Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Fix SDEI (software delegated exception interface) handlers taking
nested exceptions (looping on the KPTI trampoline vectors and
clobbering the interrupted context's exception registers), TPIDR2_EL0
preservation across CPU suspend, a kexec_file_load() memory leak and
an overflow in the /dev/mem valid_mmap_phys_addr_range() check:
- Fix nested exceptions taken by SDEI event handlers.
With KPTI, an event interrupting user space left the trampoline
vectors installed and any exception in the handler looped forever.
Also save and restore ELR/SPSR/ESR/FAR around the handler since an
event can interrupt exception entry or return where these registers
are live
- Save and restore TPIDR2_EL0 across CPU suspend.
[15 lines not shown]
Merge tag 'printk-for-7.4-fixups' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk fixes from Petr Mladek:
- Prevent possible use-after-free when printk kthreads
could not be created
- Fix computation of the free space when allocating a
bigger ring buffer
- Add info about the new printk mailing list for
printk-related subsystems
* tag 'printk-for-7.4-fixups' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
printk: Avoid multiple unregistration in unregister_console_locked()
MAINTAINERS: Add new "printk" mailing list for PRINTK, PRINTK INDEXING, and VSPRINTF
printk_ringbuffer: Fix space_used() when blk_lpos->next overflows
Merge tag 'iommu-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu fixes from Joerg Roedel:
"AMD IOMMU:
- Move PerfOpt management into the IOMMU domain attachment paths,
enabling it automatically for supported integrated GPUs in identity
mode and clearing it before switching to translated or blocked
domains
- Fix a boot panic in the GPU identity-mapping quirk when a GPU has
no upstream PCI bridge
- Clear the IOMMU SNP enable flag when RMP table initialization
fails, preventing subsequent initialization from assuming SNP setup
succeeded
- Check IVRS subtable types before parsing memory definitions,
avoiding bogus PCI segments caused by misinterpreting IVHD entries
[11 lines not shown]
Merge tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed
connect, and the nvme-rdma counterpart of the NULL queue->ctrl on
reconnect
- nvmet-rdma iWARP disconnect and device removal fixes
- nvmet-tcp: ask for the TLS record type on every receive, and bound
the connections accepted per work run so a connect flood can't
hold up port removal; nvmet-auth keep the old keys if the new ones
fail to decode; nvme-loop delete the controller if a reset fails
- nvmet-auth reject incomplete DHCHAP messages, and a keep-alive
timeout overflow
- nvmet locking and bounds fixes for tbkas reconnects and the
traddr/trsvcid configfs writes, don't leak stale memory in the ANA
log page, and cache the passthru reference across queue_response
- Wait for SRCU readers before splicing the namespace list, with a
[56 lines not shown]
Merge tag 'io_uring-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Only wait for in-flight requests on ring release if the closing task
actually uses the ring.
- SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,
as memory.high reclaim and blkcg throttling otherwise only ran at
thread exit, and don't set the stop bit on thread exit, which tripped
a WARN_ON_ONCE() in the ring teardown.
- Don't poll a writer for a read side hangup or for urgent data, as a
half-closed peer or unread OOB data kept the async poll of a send
ready on every re-arm.
- Cancel all matching poll requests in one pass for CANCEL_ALL rather
than restarting the hash walk per request.
[22 lines not shown]
arm64: sdei: Preserve the interrupted context's exception registers
An SDEI event is dispatched by firmware regardless of PSTATE.DAIF, so it
can interrupt the kernel where the exception registers are live:
- exception entry, before kernel_entry has saved ELR_EL1/SPSR_EL1 and
before the C handler has read ESR_EL1/FAR_EL1;
- exception return, after kernel_exit has loaded ELR_EL1/SPSR_EL1 and
before the ERET.
An IRQ or pseudo-NMI cannot arrive there with PSTATE.I set. Firmware
saves only x0-x17, PC and PSTATE around an SDEI event, so a synchronous
exception taken by the handler overwrites the interrupted context's
ELR, SPSR, ESR and FAR. do_sdei_event() only notices that ELR changed,
and warns.
The interrupted context then carries on with the handler's state. A
task interrupted on its way into the kernel can be sent SIGILL for the
handler's kernel data abort. A task interrupted on its way back to user
[24 lines not shown]
arm64: sdei: Run the event handler on the kernel vectors
With KPTI, VBAR_EL1 holds the trampoline vectors from the return to EL0
until the next exception from EL0 maps the kernel and installs the
kernel vectors. The trampoline vectors only handle exceptions from EL0;
their current-EL half is zero-filled.
An SDEI event is dispatched regardless of PSTATE.DAIF, so it lands there
whenever the CPU is in user space. The SDEI entry trampoline maps the
kernel but leaves VBAR_EL1 alone. An exception taken by the handler then
executes the zeros, takes an undefined instruction exception to the same
vector, and loops there forever. The event never completes and the CPU
is lost; RCU stall reports are the first sign of it.
RAS notifications land in user space whenever a task consumes the
error, and NMI backtraces land wherever the CPU happens to be. The GHES
handler takes no exception on its own, but any exception in the handler
path does it: a WARN, a kprobe hit, or a fault fixed up by a _nofault()
accessor.
[18 lines not shown]
Merge tag 'configfs-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux
Pull configfs fix from Breno Leitao:
- Fix the build of the configfs selftest on 32-bit architectures,
broken since the test was added in the v7.4 merge window.
The harness casts the ASSERT_NE() operands to intmax_t, so handing it
the pointer returned by mkdtemp() triggers gcc's pointer-to-int-cast
warning on 32-bit, and the test builds with -Werror.
KernelCI's 32-bit arm kselftest builds hit this.
* tag 'configfs-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
selftests/configfs: fix the build on 32-bit architectures
Merge tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull udf, ext2, isofs and quota fixes from Jan Kara:
- Some disk format validation improvements for udf
- Fix isofs handling of dates before 1900
- Fix ext2 inadvertedly syncing buffer on every directory modification
- Fix ext2 O_DSYNC handling for direct IO
- A couple of smaller ext2 fixes
- Fix tmpfs quotas for root filesystem
- Unify my email addresses in MAINTAINERS file
* tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
udf: Fix incorrect error code in udf_current_aext()
udf: Simplify udf_table_prealloc_blocks()
udf: don't use eloc after the end of the unallocated space table
udf: fix preallocation discarding before an empty allocation extent
udf: check the unallocated space table when it is loaded
udf: don't let the extent type hide an exhausted free-space table extent
ext2: preserve IOMAP_F_DIRTY for extending direct writes
[9 lines not shown]
Merge tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull fsnotify fixes from Jan Kara:
"Two small fixes for fsnotify"
* tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
inotify: do not coalesce rename events
fsnotify: preserve 64-bit pre-content ranges
Merge tag 'xfs-fixes-7.4-rc2' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux
Pull xfs fixes from Carlos Maiolino:
"The most notable fix here IMO is for xfs's pNFS support (mostly
related to LAYOUTCOMMIT) and for that it contains several patches.
Besides that, this contains bug fixes for different subsystems in xfs.
The last patch is mostly a refactor than a bug fix, but the refactor
is done to prevent a nasty journal transaction state corruption to
happen"
* tag 'xfs-fixes-7.4-rc2' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux:
xfs: kill xfs_trans_set/clear_context() helpers
xfs: fix recovery of partial attr removals
xfs: make pNFS LAYOUTCOMMIT stable the way fdatasync does
xfs: add datasync and log_flushed arguments to xfs_log_force_inode()
xfs: take the invalidate lock while mapping a pNFS layout
xfs: clamp the pNFS layout range to the maximum file size
xfs: cap the block count of xfs_iomap_write_direct() at one extent
[12 lines not shown]
Merge tag 'ovl-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fix a self deadlock of a fanotify permission event listener that also
watches the layers, when it reads an overlay directory
- Three casefold fixes, found by Chris Mason's AI review
- Fix a decode of a modified file handle with nfs_export=on, which
could read the stale lower data of a copied up file, also found by
Chris Mason's AI review
- Fix an overlay selftest after an errno change
* tag 'ovl-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
selftests/fscontext_ns: expect EINVAL for overlay descendant userns create
ovl: look up the index by the decoded origin
ovl: inherit FMODE_NONOTIFY when reading directory layers
[4 lines not shown]
arm64: kexec_file: Fix elf_headers memory leak in retry loop
A retry allocates new elf headers and overwrites image->elf_headers,
leaking the previous buffer.
Free it before assigning.
Cc: Will Deacon <will at kernel.org>
Cc: Thomas Huth <thuth at redhat.com>
Cc: Breno Leitao <leitao at debian.org>
Cc: Andrew Morton <akpm at linux-foundation.org>
Cc: Yeoreum Yun <yeoreum.yun at arm.com>
Cc: Baoquan He <bhe at redhat.com>
Cc: stable at vger.kernel.org
Fixes: 108aa503657e ("arm64: kexec_file: try more regions if loading segments fails")
Acked-by: Catalin Marinas <catalin.marinas at arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie at huawei.com>
[catalin.marinas at arm.com: drop the redundant NULL check before vfree()]
Signed-off-by: Catalin Marinas <catalin.marinas at arm.com>
Merge tag 'xsa526-xsa528-7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"Fix three UAF issues that can be hit in the Xen netback and blkback
drivers when a guest is forcing a teardown of a PV device"
* tag 'xsa526-xsa528-7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen-blkback: Avoid UAF when reading I/O statistics
xen-netback: defer xenvif_mcast_addr_list_free()
xen-netback: Fix UAF when reading statistics data
xen-blkback: Avoid UAF when reading I/O statistics
Reading I/O statistics via sysfs concurrently with tearing down a
frontend device might result in UAF or a NULL dereference, as the
reading of the statistics data is not synchronized with freeing the
data.
Use a rwlock for synchronizing.
This is XSA-528 / CVE-2026-100082
Fixes: db6fbc106786 ("xen/blkback: make st_ statistics per ring")
Reported-by: Yehyeong Lee <yhlee at isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross at suse.com>
Acked-by: Roger Pau Monné <roger at xenproject.org>
xen-netback: defer xenvif_mcast_addr_list_free()
In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).
Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().
This is XSA-527 / CVE-2026-100081.
Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect")
Reported-by: kerhunt <kerhunt at proton.me>
Signed-off-by: Jan Beulich <jbeulich at suse.com>
Reviewed-by: Juergen Gross <jgross at suse.com>
xen-netback: Fix UAF when reading statistics data
The network statistic data in the driver is protected by RCU.
Unfortunately when tearing down the queues after an error during
connecting to the frontend (e.g. due to illegal Xenstore data filled
in by the guest), the statistic data is being freed without
synchronizing the RCU state. In case the data is being read via sysfs
in this phase, access to already freed memory or memory being in new
use is possible.
Fix that by calling synchronize_net() before freeing the queue data.
This is XSA-526 / CVE-2026-100080
Reported-by: Yehyeong Lee <yhlee at isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross at suse.com>
iommu/amd: remove obsolete domain pointer warning on release
A warning is triggered in amd_iommu_release_device() on removal of a
device with an IOMMU_RESV_DIRECT region. The warning is based on the
false assumption that correct attachment to the release_domain will
always result in a NULL dev_data->domain pointer. For devices with
IOMMU_RESV_DIRECT (and consequently dev->iommu->require_direct), the
release domain is the permanent identity_domain which sets
itself to dev_data->domain on attach.
This behaviour was added in commit e94160488e65 ("iommu: Generic support
for RMRs during device release"). Commit c21b34762e2f ("iommu/amd: Set
release_domain to blocked_domain") caused it to take effect for AMD
IOMMU.
Remove the warning as it is no longer strictly an error to have a non-NULL
domain pointer. As this leaves amd_iommu_release_device() empty, remove it.
The warning was observed for a device with direct mapped region:
[35 lines not shown]
iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge
pci_upstream_bridge() can return NULL for devices without an upstream
bridge. The AMD GPU identity mapping quirk dereferences the returned
pointer unconditionally, causing a kernel panic during boot.
Check the pointer before accessing the bridge vendor ID.
This fixes a boot regression on a Lenovo system with an AMD PRO
A10-9700E APU. The system now boots with AMD IOMMU enabled.
Fixes: bf5bdfd1f8d4 ("iommu/amd: Force identity mode for selected GPUs only")
Signed-off-by: Jean-Christophe Guillain <jean-christophe at guillain.net>
Signed-off-by: Vasant Hegde <vasant.hegde at amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel at amd.com>
iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails
iommu_snp_enable() checks that the IOMMU can support SNP and sets
amd_iommu_snp_en, then calls snp_rmptable_init() to map the RMP table.
If that call fails, CC_ATTR_HOST_SEV_SNP is cleared but amd_iommu_snp_en
is left set. Later IOMMU initialization uses amd_iommu_snp_en to
configure the IOMMU for SNP, on the assumption that RMP setup succeeded.
Clear amd_iommu_snp_en along with CC_ATTR_HOST_SEV_SNP.
Fixes: 409f45387c93 ("x86/sev: Fix broken SNP support with KVM module built-in")
Signed-off-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava at amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni at amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde at amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel at amd.com>
iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions
init_memory_definitions() walks every top-level subtable including the
IVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets
each one as a 'struct ivmd_header', solely on m->flags, without first
checking that the subtable's type actually is one of the IVMD types
(ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE).
if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
init_unity_map_range(m, table);
IVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD
flags field's HtTunEn bit. Unlike real hardware, QEMU's AMD IOMMU
emulation sets HtTunEn unconditionally (flags=0xD1 for type 0x10,
0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified
as a unity-map/exclusion-range IVMD entry, which subsequently results
in the creation of a bogus pci segment. Eg:
AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000
[8 lines not shown]
iommu/amd: Enable PerfOpt automatically for integrated GPUs
PerfOpt is usable by integrated GPUs in identity mode. Enable it from
the IOMMU driver's domain attachment paths instead of requiring an
amdgpu policy knob and exported enable/disable interfaces.
Mark supported integrated GPUs as PerfOpt-eligible when selecting their
default identity domain. Skip GCR3 setup and ATS/PRI/PASID enablement for
these identity attachments, then enable PerfOpt after installing the DTE.
Clear PerfOpt before attaching an eligible GPU to a translated or blocked
domain, including unmanaged domains used by VFIO. Propagate failures to
clear bypass, but keep a completed identity attachment successful if the
optional PerfOpt enable fails.
Clear inherited PerfOpt state during initialization, including when a crash
kernel reuses device tables. Read feature support directly from hardware
because cached features may not be available yet, and stop initialization
if the initial clear fails.
[14 lines not shown]
Merge tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Bluetooth, IPsec, WiFi and CAN.
Current release - regressions:
- eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced
Previous releases - regressions:
- core:
- use a dedicated flag to track disabled napi instances
- frags: limit the truesize of a reassembly queue
- reject a negative TCP header offset in qdisc_pkt_len_segs_init()y
- tcp:
- reject unhashed sockets during established lookups
- free ireq->ipv6_opt after an RCU grace period
[63 lines not shown]
Merge tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull platform driver fixes from Ilpo Järvinen:
- arm64: asus-glymur-ec: Resolve config loop due to THERMAL symbol
- uniwill-laptop: Add .hw_offloaded() to avoid leds subsystem warning
about missing callback
* tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
platform/x86: uniwill-laptop: Implement .hw_offloaded trigger callback
platform: arm64: drop the vacuous THERMAL dependency from EC_ASUS_GLYMUR
Merge tag 'chrome-platform-firmware-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome platform firmware fixes from Tzung-Bi Shih:
- Don't skip CBMEM entries outside of known memory resources
- Fix a Coccinelle warning for error-pointer handling in coreboot-cfr
* tag 'chrome-platform-firmware-fixes-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
firmware: coreboot: Fix CFR error-pointer handling warning
firmware: coreboot: Don't skip CBMEM entries outside of known memory
Merge tag 'hwmon-for-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- acpi_power_meter: Check for 32-bit and 64-bit unknown ACPI values,
Fix missing locking in sysfs show callbacks and resume, and Prevent
spurious power alarm when power is unknown
- aquacomputer_d5next: Avoid truncating scaled sensor readings, Check
maxcollection when probing AQUAERO devices, and reject short status
reports
- asus_rog_ryujin: Fix pump control source on the Ryujin III, and Fix
timeout when reading 0% duty cycle
- asus_wmi_sensors: Avoid global struct mutation
- chipcap2: Series of fixes addressing various bugs in the driver
[56 lines not shown]
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull virtio fixes from Michael Tsirkin:
"vhost, virtio, and vdpa bugfixes.
Just a bunch of fixes all over the place"
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (38 commits)
virtio_pci: don't take the MSI mutex under cpu_hotplug_lock
virtio_ring: Initialize id field in packed indirect descriptors
vhost-scsi: fix page reference leak in misaligned I/O fallback
vduse: fix VA/PA confusion in the coherent page fault path
hwrng: virtio - prevent use-after-free after a failed restore
virtio: use consistent virtqueue terminology
virtio_balloon: initialize wakeup_lock before virtqueues are set up
MAINTAINERS: add missing virtio/vdpa/vduse/vhost headers
vhost-vdpa: initialize state before publishing cdev
vhost: reject backend enable without a kick file
vhost-scsi: reject delayed virtqueue setup
[10 lines not shown]
Merge tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core
Pull core memory management fixes from David Hildenbrand:
"Here's a bigger set of MM fixes that we didn't manage to have ready
for -rc1. All fixes are stable-worthy; the majority fixes nasty
long-standing bugs instead of being purely hotfixes.
We have some more of these kinds of stable-worthy fixes in the
pipeline, but we'll focus on the really urgent fixes as we get closer
to the release.
(Leaving urgent MM fixes lurking for various weeks is not good, but
having too many changes close to the release is also not good, it's
tricky ...)
Most issues were reported by Anthropic. Others were found while
reworking proposed fixes, and of course some of the fixes were just
reported and fixed on the mailing list.
[53 lines not shown]
Merge tag 'mm-nonmm-hotfixes-stable-2026-11-04-20-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull non-MM fixes from Andrew Morton:
"22 patches. 17 are cc:stable.
Most are OCFS2 fixes. These address extended-attribute corruption,
missing attributes and kernel BUGs, along with crashes during cluster
configuration, lock migration, recovery and unmount. Extent movement
is also fixed to validate its range against a stable file size.
Three FAT changes prevent a failed-write/FIBMAP race from spuriously
making the filesystem read-only, correct directory link counts after
rename, and speed up file expansion. The reported QEMU benchmarks show
particularly large improvements on synchronous mounts.
A taint-string fix prevents an out-of-bounds read which can expose
slab contents in the kernel log. There are also build fixes for
OpenRISC modules on CPUs without hardware multiply and for Clang 24"
[22 lines not shown]
Merge tag 'nvme-7.4-2026-11-05' of git://git.infradead.org/nvme into block-7.4
Pull NVMe fixes from Keith:
"- Fix a passthru reference leak that hangs disabling a target passthru
controller (7.4-rc1 regression)
- Fix namespace removal race with SRCU readers of the namespace list
- Fix use-after-free in nvme-tcp controller teardown after a failed
connect
- Fix NULL dereference in nvme-rdma when a reconnect adds queues
- nvmet-rdma device removal and disconnect fixes
- nvmet-tcp TLS record type handling and bounded connection accept work
- Don't leak stale memory in the nvmet ANA log page
- Harden nvmet against invalid input: keep-alive timeout overflow,
incomplete DHCHAP messages, configfs address bounds, arbitration
burst mask, and locking for traffic based keep alive updates
- Keep the old nvmet auth keys if setting new ones fails
- Delete nvme-loop controller on failed reset
- Fix extra cdev reference put and unregister on a zero pr_register key
[27 lines not shown]
