Merge tag 'sched-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fix from Ingo Molnar:
- Fix a false positive cputime related warning in kcpustat_dyntick_stop()
that can trigger sporadically after a clocksource switch (Stian Halseth)
* tag 'sched-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/cputime: Don't warn when the tick period starts after idle exit
Merge tag 'timers-urgent-2026-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar:
- Fix on-stack hrtimer cleanup in play_idle_precise(), and
add the hrtimer_on_stack cleanup class to facilitate the fix
(Hui Su)
- Fix clock_getres() system call's handling of NULL output
pointer in the !CONFIG_POSIX_TIMERS case (Hungyu Lin)
- Fix get_cpu_itimer() to return TICK_NSEC when the sampled CPU time
is exactly equal to the nonzero expiry (Hungyu Lin)
- Fix do_timens_ktime_to_host() time offset subtraction underflow
check (Hungyu Lin)
- Report zero remaining time for disarmed SIGEV_NONE posix timers,
and add a self-test to detect this bug in the future (Hung-Jui Lin)
[21 lines not shown]
Merge tag 'bootconfig-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig fix from Masami Hiramatsu:
- init/bootconfig: Pass init arguments in documented order
Parse extra_init_args before command-line init arguments in
start_kernel(). This ensures command-line options take precedence
over bootconfig, matching the documented order and saved command
line.
* tag 'bootconfig-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
init/bootconfig: pass init arguments in documented order
Merge tag 'rtc-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
Pull RTC updates from Alexandre Belloni:
"This introduces a way to lift the hctosys limit for 32-bit systems to
ensure systems relying on it can pass Y2038. Add a driver for the
Raspberry Pi 5 RTC and add support for the Abracon abx81x, Ricoh
R2223x, Renesas R-Car X5H and Allwinner B288 RTCs to existing drivers:
Subsystem:
- the hctosys limit for 32bit platforms is now configurable
- introduce lock guard for for rtc_device.ops_lock
- use sysfs_emit() instead of sprintf() were possible
- selftest fixes
New driver:
- Raspberry Pi 5 RTC
Drivers:
- abx80x: add support for ABX81X
[33 lines not shown]
sched/cputime: Don't warn when the tick period starts after idle exit
kcpustat_dyntick_stop() warns if idle ends before the tick period
that the next tick will account has started. That happens on x86 in
a CPU's first idle period with the tick stopped, right after the
switch from the jiffies clocksource to tsc-early.
On the jiffies clocksource ktime only moves at the tick. When the
clocksource switches some time d after a tick, that d is lost: ktime
continues from the value of the last tick. The next tick comes
TICK_NSEC after the last one, but ktime has only moved TICK_NSEC - d,
while tick_periodic() still adds a full TICK_NSEC to tick_next_period,
which is now d ahead of ktime. When NOHZ starts,
tick_init_jiffy_update() rounds it up to a multiple of TICK_NSEC and
the sched timer is armed there, up to nearly two ticks after now. A
tick stop saves that as ts->last_tick, and an idle exit before now
reaches ts->last_tick - TICK_NSEC sees the tick period in the future.
Nothing is accounted twice then. The first tick covers a period that
[18 lines not shown]
Merge tag 'power-utilities-2026.10.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
Pull x86 power utilities updates from Len Brown:
"Turbostat:
- Fix --cpu option to work more than once
- Fix --Joules option to work with --show power
- Remove hard-coded 8192-CPU limit
- Decode Uncore Frequency Agent Types
- Dump RDT (Resource Director Technology) config
- Dump RP (Resource Priority) config
- Recognize Rugged Panther Lake
- Fix PMT mmap size, bounds check, and mask computation
- Misc cleanups and minor fixes
x86_energy_perf_policy:
- Harden input parsing and bounds checks
- Fix optarg keyword matching
- Rewrite MSR device path discovery
- Misc cleanups and minor fixes"
[23 lines not shown]
Merge tag 'sound-fix-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of fixes across the sound subsystem. Nothing particularly
stands out, mostly driver- and device-specific fixes along with a few
race / UAF fixes and cleanups. Here are some highlights:
ALSA core:
- Fix potential race in PCM proc handling at disconnection
- Fix potential race in UMP sequencer callback at releasing
HD-audio:
- Reject codec reset/reconfig on ASoC buses to prevent deadlock
- Force MSI for Hygon H34M51A board
- Usual Realtek quirks for ASUS and HP laptops/AiO
USB-audio:
- Bound packet copies by PCM buffer size in generic and ua101 drivers
- Rate-limit URB submission errors at stream start
[47 lines not shown]
Merge tag 'ovl-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fixes for bugs found by Chris Mason's AI review, several of them
reachable by unprivileged users: an info leak, use-after-free and
NULL deref bugs, an RCU walk stall with remote layers and data loss
with nfs_export
- Fix copy up of files with an empty security.capability xattr, which
any user could set to block copy up
- Fix a regression from v6.16 with the override_creds mount option
- Two casefold fixes
* tag 'ovl-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
ovl: check the casefold flag of directories only
ovl: reserve space for the casefolded name terminator
[18 lines not shown]
tools/power x86_energy_perf_policy: Version 2026.10.31
Since 2026.04.25:
Harden input parsing and bounds checks.
Fix optarg keyword matching.
Rewrite MSR device path discovery.
Misc cleanups and minor fixes.
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Version 2026.10.31
Since version 2026.09.28:
Fix --cpu option to work more than once.
Fix --Joules option to work with --show power.
Remove hard-coded 8192-CPU limit.
Decode Uncore Frequency Agent Types.
Dump RDT (Resource Director Technology) config.
Dump RP (Resource Priority) config.
Recognize Rugged Panther Lake.
Fix PMT mmap size, bounds check, and mask computation.
Misc cleanups and minor fixes.
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Fix undefined behavior in pmt_gen_value_mask()
The function uses plain int literal '1' for bit shifting, which causes
undefined behavior when msb >= 31. This is because shifting a 32-bit int
by 32 or more bits is undefined behavior in C. Fix by using 1ULL
(unsigned long long) instead of 1 to ensure 64-bit arithmetic on all
platforms.
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar at intel.com>
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Fix PMT mmap size and bounds check
Remove assert(offset == 0), to allow non-zero PMT offsets.
Fix the pmt_mmio_open() mapping to round-up (offset + size).
Fix the offset bounds check to disallow running past the end of the region.
[lenb: commit message re-write]
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar at intel.com>
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Fix --Joules when used with --show power
The "--Joules" option displays energy in Joules,
replacing the same metrics displayed as power in Watts.
But when used with --show power, it deletes the power
metrics without replacing them with their energy counterparts:
$ sudo ./turbostat -q --list --show power --Joules
CoreTmp,PkgTmp,RAM_J,PKG_%,RAM_%
Fix it thus:
$ sudo ./turbostat -q --list --show power --Joules
CoreTmp,PkgTmp,Pkg_J,Cor_J,GFX_J,RAM_J,PKG_%,RAM_%,Sys_J
Signed-off-by: Len Brown <len.brown at intel.com>
Merge tag 'asoc-fix-v7.4-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v7.4
A moderately large collection of fixes and quirks that have come in
during the merge window, everything here is driver specific and none of
it unusually severe.
init/bootconfig: pass init arguments in documented order
start_kernel() appends command-line init arguments before
bootconfig init arguments, while setup_command_line()
places them in the opposite order. As a result, the
arguments passed to init do not match the saved command
line, reversing the intended precedence of options.
Parse extra_init_args before after_dashes so command-line
init arguments are passed last.
Link: https://lore.kernel.org/all/20261027073719.4010659-2-thnkslprpt@gmail.com/
Fixes: b66fbbe8d482 ("init/bootconfig: Reorder init parameter from bootconfig and cmdline")
Signed-off-by: Avi Weiss <thnkslprpt at gmail.com>
Cc: stable at vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat at kernel.org>
Merge tag 'ksmbd-for-7.4-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server fixes from Namjae Jeon:
- Fix compound CREATE response buffer sizing and reserve space for
final response padding to prevent buffer overflows and out-of-bounds
reads
- Allocate sufficient space for UTF-16 directory-name conversion,
including the terminating NUL
- Fix an RDMA transfer length underflow that can cause out-of-bounds
reads or writes when processing multiple remote buffer descriptors
- Fix use-after-free bugs during failed durable reconnect cleanup and
AppInstanceId supersede racing with session teardown
- Keep retry timeout clamp bounds constant to fix a MIPS build failure
with CONFIG_HZ=1024
[33 lines not shown]
Merge tag 'perf-tools-for-v7.4-1-2026-10-30' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next
Pull perf tool updates from Arnaldo Carvalho de Melo:
- Support instruction tracking on arm64 for data type profiling,
resolving stack, global, per-CPU and 'current' variable accesses, so
that 'perf annotate --data-type' resolves types on arm64 the way it
does on x86.
- Port the Python scripts to the perf module and standalone execution,
and improve the module: lazy sample callchains and event copies, GIL
handling, better session/thread lookup, new treport, flamegraph and
sqlite/postgres exporters.
- Reenable and fix the attribute expectation test suite: per-PMU bit
masks, other core PMUs' events, dummy tracking events, group checks
and spelled out skip reasons.
- perf trace: filter the target's tasks in BPF, open the BPF output
[94 lines not shown]
Merge tag 'apparmor-pr-2026-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor
Pull AppArmor fixes from John Johansen:
"Leaks:
- fix a leak on a rejected string table entry
- fix refcount leak in aa_get_newest_profile()
- fix profile leak when a policy load fails
- remove fs entries created by a failed policy load
- on failed load ensure profile files are removed before parent
- Fix namespace reference leak in __aa_find_or_create_ns()
Use after free/double free:
- fix a use-after-free in aa_lookupn_ns()
- avoid potential double free when remapping DFA tables
Bounds checking by-passes:
- fix table_size() integer overflow on 32 bit
- check accept index + 1 is in bounds
[48 lines not shown]
Merge tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull more driver core fixes from Danilo Krummrich:
- Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind
operations associated with misleading fuzzing reports. It also taints
established workflows, including VFIO device passthrough; a more
targeted approach will be revisited after 7.4.
- Rate limit synthetic uevent failure messages to prevent log flooding
from repeated invalid writes to sysfs uevent files
* tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers"
driver core: Limit the messages on a refused uevent
Merge branch 'fixes-from-sasha'
Misc fixes for this merge window from Sasha Levin that were posted for
issues found in linux-next but not picked up by maintainers.
In an almost certainly futile attempt to clean up the disaster area that
is my inbox, I'm merging them directly rather than leaving them pending
and wait for them to come in through the proper channels.
* fixes-from-sasha:
selftests/fuse: add the missing symlink caching test
fuse: fix link error with CONFIG_FUSE_PASSTHROUGH=n
xprtrdma: fix up the nfs/nfs-anna merge of the Write chunk head trim
selftests/fuse: add the missing symlink caching test
Commit 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
registered fuse_symlink_cache_test in the fuse selftest Makefile and
.gitignore, but the test source was not part of the applied commit, so
building the fuse selftests fails:
make[1]: *** No rule to make target 'fuse_symlink_cache_test.c', needed by '.../fuse_symlink_cache_test'.
Add fuse_symlink_cache_test.c as posted in Luis Henriques's v5
submission. The test serves a file and a symlink to it from a libfuse
low-level filesystem, resolves the symlink 100 times, and counts the
readlink requests that reach the server: one when FUSE_CAP_CACHE_SYMLINKS
is set during FUSE_INIT, and all 100 when it is not.
Fixes: 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
Reported-by: kernel test robot <lkp at intel.com>
Closes: https://lore.kernel.org/r/202610170822.oEJ1Autq-lkp@intel.com/
Link: https://lore.kernel.org/r/20261001164916.15311-8-luis@igalia.com
[4 lines not shown]
fuse: fix link error with CONFIG_FUSE_PASSTHROUGH=n
Commit 2f19d54c055d ("fuse: support 64 bit, server allocated backing ID")
moved the CONFIG_FUSE_PASSTHROUGH check out of the backing ioctl handlers
and into fuse_get_conn_for_passthrough(). The calls from the handlers
into backing.c, which is only built with CONFIG_FUSE_PASSTHROUGH, are now
only removed if the compiler inlines that helper. It does not have to,
and with gcc 11 and CONFIG_CC_OPTIMIZE_FOR_SIZE it doesn't:
dev.c:(.text+0x355c): undefined reference to `fuse_backing_open'
nios2-linux-ld: dev.c:(.text+0x3594): undefined reference to `fuse_backing_open_64'
nios2-linux-ld: dev.c:(.text+0x35d0): undefined reference to `fuse_backing_close'
Check CONFIG_FUSE_PASSTHROUGH in each handler again, as
fuse_notify_backing_remove() does. The check still comes after the
fuse_get_dev() and -ENOTCONN checks, so the errors userspace sees do not
change.
Fixes: 2f19d54c055d ("fuse: support 64 bit, server allocated backing ID")
[5 lines not shown]
xprtrdma: fix up the nfs/nfs-anna merge of the Write chunk head trim
Two fixes for the same Write chunk payload corruption meet in
linux-next. In the nfs tree, commit a0db57fee35e ("xprtrdma: Fix Write
chunk payload corruption on a short reply header") trims
head[0].iov_len in rpcrdma_decode_msg(). In the nfs-anna tree,
commit 9ee534a75912 ("xprtrdma: trim head iovec when the payload
arrives via a Write chunk") trims it in rpcrdma_inline_fixup() and
reduces buflen by the same amount.
The merge resolution keeps the caller-side trim. By the time
rpcrdma_inline_fixup() runs, head[0].iov_len already equals copy_len,
so the block added by the nfs-anna commit never runs and its buflen
reduction in rq_rcv_buf and rq_private_buf is lost. The helper is also
still passed xdr_pad_size(writelist), while its kernel-doc now
describes @writelist as the number of bytes conveyed by the Write
chunk.
Drop the caller-side trim and pass the full Write chunk length, so
[12 lines not shown]
Merge tag 'kbuild-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fixes from Nathan Chancellor:
- Move probing of '-mfentry' back into Makefile instead of Kconfig
because it does not interact well with toolchains that support
multiple bit widths
- Add a big comment in scripts/Kconfig.toolchain of two pitfalls when
moving cc-option checks from Kbuild to Kconfig
* tag 'kbuild-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild
kbuild: Move testing of '-mfentry' back to Makefile from Kconfig
Merge tag 'ktest-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest
Pull ktest updates from Steven Rostedt:
- Sort configs before writing config file
Currently the .config file is created from the perl hash array from
reading the applied min-configs. The order is determined by how perl
hashes the values. This causes the .config file to be created in
different orders for each run, and the order may determine the final
value of the .config file after it goes through a make oldconfig.
Sort the values when creating the .config so that the result is the
same for every run.
- Add total test time to run output
Have ktest display the total test time of running all the tests. This
is useful to find issues in the build, install, boot or test run
[19 lines not shown]
Merge tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara:
- Validate the offsets and lengths a server puts in its responses
before using them, so that a malicious or broken server can no longer
make the client read past the received data:
- POSIX lock data (which leaked kernel bytes through F_GETLK)
- NT transaction responses and SMB1 EA lists (both wrapping their
pointer checks on 32-bit)
- short SESSION_SETUP responses (which sent stale buffer content
back to the server in the NTLMv2 AUTHENTICATE message)
- SMB2 READ data areas
- empty truncated fiemap responses
- Fix a heap overflow in SMB2_tcon() with UNC paths longer than
MAX_SHARENAME_LENGTH
- Fix a slab-out-of-bounds write when chmod() rewrites a security
[27 lines not shown]
