Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Mostly fixes in drivers.
The three core changes are moving the target reap into the main exit
path of pseudo device allocation to fix a leak and a couple of minor
error propagation updates in bsg.
The largest driver fix is the rethreading of Buslogic to enable
context locking that was held back from the merge window pull due to
problems spotted by the maintainer"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store
scsi: target: Verify the iSCSI ISID is null-terminated
scsi: bsg: Report io_uring data copyback failures
scsi: bsg: Report synchronous data copyback failures
scsi: target: Validate REGISTER AND MOVE TransportID length
[12 lines not shown]
Merge tag 'spi-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"As well as a few driver specific fixes we have a couple of core fixes
here.
One avoids requesting interrupts until we have validated that we have
a SPI device, avoiding triggering warnings on boot.
The other avoids a request for a zero length scatterlist triggering a
BUG_ON() in swiotlb on 64k page systems, this was due to using both
DIV_ROUND_UP() and min() to compute lengths"
* tag 'spi-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: cadence-quadspi: Fix race between DMA completion and transfer start
spi: ljca: Don't require data in write replies
spi: acpi: only look up the IRQ of confirmed SPI devices
spi: pic32-sqi: fail transfer when the BD ring is exhausted
spi: fix zero-length scatterlist entries for vmalloc buffers
[2 lines not shown]
Merge tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A small collection of mostly fairly standard driver specific fixes.
The mt6363 changes are a little large but are the result of two
independent users running into the same issues and testing each
other's changes so given that it's only -rc1 it seemed sensible to
take the changes as fixes"
* tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: mt6363: Fix VEMC voltage selection
regulator: mt6363: Use 8-bit register values
regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs
regulator: qcom_spmi: don't take a sleeping lock in the SAW IPI
Merge tag 'devicetree-fixes-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree fixes from Rob Herring:
"All of these are patches that didn't get picked up for the merge
window. They all fix new warnings because the corresponding .dts
changes did get applied
- Add Altera Agilex5 DWC3 controller and Raspberry Pi RP1 PWM
controller bindings
- Make "peer-hub" property optional on cypress,hx3 USB hubs"
* tag 'devicetree-fixes-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
dt-bindings: usb: add Altera Agilex5 DWC3 controller
dt-bindings: pwm: Add Raspberry Pi RP1 PWM controller
dt-bindings: usb: cypress,hx3: make peer-hub property optional
Merge tag 'sound-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of (unsurprisingly high amount of) small fixes since the
previous PR. Majority of changes are device-specific quirks and driver
fixes, along with a few ALSA core fixes and USB-audio driver
hardening.
ALSA Core:
- Fix page leak on WC DMA buffer allocation failure
- Prevent O_APPEND on OSS streams to avoid UAF
- A PCM regression fix for PulseAudio to allow hw_refine with mmap
- Serialize DSP image loading requests in hwdep
- Clear user-provided numid before adding a control
- Fix dropped data bytes in UMP to MIDI 1.0 System message conversion
HD-audio:
- Fix double-free on stream page allocation failure in core
- Stop capability walk cleanly on empty capability header
[52 lines not shown]
Merge tag 'drm-fixes-2026-11-07' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"This is the weekly drm fixes, amdgpu leading the way with some i915,
nouveau and other fixes.
There should be a bunch of xe fixes, but their tree got screwed up so
I guess I'll send those next week once they cleanup whatever happened.
atomic:
- Fix CRTC dma-fence handling
drm:
- Add parsing for additional HDMI 2.2 FRL rates
bridge:
- nwl-dsi: Fix LCDIF handling
dma-buf:
[105 lines not shown]
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Fix SDEI (software delegated exception interface) handlers taking
nested exceptions (looping on the KPTI trampoline vectors and
clobbering the interrupted context's exception registers), TPIDR2_EL0
preservation across CPU suspend, a kexec_file_load() memory leak and
an overflow in the /dev/mem valid_mmap_phys_addr_range() check:
- Fix nested exceptions taken by SDEI event handlers.
With KPTI, an event interrupting user space left the trampoline
vectors installed and any exception in the handler looped forever.
Also save and restore ELR/SPSR/ESR/FAR around the handler since an
event can interrupt exception entry or return where these registers
are live
- Save and restore TPIDR2_EL0 across CPU suspend.
[15 lines not shown]
Merge tag 'printk-for-7.4-fixups' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk fixes from Petr Mladek:
- Prevent possible use-after-free when printk kthreads
could not be created
- Fix computation of the free space when allocating a
bigger ring buffer
- Add info about the new printk mailing list for
printk-related subsystems
* tag 'printk-for-7.4-fixups' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
printk: Avoid multiple unregistration in unregister_console_locked()
MAINTAINERS: Add new "printk" mailing list for PRINTK, PRINTK INDEXING, and VSPRINTF
printk_ringbuffer: Fix space_used() when blk_lpos->next overflows
Merge tag 'iommu-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu fixes from Joerg Roedel:
"AMD IOMMU:
- Move PerfOpt management into the IOMMU domain attachment paths,
enabling it automatically for supported integrated GPUs in identity
mode and clearing it before switching to translated or blocked
domains
- Fix a boot panic in the GPU identity-mapping quirk when a GPU has
no upstream PCI bridge
- Clear the IOMMU SNP enable flag when RMP table initialization
fails, preventing subsequent initialization from assuming SNP setup
succeeded
- Check IVRS subtable types before parsing memory definitions,
avoiding bogus PCI segments caused by misinterpreting IVHD entries
[11 lines not shown]
Merge tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed
connect, and the nvme-rdma counterpart of the NULL queue->ctrl on
reconnect
- nvmet-rdma iWARP disconnect and device removal fixes
- nvmet-tcp: ask for the TLS record type on every receive, and bound
the connections accepted per work run so a connect flood can't
hold up port removal; nvmet-auth keep the old keys if the new ones
fail to decode; nvme-loop delete the controller if a reset fails
- nvmet-auth reject incomplete DHCHAP messages, and a keep-alive
timeout overflow
- nvmet locking and bounds fixes for tbkas reconnects and the
traddr/trsvcid configfs writes, don't leak stale memory in the ANA
log page, and cache the passthru reference across queue_response
- Wait for SRCU readers before splicing the namespace list, with a
[56 lines not shown]
Merge tag 'io_uring-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Only wait for in-flight requests on ring release if the closing task
actually uses the ring.
- SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,
as memory.high reclaim and blkcg throttling otherwise only ran at
thread exit, and don't set the stop bit on thread exit, which tripped
a WARN_ON_ONCE() in the ring teardown.
- Don't poll a writer for a read side hangup or for urgent data, as a
half-closed peer or unread OOB data kept the async poll of a send
ready on every re-arm.
- Cancel all matching poll requests in one pass for CANCEL_ALL rather
than restarting the hash walk per request.
[22 lines not shown]
arm64: sdei: Preserve the interrupted context's exception registers
An SDEI event is dispatched by firmware regardless of PSTATE.DAIF, so it
can interrupt the kernel where the exception registers are live:
- exception entry, before kernel_entry has saved ELR_EL1/SPSR_EL1 and
before the C handler has read ESR_EL1/FAR_EL1;
- exception return, after kernel_exit has loaded ELR_EL1/SPSR_EL1 and
before the ERET.
An IRQ or pseudo-NMI cannot arrive there with PSTATE.I set. Firmware
saves only x0-x17, PC and PSTATE around an SDEI event, so a synchronous
exception taken by the handler overwrites the interrupted context's
ELR, SPSR, ESR and FAR. do_sdei_event() only notices that ELR changed,
and warns.
The interrupted context then carries on with the handler's state. A
task interrupted on its way into the kernel can be sent SIGILL for the
handler's kernel data abort. A task interrupted on its way back to user
[24 lines not shown]
arm64: sdei: Run the event handler on the kernel vectors
With KPTI, VBAR_EL1 holds the trampoline vectors from the return to EL0
until the next exception from EL0 maps the kernel and installs the
kernel vectors. The trampoline vectors only handle exceptions from EL0;
their current-EL half is zero-filled.
An SDEI event is dispatched regardless of PSTATE.DAIF, so it lands there
whenever the CPU is in user space. The SDEI entry trampoline maps the
kernel but leaves VBAR_EL1 alone. An exception taken by the handler then
executes the zeros, takes an undefined instruction exception to the same
vector, and loops there forever. The event never completes and the CPU
is lost; RCU stall reports are the first sign of it.
RAS notifications land in user space whenever a task consumes the
error, and NMI backtraces land wherever the CPU happens to be. The GHES
handler takes no exception on its own, but any exception in the handler
path does it: a WARN, a kprobe hit, or a fault fixed up by a _nofault()
accessor.
[18 lines not shown]
Merge tag 'configfs-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux
Pull configfs fix from Breno Leitao:
- Fix the build of the configfs selftest on 32-bit architectures,
broken since the test was added in the v7.4 merge window.
The harness casts the ASSERT_NE() operands to intmax_t, so handing it
the pointer returned by mkdtemp() triggers gcc's pointer-to-int-cast
warning on 32-bit, and the test builds with -Werror.
KernelCI's 32-bit arm kselftest builds hit this.
* tag 'configfs-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
selftests/configfs: fix the build on 32-bit architectures
Merge tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull udf, ext2, isofs and quota fixes from Jan Kara:
- Some disk format validation improvements for udf
- Fix isofs handling of dates before 1900
- Fix ext2 inadvertedly syncing buffer on every directory modification
- Fix ext2 O_DSYNC handling for direct IO
- A couple of smaller ext2 fixes
- Fix tmpfs quotas for root filesystem
- Unify my email addresses in MAINTAINERS file
* tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
udf: Fix incorrect error code in udf_current_aext()
udf: Simplify udf_table_prealloc_blocks()
udf: don't use eloc after the end of the unallocated space table
udf: fix preallocation discarding before an empty allocation extent
udf: check the unallocated space table when it is loaded
udf: don't let the extent type hide an exhausted free-space table extent
ext2: preserve IOMAP_F_DIRTY for extending direct writes
[9 lines not shown]
Merge tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull fsnotify fixes from Jan Kara:
"Two small fixes for fsnotify"
* tag 'fsnotify_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
inotify: do not coalesce rename events
fsnotify: preserve 64-bit pre-content ranges
Merge tag 'xfs-fixes-7.4-rc2' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux
Pull xfs fixes from Carlos Maiolino:
"The most notable fix here IMO is for xfs's pNFS support (mostly
related to LAYOUTCOMMIT) and for that it contains several patches.
Besides that, this contains bug fixes for different subsystems in xfs.
The last patch is mostly a refactor than a bug fix, but the refactor
is done to prevent a nasty journal transaction state corruption to
happen"
* tag 'xfs-fixes-7.4-rc2' of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux:
xfs: kill xfs_trans_set/clear_context() helpers
xfs: fix recovery of partial attr removals
xfs: make pNFS LAYOUTCOMMIT stable the way fdatasync does
xfs: add datasync and log_flushed arguments to xfs_log_force_inode()
xfs: take the invalidate lock while mapping a pNFS layout
xfs: clamp the pNFS layout range to the maximum file size
xfs: cap the block count of xfs_iomap_write_direct() at one extent
[12 lines not shown]
Merge tag 'ovl-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fix a self deadlock of a fanotify permission event listener that also
watches the layers, when it reads an overlay directory
- Three casefold fixes, found by Chris Mason's AI review
- Fix a decode of a modified file handle with nfs_export=on, which
could read the stale lower data of a copied up file, also found by
Chris Mason's AI review
- Fix an overlay selftest after an errno change
* tag 'ovl-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
selftests/fscontext_ns: expect EINVAL for overlay descendant userns create
ovl: look up the index by the decoded origin
ovl: inherit FMODE_NONOTIFY when reading directory layers
[4 lines not shown]
arm64: kexec_file: Fix elf_headers memory leak in retry loop
A retry allocates new elf headers and overwrites image->elf_headers,
leaking the previous buffer.
Free it before assigning.
Cc: Will Deacon <will at kernel.org>
Cc: Thomas Huth <thuth at redhat.com>
Cc: Breno Leitao <leitao at debian.org>
Cc: Andrew Morton <akpm at linux-foundation.org>
Cc: Yeoreum Yun <yeoreum.yun at arm.com>
Cc: Baoquan He <bhe at redhat.com>
Cc: stable at vger.kernel.org
Fixes: 108aa503657e ("arm64: kexec_file: try more regions if loading segments fails")
Acked-by: Catalin Marinas <catalin.marinas at arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie at huawei.com>
[catalin.marinas at arm.com: drop the redundant NULL check before vfree()]
Signed-off-by: Catalin Marinas <catalin.marinas at arm.com>
Merge tag 'xsa526-xsa528-7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"Fix three UAF issues that can be hit in the Xen netback and blkback
drivers when a guest is forcing a teardown of a PV device"
* tag 'xsa526-xsa528-7.4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen-blkback: Avoid UAF when reading I/O statistics
xen-netback: defer xenvif_mcast_addr_list_free()
xen-netback: Fix UAF when reading statistics data
xen-blkback: Avoid UAF when reading I/O statistics
Reading I/O statistics via sysfs concurrently with tearing down a
frontend device might result in UAF or a NULL dereference, as the
reading of the statistics data is not synchronized with freeing the
data.
Use a rwlock for synchronizing.
This is XSA-528 / CVE-2026-100082
Fixes: db6fbc106786 ("xen/blkback: make st_ statistics per ring")
Reported-by: Yehyeong Lee <yhlee at isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross at suse.com>
Acked-by: Roger Pau Monné <roger at xenproject.org>
xen-netback: defer xenvif_mcast_addr_list_free()
In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).
Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().
This is XSA-527 / CVE-2026-100081.
Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect")
Reported-by: kerhunt <kerhunt at proton.me>
Signed-off-by: Jan Beulich <jbeulich at suse.com>
Reviewed-by: Juergen Gross <jgross at suse.com>
xen-netback: Fix UAF when reading statistics data
The network statistic data in the driver is protected by RCU.
Unfortunately when tearing down the queues after an error during
connecting to the frontend (e.g. due to illegal Xenstore data filled
in by the guest), the statistic data is being freed without
synchronizing the RCU state. In case the data is being read via sysfs
in this phase, access to already freed memory or memory being in new
use is possible.
Fix that by calling synchronize_net() before freeing the queue data.
This is XSA-526 / CVE-2026-100080
Reported-by: Yehyeong Lee <yhlee at isslab.korea.ac.kr>
Signed-off-by: Juergen Gross <jgross at suse.com>
iommu/amd: remove obsolete domain pointer warning on release
A warning is triggered in amd_iommu_release_device() on removal of a
device with an IOMMU_RESV_DIRECT region. The warning is based on the
false assumption that correct attachment to the release_domain will
always result in a NULL dev_data->domain pointer. For devices with
IOMMU_RESV_DIRECT (and consequently dev->iommu->require_direct), the
release domain is the permanent identity_domain which sets
itself to dev_data->domain on attach.
This behaviour was added in commit e94160488e65 ("iommu: Generic support
for RMRs during device release"). Commit c21b34762e2f ("iommu/amd: Set
release_domain to blocked_domain") caused it to take effect for AMD
IOMMU.
Remove the warning as it is no longer strictly an error to have a non-NULL
domain pointer. As this leaves amd_iommu_release_device() empty, remove it.
The warning was observed for a device with direct mapped region:
[35 lines not shown]
iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge
pci_upstream_bridge() can return NULL for devices without an upstream
bridge. The AMD GPU identity mapping quirk dereferences the returned
pointer unconditionally, causing a kernel panic during boot.
Check the pointer before accessing the bridge vendor ID.
This fixes a boot regression on a Lenovo system with an AMD PRO
A10-9700E APU. The system now boots with AMD IOMMU enabled.
Fixes: bf5bdfd1f8d4 ("iommu/amd: Force identity mode for selected GPUs only")
Signed-off-by: Jean-Christophe Guillain <jean-christophe at guillain.net>
Signed-off-by: Vasant Hegde <vasant.hegde at amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel at amd.com>
iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails
iommu_snp_enable() checks that the IOMMU can support SNP and sets
amd_iommu_snp_en, then calls snp_rmptable_init() to map the RMP table.
If that call fails, CC_ATTR_HOST_SEV_SNP is cleared but amd_iommu_snp_en
is left set. Later IOMMU initialization uses amd_iommu_snp_en to
configure the IOMMU for SNP, on the assumption that RMP setup succeeded.
Clear amd_iommu_snp_en along with CC_ATTR_HOST_SEV_SNP.
Fixes: 409f45387c93 ("x86/sev: Fix broken SNP support with KVM module built-in")
Signed-off-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava at amd.com>
Reviewed-by: Ankit Soni <Ankit.Soni at amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde at amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel at amd.com>
iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions
init_memory_definitions() walks every top-level subtable including the
IVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets
each one as a 'struct ivmd_header', solely on m->flags, without first
checking that the subtable's type actually is one of the IVMD types
(ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE).
if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
init_unity_map_range(m, table);
IVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD
flags field's HtTunEn bit. Unlike real hardware, QEMU's AMD IOMMU
emulation sets HtTunEn unconditionally (flags=0xD1 for type 0x10,
0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified
as a unity-map/exclusion-range IVMD entry, which subsequently results
in the creation of a bogus pci segment. Eg:
AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000
[8 lines not shown]
iommu/amd: Enable PerfOpt automatically for integrated GPUs
PerfOpt is usable by integrated GPUs in identity mode. Enable it from
the IOMMU driver's domain attachment paths instead of requiring an
amdgpu policy knob and exported enable/disable interfaces.
Mark supported integrated GPUs as PerfOpt-eligible when selecting their
default identity domain. Skip GCR3 setup and ATS/PRI/PASID enablement for
these identity attachments, then enable PerfOpt after installing the DTE.
Clear PerfOpt before attaching an eligible GPU to a translated or blocked
domain, including unmanaged domains used by VFIO. Propagate failures to
clear bypass, but keep a completed identity attachment successful if the
optional PerfOpt enable fails.
Clear inherited PerfOpt state during initialization, including when a crash
kernel reuses device tables. Read feature support directly from hardware
because cached features may not be available yet, and stop initialization
if the initial clear fails.
[14 lines not shown]
Merge tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from Bluetooth, IPsec, WiFi and CAN.
Current release - regressions:
- eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced
Previous releases - regressions:
- core:
- use a dedicated flag to track disabled napi instances
- frags: limit the truesize of a reassembly queue
- reject a negative TCP header offset in qdisc_pkt_len_segs_init()y
- tcp:
- reject unhashed sockets during established lookups
- free ireq->ipv6_opt after an RCU grace period
[63 lines not shown]
Merge tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull platform driver fixes from Ilpo Järvinen:
- arm64: asus-glymur-ec: Resolve config loop due to THERMAL symbol
- uniwill-laptop: Add .hw_offloaded() to avoid leds subsystem warning
about missing callback
* tag 'platform-drivers-x86-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
platform/x86: uniwill-laptop: Implement .hw_offloaded trigger callback
platform: arm64: drop the vacuous THERMAL dependency from EC_ASUS_GLYMUR
