)]}' { "log": [ { "commit": "b67ca94c46b197b7d7ae2bd63ca644a7cbe5fa8d", "tree": "73ecbd05035e16db37c879fd1a164b0f128d83e6", "parents": [ "237851a630e62c1a8bbab68956c4f401b1c73b4b" ], "author": { "name": "Junichi Uekawa", "email": "uekawa@google.com", "time": "Thu Aug 13 09:59:23 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 03 10:08:36 2026" }, "message": "Revert \"CHROMIUM: fuse: Implement CHROMEOS_TMPFILE\"\n\n6.1 kernels and later supports FUSE_TMPFILE and we no longer need to do our\nlocal hack.\n\nBUG\u003db:536947624,b:549808934\nTEST\u003dtast run arc.Boot.vm\n\nThis reverts commit f10cc3e1ac7c45b741722626fa3874f7312de855.\n\nChange-Id: I9b89d18a03d84546474383b342d51bad89903d7c\nSigned-off-by: Junichi Uekawa \u003cuekawa@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8255691\nReviewed-by: Keiichi Watanabe \u003ckeiichiw@chromium.org\u003e\nTested-by: Junichi Uekawa \u003cuekawa@chromium.org\u003e\nCommit-Queue: Junichi Uekawa \u003cuekawa@chromium.org\u003e\nReviewed-by: Tomasz Figa \u003ctfiga@chromium.org\u003e\n" }, { "commit": "237851a630e62c1a8bbab68956c4f401b1c73b4b", "tree": "2bfb29f1f6200d78264254c7ad6cec108d69b296", "parents": [ "6728a23c672baa88e7a0f274714c8c541883678b" ], "author": { "name": "Shashikiran", "email": "shashikiranah@google.com", "time": "Wed Aug 12 09:03:08 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 03 06:21:56 2026" }, "message": "CHROMIUM: gpu: arm: mali: Restore memory allocation check in CSF queue bind\n\nDuring the uprev to Mali DDK r54p1, the physical memory allocation check\nin kbase_csf_queue_bind() was accidentally omitted. This commit restores\nthe missing check to ensure proper queue state management.\n\nBUG\u003db:541945970\nTEST\u003dCQ\n\nChange-Id: Icce1df9e1ec2739a5bd8ef16f98b3913ba289fd4\nSigned-off-by: Shashikiran \u003cshashikiranah@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8295518\nReviewed-by: Masami Hiramatsu \u003cmhiramat@google.com\u003e\nReviewed-by: Dominik Behr \u003cdbehr@chromium.org\u003e\n" }, { "commit": "6728a23c672baa88e7a0f274714c8c541883678b", "tree": "f6e33542e28b73c2ee70c8fa9949718d65c4986b", "parents": [ "1a835d0282ba0cb00a35b02546497ed2e0e4af97" ], "author": { "name": "Alex Williamson", "email": "alex.williamson@nvidia.com", "time": "Thu Jul 30 12:15:30 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:20:31 2026" }, "message": "FROMGIT: vfio/pci: Fix racy bitfields and tighten struct layout\n\n[ Upstream commit e73638e55f861758d49f14d7bb5dba3035981cd7 ]\n\nBitfield operations are not atomic, they use a read-modify-write\npattern, therefore we should be careful not to pack bitfields that\ncan be concurrently updated into the same storage unit.\n\nThis split takes a binary approach: flags that are only modified\npre/post open/close remain bitfields, flags modified from user\naction, including actions that reach across to another device (ex.\nreset) use dedicated storage units.\n\nNote that the virq_disabled and bardirty flags are relocated to fill\nan existing hole in the structure.\n\nBitfield justifications:\n\n has_dyn_msix: written only in vfio_pci_core_enable()\n pci_2_3: written only in vfio_pci_core_enable()\n reset_works: written only in vfio_pci_core_enable()\n extended_caps: written only in vfio_cap_len() under vfio_config_init()\n has_vga: written only in vfio_pci_core_enable()\n nointx: written only in vfio_pci_core_enable()\n needs_pm_restore: written only in vfio_pci_probe_power_state()\n disable_idle_d3: written only at .init in vfio_pci_core_init_dev()\n\nDedicated storage units:\n\n virq_disabled: written by guest INTx command writes in\n vfio_basic_config_write() while the device is open\n bardirty: written by guest BAR writes in vfio_basic_config_write()\n while the device is open\n pm_intx_masked: written in the runtime-PM suspend path.\n pm_runtime_engaged: written by low-power feature entry/exit paths\n needs_reset: set in vfio_pci_core_disable() and cleared for devices in\n the set by vfio_pci_dev_set_try_reset()\n sriov_active: written by vfio_pci_core_sriov_configure() via sysfs\n sriov_numvfs while bound.\n\nFixes: 9cd0f6d5cbb6 (\"vfio/pci: Use bitfield for struct vfio_pci_core_device flags\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Alex Williamson \u003calex.williamson@nvidia.com\u003e\nReviewed-by: Kevin Tian \u003ckevin.tian@intel.com\u003e\nLink: https://lore.kernel.org/r/20260615191241.688297-4-alex.williamson@nvidia.com\nSigned-off-by: Alex Williamson \u003calex@shazbot.org\u003e\n[ dropped the `has_dyn_msix:1` bitfield line (absent in this tree) while keeping the rest of the struct layout change ]\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit d837f464e6f5370fb1f546b05e11ad422e1369ab\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: I80d6c6e64a106311e3e73c84c86061794b91c172\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8277456\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "1a835d0282ba0cb00a35b02546497ed2e0e4af97", "tree": "3fa48031adbdc93664f36abb116d7ff361aa92d2", "parents": [ "72a45acca0a4475ce25a5050e61d62376de0e159" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Jul 30 00:58:09 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:19:45 2026" }, "message": "FROMGIT: Bluetooth: HCI: Remove HCI_AMP support\n\n[ Upstream commit 84a4bb6548a29326564f0e659fb8064503ecc1c7 ]\n\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\nremove it along with the capability of creating AMP controllers.\n\nSince we no longer need to differentiate between AMP and Primary\ncontrollers, as only HCI_PRIMARY is left, this also remove\nhdev-\u003edev_type altogether.\n\nFixes: e7b02296fb40 (\"Bluetooth: Remove BT_HS\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 9e6cf0eccfe15b67bf9773ecd101162dfdfed5e2\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: I928e61b1900ca5f8622cce9d4a53cc6e3028e792\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8277455\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "72a45acca0a4475ce25a5050e61d62376de0e159", "tree": "018dbfe181a8274fe57ece320b00e29bdaa53543", "parents": [ "0295261d2e37b2b5b5ff3a76fac6cf5b5b2885f0" ], "author": { "name": "Christophe JAILLET", "email": "christophe.jaillet@wanadoo.fr", "time": "Thu Jul 30 00:58:08 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:19:02 2026" }, "message": "FROMGIT: Bluetooth: Remove usage of the deprecated ida_simple_xx() API\n\n[ Upstream commit 9c16d0c8d93e3d2a95c5ed927b061f244db75579 ]\n\nida_alloc() and ida_free() should be preferred to the deprecated\nida_simple_get() and ida_simple_remove().\n\nNote that the upper limit of ida_simple_get() is exclusive, but the one of\nida_alloc_max() is inclusive. So a -1 has been added when needed.\n\nSigned-off-by: Christophe JAILLET \u003cchristophe.jaillet@wanadoo.fr\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nStable-dep-of: 84a4bb6548a2 (\"Bluetooth: HCI: Remove HCI_AMP support\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit cdb6a094effd04a6700b05ccfd5624b9fa52d962\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: Ife89e170a59685b6cdd1bb197fc8044bb757943f\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8277454\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "0295261d2e37b2b5b5ff3a76fac6cf5b5b2885f0", "tree": "141609aa9e4c05367e488ce97971e7801eda91c2", "parents": [ "eff6107492217b98caa56814eb5e421ff96cf71f" ], "author": { "name": "Martin Kaiser", "email": "martin@kaiser.cx", "time": "Tue Aug 04 19:46:35 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:18:21 2026" }, "message": "FROMGIT: selftests/ftrace: refactor eprobes test to fix argument checks\n\n[ Upstream commit 6e3abef2a27e7402a94111c9eff85d887e64a309 ]\n\nThe add/remove eprobe test installs an eprobe for the openat syscall and\nruns ls. It checks the filenames that were opened by ls against a\nwhitelist and a blacklist.\n\nCommit 206b25c09080 (\"tracing: eprobe: read the complete FILTER_PTR_STRING\npointer\") fixed access to some string fields in eprobes. This triggers\ntest failures as the blacklist does not allow relative paths for the\nopenat parameters.\n\nWhat makes this test unstable is the fact that the openat calls vary a\nlot between different systems.\n\nRefactor the test to make it more robust. \"cd \u003cdirectory\u003e\" will issue a\nchdir syscall with the target directory as parameter. Set an eprobe on\nthe sys_enter_chdir event and filter for the exact directory name. Allow\n(fault) as fallback.\n\nLink: https://lore.kernel.org/all/20260804194705.760893-1-martin@kaiser.cx/\n\nFixes: 206b25c09080 (\"tracing: eprobe: read the complete FILTER_PTR_STRING pointer\")\nReported-by: kernel test robot \u003coliver.sang@intel.com\u003e\nCloses: https://lore.kernel.org/oe-lkp/202607151010.b68428e1-lkp@intel.com\nSigned-off-by: Martin Kaiser \u003cmartin@kaiser.cx\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 169a7c6e5eea2292781fd36bb650bdfc27049944\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: Ia0edff949ed9a28af91994782e378f55ace0df40\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8276237\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "eff6107492217b98caa56814eb5e421ff96cf71f", "tree": "db9f8687c8217d613373ae40ce8495500301df3a", "parents": [ "fdf0ed283968b547d66afd6c7c031217c17374f1" ], "author": { "name": "Wentao Guan", "email": "guanwentao@uniontech.com", "time": "Wed Jul 29 15:11:51 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:18:01 2026" }, "message": "FROMGIT: bpf: drop bpf_lsm_getselfattr from hook list\n\nBackport (\"bpf, lsm: Add disabled BPF LSM hook list\") for v6.1.y bring the\nwarning \"WARN: resolve_btfids: unresolved symbol bpf_lsm_getselfattr\".\n\nThe lsm_getselfattr from commit a04a1198088a\n(\"LSM: syscalls for current process attributes\"), no need to backport\nthe huge patch, simply drop the entry to fix the noise.\n\nThis is a fix for stable v6.1.178 backport commit, so no upstream commit.\n\nFixes: 0562ae02a6c4 (\"bpf, lsm: Add disabled BPF LSM hook list\")\nLink: https://lore.kernel.org/stable/20260728225520.stable-0003@kernel.org/\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 3eb9407d266d3829edcc3f19784d09a4afaf80bc\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: Ida73818de07ba5fd0dfc6f4905dd39c23aeb9dba\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8276236\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "fdf0ed283968b547d66afd6c7c031217c17374f1", "tree": "a7e865352bc464ebd5aebc041b7e82d22a9378ad", "parents": [ "798967bd4ea7e3389d8fc123add3c70fba1f0488" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Mon Jul 06 18:22:42 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:17:16 2026" }, "message": "FROMGIT: proc: Fix broken error paths for namespace links\n\ncommit 425224c2d700391729be7fe6929a88ef4e2d7a4e upstream.\n\nDon\u0027t return the return value of down_read_killable() (0) when a ptrace\naccess check fails, return -EACCES as intended.\n\nReported-by: Magnus Lindholm \u003clinmag7@gmail.com\u003e\nCloses: https://lore.kernel.org/r/20260706170735.2941493-1-linmag7@gmail.com\nFixes: 6650527444da (\"proc: protect ptrace_may_access() with exec_update_lock (part 1)\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nLink: https://patch.msgid.link/20260706-procfs-ns-eacces-fix-v1-1-a69ab14c02e6@google.com\nTested-by: Magnus Lindholm \u003clinmag7@gmail.com\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 81818151cd228a30af961c1409149f6e0c78513a\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: Id6b91e769bbb60e27161fcb0ed0052d7c164652e\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8276235\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "798967bd4ea7e3389d8fc123add3c70fba1f0488", "tree": "05e26b6e748b0420586d1e2a06dd4df4c6cfb269", "parents": [ "687542d552fb5ebb813420cf613e260edf59a209" ], "author": { "name": "Jiangshan Yi", "email": "yijiangshan@kylinos.cn", "time": "Wed Jul 15 07:35:46 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:16:56 2026" }, "message": "FROMGIT: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms\n\ncommit 7fb13fd7e9a59a37cd911efff83abe19e3ee029d upstream.\n\nCommit b1b4efea05a5 (\"serial: 8250_mid: Disable DMA for selected\nplatforms\") replaced the dnv_board setup and exit callbacks with\nPTR_IF(false, ...), which evaluates to NULL. However, the three call\nsites in mid8250_probe() and mid8250_remove() unconditionally\ndereference these function pointers without NULL checks, causing a NULL\npointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon\nD (ICX-D/CDF), or Snowridge (SNR) platform.\n\nFix this by adding the missing NULL checks before calling the setup and\nexit callbacks.\n\nFixes: b1b4efea05a5 (\"serial: 8250_mid: Disable DMA for selected platforms\")\nCc: stable \u003cstable@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Jiangshan Yi \u003cyijiangshan@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260715073546.1875083-1-yijiangshan@kylinos.cn\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 4ea933a36a14bec19b71025cdd8407bafbd67ec1\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: If3657278d6ae94e2c966383d78f2868cd3f6a14d\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8276234\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "687542d552fb5ebb813420cf613e260edf59a209", "tree": "d599d3684a3a6255c836bf42e5c74b4ffbccedf2", "parents": [ "717c092154f82e8011fc0cb3d37cbf0e62482364" ], "author": { "name": "Diego Fernando Mancera Gomez", "email": "diegomancera.dev@gmail.com", "time": "Fri Jul 17 08:07:04 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:16:35 2026" }, "message": "FROMGIT: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect\n\n[ Upstream commit 71132cedd1ecbc4032d76e9928c18a10f7e39b80 ]\n\nuea_probe() distinguishes a pre-firmware device from a post-firmware one\nusing the USB id (UEA_IS_PREFIRM()), and stores a different object as the\ninterface data in each case: a \u0027struct completion\u0027 for a pre-firmware\ndevice (to be waited on in .disconnect()), or a \u0027struct usbatm_data\u0027 for a\npost-firmware one.\n\nuea_disconnect() instead tells the two apart by the number of interfaces\nof the active configuration (a pre-firmware device exposes a single\ninterface, ADI930 has 2 and eagle has 3), and casts the interface data\naccordingly.\n\nBecause the two handlers use different criteria, a crafted device that\nadvertises a pre-firmware id together with a multi-interface descriptor\n(or a post-firmware id with a single interface) makes them disagree: the\nsmall \u0027struct completion\u0027 stored by uea_probe() is then passed to\nusbatm_usb_disconnect(), which casts it to \u0027struct usbatm_data\u0027 and takes\ninstance-\u003eserialize, reading past the end of the allocation:\n\n BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80\n Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982\n ...\n __mutex_lock+0x152a/0x1b80\n usbatm_usb_disconnect+0x70/0x820\n uea_disconnect+0x133/0x2c0\n usb_unbind_interface+0x1dd/0x9e0\n ...\n which belongs to the cache kmalloc-96 of size 96\n The buggy address is located 0 bytes to the right of\n allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60)\n\nReject such inconsistent descriptors in uea_probe() so that both handlers\nalways make the same pre/post-firmware decision.\n\nReported-by: syzbot+e62a973f8322b3bbe3ac@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003de62a973f8322b3bbe3ac\nFixes: e2674dfbed8a (\"usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()\")\nSigned-off-by: Diego Fernando Mancera Gomez \u003cdiegomancera.dev@gmail.com\u003e\nAcked-by: Stanislaw Gruszka \u003cstf_xl@wp.pl\u003e\nLink: https://patch.msgid.link/20260717080704.1264-1-diegomancera.dev@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit e814ae925f6f575325124c29dde518b92c822b83\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: I3d38a3430601e7bc030c45c05be1fdc45e76cb76\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8276233\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "717c092154f82e8011fc0cb3d37cbf0e62482364", "tree": "145155ddfefad563534a806adad5c276dff21657", "parents": [ "9fd15e6d03c29c322d02ea7fa8d72aff65395ea1" ], "author": { "name": "Sasha Levin", "email": "sashal@kernel.org", "time": "Mon Jul 27 18:07:47 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 01 03:16:10 2026" }, "message": "FROMGIT: Revert \"drm/amd/display: Add missing kdoc for ALLM parameters\"\n\nThis reverts commit 7cb4e8ba78f96980a23be4414c8f22f417c814fa.\n\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit a0f409194b205c18f9c319b230d48deb43402581\n https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: I8bd9a9011040fd398b130573f2ebd96d8f7b98fb\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8276232\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "9fd15e6d03c29c322d02ea7fa8d72aff65395ea1", "tree": "b4eae09f0df293cfea728247246f1da73e18a255", "parents": [ "d8d9a51f321a61c7d4682234f3ed3578a8e9b3ad", "2f67bd6ab4ff8ed80e350cea1c6b7bac2a9c78d8" ], "author": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:14:55 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:14:55 2026" }, "message": "Merge \"CHROMIUM: Merge tag \u0027v6.1.180\u0027 into chromeos-6.1\" into chromeos-6.1" }, { "commit": "d8d9a51f321a61c7d4682234f3ed3578a8e9b3ad", "tree": "b31f0670816c0159157f548651d47859ba7219f3", "parents": [ "9293572124dcc5c0904041d016dd5a00013b29d8", "633e4e0f3aacc6544cdc9d348817c4b8a65aa4a0" ], "author": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:14:05 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:14:05 2026" }, "message": "Merge \"CHROMIUM: Merge tag \u0027v6.1.179\u0027 into chromeos-6.1\" into chromeos-6.1" }, { "commit": "9293572124dcc5c0904041d016dd5a00013b29d8", "tree": "a9be3a07d6b7d4a1c887d34679c7f353eab504f0", "parents": [ "f7e4fb8b4f97a8d64c3b6c2d7dcc506b827b7cc6", "4a6cce3a461ddd052822b3a31c22662a289847d8" ], "author": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:13:19 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:13:19 2026" }, "message": "Merge \"CHROMIUM: Merge tag \u0027v6.1.178\u0027 into chromeos-6.1\" into chromeos-6.1" }, { "commit": "f7e4fb8b4f97a8d64c3b6c2d7dcc506b827b7cc6", "tree": "bf4e61e9edb326090d759ddafd55b55eaddc44b6", "parents": [ "2c062275816b4ad6b6cf0bd8e6415bca9d683712", "1dd34110675c0d7267ae767bdfca2e5908d79aa8" ], "author": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:11:55 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Tue Sep 01 03:11:55 2026" }, "message": "Merge \"CHROMIUM: Merge tag \u0027v6.1.177\u0027 into chromeos-6.1\" into chromeos-6.1" }, { "commit": "2c062275816b4ad6b6cf0bd8e6415bca9d683712", "tree": "a680afb1b2a56ad61ab2656d6fa5519354649a5e", "parents": [ "5057337ca8a5f83c6e61182edf453d976de41a89" ], "author": { "name": "Sergey Senozhatsky", "email": "senozhatsky@chromium.org", "time": "Tue Aug 25 07:18:02 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 25 15:45:50 2026" }, "message": "CHROMIUM: android: usb: gadget: remove f_accessory\n\nf_accessory is not being enabled nor used any longer, so remove\nit.\n\nUPSTREAM-TASK\u003db:540593344\nBUG\u003db:540593344\nTEST\u003dCQ\n\nChange-Id: If63823229e43b492f5ef94a9f200b5b09960ac8b\nSigned-off-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8286986\nReviewed-by: Tomasz Figa \u003ctfiga@chromium.org\u003e\nCommit-Queue: Tomasz Figa \u003ctfiga@chromium.org\u003e\n" }, { "commit": "2f67bd6ab4ff8ed80e350cea1c6b7bac2a9c78d8", "tree": "b4ec86a47a814d2cec204373d7ef9f4e5adcd7d6", "parents": [ "633e4e0f3aacc6544cdc9d348817c4b8a65aa4a0", "fb28aa725e05025101446230b14b1defe4c66666" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Fri Aug 21 03:21:22 2026" }, "committer": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Tue Aug 25 10:12:46 2026" }, "message": "CHROMIUM: Merge tag \u0027v6.1.180\u0027 into chromeos-6.1\n\nNo conflicts.\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: If68c453ac56ce7aed3254b3d776d9cb66607d0fd\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\n" }, { "commit": "633e4e0f3aacc6544cdc9d348817c4b8a65aa4a0", "tree": "56b20cc40f628c4ef931d85673f88429541d9769", "parents": [ "4a6cce3a461ddd052822b3a31c22662a289847d8", "1016ca6176ee53f6ddb5d84838fa9181e92f789c" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Fri Aug 21 03:20:32 2026" }, "committer": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Tue Aug 25 10:12:42 2026" }, "message": "CHROMIUM: Merge tag \u0027v6.1.179\u0027 into chromeos-6.1\n\nConflicts:\n fs/proc/base.c\n Incoming commit 31509970efd3 conflicts due to\n downstream commit e00590e0e6e4 and 0eb5df0d8284.\n Apply the incoming and keep the downstream changes.\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: I65fcc1d67461795648480b2423ae6ffe13ad29b8\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\n" }, { "commit": "4a6cce3a461ddd052822b3a31c22662a289847d8", "tree": "4fa4c6a5650af5eafc782aaa4f2d21dd914d8762", "parents": [ "1dd34110675c0d7267ae767bdfca2e5908d79aa8", "dc5c83b7f5f83ea99aea5c771b1ec77458263a15" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Fri Aug 21 03:12:53 2026" }, "committer": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Tue Aug 25 10:11:02 2026" }, "message": "CHROMIUM: Merge tag \u0027v6.1.178\u0027 into chromeos-6.1\n\nConflicts:\n drivers/pci/Makefile\n Incoming commit 97649acc2148 conflicts due to downstream\n commit 44639acffa01. Apply the incoming and keep the\n downstream changes.\n\n fs/efivarfs/super.c\n Incoming commit 32343b69bd84 and 115409cbb6a2 conflict\n due to chromeos-6.1 picked commit 003ec8028f40 (upstream\n 5329aa5101f7) which is not in linux-6.1.y. Keep both.\n\n fs/ntfs3/fslog.c\n Incoming commit c69b90033329 and 9b3d8cc9d54f conflict\n due to it already present downstream (commit\n f73729dc5202). Incoming commit 9b3d8cc9d54f fixes the\n tailing spaces, so just apply it.\n\n net/bluetooth/hci_event.c\n Incoming commit 6a112b664aa2 conflicts due to downstream\n commit 3f9ae2a9efab7. The incoming diff can apply\n cleanly, so just apply it.\n\n Incoming commit f7e83f2278f06 conflicts due to\n downstream commit dfeffbc70db98. The incoming diff can\n apply cleanly, so just apply it.\n\nFixes:\n net/bluetooth/mgmt.c\n hci_conn_add() -\u003e hci_conn_add_unset() due to incoming\n commit f7e83f2278f0.\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: Id0e4ed55e5c103163808af33fe3959f44af0de9c\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\n" }, { "commit": "1dd34110675c0d7267ae767bdfca2e5908d79aa8", "tree": "361d5c68019bdc7df343d4eecb80e032024b8994", "parents": [ "5057337ca8a5f83c6e61182edf453d976de41a89", "090666d3cc906176fc47363520eb746b94c7d578" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Fri Aug 21 02:47:44 2026" }, "committer": { "name": "Tzung-Bi Shih", "email": "tzungbi@chromium.org", "time": "Fri Aug 21 08:52:04 2026" }, "message": "CHROMIUM: Merge tag \u0027v6.1.177\u0027 into chromeos-6.1\n\nConflicts:\n Documentation/userspace-api/ioctl/ioctl-number.rst:\n Resolved by rerere based on v5.10.260 merge: keep the\n downstream entry and align the comment indent.\n\n mm/vmscan.c:\n Incoming commit 1971f04f12da (upstream c28ac3c7eb94)\n conflicts, since the file has been modified heavily\n downstream both by upstream cherry-picks and local-only\n changes.\n\n Where applicable, resolve by matching the diff from\n c28ac3c7eb94. In the remaining hunks, the conflicts are\n caused by local commit 4358529660aff, which makes\n several changes to lru_gen_look_around function.\n Resolve by:\n * replacing return with return young, necessary because\n 4358529660aff made the function return non-void\n * aligning pointers in downstream-only code to not\n dereference pvmw anymore, matching the incoming change.\n\nBUG\u003db:542900253\nTEST\u003dcq\n\nChange-Id: Id52ed05e4f6f8f8c8fd283e10ae6ef507ba5b562\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\n" }, { "commit": "5057337ca8a5f83c6e61182edf453d976de41a89", "tree": "e6e79c31c46bbfa690b3f1a06b02b6256415b7e1", "parents": [ "ec6688ae5f35bf624c59f277977ab1bf466918b0" ], "author": { "name": "Michael Sun", "email": "michaelfsun@google.com", "time": "Tue Aug 11 17:54:42 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 16:27:54 2026" }, "message": "CHROMIUM: Bluetooth: Fix device lifecycle and locking in Floss mgmt handlers\n\nProperly manage the lifetime of struct hci_dev in Floss management\nhandlers by using hci_dev_get() and hci_dev_put() rather than unpinned\nlist traversal.\n\nIn addition, serialize lookup, creation, and deletion of struct hci_conn\nin floss_notify_sco_connection_change() under hci_dev_lock() to protect\nagainst concurrent connection state changes, and properly check error\nreturn values.\n\nFinally, restrict Floss vendor management commands to privileged sockets\nto align with standard management interface policies.\n\nUPSTREAM-TASK\u003db:321192075\nBUG\u003db:536947437\nTEST\u003dbluetooth_AdapterQuickHealth.AVL.all_floss (sa_health, sr_health, au_health) on dedede (drawman)\n\nChange-Id: Ibab8b2000d6813f48b448cd50057b18fa5bdbf5c\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8252835\nReviewed-by: Hsin-chen Chuang \u003cchharry@google.com\u003e\nAuto-Submit: Michael Sun \u003cmichaelfsun@google.com\u003e\nReviewed-by: Tomasz Figa \u003ctfiga@chromium.org\u003e\nTested-by: Michael Sun \u003cmichaelfsun@google.com\u003e\nCommit-Queue: Michael Sun \u003cmichaelfsun@google.com\u003e\n" }, { "commit": "ec6688ae5f35bf624c59f277977ab1bf466918b0", "tree": "87d921ce620b1bf568a8039321ed0f78a7c91f2d", "parents": [ "663886cc9faeec4fe1d64e7dec4e74711da08767" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Thu Jul 30 12:15:35 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 09:49:34 2026" }, "message": "BACKPORT: FROMGIT: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\n[ Upstream commit 2abd5287f08319fa35764566b15c6e22cb1068db ]\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU. If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root. On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent\u0027s role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM\u0027s invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can\u0027t be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately.\n\nReported-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nFixes: f95eec9bed76 (\"KVM: x86/mmu: Don\u0027t put invalid SPs back on the list of active pages\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 65c4f7a1028cf01a93a2762d679c289810ede990\n https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nConflicts:\n arch/x86/kvm/mmu/paging_tmpl.h\n\nBUG\u003db:543652397\nTEST\u003dBoot.vm tast\nBranches: N/A\n\nChange-Id: Iaac020fd004d2bfee8ff054d7f159377052eeae9\nSigned-off-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8256735\nReviewed-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\n" }, { "commit": "663886cc9faeec4fe1d64e7dec4e74711da08767", "tree": "57001fc030dc57da47e4bea9b25310b95580dc14", "parents": [ "542442251e68402578d8d3fe2a4cfdc8d3f9b5fa" ], "author": { "name": "David Matlack", "email": "dmatlack@google.com", "time": "Thu Jul 30 12:15:34 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 20 09:49:25 2026" }, "message": "BACKPORT: FROMGIT: KVM: x86/mmu: Rename __direct_map() to direct_map()\n\n[ Upstream commit 6c882ef4fc7bd99b67ad152e75428b669281c521 ]\n\nRename __direct_map() to direct_map() since the leading underscores are\nunnecessary. This also makes the page fault handler names more\nconsistent: kvm_tdp_mmu_page_fault() calls kvm_tdp_mmu_map() and\ndirect_page_fault() calls direct_map().\n\nOpportunistically make some trivial cleanups to comments that had to be\nmodified anyway since they mentioned __direct_map(). Specifically, use\n\"()\" when referring to functions, and include kvm_tdp_mmu_map() among\nthe various callers of disallowed_hugepage_adjust().\n\nNo functional change intended.\n\nSigned-off-by: David Matlack \u003cdmatlack@google.com\u003e\nReviewed-by: Isaku Yamahata \u003cisaku.yamahata@intel.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nMessage-Id: \u003c20220921173546.2674386-11-dmatlack@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nStable-dep-of: 2abd5287f083 (\"KVM: x86: Check for invalid/obsolete root *after* making MMU pages available\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit c4aa07bdf3653eddc90dc23d617916aecb11cda3\n https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nConflicts:\n arch/x86/kvm/mmu/mmu.c\n\nBUG\u003db:543652397\nTEST\u003dBoot.vm tast\nBranches: N/A\n\nChange-Id: Ied70bf9c1be44f433ff2c2d71d29e514da41f561\nSigned-off-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8256734\nReviewed-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\n" }, { "commit": "542442251e68402578d8d3fe2a4cfdc8d3f9b5fa", "tree": "521dcebf3070ccf44a81769b47cc125105fc72cc", "parents": [ "e82e5bb201c8f942a8ac8d932fa0f30e2cbff293" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed Jul 22 00:27:09 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 12:30:50 2026" }, "message": "FROMLIST: af_unix: Set gc_in_progress to true in unix_gc().\n\n[ Upstream commit d82ba05263c69fa2437fe93e4e561cc40f4c03af ]\n\nIgor Ushakov reported that unix_gc() could run with gc_in_progress\nbeing false if the work is scheduled while running:\n\n Thread 1 Thread 2 Thread 3\n -------- -------- --------\n unix_schedule_gc() unix_schedule_gc()\n `- if (!gc_in_progress) `- if (!gc_in_progress)\n |- gc_in_progress \u003d true |\n `- queue_work() |\n unix_gc() \u003c----------------/ |\n | |- gc_in_progress \u003d true\n ... `- queue_work()\n | |\n `- gc_in_progress \u003d false |\n |\n unix_gc() \u003c---------------------------------------------\u0027\n |\n ... /* gc_in_progress \u003d\u003d false */\n |\n `- gc_in_progress \u003d false\n\nunix_peek_fpl() relies on gc_in_progress not to confuse GC\nby MSG_PEEK.\n\nLet\u0027s set gc_in_progress to true in unix_gc().\n\nFixes: 8b90a9f819dc (\"af_unix: Run GC on only one CPU.\")\nReported-by: Igor Ushakov \u003csysroot314@gmail.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260501073945.1884564-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n[ Add setting gc_in_progress in __unix_gc(). Keep the existing\n set in unix_gc() for wait_for_unix_gc() over-limit throttling. ]\nSigned-off-by: Igor Ushakov \u003csysroot314@gmail.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Jay Wang \u003cwanjay@amazon.com\u003e\n(am from https://lore.kernel.org/r/20260722002709.12710-1-wanjay@amazon.com)\n\nUPSTREA-TASK\u003db:528770316\nBUG\u003db:528770316\nTEST\u003dCQ\nBranches: 6.1, 6.6, 6.12\n\nChange-Id: I5c04175735e7c14e175f41444353ada55741a59e\nSigned-off-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8261419\nReviewed-by: Tomasz Figa \u003ctfiga@chromium.org\u003e\n" }, { "commit": "e82e5bb201c8f942a8ac8d932fa0f30e2cbff293", "tree": "cdf52674e8767e61f659463149a0eab81961ac8e", "parents": [ "f4d1c60fb418e96daca713bac4327837a45eef6b" ], "author": { "name": "Emmanuel Grumbach", "email": "emmanuel.grumbach@intel.com", "time": "Sun Apr 19 10:00:24 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 19 10:27:03 2026" }, "message": "CHROMIUM: iwl7000: mld: disconnect only after 6 beacons without Rx\n\nAfter 4 missed beacons since last Rx, the firmware will send an NDP to the\nAP. If the NDP is ACK\u0027ed, it\u0027ll reset the missed_beacons_since_last_rx\ncounter.\nDisconnecting after 4 beacons doesn\u0027t give enough time to the firmware\nto send the NDP.\n\nWait until we get 6 missed beacons since last Rx before disconnecting.\n\nTEST\u003dwifi_matfunc,wifi_perf\nBUG\u003db:505824948\n\nChange-Id: Iefa2e8be9edfc74683997eea60bb53c2002f31f0\nSigned-off-by: Emmanuel Grumbach \u003cemmanuel.grumbach@intel.com\u003e\niwl7000-tree: 8b75f255b77d2b314c0d36ccaa99d879de713ce7\nSigned-off-by: Miri Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/7828177\nReviewed-by: Guy Damary \u003cguy.damary@intel.corp-partner.google.com\u003e\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\nTested-by: Guy Damary \u003cguy.damary@intel.corp-partner.google.com\u003e\nReviewed-by: Masami Hiramatsu \u003cmhiramat@google.com\u003e\nReviewed-by: David Ruth \u003cdruth@chromium.org\u003e\n" }, { "commit": "f4d1c60fb418e96daca713bac4327837a45eef6b", "tree": "bd23a7ab0ceb8cde7af01b0e1075ed0e7b85a212", "parents": [ "77b99ec0179f23ce8249824472f76e2789eda1cd" ], "author": { "name": "Eason Lai", "email": "Eason.Lai@mediatek.com", "time": "Wed May 06 07:04:58 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 17 07:16:31 2026" }, "message": "BACKPORT: FROMGIT: wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash\n\nWhen an AER error occurs and the bus is hung, the register reads return\n0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in\nan invalid memory access when accessing q-\u003edesc[] or q-\u003eentry[].\n\nUnable to handle kernel paging request at virtual address\nffffffc01099eac0\npc : mt76_dma_add_buf+0x124/0x188 [mt76]\nlr : mt76_dma_rx_fill+0x11c/0x1d8 [mt76]\nsp : ffffffc016d9bbf0\nx29: ffffffc016d9bc10 x28: 0000000000000000\nx27: 0000000000000000 x26: ffffffb7855e50b8\nx25: ffffffb80d04f000 x24: 0000000000000000\nx23: 0000000000000ec0 x22: ffffffb796803648\nx21: ffffffb796801f80 x20: ffffffb7968035f8\nx19: 0000000000000ec0 x18: 0000000000000000\nx17: 000000004ec00000 x16: 000000000ec00000\nx15: ffffffc01099eac0 x14: 000000004ec00000\nx13: 00000000ffc5a000 x12: ffffffc016d9bc32\nx11: 00000000ffffffff x10: 0000000000000002\nx9 : 0000000000000000 x8 : 000000000000b4ac\nx7 : 0000000000000a20 x6 : ffffffb6c1806400\nx5 : 0000000000000000 x4 : ffffffb80d04f000\nx3 : 0000000000000000 x2 : 0000000000000001\nx1 : 000000000ec04000 x0 : ffffffb7968035f8\nCall trace:\n mt76_dma_add_buf+0x124/0x188 [mt76 (HASH:1029 4)]\n mt76_dma_rx_reset+0xe8/0xfc [mt76 (HASH:1029 4)]\n mt7921_wpdma_reset+0x188/0x1b0 [mt7921e (HASH:ee48 5)]\n mt7921e_mac_reset+0x128/0x418 [mt7921e (HASH:ee48 5)]\n mt7921_mac_reset_work+0xac/0x1a8 [mt7921_common (HASH:f721 6)]\n process_one_work+0x188/0x514\n worker_thread+0x12c/0x300\n kthread+0x140/0x1fc\n ret_from_fork+0x10/0x30\n\nFix the invalid memory access by validating the DMA index read from the\nhardware before it is used as a queue index. An out-of-range value, such\nas the 0xFFFFFFFF returned while the bus is hung, is now clamped so it can\nno longer corrupt q-\u003ehead or q-\u003etail. In addition, check the bus_hung flag\nin mt7921_mac_reset_work() before attempting the reset sequence, reject MCU\nmessages while the bus is hung, and install no-op bus operations when an\nunrecoverable AER error is detected, preventing further invalid hardware\naccesses.\n\nDue to hardware limitations - such as the lack of a connected hardware\nreset pin or the absence of host re-probe functionality - affected Wi-Fi\ndevices may not fully recover to a normal operational state after\ncertain errors, even with AER enabled.\n\nFixes: 17f1de56df05 (\"mt76: add common code shared between multiple chipsets\")\nCo-developed-by: Sean Wang \u003csean.wang@mediatek.com\u003e\nSigned-off-by: Sean Wang \u003csean.wang@mediatek.com\u003e\nCo-developed-by: Jeff Hsu \u003cjeff.hsu@mediatek.com\u003e\nSigned-off-by: Jeff Hsu \u003cjeff.hsu@mediatek.com\u003e\nSigned-off-by: Eason Lai \u003cEason.Lai@mediatek.com\u003e\nCo-developed-by: Michael Lo \u003cmichael.lo@mediatek.com\u003e\nLink: https://patch.msgid.link/20260506070458.3096180-1-jb.tsai@mediatek.com\nSigned-off-by: Felix Fietkau \u003cnbd@nbd.name\u003e\n(cherry picked from commit 915672c5ae32deeb72f4572856d123f314791136\n git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main)\n\nConflicts:\n drivers/net/wireless/mediatek/mt76/dma.c\n drivers/net/wireless/mediatek/mt76/mcu.c\n drivers/net/wireless/mediatek/mt76/mt7921/pci.c\n\nBUG\u003db:322745413\nTEST\u003demerge-geralt sys-kernel/chromeos-kernel-6_1\nBranches: N/A\n\nChange-Id: I81b642da9a874b62d99227c04c8b2fd86136906a\nSigned-off-by: eason lai \u003ceason.lai@mediatek.corp-partner.google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8254640\nReviewed-by: Tzung-Bi Shih \u003ctzungbi@chromium.org\u003e\nCommit-Queue: Chen-Yu Tsai \u003cwenst@chromium.org\u003e\nReviewed-by: Chen-Yu Tsai \u003cwenst@chromium.org\u003e\n" }, { "commit": "77b99ec0179f23ce8249824472f76e2789eda1cd", "tree": "9b9a86d4052e8ad8df49ce577f1a2591d3195ac3", "parents": [ "c652f01222729f434da156ee764300691bd81fe5" ], "author": { "name": "Masami Hiramatsu", "email": "mhiramat@google.com", "time": "Mon Aug 03 05:39:09 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 14 12:20:56 2026" }, "message": "CHROMIUM: KVM: arm64: Validate frequency table index in kvm_sched_get_cpufreq_table\n\nCurrently, kvm_sched_get_cpufreq_table() directly indexes\npolicy-\u003efreq_table[idx] with the guest-supplied index without checking\nits validity or bounds, and unconditionally returns SMCCC_RET_SUCCESS.\nAn invalid or out-of-bounds index from a guest could lead to an\nout-of-bounds memory read or returning table-terminator entries.\n\nFix this by initializing the return value to SMCCC_RET_INVALID_PARAMETER\nand iterating over valid frequency table entries using\ncpufreq_for_each_valid_entry_idx(). Only when a valid entry matches the\nrequested index is SMCCC_RET_SUCCESS returned with the corresponding\nfrequency.\n\nBUG\u003db:541200998\nTEST\u003dEnsure the Arcvm booted.\n\nChange-Id: I6ca392a7c25da76c0c6c1f97fa8771626fd2307b\nSigned-off-by: Masami Hiramatsu \u003cmhiramat@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8193434\nReviewed-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\n" }, { "commit": "c652f01222729f434da156ee764300691bd81fe5", "tree": "61d7c594fc67cce0e4b5bc67c572c51b3ee5cc80", "parents": [ "a8236f183c05d1801677409541e0bc708aa660d9" ], "author": { "name": "Sergey Senozhatsky", "email": "senozhatsky@chromium.org", "time": "Sat Aug 08 08:29:40 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Aug 14 06:49:58 2026" }, "message": "CHROMIUM: fuse: log connection-init-done action\n\nAlso fuse_print_conn_mounts() when server returns INIT request.\nThis will help us catch cases when asyc init takes too long and\nand match them to hung-task reports.\n\n[ 241.755067] fuse: cros-disks: init connection, mounts: 0:235 (fuse.drivefs)\n[ 242.588057] fuse: drivefs: connection initialized, mounts: 0:235 (fuse.drivefs)\n\nUPSTREAM-TASK\u003db:450762520\nBUG\u003db:537143345\nTEST\u003ddrivefs on brya\n\nChange-Id: If71e862e318fa06bac4c905c2fe3726024c2c328\nSigned-off-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8254903\nReviewed-by: Tomasz Figa \u003ctfiga@chromium.org\u003e\n" }, { "commit": "a8236f183c05d1801677409541e0bc708aa660d9", "tree": "51fecfc817ad0bf83b0868d52a8eb113fcbadafa", "parents": [ "2907f84ee9cda3dca583ea01c72823f46a88fa86" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Jul 27 09:10:14 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 13 10:06:36 2026" }, "message": "FROMGIT: posix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\ncommit 920f893f735e92ba3a1cd9256899a186b161928d upstream.\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n posix_cpu_timer_del()\n // Observes old leader\n p \u003d pid_task(pid, pid_type);\t\tde_thread()\n\t\t\t\t\t switch_leader();\n\t\t\t\t\t release_task(old_leader)\n\t\t\t\t\t __exit_signal(old_leader)\n\t\t\t\t\t sighand \u003d lock(old_leader, sighand);\n\t\t\t\t\t posix_cpu_timers*_exit();\n sighand \u003d lock_task_sighand(p)\t unhash_task(old_leader);\n sh \u003d lock(p, sighand)\t\t old_leader-\u003esighand \u003d NULL;\n\t\t\t\t\t unlock(sighand);\n (p-\u003esighand \u003d\u003d NULL)\n\tunlock(sh)\n\treturn NULL;\n\n // Returns without action\n if(!sighand)\n return 0;\n free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np-\u003esignal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object\u0027s timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it\u0027s the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t posix_cpu_timers*_exit(p);\n\t\t\t\t\t unhash_task(p);\n\t\t\t\t\t p-\u003esighand \u003d NULL;\n sh \u003d lock_task_sighand(p)\n sighand \u003d p-\u003esighand;\n\tif (!sighand)\n\t return NULL;\n\tlock(sighand);\n\n if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p-\u003esighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n 1) Changing the store in __exit_signal() to smp_store_release().\n\n 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n of lock_task_sighand().\n\n 3) Creating a helper function for looking up the task and locking sighand\n which does not return when sighand \u003d\u003d NULL. Instead it retries the\n task lookup and only if that fails it gives up.\n\n 4) Using that helper in the three affected functions.\n\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\ngracefully. When the task lookup returns the old leader, but sighand \u003d\u003d\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that\u0027s the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which survived\nabout 10 years. The fix for the workaround changed the task pointer to a\npid pointer, but failed to see the subtle race described above. So the\nFixes tag picks that commit, which seems to be halfways accurate.\n\nThanks to Frederic Weissbecker, Oleg Nesterov and Peter Zijlstra for\nreview, feedback and suggestions and to Wongi and Jungwoo for the excellent\nbug report and analysis!\n\nFixes: 55e8c8eb2c7b (\"posix-cpu-timers: Store a reference to a pid not a task\")\nReported-by: Wongi Lee \u003cqw3rtyp0@gmail.com\u003e\nReported-by: Jungwoo Lee \u003cjwlee2217@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n\n(cherry picked from commit cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:533807738\nTEST\u003d Built locally and Passed\ntools/testing/selftests/timers/posix_timers (all [OK]).\n\nChange-Id: Iffc36d96775820e24273bd11bf1fde085ea1d53f\nSigned-off-by: Athira Palliprath \u003cpalliprath@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8223922\nReviewed-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "2907f84ee9cda3dca583ea01c72823f46a88fa86", "tree": "821de13ad77dfa9cf3ee0b6fa5474e9fa367061c", "parents": [ "232d303098e2f76e631ae7475c07514b965cabdd" ], "author": { "name": "Sergey Senozhatsky", "email": "senozhatsky@chromium.org", "time": "Wed Aug 05 04:33:02 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Aug 10 04:27:34 2026" }, "message": "CHROMIUM: fuse: do not return unopened tmpfile from fuse_chromeos_tmpfile()\n\nfuse_chromeos_tmpfile() returns create_new_entry() directly\nwithout calling finish_open_simple(). This leaves file-\u003ef_inode\nNULL and drops the dentry reference count to 0.\n\ninode_operations.tmpfile() must call finish_open() before returning\nso that file-\u003ef_path holds its own reference and FMODE_OPENED is set.\n\nUPSTREAM-TASK\u003db:536947624\nBUG\u003db:536947624\nTEST\u003dBoot.vm tast\n\nChange-Id: I4217143a41089418fc8f6305c89d576e436cba87\nSigned-off-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8228784\nReviewed-by: Tomasz Figa \u003ctfiga@chromium.org\u003e\n" }, { "commit": "232d303098e2f76e631ae7475c07514b965cabdd", "tree": "a86b8efe17f9bf63c5ff98b1d3034431e1bfd197", "parents": [ "2e54fe85f354c62dad170ee66bf95b59e43e3813" ], "author": { "name": "Sergey Senozhatsky", "email": "senozhatsky@chromium.org", "time": "Wed Aug 05 04:58:55 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Aug 05 12:20:14 2026" }, "message": "CHROMIUM: fuse: grab connection ref-counter for fusedog kthread\n\nfusedog kthread borrows fuse connection pointer but doesn\u0027t\nincrement its refcounter making it possible for fusedog to\noperate on already destroyed fuse connections. Properly\nshare fuse connection with fusedog and hold extra fuse\nconnection reference for the lifespan of fusedog kthread.\n\nUPSTREAM-TASK\u003db:450762520\nBUG\u003db:536947521\nTEST\u003dchecked normal connection termination\n checked timeout fusedog connection abort\n\nChange-Id: Ia33d991ac9f21399a6699ed7857f999b56b39567\nSigned-off-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8200585\nReviewed-by: Tomasz Figa \u003ctfiga@chromium.org\u003e\n" }, { "commit": "2e54fe85f354c62dad170ee66bf95b59e43e3813", "tree": "24afccfe422b1dd84aa3de669f447538f880d04b", "parents": [ "1479709eefcd0dd6b6802dd1c32423ee82be1427" ], "author": { "name": "Liew Rui Yan", "email": "aethernet65535@gmail.com", "time": "Mon Jul 20 09:47:08 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:20 2026" }, "message": "FROMGIT: mm/damon/reclaim: fix typo in damon_reclaim_timer_fn()\n\nCommit 2f54908fae211 (\"mm/damon/reclaim: detect and use fresh enabled\nand kdamond_pid values\") introduced a typo in damon_reclaim_timer_fn()\nwhere \u0027!\u003d\u0027 was used instead of \u0027\u003d\u003d\u0027 (unlike damon_lru_sort_timer_fn()).\nThis caused damon_reclaim to return early during the delayed work,\nbreaking early boot parameter configuration like\n\u0027damon_reclaim.enabled\u003dY\u0027.\n\nFix this by changing \u0027!\u003d\u0027 to \u0027\u003d\u003d\u0027.\n\nFixes: 2f54908fae21 (\"mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values\")\nCc: \u003cstable@vger.kernel.org\u003e # 6.1.x\nReported-by: Yikai Zhao \u003cyikai@z1k.dev\u003e\nCloses: https://lore.kernel.org/CANMyjpgq5n0Ekt4dgyLRHGb89_Ew0aOMZ3j32V_w0GjHkqH1FQ@mail.gmail.com\nReviewed-by: SJ Park \u003csj@kernel.org\u003e\nSigned-off-by: Liew Rui Yan \u003caethernet65535@gmail.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 4de650357da46d9b70f0ebabcf7f0baf03c4a165\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I9d188385346934296a3504ddcf493d72afec7cf5\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8163140\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "1479709eefcd0dd6b6802dd1c32423ee82be1427", "tree": "cf5394958ed5d7133a645de275eda7ace0b64949", "parents": [ "d85b52986d558d4515d25aa12114dbc5376a421b" ], "author": { "name": "Benjamin Marzinski", "email": "bmarzins@redhat.com", "time": "Fri Jul 03 01:43:39 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:18 2026" }, "message": "FROMGIT: dm-log: fix a bitset_size overflow on 32bit machines\n\ncommit 9743132a41f4d9d0e54c5f2adcb821b04796bab1 upstream.\n\nCommit c20e36b7631d (\"dm log: fix out-of-bounds write due to\nregion_count overflow\") made sure that region_count could fit in an\nunsigned int. But the bitmap memory isn\u0027t allocated based on\nregion_count. It uses bitset_size (a size_t variable). The first step of\ncalculating bitset_size is to set it to region_count, rounded up to a\nmultiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG\nsmaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit\narchitecture, this will make bitset_size wrap around to 0 and fail,\ndespite region_count being valid.\n\nSince bitset_size gets divided by 8, it can hold any valid region_count.\nIt just needs a special case to handle the rollover. If it is 0, the\nvalue rolled over, and bitset size should be set to the number of bytes\nneeded to hold 2^32 bits.\n\nSigned-off-by: Benjamin Marzinski \u003cbmarzins@redhat.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nFixes: c20e36b7631d (\"dm log: fix out-of-bounds write due to region_count overflow\")\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 567602fa72d57169365cbc589e0b8c3be900636d\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I5c9611c18547686a7f22d670803606fdf6462a96\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159558\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "d85b52986d558d4515d25aa12114dbc5376a421b", "tree": "432b73ff492e24bea7e9881686ce8d585cb43352", "parents": [ "c04943e0308c3d755ae8b6c23f33000589705274" ], "author": { "name": "Anshuman Khandual", "email": "anshuman.khandual@arm.com", "time": "Fri Jun 26 01:28:45 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:16 2026" }, "message": "FROMGIT: arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()\n\n[ Upstream commit ff4c5a0de1f2ef7737a8688a86e19301e567020d ]\n\nCommit 48478b9f7913 (\"arm64/mm: Enable batched TLB flush in\nunmap_hotplug_range\") inadvertently introduced redundant TLB\ninvalidation when clearing a block entry, resulting in unnecessary\nbroadcast invalidation on CPUs without support for range-based\ninvalidation.\n\nRe-introduce the old behaviour, along with some expanded comments to\nhelp people working in this area next time around.\n\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: linux-arm-kernel@lists.infradead.org\nCc: linux-kernel@vger.kernel.org\nReported-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCloses: https://lore.kernel.org/all/b0d5836032ce3135bfc473f6bff791306d086925.camel@decadent.org.uk/\nFixes: 48478b9f7913 (\"arm64/mm: Enable batched TLB flush in unmap_hotplug_range()\")\nSigned-off-by: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nReviewed-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n[will: Reword comments and commit message]\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 04166f11fe85800023e6dfbabaed38abaf333c9b\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I1b1a90e5480c81f6a60ba88ae7ba769b78fb776e\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159557\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "c04943e0308c3d755ae8b6c23f33000589705274", "tree": "62d30edee804afcdb7da9458100539aadeaf5b34", "parents": [ "ac71b8037b1bab9eda158132901abdf430fe6c38" ], "author": { "name": "Ryan Roberts", "email": "ryan.roberts@arm.com", "time": "Thu Feb 15 10:31:56 2024" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:13 2026" }, "message": "FROMGIT: arm64/mm: convert ptep_clear() to ptep_get_and_clear()\n\n[ Upstream commit cbb0294fdd72a5f63ec59fad5c0a98d63bd572fc ]\n\nptep_clear() is a generic wrapper around the arch-implemented\nptep_get_and_clear(). We are about to convert ptep_get_and_clear() into a\npublic version and private version (__ptep_get_and_clear()) to support the\ntransparent contpte work. We won\u0027t have a private version of ptep_clear()\nso let\u0027s convert it to directly call ptep_get_and_clear().\n\nLink: https://lkml.kernel.org/r/20240215103205.2607016-10-ryan.roberts@arm.com\nSigned-off-by: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nTested-by: John Hubbard \u003cjhubbard@nvidia.com\u003e\nAcked-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Andrey Ryabinin \u003cryabinin.a.a@gmail.com\u003e\nCc: Ard Biesheuvel \u003cardb@kernel.org\u003e\nCc: Barry Song \u003c21cnbao@gmail.com\u003e\nCc: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nCc: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: James Morse \u003cjames.morse@arm.com\u003e\nCc: Kefeng Wang \u003cwangkefeng.wang@huawei.com\u003e\nCc: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Yang Shi \u003cshy828301@gmail.com\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nStable-dep-of: ff4c5a0de1f2 (\"arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit f50074e7d579cd3b15ce51ad9779ff8ca10cf06a\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Ie67bb97a0045c8676a58db8fc8b7a27e3affc929\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159556\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "ac71b8037b1bab9eda158132901abdf430fe6c38", "tree": "3b84741fa5afd8e24b7ffa27a4fb65b7b893fec5", "parents": [ "f73729dc5202c0463553e5eb6232105a2edfa4ec" ], "author": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Tue Jun 16 11:26:56 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:10 2026" }, "message": "FROMGIT: HID: core: Fix OOB read in hid_get_report for numbered reports\n\n[ Upstream commit af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 ]\n\nWhen a caller passes a size of 0 to hid_report_raw_event() for a\nnumbered report, the function originally called hid_get_report() before\nperforming any size validation.\n\nInside hid_get_report(), if the report is numbered (report_enum-\u003enumbered\nis true), it unconditionally dereferences data[0] to extract the report ID.\nWith a size of 0, this results in an out-of-bounds read or kernel panic.\n\nFix this by moving the numbered report size validation check before the\ncall to hid_get_report(), ensuring that size is at least 1 before\ndereferencing the data pointer.\n\nFixes: 2c85c61d1332 (\"HID: pass the buffer size to hid_report_raw_event\")\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit c39f5765ad840b71ff8db812d0210f216cca96e4\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I48560d38bdda01f777e2c96021c4c1ec62a17d6b\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159555\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "f73729dc5202c0463553e5eb6232105a2edfa4ec", "tree": "b7e88a467bc2286d0f06691d7e35f7dc44e35af7", "parents": [ "180e61de3a7e561ea6c603340b3885afeda5cbe2" ], "author": { "name": "Konstantin Komarov", "email": "almaz.alexandrovich@paragon-software.com", "time": "Thu Apr 30 12:30:13 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:08 2026" }, "message": "FROMGIT: fs/ntfs3: add bounds check to run_get_highest_vcn()\n\n[ Upstream commit bb11485a87fbb2254b62cfed630b699d50e57da8 ]\n\nrun_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without\nany length bound, relying solely on a 0x00 terminator to stop. A\ncrafted $LogFile UpdateMappingPairs record whose embedded attribute\ncontains mapping-pairs runs without a terminator causes the function to\nread past the slab allocation, triggering a KASAN slab-out-of-bounds\nread on mount.\n\nThe sibling function run_unpack() received an analogous bounds-check in\ncommit b62567bca474 (\"ntfs3: add buffer boundary checks to run_unpack()\"),\nbut run_get_highest_vcn() was missed.\n\nTake a run_buf_size parameter and reject any run header whose payload\nwould extend past the buffer end, mirroring the pattern used by\nrun_unpack(). The caller in fslog.c passes the remaining attribute\nbytes after the mapping-pairs offset.\n\nKASAN report (on mainline v7.1 merge window HEAD):\n\n BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410\n Read of size 1 at addr ffff88800e2d5400 by task mount/72\n Call Trace:\n run_get_highest_vcn+0x3c0/0x410\n do_action.isra.0+0x3ba8/0x7b50\n log_replay+0x9ddd/0x10200\n ntfs_loadlog_and_replay+0x4ad/0x610\n ntfs_fill_super+0x214a/0x4540\n\nFixes: b62567bca474 (\"ntfs3: add buffer boundary checks to run_unpack()\")\nSigned-off-by: Jaeyeong Lee \u003clee@jaeyeong.cc\u003e\nSigned-off-by: Konstantin Komarov \u003calmaz.alexandrovich@paragon-software.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit c69b9003332917b652175d5fa9d84158c5ed8617\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I37d1e515070f88dc3be40bc00e15916357177aa2\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159554\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "180e61de3a7e561ea6c603340b3885afeda5cbe2", "tree": "9ed36a659d690e8581b025bdf5ee5a7cb2aae071", "parents": [ "6a851fde62a044abbe91f16ab873239952f77bf1" ], "author": { "name": "Aleksandr Nogikh", "email": "nogikh@google.com", "time": "Fri Jun 12 11:50:20 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:05 2026" }, "message": "FROMGIT: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write\n\n[ Upstream commit ff6f26c58421614b02694ac9d219ac61d924bc68 ]\n\nA circular locking dependency involves INODE_ALLOC_SYSTEM_INODE,\nEXTENT_ALLOC_SYSTEM_INODE, and ORPHAN_DIR_SYSTEM_INODE.\n\n1. ocfs2_mknod() acquires INODE_ALLOC then EXTENT_ALLOC.\n\n2. ocfs2_dio_end_io_write() acquires EXTENT_ALLOC for unwritten\n extents, then ORPHAN_DIR via ocfs2_del_inode_from_orphan() while still\n holding EXTENT_ALLOC.\n\n3. ocfs2_wipe_inode() acquires ORPHAN_DIR then INODE_ALLOC via\n ocfs2_remove_inode.\n\nBreak the cycle in ocfs2_dio_end_io_write() by freeing the allocation\ncontexts (releasing EXTENT_ALLOC) before acquiring ORPHAN_DIR.\n\nWARNING: possible circular locking dependency detected\n------------------------------------------------------\nis trying to acquire lock:\nffff8881e78b33a0\n(\u0026ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at:\nocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299\n\nbut task is already holding lock:\nffff8881e78b4fa0\n(\u0026ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}, at:\nocfs2_evict_inode+0xe97/0x43b0 fs/ocfs2/inode.c:1299\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #2 (\u0026ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}:\n inode_lock include/linux/fs.h:1029 [inline]\n ocfs2_del_inode_from_orphan+0x12e/0x7a0 fs/ocfs2/namei.c:2728\n ocfs2_dio_end_io+0xf9c/0x1370 fs/ocfs2/aops.c:2418\n dio_complete+0x25b/0x790 fs/direct-io.c:281\n\n-\u003e #1 (\u0026ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:\n inode_lock include/linux/fs.h:1029 [inline]\n ocfs2_reserve_suballoc_bits+0x16d/0x4840 fs/ocfs2/suballoc.c:882\n ocfs2_reserve_new_metadata_blocks+0x415/0x9a0\n fs/ocfs2/suballoc.c:1078\n ocfs2_mknod+0x10f3/0x2260 fs/ocfs2/namei.c:351\n\n-\u003e #0 (\u0026ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:\n __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237\n lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868\n down_write+0x96/0x200 kernel/locking/rwsem.c:1625\n inode_lock include/linux/fs.h:1029 [inline]\n ocfs2_remove_inode fs/ocfs2/inode.c:733 [inline]\n ocfs2_wipe_inode fs/ocfs2/inode.c:896 [inline]\n ocfs2_delete_inode fs/ocfs2/inode.c:1157 [inline]\n ocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299\n\nChain exists of:\n \u0026ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE] --\u003e\n \u0026ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE] --\u003e\n \u0026ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(\u0026ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);\n lock(\u0026ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]);\n lock(\u0026ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);\n lock(\u0026ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]);\n\n *** DEADLOCK ***\n\nLink: https://lore.kernel.org/97c902a6-3bcf-43ea-9b70-f1f136a6c3f2@mail.kernel.org\nFixes: d647c5b2fbf8 (\"ocfs2: split transactions in dio completion to avoid credit exhaustion\")\nAssisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot\nReported-by: syzbot+b225d4dfce6219600c42@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003db225d4dfce6219600c42\nLink: https://syzkaller.appspot.com/ai_job?id\u003d0b53ce1e-2972-4192-aa85-8097a702762c\nSigned-off-by: Aleksandr Nogikh \u003cnogikh@google.com\u003e\nReviewed-by: Heming Zhao \u003cheming.zhao@suse.com\u003e\nCc: Mark Fasheh \u003cmark@fasheh.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Joseph Qi \u003cjiangqi903@gmail.com\u003e\nCc: Changwei Ge \u003cgechangwei@live.cn\u003e\nCc: Jun Piao \u003cpiaojun@huawei.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 4273548e418bd935430d35e9d052870f323441f3\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Iaacfb347335cd970a7a581aa53d735d41ae9adfd\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159553\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "6a851fde62a044abbe91f16ab873239952f77bf1", "tree": "06927f03f061a9d599e8b6c38765a322f7d25627", "parents": [ "96134749f4c3e717139b2247e177f038064d33a7" ], "author": { "name": "David Disseldorp", "email": "ddiss@suse.de", "time": "Fri Jun 05 12:16:47 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:03 2026" }, "message": "FROMGIT: scsi: target: Fix hexadecimal CHAP_I handling\n\n[ Upstream commit 7e161211f1dd5288b4ea802b30e70ef919ebc3da ]\n\nA mutual CHAP handshake requires target processing of an initiator-sent\nCHAP_I identifier. The RFC 3720 specification states:\n\n 11.1.4. Challenge Handshake Authentication Protocol (CHAP)\n ...\n CHAP_A\u003d\u003cA\u003e CHAP_I\u003d\u003cI\u003e CHAP_C\u003d\u003cC\u003e\n ...\n Where N, (A,A1,A2), I, C, and R are (correspondingly) the Name,\n Algorithm, Identifier, Challenge, and Response as defined in\n [RFC1994], N is a text string, A,A1,A2, and I are numbers\n\nCHAP_I parsing currently calls extract_param(), which returns the\n@identifier string (stripped of any 0b/0B or 0x/0X prefix) and a @type\nwhich indicates DECIMAL, HEX, or BASE64 encoding (based on any stripped\nprefix).\n\nAny HEX encoded CHAP_I string is further processed via:\n\n ret \u003d kstrtoul(\u0026identifier[2], 0, \u0026id);\n\nThis is incorrect for two reasons:\n\n * The @identifier string has already been stripped of the 0x/0X prefix,\n so skipping the first two bytes omits part of the number.\n\n * The kstrtoul() call specifies a base of 0, which will see\n \u0026identifier[2] parsed as a decimal, unless a \u00270x\u0027 or (octal) \u00270\u0027 is\n erroneously present at that offset.\n\nFix this by passing the (zero-offset) identifier string to kstrtoul()\nalong with a base\u003d16 parameter. Also add an explicit error handler for\nBASE64 encoding.\n\nHex-encoded CHAP_I handling can be testing using the libiscsi EncodedI\ntest linked below.\n\nReported-by: Sashiko (gemini/gemini-3.1-pro-preview)\nLink: https://sashiko.dev/#/patchset/20260521151121.808477-1-hossu.alexandru%40gmail.com\nLink: https://github.com/sahlberg/libiscsi/pull/473\nFixes: 85db7391310b (\"scsi: target: iscsi: Validate CHAP_R length before base64 decode\")\nSigned-off-by: David Disseldorp \u003cddiss@suse.de\u003e\nReviewed-by: Lee Duncan \u003clduncan@suse.com\u003e\nReviewed-by: John Garry \u003cjohn.g.garry@oracle.com\u003e\nLink: https://patch.msgid.link/20260605122019.24146-2-ddiss@suse.de\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 0e96ba7840b6b69286c3db5f6efb9d91cfa035ed\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I5a0bb66edaca580c21861744bf8bbb5369ab2b54\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159552\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "96134749f4c3e717139b2247e177f038064d33a7", "tree": "adeaadd09285b88a61282802ea8b41dec0166780", "parents": [ "743db9ed45098310420fc40d53577f548e83a070" ], "author": { "name": "Yousef Alhouseen", "email": "alhouseenyousef@gmail.com", "time": "Sun Jun 28 00:23:05 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:04:00 2026" }, "message": "FROMGIT: Bluetooth: fix UAF in bt_accept_dequeue()\n\ncommit 4bd0b274054f2679f28b70222b607bb0afc3ab9a upstream.\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths.\n\nFixes: ab1513597c6c (\"Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()\")\nReported-by: syzbot+674ff7e4d7fdfd572afc@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d674ff7e4d7fdfd572afc\nCc: stable@vger.kernel.org\nSigned-off-by: Yousef Alhouseen \u003calhouseenyousef@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I8c154235226978bd2b24a50d76e1938323056765\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159551\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "743db9ed45098310420fc40d53577f548e83a070", "tree": "4d254309818dce67d3b6efa2234a5b84152db4e9", "parents": [ "0dd86ecada5288fb5f8bcf92aa7922ceed32ee46" ], "author": { "name": "Gil Portnoy", "email": "dddhkts1@gmail.com", "time": "Wed Jun 10 10:53:14 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:57 2026" }, "message": "FROMGIT: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL\n\ncommit 10f293a07f9e10e988b0ae44e2e99c631f5a68e0 upstream.\n\nCommit f580d27e8928 (\"ksmbd: fix use-after-free of a deferred file_lock on\ndouble SMB2_CANCEL\") made smb2_cancel() skip a work whose state is\nKSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But\nKSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same\nfreeing producer path is reached for CLOSED too:\n\n SMB2_CLOSE on the locking handle -\u003e set_close_state_blocked_works() sets\n the deferred work\u0027s state to KSMBD_WORK_CLOSED and wakes the smb2_lock()\n worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s\n the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes\n the STATUS_RANGE_NOT_LOCKED branch with \"goto out2\" -- which, like the\n cancelled branch, skips release_async_work(). The work stays on\n conn-\u003easync_requests with a live cancel_fn \u003d smb2_remove_blocked_lock\n pointing at the freed file_lock.\n\nA subsequent SMB2_CANCEL for the same AsyncId then passes the\nKSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so\nsmb2_cancel() fires cancel_fn again over the freed file_lock -- the same\nuse-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:\n\n BUG: KASAN: slab-use-after-free in __locks_delete_block\n __locks_delete_block\n locks_delete_block\n ksmbd_vfs_posix_lock_unblock\n smb2_remove_blocked_lock\n smb2_cancel \u003c- 2nd SMB2_CANCEL fires cancel_fn\n handle_ksmbd_work\n Allocated by ...: locks_alloc_lock \u003c- smb2_lock\n Freed by ...: locks_free_lock \u003c- smb2_lock (non-ACTIVE early-exit)\n ... cache file_lock_cache of size 192\n\nReproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with\nKASAN by an authenticated SMB client; the double-SMB2_CANCEL control is\nsilent on that kernel, so the splat is attributable to the CLOSE trigger.\n\nOnly an ACTIVE deferred work may have its cancel_fn fired: both terminal\nstates (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees\nthe file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE\nso any non-active work is skipped.\n\nFixes: f580d27e8928 (\"ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gil Portnoy \u003cdddhkts1@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit a796ba4e61d5e14e07b79a359faac69f8f9b22a3\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I2314f779c85b77dd8f2ffca5063b40eb1db4300b\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159550\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "0dd86ecada5288fb5f8bcf92aa7922ceed32ee46", "tree": "85f9fe565477070488d5c39d652a6c95c53dbd1d", "parents": [ "7a2207ea817f03c3f378dd89c83e7625c09c925e" ], "author": { "name": "Jonas Jelonek", "email": "jelonek.jonas@gmail.com", "time": "Fri Jul 10 22:51:47 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:54 2026" }, "message": "FROMGIT: MIPS: smp: report dying CPU to RCU in stop_this_cpu()\n\ncommit 9f3f3bdc6d9dac1a5a8262ee7ad0f2ff1527a7e7 upstream.\n\nsmp_send_stop() parks all secondary CPUs in stop_this_cpu(). The function\nmarks the CPU offline for the scheduler via set_cpu_online(false) but\nnever informs RCU, so RCU keeps expecting a quiescent state from CPUs\nthat are now spinning forever with interrupts disabled.\n\nAs long as nothing waits for an RCU grace period after smp_send_stop()\nthis is harmless, which is why it went unnoticed. Since commit\n91840be8f710 (\"irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT\")\nhowever, irq_work_sync() calls synchronize_rcu() on architectures without\nan irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns\nfalse. That is the asm-generic default used by MIPS. Any irq_work_sync()\nissued in the reboot/shutdown path after smp_send_stop() then blocks on\na grace period that can never complete, hanging the reboot:\n\n WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on\n ...\n rcu: INFO: rcu_sched detected stalls on CPUs/tasks:\n rcu: Offline CPU 1 blocking current GP.\n rcu: Offline CPU 2 blocking current GP.\n rcu: Offline CPU 3 blocking current GP.\n\nThis issue was noticed on several Realtek MIPS switch SoCs (MIPS\ninterAptiv) and came up during kernel bump downstream in OpenWrt from\n6.18.33 to 6.18.34, after the backport of the patch to the 6.18 stable\nbranch. The patch also has been backported all the way back to 6.1.\n\nCall rcu_report_dead() once interrupts are disabled, mirroring the\ngeneric CPU-hotplug offline path, so RCU stops waiting on the parked CPUs\nand grace periods can still complete. MIPS shuts down all CPUs here\nwithout going through the CPU-hotplug mechanism, so this report is not\notherwise issued. Reporting a dying CPU to RCU outside the regular hotplug\noffline path is not unprecedented: arm64 does the same in cpu_die_early().\nThere it is an exception for a CPU that was coming online and is aborting\nbringup, rather than the default shutdown action as on MIPS.\n\nNote: this differs from the upstream commit in that it calls\nrcu_report_dead(smp_processor_id()) instead of rcutree_report_cpu_dead().\nThe latter, along with the rcutree_report_cpu_dead() name, was introduced\nby commit 448e9f34d91d (\"rcu: Standardize explicit CPU-hotplug calls\")\nin v6.7; on this kernel the equivalent function is still named\nrcu_report_dead() and takes an explicit CPU argument.\n\nFixes: 91840be8f710 (\"irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT\")\nSigned-off-by: Jonas Jelonek \u003cjelonek.jonas@gmail.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit f8a1ef884013dc99f712d3eb75624c7cd3fd94f6\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I869c68216f4706414dfc3782d442f40fb84952d8\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159549\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "7a2207ea817f03c3f378dd89c83e7625c09c925e", "tree": "d3cc33d4a4e0276039801cc4aa818011e7e62b52", "parents": [ "4c62c7339becb505d9884cb2cc58cf34dedf624a" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:43 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:52 2026" }, "message": "FROMGIT: eventpoll: fix ep_remove struct eventpoll / struct file UAF\n\n[ Upstream commit a6dc643c69311677c574a0f17a3f4d66a5f3744b ]\n\nep_remove() (via ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op-\u003erelease / file_free().\n\nFor the epoll-watches-epoll case, f_op-\u003erelease is\nep_eventpoll_release() -\u003e ep_clear_and_put() -\u003e ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded -\u003erefs\nhlist_head is exactly where epi-\u003efllink.pprev points, so the\nsubsequent hlist_del_rcu()\u0027s \"*pprev \u003d next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep-\u003emtx until the waiter\nside\u0027s ep_clear_and_put() drops it. The bailed epi\u0027s share of\nep-\u003erefcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi-\u003edying under f_lock. The cheap lockless\nREAD_ONCE(epi-\u003edying) fast-path bailout stays.\n\nFixes: 58c9b016e128 (\"epoll: use refcount to reduce ep_mutex contention\")\nReported-by: Jaeyoung Chung \u003cjjy600901@snu.ac.kr\u003e\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-6-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n(cherry picked from commit a6dc643c69311677c574a0f17a3f4d66a5f3744b)\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 3e1144d2515d28e4312e663ea05eac203101491d\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I4083ee0f63ff1d48100a103d3275f3d29d1b1f49\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159548\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "4c62c7339becb505d9884cb2cc58cf34dedf624a", "tree": "906432cf3df3e7622fc395e38e429e0c2100f845", "parents": [ "bb8b98dfd28369b82e31c9dca50a9f7fe91b0fa5" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:41 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:47 2026" }, "message": "FROMGIT: eventpoll: move epi_fget() up\n\n[ Upstream commit 86e87059e6d1fd5115a31949726450ed03c1073b ]\n\nWe\u0027ll need it when removing files so move it up. No functional change.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-5-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nStable-dep-of: a6dc643c6931 (\"eventpoll: fix ep_remove struct eventpoll / struct file UAF\")\n[file_ref_get(\u0026file-\u003ef_ref) from original commit left as\n atomic_long_inc_not_zero(\u0026file-\u003ef_count) due to v6.12.y missing commit\n 90ee6ed776c0 (\"fs: port files to file_ref\") and its dependent commit\n 08ef26ea9ab3 (\"fs: add file_ref\")]\nSigned-off-by: Quentin Schulz \u003cquentin.schulz@cherry.de\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 7859566c519c75965b57ab2caccf8d6268717c9a\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I4a3f00764b949c0045218bbece158d285529c138\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159547\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "bb8b98dfd28369b82e31c9dca50a9f7fe91b0fa5", "tree": "589271c5fd1407c0c4f1210f01d39fc2932243e6", "parents": [ "bdd5a0fcc9c024b5d1b2885ac792a800148e6aec" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:39 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:44 2026" }, "message": "FROMGIT: eventpoll: rename ep_remove_safe() back to ep_remove()\n\n[ Upstream commit 0bade234723e40e4937be912e105785d6a51464e ]\n\nThe current name is just confusing and doesn\u0027t clarify anything.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nStable-dep-of: a6dc643c6931 (\"eventpoll: fix ep_remove struct eventpoll / struct file UAF\")\nSigned-off-by: Quentin Schulz \u003cquentin.schulz@cherry.de\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 136e5900ea830dee549e3485c8931ec1c8f6c1b1\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I22ff1f727120b559fccc54ed56a185438d0c5586\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159546\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "bdd5a0fcc9c024b5d1b2885ac792a800148e6aec", "tree": "8b20abb19bfcd0211f730de34e222dc535c03225", "parents": [ "6ca112b3bd2ede7fc108f21feba6e780cecd1b8e" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:37 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:42 2026" }, "message": "FROMGIT: eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()\n\n[ Upstream commit 0feaf644f7180c4a91b6b405a881afbfd958f1cf ]\n\nWith __ep_remove() gone, the double-underscore on __ep_remove_file()\nand __ep_remove_epi() no longer contrasts with a __-less parent and\njust reads as noise. Rename both to ep_remove_file() and\nep_remove_epi(). No functional change.\n\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nStable-dep-of: a6dc643c6931 (\"eventpoll: fix ep_remove struct eventpoll / struct file UAF\")\nSigned-off-by: Quentin Schulz \u003cquentin.schulz@cherry.de\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit e40f6d02a75baa0f145e0394a2d9b31b969da247\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I1134506c1f77f1d4b8b8ef58eff2b8baec76063c\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159545\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "6ca112b3bd2ede7fc108f21feba6e780cecd1b8e", "tree": "ea89491e00375d50ab496cd578318617c7c1845e", "parents": [ "ed14a1e9083f80fcf446f90714687f014dee82ee" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:35 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:39 2026" }, "message": "FROMGIT: eventpoll: kill __ep_remove()\n\n[ Upstream commit e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330 ]\n\nRemove the boolean conditional in __ep_remove() and restructure the code\nso the check for racing with eventpoll_release_file() are only done in\nthe ep_remove_safe() path where they belong.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-3-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nStable-dep-of: a6dc643c6931 (\"eventpoll: fix ep_remove struct eventpoll / struct file UAF\")\nSigned-off-by: Quentin Schulz \u003cquentin.schulz@cherry.de\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 13e8b6ab5fd34129b2a4a1b2c00b4921dde462cd\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I4764d2235e4ca8676b0d68e5d9abb2884842920f\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159544\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "ed14a1e9083f80fcf446f90714687f014dee82ee", "tree": "d28d1f65ffcf5ac4fe90f3cb40e7be083afd6bc7", "parents": [ "a5a16d48d0577117d51087380ef0e867a811ab52" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:33 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:37 2026" }, "message": "FROMGIT: eventpoll: split __ep_remove()\n\n[ Upstream commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0 ]\n\nSplit __ep_remove() to delineate file removal from epoll item removal.\n\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nStable-dep-of: a6dc643c6931 (\"eventpoll: fix ep_remove struct eventpoll / struct file UAF\")\nSigned-off-by: Quentin Schulz \u003cquentin.schulz@cherry.de\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 66bc7c8a33df3618e43ce0d0d4a985595ce57861\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Iaee3fb370e83b5e83453ff0a23a0be72f2d9ab2e\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159543\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "a5a16d48d0577117d51087380ef0e867a811ab52", "tree": "1700e0001a5bd5edda485b1048debdfb1270857e", "parents": [ "a5f296a620eec88ddda2194149a31f5d7bb7b469" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:31 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:34 2026" }, "message": "FROMGIT: eventpoll: use hlist_is_singular_node() in __ep_remove()\n\n[ Upstream commit 3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b ]\n\nReplace the open-coded \"epi is the only entry in file-\u003ef_ep\" check\nwith hlist_is_singular_node(). Same semantics, and the helper avoids\nthe head-cacheline access in the common false case.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-1-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nStable-dep-of: a6dc643c6931 (\"eventpoll: fix ep_remove struct eventpoll / struct file UAF\")\nSigned-off-by: Quentin Schulz \u003cquentin.schulz@cherry.de\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 605963b245b2c436803cbbefddf5ee5cb326ceaa\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I86067fd2b9d0bb6ba030c01917375cfc470f920e\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159542\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "a5f296a620eec88ddda2194149a31f5d7bb7b469", "tree": "269f7edd0e3af684718dffa436cc147a57745d67", "parents": [ "0b587122e76f3644096d0a18311f5e754f1ff16f" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sun Jun 28 16:19:29 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:32 2026" }, "message": "FROMGIT: file: add fput() cleanup helper\n\n[ Upstream commit 257b1c2c78c25643526609dee0c15f1544eb3252 ]\n\nAdd a simple helper to put a file reference.\n\nLink: https://lore.kernel.org/r/20240719-work-mount-namespace-v1-4-834113cab0d2@kernel.org\nReviewed-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit ac275934626a85285cca43405e876566daa10533\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I5531e3cf1fb8810e482ca456e3480ed9bc20c44d\nStable-dep-of: 3e1144d2515d28e4312e663ea05eac203101491d\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159309\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "0b587122e76f3644096d0a18311f5e754f1ff16f", "tree": "26c94d032422b5a32594a659af23cb06e7ff14c7", "parents": [ "9b68a8d8927a86c8dca881c640b3879bce8333b2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 28 16:19:27 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:29 2026" }, "message": "FROMGIT: eventpoll: don\u0027t decrement ep refcount while still holding the ep mutex\n\ncommit 8c2e52ebbe885c7eeaabd3b7ddcdc1246fc400d2 upstream.\n\nJann Horn points out that epoll is decrementing the ep refcount and then\ndoing a\n\n mutex_unlock(\u0026ep-\u003emtx);\n\nafterwards. That\u0027s very wrong, because it can lead to a use-after-free.\n\nThat pattern is actually fine for the very last reference, because the\ncode in question will delay the actual call to \"ep_free(ep)\" until after\nit has unlocked the mutex.\n\nBut it\u0027s wrong for the much subtler \"next to last\" case when somebody\n*else* may also be dropping their reference and free the ep while we\u0027re\nstill using the mutex.\n\nNote that this is true even if that other user is also using the same ep\nmutex: mutexes, unlike spinlocks, can not be used for object ownership,\neven if they guarantee mutual exclusion.\n\nA mutex \"unlock\" operation is not atomic, and as one user is still\naccessing the mutex as part of unlocking it, another user can come in\nand get the now released mutex and free the data structure while the\nfirst user is still cleaning up.\n\nSee our mutex documentation in Documentation/locking/mutex-design.rst,\nin particular the section [1] about semantics:\n\n\t\"mutex_unlock() may access the mutex structure even after it has\n\t internally released the lock already - so it\u0027s not safe for\n\t another context to acquire the mutex and assume that the\n\t mutex_unlock() context is not using the structure anymore\"\n\nSo if we drop our ep ref before the mutex unlock, but we weren\u0027t the\nlast one, we may then unlock the mutex, another user comes in, drops\n_their_ reference and releases the \u0027ep\u0027 as it now has no users - all\nwhile the mutex_unlock() is still accessing it.\n\nFix this by simply moving the ep refcount dropping to outside the mutex:\nthe refcount itself is atomic, and doesn\u0027t need mutex protection (that\u0027s\nthe whole _point_ of refcounts: unlike mutexes, they are inherently\nabout object lifetimes).\n\nReported-by: Jann Horn \u003cjannh@google.com\u003e\nLink: https://docs.kernel.org/locking/mutex-design.html#semantics [1]\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit b0821ec902d39062356cb644c16e17a705d1c9f5\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Ie961c95b64875f1e553aa3887fe3addf99127a01\nStable-dep-of: 13e8b6ab5fd34129b2a4a1b2c00b4921dde462cd\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159541\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "9b68a8d8927a86c8dca881c640b3879bce8333b2", "tree": "7c3aeb947ddd353293bca0d83713d1897311bcc1", "parents": [ "c38dd0912d29005634fa9efa01aa940e074efffe" ], "author": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Jul 03 03:24:00 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:26 2026" }, "message": "FROMGIT: LoongArch: Report dying CPU to RCU in stop_this_cpu()\n\ncommit f2539c56c74691e7a88af6372ba2b48c06ed2fe4 upstream.\n\nThis is a port of MIPS commit 9f3f3bdc6d9dac1 (\"MIPS: smp: report dying\nCPU to RCU in stop_this_cpu()\"). smp_send_stop() parks all secondary\nCPUs in stop_this_cpu(). And the function marks the CPU offline for the\nscheduler via set_cpu_online(false) but never informs RCU, so RCU keeps\nexpecting a quiescent state from CPUs that are now spinning forever with\ninterrupts disabled.\n\nAs long as nothing waits for an RCU grace period after smp_send_stop()\nthis is harmless, which is why it went unnoticed. However, since commit\n91840be8f710370 (\"irq_work: Fix use-after-free in irq_work_single() on\nPREEMPT_RT\"), irq_work_sync() calls synchronize_rcu() on architectures\nwithout an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt()\nreturns false. Any irq_work_sync() issued in the reboot/shutdown/halt\npath after smp_send_stop() then blocks on a grace period that can never\ncomplete, hanging the reboot:\n\n WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on\n ...\n rcu: INFO: rcu_sched detected stalls on CPUs/tasks:\n rcu: Offline CPU 1 blocking current GP.\n rcu: Offline CPU 2 blocking current GP.\n rcu: Offline CPU 3 blocking current GP.\n\nThis issue needs some hacks to reproduce, and it was not noticed on\nLoongArch because arch_irq_work_has_interrupt() usually returns true.\n\nCall rcutree_report_cpu_dead() once interrupts are disabled, mirroring\nthe generic CPU-hotplug offline path, so RCU stops waiting on the parked\nCPUs and grace periods can still complete. LoongArch shuts down all CPUs\nhere without going through the CPU-hotplug mechanism, so this report is\nnot otherwise issued.\n\nCc: \u003cstable@vger.kernel.org\u003e\nFixes: 91840be8f710 (\"irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT\")\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit 262dadc619e69ebeb97affd334cd1078a9704e98\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: I56fb5e8d4534997c96f9fd51110d3d935ca2b062\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8159540\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "c38dd0912d29005634fa9efa01aa940e074efffe", "tree": "4b7f50129c4516373f9e881599564f1f33b50502", "parents": [ "e19420f14d274ff561908bd1ebb2e32bf279cc66" ], "author": { "name": "Davidlohr Bueso", "email": "dave@stgolabs.net", "time": "Wed Jun 17 12:46:07 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:23 2026" }, "message": "FROMGIT: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued\n\n[ Upstream commit 40a25d59e85b3c8709ac2424d44f65610467871e ]\n\nsyzbot triggered the following splat in remove_waiter() via\nFUTEX_CMP_REQUEUE_PI:\n\n KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]\n class_raw_spinlock_constructor\n remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561\n rt_mutex_start_proxy_lock+0x103/0x120\n futex_requeue+0x10e4/0x20d0\n __x64_sys_futex+0x34f/0x4d0\n\ntask_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,\nleaving waiter-\u003etask nil, where 3bfdc63936dd (\"rtmutex: Use waiter::task instead\nof current in remove_waiter()\") made this fatal.\n\nFurthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()\nupon a successfully grabbing the rtmutex. 1a1fb985f2e2 (\"futex: Handle early deadlock\nreturn correctly\"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()\n(where \u0027ret\u0027 was only ever 0 or \u003c 0) into the wrapper. Tighten this check to\naccount for try_to_take_rt_mutex().\n\nFixes: 3bfdc63936dd (\"rtmutex: Use waiter::task instead of current in remove_waiter()\")\nReported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com\nSigned-off-by: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nCloses: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/\nLink: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 4afda3a1da02129568a3a2f1898aa13e6763bcba\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Id6776b6383f7bc986059979763483ef5f911f47f\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8097747\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "e19420f14d274ff561908bd1ebb2e32bf279cc66", "tree": "a4b7a15eac465c11fd1a97b0792a9791590976f5", "parents": [ "6accbce572e6dad3f4a41988e1600422ae4a4b9b" ], "author": { "name": "Hem Parekh", "email": "hemparekh1596@gmail.com", "time": "Tue Jun 02 23:56:46 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:20 2026" }, "message": "FROMGIT: ksmbd: fix out-of-bounds read in smb_check_perm_dacl()\n\ncommit 1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b upstream.\n\nThe permission-check ACE walk in smb_check_perm_dacl() validates the ACE\nheader size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it\nnever checks that ace-\u003esize is actually large enough to contain\nnum_subauth sub-authorities before compare_sids() dereferences them.\n\nCIFS_SID_BASE_SIZE covers the SID header up to but excluding the\nsub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,\nso the existing guards only guarantee the 8-byte SID base, i.e. zero\nsub-authorities. compare_sids() then reads ace-\u003esid.sub_auth[i] for\ni \u003c min(local_sid-\u003enum_subauth, ace-\u003esid.num_subauth). The local\ncomparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid()\nresult) always have at least one sub-authority, and an attacker controls\nthe ACE revision and authority bytes (which lie within the in-bounds SID\nbase), so they can match one of those SIDs and force the sub_auth read.\n\nA crafted ACE with size \u003d\u003d 16 and num_subauth \u003e\u003d 1 placed at the tail of\nthe security descriptor therefore causes a heap out-of-bounds read of up\nto SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd\nallocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr()\ninto a buffer sized exactly to the on-disk data (kzalloc(sd_size) in\nndr_decode_v4_ntacl()), so the read lands past the allocation. The\nmalformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL\nis not normalised before being written to the security.NTACL xattr) and\nthe read fires on a subsequent SMB2_CREATE access check, making this\nreachable by an authenticated client on a share that uses ACL xattrs.\n\nAdd the missing num_subauth-versus-ace_size check, mirroring the\nidentical guards already present in the sibling parsers parse_dacl() and\nsmb_inherit_dacl().\n\nFixes: d07b26f39246 (\"ksmbd: require minimum ACE size in smb_check_perm_dacl()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hem Parekh \u003chemparekh1596@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 988c93d3bba066d8669143e6ec30bb2be9608d53\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Iedf481acb12ea6ab652d282f994f2cd26ca48849\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8097746\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "6accbce572e6dad3f4a41988e1600422ae4a4b9b", "tree": "309210b5b714614d74f94f56faa6b0198820b982", "parents": [ "41a92be65cab9266c164384cbb3b4e5b0fe86b40" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Thu Jun 25 13:32:22 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:17 2026" }, "message": "FROMGIT: perf block-range: Move debug code behind ifndef NDEBUG\n\n[ Upstream commit 984a785f25e5b5db5fa673130b60dca6ca794406 ]\n\nMake good on a comment and avoid a unused-but-set-variable warning.\n\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nCc: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Sean Christopherson \u003cseanjc@google.com\u003e\nLink: https://lore.kernel.org/r/20230330183827.1412303-1-irogers@google.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nStable-dep-of: 616b14b47a86 (\"perf build: Conditionally define NDEBUG\")\nSigned-off-by: Simon Liebold \u003csimonlie@amazon.de\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit fde42f1685fbe58fba31b53687c4c645bff0d1f1\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Ic807ea73444fd1c1b803fa80a6c395ff9e48b56c\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8097745\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "41a92be65cab9266c164384cbb3b4e5b0fe86b40", "tree": "870ec81b2c5bac18acbffe40f2703579bf18ae53", "parents": [ "62a8fb7e16f98e44f1d2825846f7d7b07823d494" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Thu Jun 25 13:32:21 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:13 2026" }, "message": "FROMGIT: perf bench: Avoid NDEBUG warning\n\n[ Upstream commit d1babea9c38282b58a6f822ab95027cba3165a42 ]\n\nWith NDEBUG set the asserts are compiled out. This yields\n\"unused-but-set-variable\" variables. Move these variables behind\nNDEBUG to avoid the warning.\n\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nCc: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Sean Christopherson \u003cseanjc@google.com\u003e\nLink: https://lore.kernel.org/r/20230330183827.1412303-1-irogers@google.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nStable-dep-of: 616b14b47a86 (\"perf build: Conditionally define NDEBUG\")\nSigned-off-by: Simon Liebold \u003csimonlie@amazon.de\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit c1e2169ed5b3275468032178c4d9a638149ec916\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: If07a14430a8fe9ef91f3e2b55da18cbf40931a51\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8097744\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\n" }, { "commit": "62a8fb7e16f98e44f1d2825846f7d7b07823d494", "tree": "4c5d64f9e1f8fe42813832f3fb0083857090269d", "parents": [ "a786c518cb5df88c721c1979d4ad35f376ef712d" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@gmail.com", "time": "Thu Jun 18 01:40:31 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 23:03:10 2026" }, "message": "FROMGIT: selftests/bpf: move SYS() macro into the test_progs.h\n\ncommit b61987d37cbee3c44e80304598c60b163553926b upstream.\n\nA lot of tests defined SYS() macro to run system calls with goto label.\nLet\u0027s move this macro to test_progs.h and add configurable\n\"goto_label\" as the first arg.\n\nSuggested-by: Martin KaFai Lau \u003cmartin.lau@linux.dev\u003e\nSigned-off-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230224061343.506571-2-liuhangbin@gmail.com\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nStable-dep-of: 967e8def1100 (\"selftests/bpf: Fix bpf_nf selftest failure\")\n[shung-hsi.yu: changes to several files are dropped because they don\u0027t exist\nyet: decap_sanity.c, fib_lookup.c, xdp_metadata.c, and xfrm_info.c. Addional\nchanges are introdced to tc_redirect.c to patch SYS() macro usage not found\nin upstream. ]\nSigned-off-by: Shung-Hsi Yu \u003cshung-hsi.yu@suse.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n(cherry picked from commit f9c63caf1f2f0e3f3050d743a2c869ea9bd77363\n git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y)\n\nBUG\u003db:532414765\nTEST\u003dcq\nBranches: N/A\n\nChange-Id: Ia47eb248cde1618450fe77384f6e9c759806e2bf\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8097743\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "a786c518cb5df88c721c1979d4ad35f376ef712d", "tree": "6f8418169d3acea43abfc0e8ad67122ed2bb89d3", "parents": [ "c9983759d2127772534d2522bb65f7fcb3dac546", "8d62ff256e68c7e0980dc9474ba45532c3c5c1a6" ], "author": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Jul 30 23:03:06 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Jul 30 23:03:06 2026" }, "message": "Merge \"CHROMIUM: Merge tag \u0027v6.1.176\u0027 into chromeos-6.1\" into chromeos-6.1" }, { "commit": "c9983759d2127772534d2522bb65f7fcb3dac546", "tree": "4628a6852445ac525daa1a759e0bf2859bd5ef38", "parents": [ "db3ff15b9f2a4ba73d55eabe0c6b57a868823f04", "374c791ad536ea6b17a315c5b254fa42d0505665" ], "author": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Jul 30 23:03:01 2026" }, "committer": { "name": "Gerrit Code Review", "email": "noreply-gerritcodereview@google.com", "time": "Thu Jul 30 23:03:01 2026" }, "message": "Merge \"CHROMIUM: Merge tag \u0027v6.1.175\u0027 into chromeos-6.1\" into chromeos-6.1" }, { "commit": "db3ff15b9f2a4ba73d55eabe0c6b57a868823f04", "tree": "b6f55d2ae6a962f49d40587d988ce9bde087c077", "parents": [ "f2271c2b8a8290fa733a1f96a5e84f6c384d550c" ], "author": { "name": "Athira Palliprath", "email": "palliprath@google.com", "time": "Wed Jul 08 06:46:14 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 12:38:41 2026" }, "message": "CHROMIUM: mmc: block: dump registers and bus state on critical I/O errors\n\nIntroduce mmc_panic_dump_regs() to log a comprehensive hardware and\nelectrical state snapshot when unrecoverable read errors occur. This\ncaptures critical diagnostics right before dm-verity triggers a\nsystem panic on transient block failures.\n\nThe dump pulls purely from memory-resident structures to avoid hanging\non a dead physical bus, capturing:\n- Core Registers: OCR, RCA, CID, CSD, and card state flags.\n- Power States: VDD index, VCCQ I/O signaling voltage, and power mode.\n- Bus Topology: Clock frequency, bus width, timing mode, and Enhanced\n Strobe status.\n\nBUG\u003db:405124991\nTEST\u003dBuilt and verified the trace line in dmesg\n\nChange-Id: I93893bcb60058252decf32efbadb9a0c7fcb1dcb\nSigned-off-by: Athira Palliprath \u003cpalliprath@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8098902\nReviewed-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "f2271c2b8a8290fa733a1f96a5e84f6c384d550c", "tree": "e30e6094e0854dd62e59391806ec93ae4d8a9efd", "parents": [ "e1d7dab4ec187cf8307fd424d1b3b6fdf832090c" ], "author": { "name": "Athira Palliprath", "email": "palliprath@google.com", "time": "Mon May 25 08:28:53 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 12:35:12 2026" }, "message": "CHROMIUM: mmc: cqhci: Log PCIe link status during timeouts\n\nLog the underlying PCIe link status, control flags, and power states\nimmediately upon a command queue timeout. This data is critical for\nisolating hardware state-machine freezes from software driver bugs.\n\nCaptured data:\n- Port, LNKSTA, LnkCtl, L1Sub, and PwrStateRaw\n\nBUG\u003db:379013271\nTEST\u003dBuilt and verified the trace line in dmesg\n\nChange-Id: I3b6cd92f94b24987e165ff041b3c0d22a21cae2c\nSigned-off-by: Athira Palliprath \u003cpalliprath@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/7866791\nReviewed-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "fb28aa725e05025101446230b14b1defe4c66666", "tree": "6715fb8e5afd4d9e4ca154f48231cf13bac3a3cb", "parents": [ "cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 30 10:59:53 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 30 10:59:53 2026" }, "message": "Linux 6.1.180\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa", "tree": "f80663f07ce52a4a3354db525f4c5af81872d255", "parents": [ "1016ca6176ee53f6ddb5d84838fa9181e92f789c" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Jul 27 09:10:14 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 30 10:59:53 2026" }, "message": "posix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\ncommit 920f893f735e92ba3a1cd9256899a186b161928d upstream.\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n posix_cpu_timer_del()\n // Observes old leader\n p \u003d pid_task(pid, pid_type);\t\tde_thread()\n \t\t\t\t\t switch_leader();\n\t\t\t\t\t release_task(old_leader)\n\t\t\t\t\t __exit_signal(old_leader)\n\t\t\t\t\t sighand \u003d lock(old_leader, sighand);\n\t\t\t\t\t posix_cpu_timers*_exit();\n sighand \u003d lock_task_sighand(p)\t unhash_task(old_leader);\n sh \u003d lock(p, sighand)\t \t old_leader-\u003esighand \u003d NULL;\n\t\t\t\t\t unlock(sighand);\n (p-\u003esighand \u003d\u003d NULL)\n\tunlock(sh)\n\treturn NULL;\n\n // Returns without action\n if(!sighand)\n return 0;\n free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np-\u003esignal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object\u0027s timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it\u0027s the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t posix_cpu_timers*_exit(p);\n\t\t\t\t\t unhash_task(p);\n\t\t\t\t\t p-\u003esighand \u003d NULL;\n sh \u003d lock_task_sighand(p)\n sighand \u003d p-\u003esighand;\n\tif (!sighand)\n\t return NULL;\n\tlock(sighand);\n\n if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p-\u003esighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n 1) Changing the store in __exit_signal() to smp_store_release().\n\n 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n of lock_task_sighand().\n\n 3) Creating a helper function for looking up the task and locking sighand\n which does not return when sighand \u003d\u003d NULL. Instead it retries the\n task lookup and only if that fails it gives up.\n\n 4) Using that helper in the three affected functions.\n\n#1/#2 ensures that the reader side which observes sighand \u003d\u003d NULL also\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\n#3 ensures that the above described non-leader exec() situation is handled\ngracefully. When the task lookup returns the old leader, but sighand \u003d\u003d\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that\u0027s the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which survived\nabout 10 years. The fix for the workaround changed the task pointer to a\npid pointer, but failed to see the subtle race described above. So the\nFixes tag picks that commit, which seems to be halfways accurate.\n\nThanks to Frederic Weissbecker, Oleg Nesterov and Peter Zijlstra for\nreview, feedback and suggestions and to Wongi and Jungwoo for the excellent\nbug report and analysis!\n\nFixes: 55e8c8eb2c7b (\"posix-cpu-timers: Store a reference to a pid not a task\")\nReported-by: Wongi Lee \u003cqw3rtyp0@gmail.com\u003e\nReported-by: Jungwoo Lee \u003cjwlee2217@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "1016ca6176ee53f6ddb5d84838fa9181e92f789c", "tree": "d1ad42b0a9ba756670f24bd9411ad5df7ea8dd48", "parents": [ "31509970efd3716c3641d0a592e8a53c43e2297f" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 29 15:47:48 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 29 15:47:48 2026" }, "message": "Linux 6.1.179\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "31509970efd3716c3641d0a592e8a53c43e2297f", "tree": "7511cd530299562609276e2a736c4ac3d35d5193", "parents": [ "dc5c83b7f5f83ea99aea5c771b1ec77458263a15" ], "author": { "name": "Lorenzo Stoakes", "email": "lorenzo.stoakes@oracle.com", "time": "Tue Sep 24 20:10:23 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 29 15:47:48 2026" }, "message": "mm: refactor mm_access() to not return NULL\n\n[ Upstream commit cd3f8467afd470ccab0de2fbc7c76664af4a0bac ]\n\nmm_access() can return NULL if the mm is not found, but this is handled\nthe same as an error in all callers, with some translating this into an\n-ESRCH error.\n\nOnly proc_mem_open() returns NULL if no mm is found, however in this case\nit is clearer and makes more sense to explicitly handle the error.\nAdditionally we take the opportunity to refactor the function to eliminate\nunnecessary nesting.\n\nSimplify things by simply returning -ESRCH if no mm is found - this both\neliminates confusing use of the IS_ERR_OR_NULL() macro, and simplifies\ncallers which would return -ESRCH by returning this error directly.\n\n[lorenzo.stoakes@oracle.com: prefer neater pointer error comparison]\n Link: https://lkml.kernel.org/r/2fae1834-749a-45e1-8594-5e5979cf7103@lucifer.local\nLink: https://lkml.kernel.org/r/20240924201023.193135-1-lorenzo.stoakes@oracle.com\nSigned-off-by: Lorenzo Stoakes \u003clorenzo.stoakes@oracle.com\u003e\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n" }, { "commit": "8d62ff256e68c7e0980dc9474ba45532c3c5c1a6", "tree": "d323d7b7ad9457af7a7dd297d16ebeb63f88d2e0", "parents": [ "374c791ad536ea6b17a315c5b254fa42d0505665", "fdb6fcb41cc741ad5eaa7995f278dfcb94fdf795" ], "author": { "name": "Jędrzej Ciupis", "email": "jciupis@google.com", "time": "Tue Jul 21 12:16:54 2026" }, "committer": { "name": "Jędrzej Ciupis", "email": "jciupis@google.com", "time": "Wed Jul 29 09:32:42 2026" }, "message": "CHROMIUM: Merge tag \u0027v6.1.176\u0027 into chromeos-6.1\n\nConflicts:\n\tarch/arm64/include/asm/tlbflush.h:\n\t\tBoth incoming commits are already present downstream\n\t\tand the rest of the file\u0027s history is shared. Ignore\n\t\tthe incoming hunk.\n\n\tarch/arm64/kvm/hyp/nvhe/tlb.c:\n\tarch/arm64/kvm/hyp/vhe/tlb.c:\n\tdrivers/thermal/thermal_core.c:\n\t\tResolved by rerere based on the v5.10.259 merge. Looks\n\t\tgood, let it be.\n\n\tdrivers/usb/core/quirks.c:\n\t\tResolved by rerere based on the v5.15.210 merge. Looks\n\t\tgood, let it be.\n\n\tdrivers/gpu/drm/i915/display/intel_psr.c:\n\t\tIncoming commit 64b53bab733fad (upstream f30bece421a4a)\n\t\tconflicts with local commit 7400a5aa3f315f (upstream\n\t\tcfc10489828a8). Since cfc10489828a8 is an ancestor of\n\t\tf30bece421a4a, follow the upstream resolution and pick\n\t\tboth headers.\n\n\tdrivers/net/usb/r8152.c:\n\t\tIncoming commit 30b071675bcbb5 (upstream 19440600e729d)\n\t\tconflicts, but applies cleanly. Just apply it.\n\n\tdrivers/net/wwan/t7xx/t7xx_modem_ops.c:\n\t\tIncoming commit 307c5d0f36a5c (upstream 0e7c074cfcd9b)\n\t\tconflicts with local commit 70cd0fffd21ae: the local\n\t\tcommit modified the if clause condition while the\n\t\tincoming commit modifies the function call executed\n\t\tinside that if block. To resolve, keep the downstream\n\t\tcondition and update the function call.\n\nBUG\u003db:532414765\nTEST\u003dcq\n\nChange-Id: I749f11672f08a7711b1d97a4814646b11453dc00\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "374c791ad536ea6b17a315c5b254fa42d0505665", "tree": "f2dcfe2e1e2ccfae29c373f318b39cb11965ac3e", "parents": [ "e1d7dab4ec187cf8307fd424d1b3b6fdf832090c", "228da13e907e2b46b7222cfc35290fbfad920bef" ], "author": { "name": "Jędrzej Ciupis", "email": "jciupis@google.com", "time": "Tue Jul 21 12:13:42 2026" }, "committer": { "name": "Jędrzej Ciupis", "email": "jciupis@google.com", "time": "Wed Jul 29 09:31:13 2026" }, "message": "CHROMIUM: Merge tag \u0027v6.1.175\u0027 into chromeos-6.1\n\nConflicts:\n\tarch/x86/kvm/mmu/mmu.c:\n\t\tIncoming commit e9d4ea13aa2b6 (upstream 0cb2af2ea66ad)\n\t\tis already present downstream as 20a87ab43f324. Ignore\n\t\tthe incoming hunk.\n\n\tdrivers/gpu/drm/bridge/ite-it66121.c:\n\t\tIncoming commit fc81faa01307a (upstream e02b5262fd288)\n\t\tadds code adjacent to where local commit 565f46c769b5f\n\t\t(upstream 334c8c1d3f2b0) deleted code, namely a call to\n\t\tite66121_power_on. Add the GPIO reset, as intended,\n\t\tmatching the upstream diff.\n\n\tdrivers/gpu/drm/i915/display/skl_watermark.c:\n\tdrivers/gpu/drm/i915/display/skl_watermark.h:\n\t\tIncoming commit f2b10734b022eb (upstream 487a2db8bc4eb)\n\t\tis already present downstream as addf6745edee5,\n\t\tIt is followed by local commit 6e473634d9706 (upstream\n\t\t8f0994d47e897), which further modifies the same\n\t\tsignature. Ignore the incoming hunk, which would\n\t\teffectively revert the change made by 6e473634d9706.\n\n\tdrivers/iommu/intel/iommu.c:\n\t\tResolved by rerere based on the v5.10.258 merge. Looks\n\t\tgood, let it be.\n\n\tsound/core/control_led.c:\n\t\tResolved by rerere based on the v5.15.209 merge. Looks\n\t\tgood, let it be.\n\n\tsound/pci/hda/patch_realtek.c:\n\t\tIncoming commit d2b7432a1791a7 (upstream d1888bf848ade)\n\t\tfixes code style and puts else on the same line as the\n\t\tbraces. Just apply the same change downstream.\n\n\tsound/soc/sof/amd/acp-ipc.c:\n\t\tIncoming commit 9cb3dc7cb30df4 (upstream aae7e412b0ec0)\n\t\tis already present downstream as 141fbd22fa242c and is\n\t\tfollowed by more upstream cherry-picks, which conflict.\n\t\tIgnore the incoming hunk.\n\n\tsound/soc/sof/sof-priv.h:\n\t\tIncoming commit 428f2d04006c96 (upstream 2c4fdd055f92a)\n\t\tconflicts, but applies cleanly. Just apply it.\n\n\tsound/soc/sof/stream-ipc.c:\n\t\tAll incoming commits but one are already present\n\t\tdownstream and the history of this file before these\n\t\tthree commits is shared. To resolve, just apply the\n\t\tchange from the last incoming commit, dfe25c554daa1\n\t\t(upstream d8d99c3b5c485).\n\nBUG\u003db:532414765\nTEST\u003dcq\n\nChange-Id: I0294e4cb2fe747e1cb6318788126c4f19c80d5f5\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\n" }, { "commit": "e1d7dab4ec187cf8307fd424d1b3b6fdf832090c", "tree": "497a137e5b17a5c61f94c2997a1639815dba37c8", "parents": [ "ca25f1d2c9fc2482adb8e99c0ef5be8bb9d6c43e" ], "author": { "name": "Jędrzej Ciupis", "email": "jciupis@google.com", "time": "Tue Jul 21 12:06:15 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 09:12:38 2026" }, "message": "Revert \"CHROMIUM: platform/x86/intel/vsec: Add support for Meteor Lake ES0\"\n\nThis reverts commit 2cc4e49d9ed2bffd324a6e4e8f2342761ec5357b.\n\nThe reverted commit introduced a hack needed for Intel MTL ES0 silicon,\nwhich was a preliminary revision of the hardware, deprecated now. The\ncommit causes a difficult conflict with v6.1.176 tag, which enforces\nthe expectation that quirks are known at compile time.\n\nSince the hardware has been long deprecated and doesn\u0027t need to be\nsupported anymore, revert the commit and avoid the merge conflict\naltogether.\n\nBUG\u003db:532414765\nTEST\u003dcq\n\nChange-Id: I6e907ec375099eedead49f9dd88b51fe0e06537b\nDisallow-Recycled-Builds: test-failures\nSigned-off-by: Jędrzej Ciupis \u003cjciupis@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/8127598\nReviewed-by: Lina Versace \u003clinyaa@google.com\u003e\n" }, { "commit": "dc5c83b7f5f83ea99aea5c771b1ec77458263a15", "tree": "8305554d18cbda8d2e10e9baa4fe8f37ea5c9cd1", "parents": [ "83de1cc01e77efb10cbc35025bdee4c78a961bc5" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "Linux 6.1.178\n\nLink: https://lore.kernel.org/r/20260721152424.521567757@linuxfoundation.org\nTested-by: Brett A C Sheffield \u003cbacs@librecast.net\u003e\nTested-by: Peter Schneider \u003cpschneider1968@googlemail.com\u003e\nTested-by: Ron Economos \u003cre@w6rz.net\u003e\nTested-by: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nTested-by: Pavel Machek (CIP) \u003cpavel@nabladev.com\u003e\nLink: https://lore.kernel.org/r/20260722143218.909123637@linuxfoundation.org\nTested-by: Brett A C Sheffield \u003cbacs@librecast.net\u003e\nTested-by: Pavel Machek (CIP) \u003cpavel@nabladev.com\u003e\nTested-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nTested-by: Francesco Dolcini \u003cfrancesco.dolcini@toradex.com\u003e\nTested-by: Peter Schneider \u003cpschneider1968@googlemail.com\u003e\nTested-by: Shung-Hsi Yu \u003cshung-hsi.yu@suse.com\u003e\nTested-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nTested-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "83de1cc01e77efb10cbc35025bdee4c78a961bc5", "tree": "ff6204872bd438c89a2c708f81ec8f2d4735ddbd", "parents": [ "a224c84e5d3d35708c082c84ad12d81d90762195" ], "author": { "name": "Sandipan Das", "email": "sandipan.das@amd.com", "time": "Mon Jun 01 14:58:46 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "perf/x86/amd/core: Always use the NMI latency mitigation\n\ncommit 73a4c02f94a98d94480c3e5c81450215a4da05ba upstream.\n\nCommit df4d29732fda (\"perf/x86/amd: Change/fix NMI latency mitigation\nto use a timestamp\") fixed handling of late-arriving NMIs but limited\nthe mitigation to processors having X86_FEATURE_PERFCTR_CORE. However,\nit is unclear if processors without this feature are also affected.\nWhen Mediated vPMU is enabled on affected hardware, it is also possible\nto bypass the fix inside KVM guests if X86_FEATURE_PERFCTR_CORE is\nremoved from the guest CPUID (e.g. using \"-cpu host,-perfctr-core\" with\nQEMU). Hence, use the mitigation at all times.\n\nFixes: df4d29732fda (\"perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp\")\nSigned-off-by: Sandipan Das \u003csandipan.das@amd.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/29a3c970da289ab8f24282933bdb36545c0403e8.1780325517.git.sandipan.das@amd.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a224c84e5d3d35708c082c84ad12d81d90762195", "tree": "b20ac3883ebee2ae725a48ea62adfa9f9cb1999b", "parents": [ "4d94fb171ac22fdcfeb3f9d6301a42a61122f6e1" ], "author": { "name": "HyeongJun An", "email": "sammiee5311@gmail.com", "time": "Tue Jun 23 23:38:40 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()\n\ncommit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream.\n\nsnd_seq_event_dup() copies an incoming event into a pool cell and, in\nthe UMP-enabled build, clears the trailing cell-\u003eump.raw.extra word that\nthe memcpy() did not cover. The guard deciding whether to clear it\ncompares the copied size against sizeof(cell-\u003eevent):\n\n\tmemcpy(\u0026cell-\u003eump, event, size);\n\tif (size \u003c sizeof(cell-\u003eevent))\n\t\tcell-\u003eump.raw.extra \u003d 0;\n\nFor a legacy (non-UMP) event, size \u003d\u003d sizeof(struct snd_seq_event) \u003d\u003d\nsizeof(cell-\u003eevent), so the condition is false and the extra word keeps\nstale data. The cell pool is allocated with kvmalloc() (not zeroed) and\ncells are reused via a free list, so that word holds uninitialised heap\nor leftover event data.\n\nWhen such a cell is delivered to a UMP client (client-\u003emidi_version \u003e 0)\nthat set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it\nunconverted -- snd_seq_read() reads it out as the larger struct\nsnd_seq_ump_event and copies the stale word to user space, a 4-byte\nkernel heap infoleak to an unprivileged /dev/snd/seq client.\n\nCompare against sizeof(cell-\u003eump) instead, so the trailing word is zeroed\nfor every event shorter than the UMP cell.\n\nFixes: 46397622a3fa (\"ALSA: seq: Add UMP support\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: HyeongJun An \u003csammiee5311@gmail.com\u003e\nLink: https://patch.msgid.link/20260623233841.853326-1-sammiee5311@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4d94fb171ac22fdcfeb3f9d6301a42a61122f6e1", "tree": "394c33df97729a3d24bcafa7baa4d947d673a5ef", "parents": [ "29ef3cf8c735cac31f1a9e85aac9db8c9c565e00" ], "author": { "name": "Jean-Baptiste Maneyrol", "email": "jean-baptiste.maneyrol@tdk.com", "time": "Tue Jun 23 14:22:15 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "iio: imu: inv_icm42600: fix timestamp clock period by using lower value\n\ncommit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.\n\nClock period value is used for computing periods of sampling. There is\nno need for it to be higher than the maximum odr, otherwise we are\nlosing precision in the computation for nothing.\n\nSwitch clock period value to maximum odr period (8kHz).\n\nFixes: 0ecc363ccea7 (\"iio: make invensense timestamp module generic\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jean-Baptiste Maneyrol \u003cjean-baptiste.maneyrol@tdk.com\u003e\nSigned-off-by: Jonathan Cameron \u003cjic23@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "29ef3cf8c735cac31f1a9e85aac9db8c9c565e00", "tree": "f5d121ea126991084abdbcacdd045c6245fd9817", "parents": [ "96531369e2868d4678488a3db2fa8cbf64c17e36" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Dec 31 14:53:58 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "ALSA: seq: Check UMP support for midi_version change\n\ncommit 8765429279e7d3d68d39ace5f84af2815174bb1e upstream.\n\nWhen the kernel is built without UMP support but a user-space app\nrequires the midi_version \u003e 0, the kernel should return an error.\nOtherwise user-space assumes as if it were possible to deal,\neventually hitting serious errors later.\n\nFixes: 46397622a3fa (\"ALSA: seq: Add UMP support\")\nCc: \u003cstable@vger.kernel.org\u003e\nLink: https://patch.msgid.link/20241231145358.21946-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "96531369e2868d4678488a3db2fa8cbf64c17e36", "tree": "082e16bc3ef27da31b9899cc3569c05ba1e5fd0b", "parents": [ "2ae8d7742a09c275872e670c53337b3dcedaa11c" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Aug 19 08:41:53 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "ALSA: seq: Skip event type filtering for UMP events\n\ncommit 32108c22ac619c32dd6db594319e259b63bfb387 upstream.\n\nUMP events don\u0027t use the event type field, hence it\u0027s invalid to apply\nthe filter, which may drop the events unexpectedly.\nSkip the event filtering for UMP events, instead.\n\nFixes: 46397622a3fa (\"ALSA: seq: Add UMP support\")\nCc: \u003cstable@vger.kernel.org\u003e\nLink: https://patch.msgid.link/20240819084156.10286-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2ae8d7742a09c275872e670c53337b3dcedaa11c", "tree": "ee09107cba82462b0043c5e84f30225d71d45265", "parents": [ "a06a8cc80fa203fde828a8429583f7e4fe27eca4" ], "author": { "name": "Pavel Skripkin", "email": "paskripkin@gmail.com", "time": "Thu Jun 20 19:27:47 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX\n\ncommit 1cc18c2ab2e8c54c355ea7c0423a636e415a0c23 upstream.\n\nSyzbot hit warning in hci_conn_del() caused by freeing handle that was\nnot allocated using ida allocator.\n\nThis is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by\nhci_le_big_sync_established_evt(), which makes code think it\u0027s unset\nconnection.\n\nAdd same check for handle upper bound as in hci_conn_set_handle() to\nprevent warning.\n\nLink: https://syzkaller.appspot.com/bug?extid\u003db2545b087a01a7319474\nReported-by: syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com\nFixes: 181a42edddf5 (\"Bluetooth: Make handle of hci_conn be unique\")\nSigned-off-by: Pavel Skripkin \u003cpaskripkin@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a06a8cc80fa203fde828a8429583f7e4fe27eca4", "tree": "da62d576d419509fdc7a902433473c15901907fb", "parents": [ "743b6c64884f15baa3c101f07698160a9649ac34" ], "author": { "name": "Edward Adam Davis", "email": "eadavis@qq.com", "time": "Mon Jun 17 11:09:37 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "Bluetooth: Ignore too large handle values in BIG\n\ncommit 015d79c96d62cd8a4a359fcf5be40d58088c936b upstream.\n\nhci_le_big_sync_established_evt is necessary to filter out cases where the\nhandle value is belonging to ida id range, otherwise ida will be erroneously\nreleased in hci_conn_cleanup.\n\nFixes: 181a42edddf5 (\"Bluetooth: Make handle of hci_conn be unique\")\nReported-by: syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003db2545b087a01a7319474\nSigned-off-by: Edward Adam Davis \u003ceadavis@qq.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "743b6c64884f15baa3c101f07698160a9649ac34", "tree": "b117d95fabc609c878a720c4cc1a142c3804f81e", "parents": [ "15de69c3805ce503a6a23037cd627f28340e8b13" ], "author": { "name": "Jean-Baptiste Maneyrol", "email": "jean-baptiste.maneyrol@tdk.com", "time": "Fri May 24 12:48:51 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:19 2026" }, "message": "iio: invensense: fix odr switching to same value\n\ncommit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream.\n\nODR switching happens in 2 steps, update to store the new value and then\napply when the ODR change flag is received in the data. When switching to\nthe same ODR value, the ODR change flag is never happening, and frequency\nswitching is blocked waiting for the never coming apply.\n\nFix the issue by preventing update to happen when switching to same ODR\nvalue.\n\nFixes: 0ecc363ccea7 (\"iio: make invensense timestamp module generic\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jean-Baptiste Maneyrol \u003cjean-baptiste.maneyrol@tdk.com\u003e\nLink: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com\nSigned-off-by: Jonathan Cameron \u003cJonathan.Cameron@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "15de69c3805ce503a6a23037cd627f28340e8b13", "tree": "c4095622c67a70c617a59802002f2fd3e1516d53", "parents": [ "1a2b4dcd5064f478c9b73e1b44740a9f5917bf37" ], "author": { "name": "Jean-Baptiste Maneyrol", "email": "jean-baptiste.maneyrol@tdk.com", "time": "Mon Feb 19 15:47:41 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "iio: imu: inv_mpu6050: fix frequency setting when chip is off\n\ncommit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream.\n\nTrack correctly FIFO state and apply ODR change before starting\nthe chip. Without the fix, you cannot change ODR more than 1 time\nwhen data buffering is off. This restriction on a single pending ODR\nchange should only apply when the FIFO is on.\n\nFixes: 111e1abd0045 (\"iio: imu: inv_mpu6050: use the common inv_sensors timestamp module\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jean-Baptiste Maneyrol \u003cjean-baptiste.maneyrol@tdk.com\u003e\nLink: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com\nSigned-off-by: Jonathan Cameron \u003cJonathan.Cameron@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1a2b4dcd5064f478c9b73e1b44740a9f5917bf37", "tree": "8d13e591316b9c647f0176e6906d1d4f6d9e9dc1", "parents": [ "c2a0dc9fd31edd30be60c496c1fd9e14a0911a95" ], "author": { "name": "Xuan Zhuo", "email": "xuanzhuo@linux.alibaba.com", "time": "Fri Dec 01 03:33:03 2023" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "virtio_ring: fix syncs DMA memory with different direction\n\ncommit 1f475cd572ea77ae6474a17e693a96bca927efe9 upstream.\n\nNow the APIs virtqueue_dma_sync_single_range_for_{cpu,device} ignore\nthe parameter \u0027dir\u0027, that is a mistake.\n\n[ 6.101666] ------------[ cut here ]------------\n[ 6.102079] DMA-API: virtio-pci 0000:00:04.0: device driver syncs DMA memory with different direction [device address\u003d0x00000000ae010000] [size\u003d32752 bytes] [mapped with DMA_FROM_DEVICE] [synced with DMA_BIDIRECTIONAL]\n[ 6.103630] WARNING: CPU: 6 PID: 0 at kernel/dma/debug.c:1125 check_sync+0x53e/0x6c0\n[ 6.107420] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G E 6.6.0+ #290\n[ 6.108030] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n[ 6.108936] RIP: 0010:check_sync+0x53e/0x6c0\n[ 6.109289] Code: 24 10 e8 f5 d9 74 00 4c 8b 4c 24 10 4c 8b 44 24 18 48 8b 4c 24 20 48 89 c6 41 56 4c 89 ea 48 c7 c7 b0 f1 50 82 e8 32 fc f3 ff \u003c0f\u003e 0b 48 c7 c7 48 4b 4a 82 e8 74 d9 fc ff 8b 73 4c 48 8d 7b 50 31\n[ 6.110750] RSP: 0018:ffffc90000180cd8 EFLAGS: 00010092\n[ 6.111178] RAX: 00000000000000ce RBX: ffff888100aa5900 RCX: 0000000000000000\n[ 6.111744] RDX: 0000000000000104 RSI: ffffffff824c3208 RDI: 00000000ffffffff\n[ 6.112316] RBP: ffffc90000180d40 R08: 0000000000000000 R09: 00000000fffeffff\n[ 6.112893] R10: ffffc90000180b98 R11: ffffffff82f63308 R12: ffffffff83d5af00\n[ 6.113460] R13: ffff888100998200 R14: ffffffff824a4b5f R15: 0000000000000286\n[ 6.114027] FS: 0000000000000000(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000\n[ 6.114665] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.115128] CR2: 00007f10f1e03030 CR3: 0000000108272004 CR4: 0000000000770ee0\n[ 6.115701] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 6.116272] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 6.116842] PKRU: 55555554\n[ 6.117069] Call Trace:\n[ 6.117275] \u003cIRQ\u003e\n[ 6.117452] ? __warn+0x84/0x140\n[ 6.117727] ? check_sync+0x53e/0x6c0\n[ 6.118034] ? __report_bug+0xea/0x100\n[ 6.118353] ? check_sync+0x53e/0x6c0\n[ 6.118653] ? report_bug+0x41/0xc0\n[ 6.118944] ? handle_bug+0x3c/0x70\n[ 6.119237] ? exc_invalid_op+0x18/0x70\n[ 6.119551] ? asm_exc_invalid_op+0x1a/0x20\n[ 6.119900] ? check_sync+0x53e/0x6c0\n[ 6.120199] ? check_sync+0x53e/0x6c0\n[ 6.120499] debug_dma_sync_single_for_cpu+0x5c/0x70\n[ 6.120906] ? dma_sync_single_for_cpu+0xb7/0x100\n[ 6.121291] virtnet_rq_unmap+0x158/0x170 [virtio_net]\n[ 6.121716] virtnet_receive+0x196/0x220 [virtio_net]\n[ 6.122135] virtnet_poll+0x48/0x1b0 [virtio_net]\n[ 6.122524] __napi_poll+0x29/0x1b0\n[ 6.123083] net_rx_action+0x282/0x360\n[ 6.123612] __do_softirq+0xf3/0x2fb\n[ 6.124138] __irq_exit_rcu+0x8e/0xf0\n[ 6.124663] common_interrupt+0xbc/0xe0\n[ 6.125202] \u003c/IRQ\u003e\n\nWe need to enable CONFIG_DMA_API_DEBUG and work with need sync mode(such\nas swiotlb) to reproduce this warn.\n\nFixes: 8bd2f71054bd (\"virtio_ring: introduce dma sync api for virtqueue\")\nReported-by: \"Ning, Hongyu\" \u003chongyu.ning@linux.intel.com\u003e\nCloses: https://lore.kernel.org/all/f37cb55a-6fc8-4e21-8789-46d468325eea@linux.intel.com/\nSuggested-by: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: Xuan Zhuo \u003cxuanzhuo@linux.alibaba.com\u003e\nMessage-Id: \u003c20231201033303.25141-1-xuanzhuo@linux.alibaba.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nReviewed-by: Parav Pandit \u003cparav@nvidia.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nTested-by: Hongyu Ning \u003chongyu.ning@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c2a0dc9fd31edd30be60c496c1fd9e14a0911a95", "tree": "ef30775da82ce63d8ca4bdb347e858fc42e2f797", "parents": [ "b0b9908112e15e8f94217f18585499d941622873" ], "author": { "name": "Shyam Prasad N", "email": "sprasad@microsoft.com", "time": "Tue Nov 14 04:58:23 2023" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "cifs: fix lock ordering while disabling multichannel\n\ncommit 5eef12c4e3230f2025dc46ad8c4a3bc19978e5d7 upstream.\n\nThe code to handle the case of server disabling multichannel\nwas picking iface_lock with chan_lock held. This goes against\nthe lock ordering rules, as iface_lock is a higher order lock\n(even if it isn\u0027t so obvious).\n\nThis change fixes the lock ordering by doing the following in\nthat order for each secondary channel:\n1. store iface and server pointers in local variable\n2. remove references to iface and server in channels\n3. unlock chan_lock\n4. lock iface_lock\n5. dec ref count for iface\n6. unlock iface_lock\n7. dec ref count for server\n8. lock chan_lock again\n\nSince this function can only be called in smb2_reconnect, and\nthat cannot be called by two parallel processes, we should not\nhave races due to dropping chan_lock between steps 3 and 8.\n\nFixes: ee1d21794e55 (\"cifs: handle when server stops supporting multichannel\")\nReported-by: Paulo Alcantara \u003cpc@manguebit.com\u003e\nSigned-off-by: Shyam Prasad N \u003csprasad@microsoft.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b0b9908112e15e8f94217f18585499d941622873", "tree": "3b0aaa96855ab205b0a49c0c755046fb44948928", "parents": [ "118b667516cedc0abfc32bdf70a8a3fd55bd6d95" ], "author": { "name": "Liming Wu", "email": "liming.wu@jaguarmicro.com", "time": "Sun Oct 08 03:17:33 2023" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "tools/virtio: Add dma sync api for virtio test\n\ncommit e07744b43d3ad10b040f0ec464b6323ca96903d6 upstream.\n\nFixes: 8bd2f71054bd (\"virtio_ring: introduce dma sync api for virtqueue\")\nalso add dma sync api for virtio test.\n\nSigned-off-by: Liming Wu \u003climing.wu@jaguarmicro.com\u003e\nMessage-Id: \u003c20231008031734.1095-1-liming.wu@jaguarmicro.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "118b667516cedc0abfc32bdf70a8a3fd55bd6d95", "tree": "caa6599f6a621a48dca81a3bdafcdf432bc2dc0c", "parents": [ "c73b6c5780bdfc1578e543279ef7383d1f538d1d" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Jun 05 14:47:58 2023" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "ALSA: seq: Avoid confusion of aligned read size\n\ncommit 8c15a18331191b67bdce54d21af068baec044baf upstream.\n\nCurrently the read event packet size in snd_seq_read() is defined by\nclient-\u003emidi_version value that is guaranteed to be zero if UMP isn\u0027t\nenabled. But the static analyzer doesn\u0027t know of the fact, and it\nstill suspects as if it were leading to a potential overflow.\n\nAdd the more explicit check of CONFIG_SND_SEQ_UMP to determine the\naligned_size value for avoiding the confusion.\n\nFixes: 46397622a3fa (\"ALSA: seq: Add UMP support\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCloses: https://lore.kernel.org/r/202305261415.NY0vapZK-lkp@intel.com/\nLink: https://lore.kernel.org/r/20230605144758.6677-2-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c73b6c5780bdfc1578e543279ef7383d1f538d1d", "tree": "152149a90ac10f408cccfbb03175c044e346a7fa", "parents": [ "21587f5984ce3cd618517a94bf180ed18d564826" ], "author": { "name": "Danilo Krummrich", "email": "dakr@kernel.org", "time": "Mon May 25 01:23:22 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "driver core: Guard deferred probe timeout extension with delayed_work_pending()\n\ncommit 557495bc879013c3d5e21d667e987e7ce3a514de upstream.\n\nmod_delayed_work() unconditionally queues the work even when it wasn\u0027t\npreviously pending, which can fire the timeout prematurely or restart it\nafter it already fired. Add a delayed_work_pending() guard to restore\nthe originally intended semantics.\n\nPremature firing calls fw_devlink_drivers_done() before all built-in\ndrivers have registered, causing fw_devlink to prematurely relax device\nlinks for suppliers whose drivers haven\u0027t loaded yet.\n\nFixes: 1137838865bf (\"driver core: Use mod_delayed_work to prevent lost deferred probe work\")\nTested-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nReviewed-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nLink: https://patch.msgid.link/20260525012340.3860581-2-dakr@kernel.org\nSigned-off-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "21587f5984ce3cd618517a94bf180ed18d564826", "tree": "893e66ffc9a9cb5879f361f26e1b798fba83b576", "parents": [ "4908098c9e2a098ef04c3bf5c1d372c32673ebfd" ], "author": { "name": "Danilo Krummrich", "email": "dakr@kernel.org", "time": "Mon May 25 01:23:21 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()\n\ncommit f9e6da99fe49277979798a1c3b9790ae10aaa18a upstream.\n\nmod_delayed_work() takes jiffies, not seconds. Thus, restore the dropped\nconversion.\n\nWhile at it, fix incorrect indentation.\n\nFixes: 1137838865bf (\"driver core: Use mod_delayed_work to prevent lost deferred probe work\")\nTested-by: Biju Das \u003cbiju.das.jz@bp.renesas.com\u003e\nTested-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nReviewed-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nLink: https://patch.msgid.link/20260525012340.3860581-1-dakr@kernel.org\nSigned-off-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4908098c9e2a098ef04c3bf5c1d372c32673ebfd", "tree": "d803e3c105e69c6b821c943629c872fb8499c4f8", "parents": [ "9e107c549965dc484886cbb8f2b87995302fc420" ], "author": { "name": "Easwar Hariharan", "email": "eahariha@linux.microsoft.com", "time": "Thu Jan 30 19:26:58 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "jiffies: Cast to unsigned long in secs_to_jiffies() conversion\n\ncommit bb2784d9ab49587ba4fbff37a319fff2924db289 upstream.\n\nWhile converting users of msecs_to_jiffies(), lkp reported that some range\nchecks would always be true because of the mismatch between the implied int\nvalue of secs_to_jiffies() vs the unsigned long return value of the\nmsecs_to_jiffies() calls it was replacing.\n\nFix this by casting the secs_to_jiffies() input value to unsigned long.\n\nFixes: b35108a51cf7ba (\"jiffies: Define secs_to_jiffies()\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nSigned-off-by: Easwar Hariharan \u003ceahariha@linux.microsoft.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/all/20250130192701.99626-1-eahariha@linux.microsoft.com\nCloses: https://lore.kernel.org/oe-kbuild-all/202501301334.NB6NszQR-lkp@intel.com/\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9e107c549965dc484886cbb8f2b87995302fc420", "tree": "70fd777827375bf26a19fe8c818b7977c95ccb47", "parents": [ "b360aa7208f03734b72b065afae23579460cf096" ], "author": { "name": "Easwar Hariharan", "email": "eahariha@linux.microsoft.com", "time": "Wed Oct 30 17:47:35 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "jiffies: Define secs_to_jiffies()\n\ncommit b35108a51cf7bab58d7eace1267d7965978bcdb8 upstream.\n\nsecs_to_jiffies() is defined in hci_event.c and cannot be reused by\nother call sites. Hoist it into the core code to allow conversion of the\n~1150 usages of msecs_to_jiffies() that either:\n\n - use a multiplier value of 1000 or equivalently MSEC_PER_SEC, or\n - have timeouts that are denominated in seconds (i.e. end in 000)\n\nIt\u0027s implemented as a macro to allow usage in static initializers.\n\nThis will also allow conversion of yet more sites that use (sec * HZ)\ndirectly, and improve their readability.\n\nSuggested-by: Michael Kelley \u003cmhklinux@outlook.com\u003e\nSigned-off-by: Easwar Hariharan \u003ceahariha@linux.microsoft.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nLink: https://lore.kernel.org/all/20241030-open-coded-timeouts-v3-1-9ba123facf88@linux.microsoft.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b360aa7208f03734b72b065afae23579460cf096", "tree": "8fbc311248fafd7171c4a37b202983181fc544f1", "parents": [ "382cf81cae89e58d22b4bdc38891cd4d0b9ba921" ], "author": { "name": "Baokun Li", "email": "libaokun@linux.alibaba.com", "time": "Thu May 21 09:50:15 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()\n\ncommit e90a6d668e26e00a72df2d09c173b563468f09c9 upstream.\n\nCommit e1b849cfa6b6 (\"writeback: Avoid contention on wb-\u003elist_lock when\nswitching inodes\") replaced the queue_rcu_work() based scheduling of\ninode wb switches with a plain queue_work(). Since then no switcher\ngoes through call_rcu(), so rcu_barrier() in cgroup_writeback_umount()\nhas no callbacks of its own to wait for. It still drains unrelated\ncall_rcu() callbacks from other subsystems on busy systems, which\nincidentally slows umount down; drop it.\n\nFixes: e1b849cfa6b6 (\"writeback: Avoid contention on wb-\u003elist_lock when switching inodes\")\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Baokun Li \u003clibaokun@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260521095016.2791354-3-libaokun@linux.alibaba.com\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "382cf81cae89e58d22b4bdc38891cd4d0b9ba921", "tree": "478ba93b307cf10068f3699d789515586dd018d4", "parents": [ "b8a32a5fc915b024c60f18d51b6cffd2bd64d4a6" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Apr 13 09:36:19 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "writeback: Fix use after free in inode_switch_wbs_work_fn()\n\ncommit 6689f01d6740cf358932b3e97ee968c6099800d9 upstream.\n\ninode_switch_wbs_work_fn() has a loop like:\n\n wb_get(new_wb);\n while (1) {\n list \u003d llist_del_all(\u0026new_wb-\u003eswitch_wbs_ctxs);\n /* Nothing to do? */\n if (!list)\n break;\n ... process the items ...\n }\n\nNow adding of items to the list looks like:\n\nwb_queue_isw()\n if (llist_add(\u0026isw-\u003elist, \u0026wb-\u003eswitch_wbs_ctxs))\n queue_work(isw_wq, \u0026wb-\u003eswitch_work);\n\nBecause inode_switch_wbs_work_fn() loops when processing isw items, it\ncan happen that wb-\u003eswitch_work is pending while wb-\u003eswitch_wbs_ctxs is\nempty. This is a problem because in that case wb can get freed (no isw\nitems -\u003e no wb reference) while the work is still pending causing\nuse-after-free issues.\n\nWe cannot just fix this by cancelling work when freeing wb because that\ncould still trigger problematic 0 -\u003e 1 transitions on wb refcount due to\nwb_get() in inode_switch_wbs_work_fn(). It could be all handled with\nmore careful code but that seems unnecessarily complex so let\u0027s avoid\nthat until it is proven that the looping actually brings practical\nbenefit. Just remove the loop from inode_switch_wbs_work_fn() instead.\nThat way when wb_queue_isw() queues work, we are guaranteed we have\nadded the first item to wb-\u003eswitch_wbs_ctxs and nobody is going to\nremove it (and drop the wb reference it holds) until the queued work\nruns.\n\nFixes: e1b849cfa6b6 (\"writeback: Avoid contention on wb-\u003elist_lock when switching inodes\")\nCC: stable@vger.kernel.org\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260413093618.17244-2-jack@suse.cz\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b8a32a5fc915b024c60f18d51b6cffd2bd64d4a6", "tree": "cdb619b836c22712e688438714753a139342b49c", "parents": [ "6f78474c05f612ccc929903517f55847c05704f4" ], "author": { "name": "Stig Hornang", "email": "stig@hornang.me", "time": "Fri Jun 12 14:38:18 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "Bluetooth: L2CAP: fix tx ident leak for commands without a response\n\ncommit 6e1930ece855a4c256f1c7e6632d634cfb9888b5 upstream.\n\nCommit 6c3ea155e5ee (\"Bluetooth: L2CAP: Fix not tracking outstanding\nTX ident\") changed ident allocation to use an IDA, releasing idents in\nl2cap_put_ident() when the matching response command is received.\n\nBut identifiers allocated for commands that have no response defined\nare never released. In particular L2CAP_LE_CREDITS is sent repeatedly for\nthe lifetime of an LE CoC channel, so a peer streaming data to the\nhost exhausts the 1-255 ident range after 254 credit packets. From\nthen on l2cap_get_ident() fails:\n\n kernel: Bluetooth: Unable to allocate ident: -28\n\nand every subsequent L2CAP_LE_CREDITS packet is sent with ident 0,\nwhich is invalid (Core Spec, Vol 3, Part A, Section 4: \"Signaling\nidentifier 0x00 is an invalid identifier and shall never be used in\nany command\"). Remote stacks that validate the ident drop these\ncommands, never receive new credits, and the channel stalls\npermanently. With default socket buffers this happens after roughly 0.5 MB\nof received data (the exact amount depends on the socket receive buffer):\n\n \u003c ACL Data TX: Handle 2048 flags 0x00 dlen 12\n LE L2CAP: LE Flow Control Credit (0x16) ident 0 len 4\n Source CID: 64\n Credits: 1\n\nRelease the ident immediately after sending L2CAP_LE_CREDITS since no\nresponse will ever release it. Use a local variable instead of\nchan-\u003eident so that an ident that an EXT_FLOWCTL channel may be waiting on\n(e.g. a pending reconfigure) is not overwritten by a credit packet.\n\nAlso add the missing L2CAP_LE_CONN_RSP case to l2cap_put_ident() so\nidents allocated for outgoing L2CAP_LE_CONN_REQ commands are released\nwhen the response arrives.\n\nFixes: 6c3ea155e5ee (\"Bluetooth: L2CAP: Fix not tracking outstanding TX ident\")\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221629\nAssisted-by: Claude:claude-opus-4.8\nAssisted-by: Fable:5\nSigned-off-by: Stig Hornang \u003cstig@hornang.me\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6f78474c05f612ccc929903517f55847c05704f4", "tree": "b973bfeffea29b3e95d2bf0e3239a1c56ea0d007", "parents": [ "5673c251f35c041eec0181437f992178dd29df87" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Tue Mar 17 15:54:01 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "Bluetooth: L2CAP: Fix regressions caused by reusing ident\n\ncommit 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 upstream.\n\nThis attempt to fix regressions caused by reusing ident which apparently\nis not handled well on certain stacks causing the stack to not respond to\nrequests, so instead of simple returning the first unallocated id this\nstores the last used tx_ident and then attempt to use the next until all\navailable ids are exausted and then cycle starting over to 1.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221120\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221177\nFixes: 6c3ea155e5ee (\"Bluetooth: L2CAP: Fix not tracking outstanding TX ident\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nTested-by: Christian Eggers \u003cceggers@arri.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5673c251f35c041eec0181437f992178dd29df87", "tree": "a4abddf1d86f677ba37a783e04adfbba4d951c99", "parents": [ "cfe107b02a3c3f049e0dc15b6a36625f048eda2a" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@infradead.org", "time": "Fri Jan 23 18:37:49 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "seqlock: fix scoped_seqlock_read kernel-doc\n\ncommit f88a31308db6a856229150039b0f56d59696ed31 upstream.\n\nEliminate all kernel-doc warnings in seqlock.h:\n\n- correct the macro to have \"()\" immediately following the macro name\n- don\u0027t include the macro parameters in the short description (first line)\n- make the parameter names in the comments match the actual macro\n parameter names.\n- use \"::\" for the Example\n\nWARNING: include/linux/seqlock.h:1341 This comment starts with \u0027/**\u0027, but isn\u0027t a kernel-doc comment.\n * scoped_seqlock_read (lock, ss_state) - execute the read side critical\nDocumentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING:\n Definition list ends without a blank line; unexpected unindent. [docutils]\nWarning: include/linux/seqlock.h:1357 function parameter \u0027_seqlock\u0027 not described in \u0027scoped_seqlock_read\u0027\nWarning: include/linux/seqlock.h:1357 function parameter \u0027_target\u0027 not described in \u0027scoped_seqlock_read\u0027\n\nFixes: cc39f3872c08 (\"seqlock: Introduce scoped_seqlock_read()\")\nSigned-off-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cfe107b02a3c3f049e0dc15b6a36625f048eda2a", "tree": "a6a2bb7a7825959fdf354043ecabd7ead89378d4", "parents": [ "0710cc97962ca3bcabaa15ce7fead300faf726cd" ], "author": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Sat Jun 27 10:51:05 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers\n\ncommit 3a07249981629ace483ebbef81ef6b34c2d2afec upstream.\n\nkvm_io_bus_get_dev() returns a device that is only matched by the\naddress, and nothing else. This can cause a lifetime issue if\nthe matched device is not the expected type, as by the time\nthe caller can introspect the object, it might be gone (the srcu\nlock having been dropped).\n\nGiven that there is only a single user of this helper, the simplest\noption is to move the locking responsibility to the caller, which\ncan keep the srcu lock held for as long as it wants.\n\nNote that this aligns with other kvm_io_bus*() helpers, which\nalready require the srcu lock to be held by the callers.\n\nReported-by: Will Deacon \u003cwill@kernel.org\u003e\nFixes: 8a39d00670f07 (\"KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call\")\nLink: https://lore.kernel.org/all/20260626111344.802555-1-maz@kernel.org\nCc: stable@vger.kernel.org\nReviewed-by: Oliver Upton \u003coupton@kernel.org\u003e\nLink: https://patch.msgid.link/20260627105105.1005990-1-maz@kernel.org\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0710cc97962ca3bcabaa15ce7fead300faf726cd", "tree": "23cb671f1be1f1768f65d6a7861c97def7da5ade", "parents": [ "af552054a06480f896aee5b49091c15bb9f1a113" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Thu Jun 18 00:56:47 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:18 2026" }, "message": "mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()\n\ncommit d58fdbe37a829fd2e5803dd4e5a72992dd8c5368 upstream.\n\nPatch series \"mm/damon/sysfs-schemes: fix wrong directories put orders in\nerror paths\".\n\nError paths of damon_sysfs_access_pattern_add_dirs() and\ndamon_sysfs_scheme_add_dirs() functions put references to directories in\nwrong orders. As a result, uninitialized memory dereference and/or\nmemory leak can happen. Fix those.\n\n\nThis patch (of 2):\n\nIn access_pattern_add_dirs(), error handling path puts references starting\nfrom setup failed directories. If the failure happpened from the initial\nallication in the setup functions, uninitialized memory dereference\nhappen. The allocation failures will not commonly happen, but the\nconsequence is quite bad. Fix the wrong reference put orders.\n\nThe issue was discovered [1] by Sashiko.\n\nLink: https://lore.kernel.org/20260618005650.83868-2-sj@kernel.org\nLink: https://lore.kernel.org/20260617060005.86852-1-sj@kernel.org [1]\nFixes: 7e84b1f8212a (\"mm/damon/sysfs: support DAMON-based Operation Schemes\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 5.18.x\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "af552054a06480f896aee5b49091c15bb9f1a113", "tree": "0a155d92c1309bd4bfd4bb84884332c8cd642fda", "parents": [ "10b1abc1d0c8ae25c2b9ac465515717c68ffff05" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Tue Apr 28 04:29:40 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:17 2026" }, "message": "mm/damon/core: make charge_addr_from aware of end-address exclusivity\n\ncommit 5a2d162e22bf33eb89d53e802d0fc1ec422e19b6 upstream.\n\nDAMON region end address is exclusive one, but charge_addr_from is\nassigned assuming the end address is inclusive. As a result, DAMOS action\nto next up to min_region_sz memory can be skipped. This is quite\nnegligible user impact. But, the bug is a bug that can be very simply\nfixed. Fix the wrong assignment to respect the exclusiveness of the\naddress.\n\nThe issue was discovered [1] by Sashiko.\n\nLink: https://lore.kernel.org/20260428042942.118230-1-sj@kernel.org\nLink: https://lore.kernel.org/20260428032324.115663-1-sj@kernel.org [1]\nFixes: 50585192bc2e (\"mm/damon/schemes: skip already charged targets and regions\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 5.16.x\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "10b1abc1d0c8ae25c2b9ac465515717c68ffff05", "tree": "a84a7e8a89c9905a44fce88576bed10e2ba668eb", "parents": [ "22c739df6534cedadd526f52f27f6b0f028585e2" ], "author": { "name": "Qu Wenruo", "email": "wqu@suse.com", "time": "Mon Jul 20 20:19:07 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:17 2026" }, "message": "btrfs: fix incorrect buffered IO fallback for append direct writes\n\n[ Upstream commit ff66fe6662330226b3f486014c375538d91c44aa ]\n\n[BUG]\nWith the previous bug of short direct writes fixed, test case\ngeneric/362 (*) still fails with the following error with nodatasum\nmount option:\n\n# generic/362 0s ... - output mismatch (see /home/adam/xfstests/results//generic/362.out.bad)\n# - output mismatch (see /home/adam/xfstests/results//generic/362.out.bad)\n# --- tests/generic/362.out\t2024-08-24 15:31:37.200000000 +0930\n# +++ /home/adam/xfstests/results//generic/362.out.bad\t2026-05-27 10:13:09.072485767 +0930\n# @@ -1,2 +1,3 @@\n# QA output created by 362\n# +Wrong file size after first write, got 8192 expected 4096\n# Silence is golden\n# ...\n\n*: If the test case has been executed before with default data checksum,\nthe failure will not reproduce. Need the following fix to make it\nreliably reproducible:\nhttps://lore.kernel.org/linux-btrfs/20260528111659.87113-1-wqu@suse.com/\n\n[CAUSE]\nInside btrfs_dio_iomap_begin() for a direct write, we increase the isize\nif it\u0027s beyond the current isize.\n\nBut if the direct io finished short, we do not revert the isize to the\nprevious value nor to the short write end.\n\nThen if we need to fall back to buffered writes, and the write has\nIOCB_APPEND flag, then the buffered write will be positioned at the\nincorrect isize.\n\nThe call chain looks like this:\n\n btrfs_direct_write(pos\u003d0, length\u003d4K)\n |- __iomap_dio_rw()\n | |- iomap_iter()\n | | |- btrfs_dio_iomap_begin()\n | | |- btrfs_get_blocks_direct_write()\n | | |- i_size_write()\n | | Which updates the isize to the write end (4K).\n | |\n | |- iomap_dio_iter()\n | | Failed with -EFAULT on the first page.\n | |\n | |- iomap_iter()\n | | |- btrfs_dio_iomap_end()\n | | Detects a short write, return -ENOTBLK\n | |- if (ret \u003d\u003d -ENOTBLK) { ret \u003d 0;}\n | Which resets the return value.\n |\n |- ret \u003d iomap_dio_complet()\n | Which returns 0.\n |\n |- btrfs_buffered_write(iocb, from);\n |- generic_write_checks()\n |- iocb-\u003eki_pos \u003d i_size_read()\n Which is still the new size (4K), other than the original\n\t isize 0.\n\n[FIX]\nIntroduce the following btrfs_dio_data members:\n\n- old_isize\n\n- updated_isize\n If the direct write has enlarged the isize.\n\nThen if we got a short write, and btrfs_dio_data::updated_isize is set,\nrevert to the correct isize based on old_isize and current file\nposition.\n\nAnd here we call i_size_write() without holding an extent lock, which is\na very special case that we\u0027re safe to do:\n\n - Only a single writer can be enlarging isize\n Enlarging isize will take the exclusive inode lock.\n\n - Buffered readers need to wait for the OE we\u0027re holding\n Buffered readers will lock extent and wait for OE of the folio range.\n Sometimes we can skip the OE wait, but since all page cache is\n invalidated, the OE wait can not be skipped.\n\nBut I do not think this is the most elegant solution, nor covers all\ncases. E.g. if the bio is submitted but IO failed, we are unable to do\nthe revert.\n\nI believe the more elegant one would be extend the EXTENT_DIO_LOCKED\nlifespan for direct writes, so that we can update the isize when a\nwrite beyond EOF finished successfully.\n\nHowever that change is too huge for a small bug fix.\nSo only implement the minimal partial fix for now.\n\n[REASON FOR NO FIXES TAG]\nThe bug is again very old, before commit f85781fb505e (\"btrfs: switch to\niomap for direct IO\") we are already increasing isize without a\nproper rollback for short writes.\n\nThus only a CC to stable.\n\nCC: stable@vger.kernel.org # 5.15+\nReviewed-by: Boris Burkov \u003cboris@bur.io\u003e\nSigned-off-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "22c739df6534cedadd526f52f27f6b0f028585e2", "tree": "a483646fe11e6cab615a3084d4da47d1c4216c1f", "parents": [ "637c11e3d8d43a7ee654591cda8d17c55a9234fa" ], "author": { "name": "Qu Wenruo", "email": "wqu@suse.com", "time": "Mon Jul 20 18:08:52 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:17 2026" }, "message": "btrfs: fix false IO failure after falling back to buffered write\n\n[ Upstream commit 66ff4d366e7eb4d31813d2acabf3af512ce03aa5 ]\n\n[BUG]\nThe test case generic/362 will fail with \"nodatasum\" mount option (*):\n\n MOUNT_OPTIONS -- -o nodatasum /dev/mapper/test-scratch1 /mnt/scratch\n\n# generic/362 0s ... - output mismatch (see /home/adam/xfstests/results//generic/362.out.bad)\n# --- tests/generic/362.out\t2024-08-24 15:31:37.200000000 +0930\n# +++ /home/adam/xfstests/results//generic/362.out.bad\t2026-05-27 10:21:17.574771567 +0930\n# @@ -1,2 +1,3 @@\n# QA output created by 362\n# +First write failed: Input/output error\n# Silence is golden\n# ...\n\n*: If the test case has been executed before with default data checksum,\nthe failure will not reproduce. Need the following fix to make it\nreliably reproducible:\nhttps://lore.kernel.org/linux-btrfs/20260528111659.87113-1-wqu@suse.com/\n\n[CAUSE]\nInside __iomap_dio_rw(), the -EFAULT/-ENOTBLK error is not directly returned.\nThus we never got an error pointer from __iomap_dio_rw().\n\nThe call chain looks like this:\n\n btrfs_direct_write()\n |- btrfs_dio_write()\n |- __iomap_dio_rw()\n | |- iomap_iter()\n | | |- btrfs_dio_iomap_begin()\n | | Now an ordered extent is allocated for the 4K write.\n | |\n | |- iomi.status \u003d iomap_dio_iter()\n | | Where iomap_dio_iter() returned -EFAULT.\n | |\n | |- ret \u003d iomap_iter()\n | | |- btrfs_dio_iomap_end()\n | | | |- btrfs_finish_ordered_extent(uptodate \u003d false)\n | | | | |- can_finish_ordered_extent()\n | | | | |- btrfs_mark_ordered_extent_error()\n | | | | |- mapping_set_error()\n | | | | Now the address space is marked error.\n | | | | return -ENOTBLK\n | | |- return -ENOTBLK\n | |- if (ret \u003d\u003d -ENOTBLK) { ret \u003d 0; }\n | Now the return value is reset to 0.\n | Thus no error pointer will be returned.\n |\n |- ret \u003d iomap_dio_complete()\n | Since no byte is submitted, @ret is 0.\n |\n |- Fallback to buffered IO\n | And the buffered write finished without error\n |\n |- filemap_fdatawait_range()\n |- filemap_check_errors()\n The previous error is recorded, thus an error is returned\n\nHowever the buffered write is properly submitted and finished, the error\nis from the btrfs_finish_ordered_extent() call with @uptodate \u003d false.\n\n[FIX]\nWhen a short dio write happened, any range that is submitted will have\nbtrfs_extract_ordered_extent() to be called, thus the submitted range\nwill always have an OE just covering the submitted range.\n\nThe remaining OE range is never submitted, thus they should be treated\nas truncated, not an error. So that we can properly reclaim and not\ninsert an unnecessary file extent item, without marking the mapping as\nerror.\n\nExtract a helper, btrfs_mark_ordered_extent_truncated(), and utilize\nthat helper to mark the direct IO ordered extent as truncated, so it\nwon\u0027t cause failure for the later buffered fallback.\n\n[REASON FOR NO FIXES TAG]\nThe bug itself is pretty old, at commit f85781fb505e (\"btrfs: switch to\niomap for direct IO\") we\u0027re already passing @uptodate\u003dfalse finishing\nthe OE.\nBut at that time OE with IOERR won\u0027t call mapping_set_error(), so it\u0027s\nnot exposed.\nLater commit d61bec08b904 (\"btrfs: mark ordered extent and inode with\nerror if we fail to finish\") finally exposed the bug, but that commit\nis doing a correct job, not the root cause.\n\nAnyway the bug is very old, dating back to 5.1x days, thus only CC to\nstable.\n\nCC: stable@vger.kernel.org # 5.15+\nReviewed-by: Boris Burkov \u003cboris@bur.io\u003e\nSigned-off-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "637c11e3d8d43a7ee654591cda8d17c55a9234fa", "tree": "b2f4884133ec12381d2db957c1d1d65969d99811", "parents": [ "00e76eb6418b5f6a3327522ff2b533e421dc9515" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Tue Jul 21 01:28:14 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:17 2026" }, "message": "regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()\n\n[ Upstream commit fa11039d6cdff84584a3ef8cc1f5e1b56e045da2 ]\n\nscmi_regulator_probe() calls of_find_node_by_name() which takes a\nreference on the returned device node. On the error path where\nprocess_scmi_regulator_of_node() fails, the function returns without\ncalling of_node_put() on the child node, leaking the reference.\n\nAdd of_node_put(np) on the error path to properly release the\nreference.\n\nCc: stable@vger.kernel.org\nFixes: 0fbeae70ee7c (\"regulator: add SCMI driver\")\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260527104850.872415-1-vulab@iscas.ac.cn\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "00e76eb6418b5f6a3327522ff2b533e421dc9515", "tree": "b487f0626ea49280e74494b6b00ef6b9a5dc40b5", "parents": [ "e82735d5d35b8a968751f5a621d9c76d07a58a4c" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@linaro.org", "time": "Tue Jul 21 01:28:13 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:17 2026" }, "message": "regulator: scmi: Simplify with scoped for each OF child loop\n\n[ Upstream commit 99cf5db9cdd39136fd5dbd10bda833aa0f870452 ]\n\nUse scoped for_each_available_child_of_node_scoped() when iterating over\ndevice nodes to make code a bit simpler.\n\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@linaro.org\u003e\nLink: https://patch.msgid.link/20240814-cleanup-h-of-node-put-regulator-v1-7-87151088b883@linaro.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nStable-dep-of: fa11039d6cdf (\"regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e82735d5d35b8a968751f5a621d9c76d07a58a4c", "tree": "453f8d4b27d206e5fd7e0a969ca0a3d16d250eb7", "parents": [ "71da3b660b836304c0064d4410b50a4d37ec9bb0" ], "author": { "name": "Ricardo Robaina", "email": "rrobaina@redhat.com", "time": "Tue Jul 21 01:27:51 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:17 2026" }, "message": "audit: fix potential integer overflow in audit_log_n_hex()\n\n[ Upstream commit 65dfde57d1e29ce2b76fc23dd565eccd5c0bc0f0 ]\n\nThe function calculates new_len as len \u003c\u003c 1 for hex encoding. This\nhas two overflow risks: the shift itself can overflow when len is\nlarge, and the result can be truncated when assigned to new_len\n(declared as int) from the size_t calculation.\n\nFix by using check_shl_overflow() to catch shift overflow and\nchanging new_len and loop counter i to size_t to prevent truncation.\n\nCc: stable@vger.kernel.org\nFixes: 168b7173959f (\"AUDIT: Clean up logging of untrusted strings\")\nReviewed-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Ricardo Robaina \u003crrobaina@redhat.com\u003e\n[PM: remove vertical whitspace noise]\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "71da3b660b836304c0064d4410b50a4d37ec9bb0", "tree": "a507881077950ee021f8d66dc126e701364376a3", "parents": [ "1002719d13072a5e4be1e993aa61dffb4a604e82" ], "author": { "name": "Ricardo Robaina", "email": "rrobaina@redhat.com", "time": "Tue Jul 21 01:27:50 2026" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 24 13:55:17 2026" }, "message": "audit: add audit_log_nf_skb helper function\n\n[ Upstream commit f19590b07cb620be1fcd5474c49515e21a05d406 ]\n\nNetfilter code (net/netfilter/nft_log.c and net/netfilter/xt_AUDIT.c)\nhave to be kept in sync. Both source files had duplicated versions of\naudit_ip4() and audit_ip6() functions, which can result in lack of\nconsistency and/or duplicated work.\n\nThis patch adds a helper function in audit.c that can be called by\nnetfilter code commonly, aiming to improve maintainability and\nconsistency.\n\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nSuggested-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nSigned-off-by: Ricardo Robaina \u003crrobaina@redhat.com\u003e\nAcked-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nStable-dep-of: 65dfde57d1e2 (\"audit: fix potential integer overflow in audit_log_n_hex()\")\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" } ], "next": "1002719d13072a5e4be1e993aa61dffb4a604e82" }