e",
      "parents": [
        "723d4dc628d764b19cf9efca14b82cca5ff020c9"
      ],
      "author": {
        "name": "Mario Limonciello",
        "email": "mario.limonciello@amd.com",
        "time": "Tue Sep 15 10:59:45 2026 -0500"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:55:14 2026 -0400"
      },
      "message": "drm/amdgpu: Fix GPU PCIe link capability reporting\n\nCommit eb53125a7ad9 (\"drm/amd: Add dedicated helper for\namdgpu_device_find_parent()\") made amdgpu_device_gpu_bandwidth() query\nthe first device outside the dGPU. That is the host side of the\nphysical link, not the GPU side.\n\nAs a result, the ASIC and platform capability masks can both be based\non the host port. drm_amdgpu_info_device then exposes the host\ncapabilities to userspace, such as Gen5 x16 for a Gen4 x8 GPU.\n\nCache both ends of the physical link during device initialization.\nUse link_dev for the GPU capability and link_partner for the platform\ncapability and _PR3 detection.\n\nReported-by: \"Marek Olšák\" \u003cmaraeo@gmail.com\u003e\nCloses: https://lore.kernel.org/amd-gfx/CAAxE2A4VhsAzzO1QjBjUg+NgnbD04ZzMyN6xsUJxjKJHH6hxiw@mail.gmail.com/\nSuggested-by: Lijo Lazar \u003clijo.lazar@amd.com\u003e\nFixes: eb53125a7ad9 (\"drm/amd: Add dedicated helper for amdgpu_device_find_parent()\")\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 7ea6a47224e2c6e89a3a682d7fbaace4817a55aa)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "723d4dc628d764b19cf9efca14b82cca5ff020c9",
      "tree": "1e7aa3764d550e0cba4fe388b472ec0f884c703c",
      "parents": [
        "636139603b99d2e3a18a46cf3f8d39313ce8042e"
      ],
      "author": {
        "name": "Dmitriy Chumachenko",
        "email": "Dmitry.Chumachenko@cyberprotect.ru",
        "time": "Mon Sep 14 17:33:03 2026 +0300"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:54:31 2026 -0400"
      },
      "message": "drm/amdgpu: check ras and obj before dereference\n\nnbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj\nwithout checking either for NULL. Both amdgpu_ras_get_context() and\namdgpu_ras_find_obj() can return NULL, e.g. during the window between\nadev-\u003enbio.ras being set (early in amdgpu_ras_init(), by design, to\nenable the fatal-error interrupt as soon as possible) and the PCIE_BIF\nras object actually being created in RAS late_init. Any interrupt in that\nwindow crashes in hard-IRQ context.\n\nThis is analogous to commit d190b459b2a4 (\"drm/amdgpu: the warning\ndereferencing obj for nbio_v7_4\"), which fixed the same issue in the\nnbio_v7_4 handler.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nFixes: 7692e1ee2446 (\"drm/amdgpu: add RAS fatal error handler for NBIO v7.9\")\nReviewed-by: Tao Zhou \u003ctao.zhou1@amd.com\u003e\nSigned-off-by: Dmitriy Chumachenko \u003cDmitry.Chumachenko@cyberprotect.ru\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c7071767a50a32ed727cf800ac84372429e3b4b3)\n"
    },
    {
      "commit": "636139603b99d2e3a18a46cf3f8d39313ce8042e",
      "tree": "c8c9f10598d5f47a29bbe697faa22d67e70e4b10",
      "parents": [
        "5f28bb1c2cd9dcdb76a20d61b3ea069b85893c59"
      ],
      "author": {
        "name": "Mike Lothian",
        "email": "mike@fireburn.co.uk",
        "time": "Sat Sep 12 00:29:08 2026 +0100"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:54:05 2026 -0400"
      },
      "message": "drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments\n\namdgpu_dma_buf_map() adds VRAM to the allowed domains for a peer2peer\nattachment.  GTT is only a fallback placement when VRAM is preferred, so\nttm_bo_validate() migrates the buffer from GTT into VRAM.  While the\nexporting device is runtime suspended its SDMA rings are down and the\nmove fails:\n\n  amdgpu: Move buffer fallback to memcpy unavailable\n\nAn importer on a second GPU reaches this holding no runtime PM\nreference on the exporter, e.g. a compositor on the APU submitting a\nframe that references a buffer exported by an idle dGPU:\n\n  amdgpu_cs_ioctl -\u003e amdgpu_cs_parser_bos -\u003e amdgpu_cs_bo_validate\n    -\u003e ttm_bo_validate -\u003e amdgpu_bo_move -\u003e dma_buf_map_attachment\n      -\u003e amdgpu_dma_buf_map -\u003e ttm_bo_validate -\u003e amdgpu_bo_move\n\nPinning a dma-buf into VRAM has the same requirement, which\ncommit 030631e97b20 (\"drm/amdgpu: revert \"take runtime pm reference\nwhen we attach a buffer\" v2\") called out as the one case that would\nneed the reference back.\n\nTake it in attach and drop it in detach.  pm_runtime_get_if_active()\nnever resumes the device, so it cannot deadlock against the reservation\ntaken during resume, which is why the old pm_runtime_get_sync() had to\ngo.  If the device is not active, clear peer2peer instead: the buffer\nthen stays in GTT, which remains accessible while the GPU is powered\ndown.  If runtime PM is disabled, take a plain reference so the put in\ndetach stays balanced.\n\nFixes: 030631e97b20 (\"drm/amdgpu: revert \"take runtime pm reference when we attach a buffer\" v2\")\nSuggested-by: Christian König \u003cchristian.koenig@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Mike Lothian \u003cmike@fireburn.co.uk\u003e\nAssisted-by: Claude:Opus-5 [Claude Code]\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 062ff15e30a48d14fb7d7558eba84f8dc97197f0)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "5f28bb1c2cd9dcdb76a20d61b3ea069b85893c59",
      "tree": "770057b69675d024b9c6b94c152ccaf99693b298",
      "parents": [
        "63e19ef3ddab806c472748c825f4dc88dcd994e8"
      ],
      "author": {
        "name": "Vladimir Marioukhine",
        "email": "Vladimir.Marioukhine@amd.com",
        "time": "Wed Aug 12 13:19:46 2026 -0400"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:53:24 2026 -0400"
      },
      "message": "drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1\n\nkfd_mqd_manager_v12.c (GFX 12.0) and kfd_mqd_manager_v12_1.c (GFX 12.1)\ndo not implement restore_mqd callbacks, leaving the function pointers\nNULL and causing CRIU restore to return -EOPNOTSUPP on GFX12.\n\nImplement restore_mqd for both compute and SDMA queues in\nkfd_mqd_manager_v12.c and kfd_mqd_manager_v12_1.c, modeled after the\nGFX 11 implementation with the following improvements:\n- update cp_mqd_base_addr_lo/hi to the newly allocated MQD address,\n  fixing a pre-existing gap shared with v11 where the in-MQD copy\n  still pointed at the old checkpoint-time address after restore\n- memset the full allocation before memcpy for compute queues to avoid\n  stale data in the GTT sub-allocator tail; SDMA MQDs use sizeof(*m)\n  since they are packed at mqd_size stride in a shared BO\n\ncheckpoint_mqd registration is deferred to a follow-up patch that also\nimplements get_checkpoint_info, so that checkpoint and restore are\nenabled together as a complete and testable unit.\n\nNote: GFX12.1 restore handles XCC0 only. Multi-XCC CRIU restore is\ncurrently unreachable due to a separate validation issue in\nkfd_criu_restore_queue(). A pr_warn_once() is emitted if a multi-XCC\ndevice is encountered.\n\nSigned-off-by: Vladimir Marioukhine \u003cVladimir.Marioukhine@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit b1f9601237d050f5df478464cf51bf1fff29a256)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "63e19ef3ddab806c472748c825f4dc88dcd994e8",
      "tree": "3c4fc34b1629c64df86e60d6b069557119ff180f",
      "parents": [
        "9413959fa9fe2d94d4814f8cc2b60409f4cd46b5"
      ],
      "author": {
        "name": "Leo Li",
        "email": "sunpeng.li@amd.com",
        "time": "Tue Aug 25 23:21:53 2026 -0400"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:52:06 2026 -0400"
      },
      "message": "drm/amd/display: Atomize IRQ register read/modify/write ops\n\n[Why]\n\nThe OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for\nthe output timing generator (OTG). VUPDATE_NO_LOCK is one of them.\n\nTo enable the IRQ, driver sets the VUPDATE_NO_LOCK_EN bit in the\nGLOBAL_SYNC_STATUS register.\n\nTo ack the IRQ after it fires, the driver sets the VUPDATE_NO_LOCK_CLEAR\nbit in the same GLOBAL_SYNC_STATUS register.\n\nThe bit sets are done through read/modify/write operations, which are\nnot atomic. Thus, the following race is possible:\n\n    Thread A:                       IRQ handler:\n                                    *HW IRQ fires*\n    # IRQ disable\n    val \u003d read(GLOBAL_SYNC_STATUS)\n    unset(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # ACK reads VUPDATE_NO_LOCK_EN unset\n                                    val1 \u003d read(GLOBAL_SYNC_STATUS)\n                                    set(val1, VUPDATE_NO_LOCK_CLEAR)\n    # IRQ enable\n    val \u003d read(GLOBAL_SYNC_STATUS)\n    set(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # BAD! clears VUPDATE_NO_LOCK_EN\n                                    write(val1, GLOBAL_SYNC_STATUS)\n\nRegarding the tagged Fixes: change, it appears the change made this race\nmore likely to occur. Since VUPDATE_NO_LOCK is now the sole IRQ source\nfor vblank handling, a single race on high refresh panels can lead to a\ntime out.\n\n[How]\n\nThe GLOBAL_SYNC_STATUS register is only one example, other IRQ control\nregisters also share the same scheme. On top of GLOBAL_SYNC_STATUS,\nlet\u0027s clean up those as well.\n\nTo keep things simple, Let\u0027s atomize the IRQ rmw ops via a single\ndriver-wide spinlock. Due to the small scope of this lock, it is\nunlikely to cause noticeable overhead on top of all the existing locking\nwithin the IRQ set/handle paths.\n\nSince DM is responsible for locking, wrap dc_interrupt_set/ack with the\nspinlock in the new amdgpu_dm_irq_set/ack functions. Migrate/drop all\nreferences in DM to dc_interrupt_set/ack to use amdgpu_dm_irq_set/ack\ninstead.\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5616\nFixes: c87e6635d2db (\"drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock\")\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nSigned-off-by: Chenyu Chen \u003cchen-yu.chen@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 70de0a0216583a53c946155f8c8adedfdca6b4e7)\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "9413959fa9fe2d94d4814f8cc2b60409f4cd46b5",
      "tree": "4afd032f062a466c27ead8069927894c6d84b95c",
      "parents": [
        "fd73f4a6659897191fa0d40695fe370925dd3780"
      ],
      "author": {
        "name": "Kevin Wang",
        "email": "kevin.wang@amd.com",
        "time": "Tue Aug 25 23:09:32 2026 +0800"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Thu Sep 17 11:51:15 2026 -0400"
      },
      "message": "drm/amd/pm: report energy accumulator for smu 14.0.3\n\nadd energy accumulator on pmfw 0x00685000 and above version.\n\nSigned-off-by: Kevin Wang \u003ckevin.wang@amd.com\u003e\nReviewed-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 4aa733ab15b303e2a40e2985ac21a0e01f24cc4a)\n"
    },
    {
      "commit": "3b95a04eb5f95bf6a016a1bb9ff37d3eee48de63",
      "tree": "f8d6e1cf388a6f343cb8e15fabb51541c8461e9e",
      "parents": [
        "a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309",
        "f3ef03357396d4b147d8e76c75fb612c2f264ffc"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Sep 17 08:14:38 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Sep 17 08:14:39 2026 -0700"
      },
      "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-3-rc4\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.3-rc4\n\nHere are two unrelated fixes:\n\n- Patch 1: avoid unneeded actions on subflow reset. A fix for another\n  fix introduced in v6.12 and targeting a commit from v5.7.\n\n- Patch 2: close a possible race when scheduling a closing path. A fix\n  for another fix introduced in v6.0 and targeting v5.10.\n\n- Patch 3: fix bad accounting when __subflow_push_pending returns an\n  error. A fix for v6.6.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-0-0cf5c72667c8@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "f3ef03357396d4b147d8e76c75fb612c2f264ffc",
      "tree": "f8d6e1cf388a6f343cb8e15fabb51541c8461e9e",
      "parents": [
        "42064de57fb83231fcc89663a94885f228a1ee53"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 15:05:59 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Sep 17 08:14:33 2026 -0700"
      },
      "message": "mptcp: fix bad accounting in __mptcp_subflow_push_pending()\n\nIf __subflow_push_pending() errors out we should avoid updating the\ncopied byte counters, to avoid mismatch push call later on.\n\nFixes: 0fa1b3783a17 (\"mptcp: use get_send wrapper\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-3-0cf5c72667c8@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "42064de57fb83231fcc89663a94885f228a1ee53",
      "tree": "e77e8ff6293e74412dcedba4d8d99576ecde65b9",
      "parents": [
        "2b0f561f21b27c40c91ea4975268a06092bd7e9c"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 15:05:58 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Sep 17 08:14:33 2026 -0700"
      },
      "message": "mptcp: close race between scheduler and state change\n\nThe mptcp scheduler may race with subflow sockets state change: data\ntransmission on the selected socket may fail and a later release could\ntry to use mss_now reset to 0 for a divide operation.\n\nAddress the issue by explicitly checking for the critical scenario.\n\nFixes: c886d70286bf (\"mptcp: do not queue data on closed subflows\")\nCc: stable@vger.kernel.org\nReported-by: Shardul Bankar \u003cshardul.b@mpiricsoftware.com\u003e\nReported-by: Xinyang Ge \u003cxinyang@anthropic.com\u003e\nCloses: https://lore.kernel.org/20260525194828.1137119-1-shardul.b@mpiricsoftware.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-2-0cf5c72667c8@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "2b0f561f21b27c40c91ea4975268a06092bd7e9c",
      "tree": "c88af0230d14081ad30a6a3dcb886d3e5cb95633",
      "parents": [
        "a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 15:05:57 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Sep 17 08:14:33 2026 -0700"
      },
      "message": "mptcp: avoid unneeded actions on subflow reset\n\nOnce in a blue moon, the mptcp receive path can recursively call\nmptcp_data_ready() via state change under unlucky error conditions, and\nthen try to hold the data lock again.\n\nBreak the recursion loop explicitly checking for the exceptional\ncondition.\n\nAdd a new flag instead of using an existing one like \u0027closing\u0027, to exit\nearly in subflow_state_change(), and explicitly flush the RX queue at\nreset time.\n\nThis avoids unneeded processing to check for available data -- calling\nget_mapping_status() and more on a dying subflow -- but also in error\nreporting and worker scheduling.\n\nNote that we must consume the currently peeked skb before invoking\nmptcp_dss_corruption to avoid consuming it again after the eventual\nreset has freed it.\n\nFixes: e32d262c89e2 (\"mptcp: handle consistently DSS corruption\")\nCc: stable@vger.kernel.org\nReported-by: Xinyang Ge \u003cxinyang@anthropic.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260917-net-mptcp-misc-fixes-7-3-rc4-v2-1-0cf5c72667c8@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "4aec9ad1c668755b253bff4d95a9d82a17d2d434",
      "tree": "d3e2b627494ec7645f85d7877eb977ad40eaef9d",
      "parents": [
        "238650ef6c7c7cca08e032527329424c9fbd70e5",
        "55a8e1451869233db837a97e8f3cbf9983bc8678"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 08:03:37 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Sep 17 08:03:37 2026 -0700"
      },
      "message": "Merge tag \u0027dma-mapping-7.3-2026-09-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"A few fixes for the DMA-mapping code:\n\n   - resolved regression in accessing encrypted memory by IOMMU-backed\n     devices (Aneesh Kumar K.V)\n\n   - improved failure handling and removed rare bug in swiotlb/highmem\n     (Donggeun Yoo)\"\n\n* tag \u0027dma-mapping-7.3-2026-09-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n  x86/mm: Don\u0027t force unencrypted DMA for IOMMU-backed devices\n  dma-mapping: don\u0027t trace the DMA address when the allocation fails\n  swiotlb: use the adjusted address for the highmem page lookup\n  dma-coherent: report a failed reserved memory assignment\n"
    },
    {
      "commit": "a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309",
      "tree": "79e4a5a1c8e35269d9d4525598af02d2b169ad99",
      "parents": [
        "ad9c65b8f948f9ca00d065114d6cd7d281f53ec9"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Sep 15 13:04:23 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 16:05:02 2026 +0200"
      },
      "message": "net: skbuff: do not leave stale header offsets after pskb_carve()\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove\nthe first bytes of a packet and reallocate skb-\u003ehead.\n\nAll the headers that were present before the operation are gone,\nbut both functions call skb_headers_offset_update(skb, 0), which\nis a no-op : skb-\u003emac_header, skb-\u003enetwork_header,\nskb-\u003etransport_header and skb-\u003ecsum_start keep their old values and\nnow describe bytes which are no longer there.\n\nBoth helpers size the new head from the old skb_end_offset(), so the\nstale offsets still land inside the new allocation. They point past\nskb_tail_pointer() though, to bytes that were never initialized.\n\npskb_carve_inside_nonlinear() is the worst case, because it leaves a\nzombie skb with an empty linear part (skb-\u003edata \u003d\u003d\nskb_tail_pointer(skb), skb_headlen(skb) \u003d\u003d 0), while\nskb_mac_header_was_set() is still true and skb-\u003emac_header is way\nahead of skb-\u003edata.\n\nThe only user of pskb_extract() is rds_tcp_data_recv(), and the\ncarved skb is queued on tinc-\u003eti_skb_list. When the RDS incoming\nmessage is released, rds_tcp_inc_free() calls skb_queue_purge(),\nwhich frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is\nvisible from drop_monitor, which then tries to pull back to the\n(bogus) mac header :\n\nskbuff: __skb_pull(len\u003d234)\nskb len\u003d6968 data_len\u003d6968 headroom\u003d0 headlen\u003d0 tailroom\u003d0\nend-tail\u003d384 mac\u003d(234,14) mac_len\u003d14 net\u003d(248,40) trans\u003d288\nshinfo(txflags\u003d0 nr_frags\u003d1 gso(size\u003d1428 type\u003d16 segs\u003d5))\ncsum(0x100120 start\u003d288 offset\u003d16 ip_summed\u003d3 complete_sw\u003d0 valid\u003d1 level\u003d0)\nhash(0x7b446c6c sw\u003d0 l4\u003d1) proto\u003d0x86dd pkttype\u003d0 iif\u003d60\nkernel BUG at ./include/linux/skbuff.h:2847!\n\nAdd skb_carve_reset_headers() to mark the mac and transport headers\nas not set, reset the network header, clear skb-\u003emac_len, and drop\na now meaningless CHECKSUM_PARTIAL (csum_start no longer describes\nanything).\n\nInvalidate the inner offsets as well. Unlike mac_header and\ntransport_header they have no \"unset\" sentinel, so a leftover\nnon-zero value still looks like a real header. Zero\nskb-\u003einner_mac_header, skb-\u003einner_network_header,\nskb-\u003einner_transport_header, skb-\u003einner_protocol and\nskb-\u003eencapsulation, so that all the header state is invalidated in\none place.\n\nv2: fixed an inaccurate changelog. The stale offsets stay inside the\n    new skb-\u003ehead, which is never smaller than the old one, they\n    simply point past skb_tail_pointer() to bytes that are gone.\n    Thanks to Xuanqiang Luo for insisting on this.\n    Also invalidate the inner header state, as suggested by the\n    netdev AI review :\n    https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com\n\nFixes: 6fa01ccd8830 (\"skbuff: Add pskb_extract() helper function\")\nReported-by: syzbot+586af68eb819833c2d91@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6aa3e9d3.f2639fcc.29487d.0028.GAE@google.com/\nCc: Xuanqiang Luo \u003cxuanqiang.luo@linux.dev\u003e\nCc: Allison Henderson \u003cachender@kernel.org\u003e\nCc: rds-devel@oss.oracle.com\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260915130423.3956471-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "ad9c65b8f948f9ca00d065114d6cd7d281f53ec9",
      "tree": "24460f2d4896308f91e3bb5f6c294f056f2f4aaa",
      "parents": [
        "d798162eb364df2e77a56fdbe5bae54440152d3b",
        "d841cd7513f3d48018175ecb1fb972cfd3c3c10b"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 15:18:10 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 15:18:49 2026 +0200"
      },
      "message": "Merge branch \u0027tcp-exclude-old-acks-from-fast-path\u0027\n\nInbal Schussheim says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ntcp: exclude old ACKs from fast path\n\nExclude ACKs outside [SND.UNA, SND.NXT] from TCP header prediction so\nthat they fall through to the slow path, where ACK\nvalidation is applied.\n\nAdd a packetdrill test for a data segment carrying an\nexcessively old ACK. The test fails on the unpatched kernel and passes\nwith the fix.\n\nv2: https://lore.kernel.org/netdev/20260909075644.1408171-1-inbal.lipshtat@mail.huji.ac.il/\nv1: https://lore.kernel.org/netdev/20260906123151.1391349-1-inbal.lipshtat@mail.huji.ac.il/T/#u\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260914090408.1435080-1-inbal.lipshtat@mail.huji.ac.il\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "d841cd7513f3d48018175ecb1fb972cfd3c3c10b",
      "tree": "24460f2d4896308f91e3bb5f6c294f056f2f4aaa",
      "parents": [
        "f81e6c3fb06327bc49cdd6e559845293ba06a704"
      ],
      "author": {
        "name": "Inbal Schussheim",
        "email": "inbal.lipshtat@mail.huji.ac.il",
        "time": "Mon Sep 14 12:04:08 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 15:17:58 2026 +0200"
      },
      "message": "selftests: net: packetdrill: test exclusion of old ACK from TCP fast path\n\nAdd a packetdrill test for an in-sequence data segment carrying an\nexcessively old ACK.\n\nVerify that the segment falls through from the TCP fast path to the slow\npath, where the existing ACK validation rejects it and sends a challenge\nACK. The payload is not accepted and RCV.NXT remains unchanged.\n\nBased on the reproducer from Commit 3d501dd326fb\n(\"tcp: do not accept ACK of bytes we never sent\").\n\nSigned-off-by: Inbal Schussheim \u003cinbal.lipshtat@mail.huji.ac.il\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260914090408.1435080-3-inbal.lipshtat@mail.huji.ac.il\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f81e6c3fb06327bc49cdd6e559845293ba06a704",
      "tree": "d0bab714377f843fe238b2adbeadb088e3822ae6",
      "parents": [
        "d798162eb364df2e77a56fdbe5bae54440152d3b"
      ],
      "author": {
        "name": "Inbal Schussheim",
        "email": "inbal.lipshtat@mail.huji.ac.il",
        "time": "Mon Sep 14 12:04:07 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 15:17:58 2026 +0200"
      },
      "message": "tcp: exclude old ACKs from tcp fast path\n\nExclude old ACKs before SND.UNA from the tcp fast path\nas well as ACKs after SND.NXT.\n\nSuch ACKs will fall through to the slow path, where tcp_ack()\nperforms the appropriate validation and challenge ACK handling\naccording to RFC5961 and Commit 3d501dd326fb1c7 (\"tcp: do not\naccept ACK of bytes we never sent\").\n\nThis prevents old ACKs from being accepted\nor modifying connection state as part of the fast path before\nappropriate ACK validation is applied.\nIn particular, this prevents payload carried by a segment with\nan excessively old ACK from advancing RCV.NXT before the ACK\nis rejected.\n\nFixes: 31770e34e43d (\"tcp: Revert \"tcp: remove header prediction\"\")\nReported-by: Amit Klein \u003camit.klein@mail.huji.ac.il\u003e\nReported-by: Tamir Shahar \u003ctamir.shahar1@mail.huji.ac.il\u003e\nReported-by: Inbal Schussheim \u003cinbal.lipshtat@mail.huji.ac.il\u003e\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Inbal Schussheim \u003cinbal.lipshtat@mail.huji.ac.il\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260914090408.1435080-2-inbal.lipshtat@mail.huji.ac.il\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "d798162eb364df2e77a56fdbe5bae54440152d3b",
      "tree": "0c2d1a28f23a2a58d824a90d75533fb1055a07ea",
      "parents": [
        "14cb1e7702e5cb3c58888f6aed498381a73927d2"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Sep 15 14:30:47 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 14:51:23 2026 +0200"
      },
      "message": "dpll: reject a reference sync pin which is not on the pin\u0027s dpll\n\ndpll_pin_ref_sync_state_set() resolves the partner\u0027s driver private data\nwith dpll_pin_on_dpll_priv() and passes the result to ref_sync_get() and\nref_sync_set() without looking at it. The helper returns NULL when the\npartner holds no ref on that dpll. Of the two drivers implementing the\nfeature only zl3073x dereferences the pointer (sync_pin-\u003eid); ice ignores\nit, so ice cannot fault here.\n\nThe NULL is a teardown race, not a steady state - zl3073x registers every\ninput pin with every channel, so the partner is normally present on the\ndpll the base pin resolves to. zl3073x_dev_stop() unregisters pins one at\na time, taking and dropping dpll_lock for each, and between the partner\u0027s\nturn and the base pin\u0027s the partner is out of that dpll\u0027s pin_refs while\nstill registered with the channels not yet torn down, so\ndpll_pin_available() keeps passing. That path is not only driver removal:\ndevlink reload and devlink dev flash both run zl3073x_dev_stop().\n\nReproduced by holding that state open with a mock dpll device, which is\nwhere the frame name comes from:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:mock_ref_sync_get+0x5/0x30\n Call Trace:\n  \u003cTASK\u003e\n  dpll_pin_ref_sync_set+0x19f/0x4a0\n  dpll_nl_pin_set_doit+0x17d/0x840\n  genl_family_rcv_msg_doit+0xd6/0x130\n  genl_rcv_msg+0x181/0x2b0\n  netlink_rcv_skb+0x55/0x100\n  genl_rcv+0x23/0x30\n  netlink_unicast+0x24d/0x370\n  netlink_sendmsg+0x1e2/0x420\n  __sys_sendto+0x1db/0x1f0\n  __x64_sys_sendto+0x1f/0x30\n  do_syscall_64+0xe1/0x490\n\nCommit d2e914a4a0d0 (\"dpll: fix NULL pointer dereference in\ndpll_msg_add_pin_ref_sync()\") added the same guard to the read side, which\nthe kernel walks into by itself because the delete notification is emitted\nfrom inside the unregister; the write side needs a pin-set to land in the\nwindow and was left alone. Test the priv rather than look up pin_refs\ndirectly, so that the two halves key off the same condition.\n\nFixes: 58256a26bfb3 (\"dpll: add reference sync get/set\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nLink: https://patch.msgid.link/20260915213047.1352286-1-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "14cb1e7702e5cb3c58888f6aed498381a73927d2",
      "tree": "8dc204235313dd83a6f1bf390efe087be5320e9b",
      "parents": [
        "9ca4ba24259183ce15665be86b2956cd896c4687"
      ],
      "author": {
        "name": "Dmitriy Okunev",
        "email": "dokunevdmitriy@gmail.com",
        "time": "Mon Sep 14 12:15:57 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 14:43:29 2026 +0200"
      },
      "message": "net: mvpp2: prevent buffer overflow in page_pool allocation\n\nThe per‑processor buffering scheme is supported only if the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\n\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv-\u003epage_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\n\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nFixes: 7d04b0b13b11 (\"mvpp2: percpu buffers\")\nSigned-off-by: Dmitriy Okunev \u003cdokunevdmitriy@gmail.com\u003e\nLink: https://patch.msgid.link/20260914091557.71769-1-dokunevdmitriy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "9ca4ba24259183ce15665be86b2956cd896c4687",
      "tree": "7204238fdde71195b0135aedf3bb6020e5f20486",
      "parents": [
        "c9151088f1674fd29ff26a20f5fc687acf53a2f0"
      ],
      "author": {
        "name": "James Clark",
        "email": "jjc@jclark.com",
        "time": "Tue Sep 15 11:58:17 2026 +0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Sep 17 14:25:52 2026 +0200"
      },
      "message": "net: macb: fix ordering around PTP timestamp read\n\nPTP_SYS_OFFSET_EXTENDED returns system timestamps that do not correctly\nbracket the PHC register read on MACB/GEM. On a Raspberry Pi 5, the\nreturned interval can be as short as 37 ns, while an ordered register\nread takes approximately 1 us. This biases the midpoint used by phc2sys,\ncausing CLOCK_REALTIME to run approximately 0.5 us ahead when synchronized\nto the PHC.\n\ngem_tsu_get_time() reads the nanoseconds register using the driver\u0027s\nrelaxed MMIO accessor. On weakly ordered systems, the subsequent system\ntimestamp can be taken before the register read completes. The internal\nsmp_rmb() in the pre-timestamp path also does not guarantee ordering\nagainst the subsequent MMIO read.\n\nAdd rmb() before and after the bracketed nanoseconds read in both the\nnormal and seconds rollover paths so the system timestamps bracket the\nPHC read. Adding the post-read barrier increases the minimum interval on\nthe same Raspberry Pi 5 to approximately 1 us.\n\nFixes: e51bb5c2784c (\"net: macb: ptp: Switch to gettimex64() interface\")\nTested-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e # Raspberry Pi CM5, min bracket 37 ns -\u003e 981 ns\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nAssisted-by: LLM\nSigned-off-by: James Clark \u003cjjc@jclark.com\u003e\nLink: https://patch.msgid.link/20260915045823.76100-1-jjc@jclark.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b15e54761a0dd5fdf3dc790a031ab0e4185b7612",
      "tree": "2955162451ea2d5c123c9b3b7fbb9deae3dbac85",
      "parents": [
        "fd73f4a6659897191fa0d40695fe370925dd3780",
        "a15fac810c76397ec9f62a6fc26c4d7ab6e238a7"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Thu Sep 17 19:05:20 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Thu Sep 17 19:05:21 2026 +1000"
      },
      "message": "Merge tag \u0027drm-msm-fixes-2026-09-16\u0027 of https://gitlab.freedesktop.org/drm/msm into drm-fixes\n\nFixes for v7.3-rc4:\n\nDT:\n- Corrected indentation\n\nCore:\n- Marked fbdev as system memory\n\nGPU:\n- Fixed autosuspend cleanup on teardown\n- a750: fix timestamps\n- Increase GMU fw init timeout\n- Misc fixes/cleanups\n\nDPU:\n- Fixed clock rounding, unbreaking newest platforms\n- Cleared pending flush state\n\nDP:\n- Skip PUSH_IDLE when link was never enabled\n- Fixed bandwidth checks\n\nHDMI:\n- Fixed runtime PM cleanup on probe failure\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Rob Clark \u003crob.clark@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/CACSVV021rZsjmiPEyR_LR7L\u003dk7\u003dDRV0QdsA50BF_Gd0s2DXaCw@mail.gmail.com\n"
    },
    {
      "commit": "a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255",
      "tree": "73fef824f9a846cf935869d0dbc5070ef6e2f741",
      "parents": [
        "704340f1cd0dcef829eb62f5b48ae95a2ce17bdf"
      ],
      "author": {
        "name": "Jinke Han",
        "email": "jinkehan@didiglobal.com",
        "time": "Tue Sep 08 15:37:42 2026 +0800"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Thu Sep 17 09:48:42 2026 +0200"
      },
      "message": "x86/kprobes: Fix crash when probing CS CALL instructions\n\nWhen using eBPF to probe CS CALL instructions within a function,\na crash can be triggered.\n\nThe eBPF tool probes offset 257 of the __hrtimer_run_queues()\nfunction:\n\n\u003c__hrtimer_run_queues+249\u003e:  nopl   0x0(%rax,%rax,1)\n\u003c__hrtimer_run_queues+254\u003e:  mov    %r14,%rdi\n\u003c__hrtimer_run_queues+257\u003e:  cs call \u003c__x86_indirect_thunk_r12\u003e\n\u003c__hrtimer_run_queues+263\u003e:  mov    %eax,%r12d\n\u003c__hrtimer_run_queues+266\u003e:  xchg   %ax,%ax\n\u003c__hrtimer_run_queues+268\u003e:  mov    %r13,%rdi\n\nWhich triggers this crash:\n\n  BUG: unable to handle page fault for address: 00000000000f41c9\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 0 P4D 0\n  Oops: 0002 [#1] SMP NOPTI\n  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P\n  RIP: 0010:__hrtimer_run_queues+0x106/0x230\n\nNote that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is\nat the 6th byte of the above CS CALL instruction. Since the CS CALL\ninstruction occupies 6 bytes, the exception occurred in the middle of that\ncall instruction.\n\nThe root cause is that when using eBPF tools to probe in the middle of a\nfunction, a kprobe with INT3 is used as the underlying implementation.\n\nDuring single-step emulation of the original CALL instruction,\nint3_emulate_call() assumes that the probed CALL instruction is 5 bytes\nlong. However, the actual CS-prefixed CALL instruction occupies 6 bytes,\nso it constructs an incorrect exception return address. When the CPU\nreturns from the kprobe handler, the next instruction to be executed is at\nthe address of the last byte of that CS CALL instruction. Coincidentally,\nstarting from that address, the CPU fetches and decodes a completely\ndifferent instruction, which ultimately triggers a kernel crash.\n\nFix the issue by using the actual instruction length obtained from\nthe instruction decoder when constructing the exception return\naddress, rather than relying on the hardcoded CALL_INSN_SIZE macro.\n\n[ mingo: Refined the changelog ]\n\nFixes: 6256e668b7af (\"x86/kprobes: Use int3 instead of debug trap for single-step\")\nSuggested-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Jinke Han \u003cjinkehan@didiglobal.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nAcked-by: Yafang Shao \u003claoar.shao@gmail.com\u003e\nAcked-by: Borislav Petkov \u003cbp@alien8.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000\n"
    },
    {
      "commit": "5535d5e61a77ad79118ea7665ce1c14f857f0f12",
      "tree": "abce5acbb19eac80966ee2e98be1799883285a41",
      "parents": [
        "6c62dfd2820f0c32b0083668edbe0baca6e10b92"
      ],
      "author": {
        "name": "Huacai Chen",
        "email": "chenhuacai@loongson.cn",
        "time": "Thu Sep 03 16:42:12 2026 +0800"
      },
      "committer": {
        "name": "Icenowy Zheng",
        "email": "zhengxingda@iscas.ac.cn",
        "time": "Thu Sep 17 15:12:26 2026 +0800"
      },
      "message": "drm/loongson: Create blend mode property for cursor plane\n\nAfter commit 860e748bddcc929 (\"drm: ensure blend mode supported if pixel\nformat with alpha exposed\") we get warnings at boot:\n\nloongson 0000:00:06.1: [drm] [PLANE:41:ls-cursor-plane-0] pixel format with alpha exposed but blend mode not setup. Please fix.\nloongson 0000:00:06.1: [drm] [PLANE:46:ls-cursor-plane-1] pixel format with alpha exposed but blend mode not setup. Please fix.\n\nThe reason is the cursor plane supports color formats with alpha but the\ndriver doesn\u0027t create blend mode property, which triggers the warning in\nvalidate_blend_mode_for_alpha_formats().\n\nThe loongson DC HW doesn\u0027t support DRM_MODE_BLEND_PREMULTI, so create\nblend mode property with DRM_MODE_BLEND_COVERAGE for cursor planes since\nit is the only one implemented in the driver.\n\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\nReviewed-by: Jianmin Lv \u003clvjianmin@loongson.cn\u003e\nSigned-off-by: Icenowy Zheng \u003czhengxingda@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260903084212.3621540-1-chenhuacai@loongson.cn\n"
    },
    {
      "commit": "546b928da0427b0d6c663cbb992bd7bfa9ac7971",
      "tree": "8af139c814686116b55ab46ad130804f5da46a57",
      "parents": [
        "dbd9d1cbf9700528c8595ab1fa7ef832e79821fe",
        "940e8fe8535d22ce67dd2fb9588e6c55a31d7d03"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Sep 17 08:15:32 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Sep 17 08:15:32 2026 +0200"
      },
      "message": "Merge tag \u0027asoc-fix-v7.3-rc3\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.3\n\nA relatively large pile of fixes here, a lot of driver specific stuff\nthat\u0027s broadly unremarkable plus a few core fixes from Richard that fix\nissues where SoundWire systems with multiple CODECs on the same link\nwould configure the CODECs to use the same bus slots leading to broken\naudio.\n"
    },
    {
      "commit": "c9151088f1674fd29ff26a20f5fc687acf53a2f0",
      "tree": "5d219670a0f060605a7692b25678446a3d1e29b2",
      "parents": [
        "dd56c0bc4836fa705acb2f6a8a44af669d30fa3a",
        "b4288c59bda883b0e5cd95099dc3b0b7b7fc50f6"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Sep 16 19:18:26 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Sep 16 19:18:26 2026 -0700"
      },
      "message": "Merge branch \u0027net-psp-avoid-conflicts-with-skb-decrypted-and-sk_validate_xmit_skb\u0027\n\nDaniel Zahka says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: psp: avoid conflicts with skb-\u003edecrypted and sk_validate_xmit_skb()\n\nSashiko\u0027s review of commit da630d1da2b1 (\"netdevsim: psp: drop tx key\nops\") [1] showed that there is a hazard between PSP and offloaded TLS,\nwhere both can clobber what the other set in the sk_validate_xmit_skb\ncallback.\n\nIt was discussed further on the mailing list [2], and it was pointed out\nthat there are conflicts with PSP and TLS ULP both using the\nskb-\u003edecrypted bit.\n\nThe simplest fix is to make psp and tls mutually exclusive. This series\ngoes a bit further and makes psp exclusive with all TCP ULPs. The PSP\nimplementation that we have is not designed to be used with any TCP ULP,\nso don\u0027t allow a socket to have state for both.\n\nI will send a subsequent series to net-next which will remove the\nability to perform the rx-assoc and tx-assoc psp netlink calls on\nsockets that are not in the TCP_ESTABLISHED state. This will close the\nremaining quirk that a sk_clone() on a listen socket with psp tx-assoc\nstate will leave a stale sk-\u003esk_validate_xmit_skb call back on a new,\nnon-psp socket. I do not believe that change needs to be regarded as a\nfix, because it only stands to add unecessary validation code in the tx\npath.\n\n[1]: https://sashiko.dev/#/patchset/20260903-psp-prep-v1-0-d47e9c4c375d%40gmail.com\n[2]: https://lore.kernel.org/netdev/20260903-psp-prep-v1-0-d47e9c4c375d@gmail.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260915-psp-ktls-fix-v2-0-0eedc3b148ec@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "b4288c59bda883b0e5cd95099dc3b0b7b7fc50f6",
      "tree": "5d219670a0f060605a7692b25678446a3d1e29b2",
      "parents": [
        "a41f24c612c3f5139a3143307eb85bbcf1bd4d07"
      ],
      "author": {
        "name": "Daniel Zahka",
        "email": "daniel.zahka@gmail.com",
        "time": "Tue Sep 15 16:11:38 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Sep 16 19:18:24 2026 -0700"
      },
      "message": "selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion\n\nTest both setting PSP after TLS ULP, and TLS ULP after PSP.\n\nAdd CONFIG_TLS\u003dy to the drivers/net/config.\n\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260915-psp-ktls-fix-v2-2-0eedc3b148ec@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    }
  ],
  "next": "a41f24c612c3f5139a3143307eb85bbcf1bd4d07"
}