Merge tag 'sched_ext-for-7.4-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext fixes from Tejun Heo:
- With proxy execution or core scheduling, a CPU could run a task that
had been requeued on another CPU while dispatch had the rq lock
dropped.
- Unregistering a scheduler could return while its teardown was still
running, letting the teardown call into BPF code that was already
freed.
- A CPU coming online could call into the BPF scheduler before the
scheduler was told that the CPU is online.
- A parent scheduler could be asked to attach a sub-scheduler to a
cgroup that was already removed.
- Hardening: more kfuncs that take a queue lock are rejected in tracing
[21 lines not shown]
Merge tag 'cgroup-for-7.4-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo:
- A file notification racing the file's removal could re-arm the
notification timer after it was shut down, corrupting the timer wheel
or firing on freed memory.
- The v1 freezer could leave an exiting task frozen forever after its
cgroup was thawed or removed.
- With memcg built without the block cgroup controller, memcg reclaim
waited on writeback and could deadlock against a filesystem freeze.
memcg now selects the controller.
- cpuset partition state could go wrong when CPUs move between nested
partitions or go offline: isolated CPUs leaked or went missing,
invalid partitions kept exclusive CPUs or came back with no usable
CPU, and expanding a remote partition could fail. Separately, a
[19 lines not shown]
Merge tag 'nfs-for-7.4-2' of git://git.linux-nfs.org/projects/anna/linux-nfs
Pull NFS client fixes from Anna Schumaker:
- Various NFS and SunRPC fixes from Avi Weiss
- Various localio fixes from Mike Snitzer
- Delegated timestamp fixes from Jeff Layton
- CB_NOTIFY_LOCK fixes from Olga Kornievskaia
- Various sunrpc, flexfiles, and xprtrdma fixes from Tim Menninger
* tag 'nfs-for-7.4-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: (26 commits)
NFSv4: Prevent indefinite waits for out-of-order OPEN stateids
NFSv4/flexfiles: limit transport disconnects when cancelling I/O
SUNRPC: add request-scoped disconnects when cancelling tasks
pNFS: avoid repeatedly cancelling I/O for the same lseg
[17 lines not shown]
Merge tag 'for-7.4/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper fixes from Mikulas Patocka:
"dm:
- fix infinite loop when removing a zoned device
- fix misbehavior if kobject_init_and_add fails
- fix refcount underflow if zone reset failed
- fix misbehavior if we attempt to load a table after previous table
load failed
- fix use-after-free if we open a device read-only and then re-open
it read-write
- fix error being ignored if flush failed
dm-pcache:
- fix misbehavior on flush failure
dm-raid:
- validate array_position after it is read from the superblock
[69 lines not shown]
Merge tag 'spi-fix-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"There's a few small collection of driver fixes here, the usual story
where none of them are super remarkable if you don't have the have the
hardware. The largest batch is the Tegra fixes which are mainly around
error handling"
* tag 'spi-fix-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: axi-spi-engine: Start the program length at zero
spi: virtio: move teardown to .remove()
spi: dt-bindings: pl022: Allow a power domain
spi: tegra210-quad: Unmap DMA buffers on transfer timeout
spi: tegra210-quad: Track DMA mapping state
spi: tegra210-quad: don't overwrite refreshed status with lost-IRQ snapshot
Merge tag 'regulator-fix-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A small change adding support for the Silergy SYM827 which is a
variation on the FAN53555 so needs some quirk data and a new DT
compatible"
* tag 'regulator-fix-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: fan53555: Add support for Silergy SYM827
regulator: dt-bindings: fan53555: Add Silergy SYM827
Merge tag 'driver-core-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core fix from Danilo Krummrich:
- Fix a use-after-free during device removal when a child device reuses
its parent's managed software node (affecting Xe)
* tag 'driver-core-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
software node: only let the owner release a managed node
cgroup/cpuset: Don't revive invalid partition without active CPU on hotplug
When a CPU hotplug leaves no CPU outside of the partitions for the top
cpuset, cpuset_handle_hotplug() clears subpartitions_cpus and gives all
the active CPUs back to the top cpuset. cpuset_hotplug_update_tasks()
then walks the hierarchy and invalidates the partitions, as
subpartitions_cpus is empty.
However, an invalid partition visited in the same walk may be revived
if its effective_xcpus is not empty. tasks_nocpu_error() doesn't catch
it when its CPUs are all offline but it has no task. Its CPUs are put
back into subpartitions_cpus, and the valid partitions visited after it
are no longer invalidated, as subpartitions_cpus is not empty any more.
The top cpuset is left with CPUs overlapping with these partitions.
It can be reproduced on a system with 8 CPUs:
# cd /sys/fs/cgroup
# echo +cpuset > cgroup.subtree_control
[33 lines not shown]
cgroup/cpuset: Remove redundant WARN_ON_ONCE() in remote_cpus_update()
remote_cpus_update() warns if the CPUs to be added to a remote partition
intersect subpartitions_cpus, and then checks the very same condition
right below to set PERR_NOCPUS and invalidate the partition:
WARN_ON_ONCE(cpumask_intersects(tmp->addmask, subpartitions_cpus));
if (!capable(CAP_SYS_ADMIN))
WRITE_ONCE(cs->prs_err, PERR_ACCESS);
else if (cpumask_intersects(tmp->addmask, subpartitions_cpus) ||
cpumask_subset(top_cpuset.effective_cpus, tmp->addmask))
WRITE_ONCE(cs->prs_err, PERR_NOCPUS);
Sashiko reported that the warning could be triggered by a write to a
cpuset control file, before the CAP_SYS_ADMIN check, which would panic a
system with panic_on_warn set.
The warning was added by commit 86888c7bd117 ("cgroup/cpuset: Add
warnings to catch inconsistency in exclusive CPUs") as an assertion that
[13 lines not shown]
Merge tag 'x86-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Don't print reset reason in VMs, to fix Xen PV domU boot
regression on AMD Zen CPUs (Jason Andryuk)
- Preserve the default VGA fallback for legacy modes, to fix
regression where a SeaBIOS QEMU guest with bochs and VKMS
the boot VGA (bochs) loses its DRM boot_display attribute
(Hengyu Liang)
- Ensure write visibility during LDT installation (Dave Hansen)
* tag 'x86-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/mm: Ensure write visibility during LDT installation
x86/video: Preserve the default VGA fallback for legacy modes
x86/CPU/AMD: Don't print reset reason in VMs
Merge tag 'timers-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar::
- Add VDSO_UNALIGNED_PACKED config option for targets without efficient
unaligned memory accesses (such as ARMv5), and turn it on for
!CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS platforms.
Propagate these changes into tooling headers as well (Ian Rogers)
- Read getboottime64() offsets under the tk_core.seq sequence counter
(Hungyu Lin)
- Keep tsacct task begin times stable across suspend (Hungyu Lin)
- Reject cross timestamps for invalid AUX clocks (Avi Weiss)
- Refresh auxiliary timekeeper base before offset validation (Avi
Weiss)
[8 lines not shown]
Merge tag 'sched-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix spurious SYS_sched_setattr() -EPERM for migration-disabled
tasks (Andrea Parri)
- Reject clamp values above SCHED_CAPACITY_SCALE (Andrea Parri)
- Fix cpuset_mutex double unlock in __sched_setscheduler()
(Andrea Parri)
- Don't use fits_capacity() to compare thread and CPU counts in
in invalid_llc_nr() (Zhan Xusheng)
- Do not touch SMT siblings that have not joined the core yet
during CPU onlining (Seiji Nishikawa)
* tag 'sched-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
[5 lines not shown]
Merge tag 'perf-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Avoid AMD uncore context migration from non-owners (Sandipan Das)
- Clear stop state in perf_trace_add(), to fix self-profilers such as
async-profiler. Also fix a similar bug in hw_breakpoint_add() (Paolo
Bertinetti)
- Fix racy update of cpc->hrtimer_interval (Benjamin Segall)
- Do not resurrect cpuctx->cgrp after last cgroup event exit, to fix
UAF bug (Phat Dinh)
* tag 'perf-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf/core: Do not resurrect cpuctx->cgrp after last cgroup event exit
perf: Fix racy update of cpc->hrtimer_interval
perf/hw_breakpoint: Clear stop state in hw_breakpoint_add()
[2 lines not shown]
Merge tag 'core-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull core syscall fixes from Ingo Molnar:
- Two generic syscall entry code fixes for return code
data type definitions (Florian Bezdeka)
* tag 'core-urgent-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
entry: Complete syscall_enter_from_user_mode_work() to bool migration
entry: Fix return type of syscall_trace_enter()
Merge tag 'fixes-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux
Pull liveupdate fixes from Mike Rapoport:
- avoid address translation in is_kho_boot() before the linear map is
initialized, fixing early boot BUG_ONs on arm64
- check for duplicate session names before growing the sessions
preservations block set to avoid preserving an empty block that
causes restoration to panic()
* tag 'fixes-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
kho: check fdt_phys in is_kho_boot()
liveupdate: check for duplicate session before growing block set
Merge tag 'kexec-fixes-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux
Pull kexec MAINTAINERS update from Mike Rapoport:
"Remove Dave Young as kdump reviewer"
* tag 'kexec-fixes-2026-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
Remove myself as a kdump reviewer
Merge tag 'probes-fixes-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probe fixes from Masami Hiramatsu:
"Fix ftrace ops switching and optprobe state transitions:
- Switch an armed ftrace-based kprobe from kprobe_ftrace_ops to
kprobe_ipmodify_ops in register_aggr_kprobe() when adding a probe
with a post_handler, so later disarming does not fail with -ENOENT
and leave the probe armed
- Queue forcibly unoptimized probes onto the generation's
cooling_list in force_unoptimize_kprobe() so unregister_kprobes()
waits for Tasks RCU before freeing the optinsn slot, preventing a
use-after-free
- Skip arch_arm_kprobe() in __arm_kprobe() when a probe is queued for
unoptimization so the active relative jump instruction is not
partially overwritten with a breakpoint before the optimizer runs
[73 lines not shown]
Merge tag 'bootconfig-fixes-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig fixes from Masami Hiramatsu:
- bootconfig: Allow keys with the maximum supported depth
Check the array capacity before storing the next key component in
xbc_node_compose_key_after() so keys at XBC_DEPTH_MAX (16) are
composed instead of failing with -ERANGE when listing keys or
creating /proc/bootconfig.
- bootconfig: Trim unquoted values at end of file
Trim trailing whitespace from unquoted values in __xbc_parse_value()
after scanning finishes so values at end of input without a trailing
newline do not retain extra whitespace.
- tools/bootconfig: Close only opened braces in compact output
[14 lines not shown]
memcg: make MEMCG select BLK_CGROUP
Memcg reclaim only relies on writeback throttling if
writeback_throttling_sane() does. Since commit 97c9341f7271 ("mm:
vmscan: disable memcg direct reclaim stalling if cgroup writeback
support is in use") that's the case if the memory controller is on the
default hierarchy and CONFIG_CGROUP_WRITEBACK is set. Otherwise
shrink_folio_list() sleeps in folio_wait_writeback() for a folio that
is under writeback and already marked for reclaim if the allocation may
enter the filesystem.
CONFIG_CGROUP_WRITEBACK is enabled whenever CONFIG_MEMCG and
CONFIG_BLK_CGROUP are. So with CONFIG_MEMCG=y and CONFIG_BLK_CGROUP=n
memcg reclaim on cgroup v2 waits for writeback just like it does on
cgroup v1.
That wait can deadlock against freezing a filesystem. Loop takes freeze
protection on the backing filesystem for its writes. A task in the
middle of a write() to the backing filesystem holds freeze protection
[20 lines not shown]
x86/mm: Ensure write visibility during LDT installation
During LDT installation, the intent is to overwrite the old per-mm
LDT value, then send an IPI to the mm user CPUs to have each load
the new value.
But there is an ordering problem: a new mm user CPU sets itself in
mm_cpumask() and then reads mm->context.ldt. The LDT-installing CPU
writes mm->context.ldt and then reads mm_cpumask(). But, there is
nothing which orders the LDT installation side actions. The CPU
can read mm_cpumask() before its write becomes visible.
Ensure that new mm user CPUs see the new mm->context.ldt. Make
mm->context.ldt visible before reading mm_cpumask().
Also convert the smp_store_release() over to a WRITE_ONCE().
smp_store_release() has an internal barrier which is weaker than
the new smp_mb(). Avoid an extra barrier by converting it to
WRITE_ONCE().
[11 lines not shown]
Merge tag 'for-linus-7.4a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"A bunch of isolated fixes of Xen related drivers"
* tag 'for-linus-7.4a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
Xen/gnttab: improve error handling in gnttab_dma_{alloc,free}_pages()
xen: don't allow gnttab_dma_[alloc|free]_pages() in PV guest
xen/pvcalls: destroy the per-socket workqueue on release
xen/pvcalls: unwind pvcalls_new_active_socket() step by step
xen/privcmd: fix double free when an irqfd is shut down twice
xen/gntdev: fix deadlock between map ioctl and mmap
xen/platform-pci: Disable device before releasing PCI regions
xen/grant-table: annotate on-stack work in gnttab_unmap_refs_sync()
Merge tag 'hwmon-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- Read tracking-mode voltage fault limits dynamically in the mp2975
PMBus driver instead of caching probe-time snapshots, avoiding false
over-voltage alarms when CPU voltage changes at runtime.
- Fix SCMI sensor probe by enabling supported sensors via firmware IDs
before exposing channels and checking channel config allocations.
- Fix runtime PM enable and reference count imbalances during probe and
teardown in the gpio-fan driver.
- Fix max31760 fan controller initialization and reporting, including
leaving standby at probe, initial 0 RPM reporting, and swapped
temperature limit registers.
- Assorted minor sensor reading, interval clamping, and register
[14 lines not shown]
Merge tag 'ovl-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fixes for data-only layers (composefs), some for regressions from
v6.16, which relaxed the requirements for redirects to data-only
layers
- Fix a use-after-free in lookup of a hardlink with a FUSE upper,
reported by Sashiko
- Fix a mount failure right after unmount of an overlay with the same
upperdir
- Reject lower layers on the same fs with different idmaps, which could
decode file handles through the wrong layer
- Minor fixes for a memory leak, an error message and readdir d_ino
[13 lines not shown]
Merge tag 'ntfs-for-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- Validate that $INDEX_ALLOCATION is open and non-resident before
reading or writing index blocks, preventing NULL pointer dereferences
when an earlier index operation has not opened it
- Check that index allocation inodes are non-resident and child VCNs
are non-negative and within bounds before directory lookup reads,
preventing a deadlock when $INDEX_ALLOCATION is missing or damaged
- Validate file names against the index entry's key length, preventing
out-of-bounds reads when directory enumeration resumes using a copied
key
- Return -ENOENT for NTFS_IOC_LIST_STREAMS on deleted base files and
fix unsigned underflow in its buffer bounds check, preventing
out-of-bounds writes when the sizing and filling passes disagree
[11 lines not shown]
Merge tag 'ksmbd-for-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server fixes from Namjae Jeon:
- Evaluate explicit-access requests in DACL order with exact SID
matching, and prevent guest and anonymous sessions from matching
Authenticated Users
- Apply Unix group and OWNER RIGHTS ACEs, and keep their denials when
POSIX ACL fallback determines access
- Allow the parent directory’s DACL to grant explicitly requested
DELETE and FILE_READ_ATTRIBUTES through FILE_DELETE_CHILD and
FILE_LIST_DIRECTORY
- Exclude metadata-only file and stream opens from sharing conflicts
and stream delete-sharing checks, while accounting for writes implied
by overwrites and named-stream creation
[20 lines not shown]
Merge tag 'keys-v7.4-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key fixes from Jarkko Sakkinen:
- Invoke the match callback before the state checks in
keyring_search_iterator(), so that a non-matching revoked,
expired or invalidated key cannot decide the search result
- Take key->sem for reading around the ->asym_*() method calls
in the keyctl pkey operations, as a key reference does not
pin the module providing the key type
* tag 'keys-v7.4-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Protect pkey method checks against type removal
KEYS: do not let an unmatched key decide the search result
Merge tag 'drm-fixes-2026-11-14' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Weekly drm fixes, this is a bit bigger as we missed xe last week due
to a tree screw up, so it's mostly xe and amdgpu, then the usual
scattering of fixes across drivers.
sched:
- Ensure stopped entity cannot be re-added to the run-queue
bridge:
- ssd2825: Fix panel enable sequence
- sii902x: validate I2S data lane values
display:
- hdmi: Fixes to SCDC
i915:
- Fix for PTL GitLab #9196: eDP-2 on DDI B ends up in a state where
[87 lines not shown]
Merge tag 'watchdog-fixes-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog fixes from Guenter Roeck:
- gunyah_wdt: Re-enable the watchdog on resume
- mediatek: Register reset controller before watchdog device
- meson_gxbb_wdt: fix suspend/resume handling of HW_RUNNING watchdog
- mtk_wdt: Stop a running watchdog over system sleep even if not opened
- npcm: fix clock prepare leak when setting timeout on a running
watchdog
- omap: Fix early_enable handling in omap_wdt_probe()
- orion_wdt: load the pretimeout counter on Armada 370/XP start
[22 lines not shown]
Merge tag 'drm-misc-fixes-2026-11-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
Short summary of fixes pull:
bridge:
- ssd2825: Fix panel enable sequence
- sii902x: validate I2S data lane values
display:
- hdmi: Fixes to SCDC
gud:
- Avoid divide error in gud_stats_debugfs
meson:
- load ENCL gamma table while ENCL is disabled
nouveau:
- disp: Set atomic functions in struct drm_mode_config_funcs
[18 lines not shown]
