Linux/linux 8a65162 — . MAINTAINERS, fs/kernfs dir.c

Merge tag 'driver-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Fix an unused-function warning in the Rust I/O code that breaks
   builds with CONFIG_PCI disabled and CONFIG_WERROR enabled

 - Fix kernfs sparse warnings on SMP Alpha when inheriting a parent
   node's group ID

 - Add Johan Hovold as an auxiliary bus maintainer

* tag 'driver-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  MAINTAINERS: update auxiliary bus entry
  kernfs: avoid READ_ONCE() on a kgid_t in kernfs_new_node()
  rust: io: fix unused Flags::from_raw warning without CONFIG_PCI
DeltaFile
+1-1rust/kernel/io/resource.rs
+1-1fs/kernfs/dir.c
+1-0MAINTAINERS
+3-23 files

Linux/linux e6f836e — drivers/ata libata-sata.c libata-core.c

Merge tag 'ata-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fixes from Niklas Cassel:

 - Allow re-enabling NCQ, after EH disabled it, by writing the current
   queue depth to the queue_depth sysfs attribute (Igor)

 - Retry failed non-NCQ commands when their sense data asks for a
   retry, as is already done for NCQ commands. Previously, such
   non-NCQ commands were never retried (me)

 - Only check the power mode of ATA and ZAC devices before putting
   them in standby mode (on suspend, shutdown or device removal).
   libata never puts other devices, such as ATAPI devices, in standby
   mode, and some ATAPI devices reject the CHECK POWER MODE command
   (Giuseppe)

 - Fix several bugs in the MODE SELECT translation.


    [35 lines not shown]
DeltaFile
+135-71drivers/ata/libata-scsi.c
+14-2drivers/ata/libata-eh.c
+14-0drivers/ata/libata-pmp.c
+4-4drivers/ata/libata-core.c
+1-1drivers/ata/libata-sata.c
+168-785 files

Linux/linux 25fccf4 — drivers/firewire ohci.c

Merge tag 'firewire-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire fix from Takashi Sakamoto:
 "Fix a race in the 1394 OHCI driver, introduced in v7.4-rc1

  Queueing an AT local request in interrupt context can race with
  dequeueing requests in a workqueue without disabling interrupts,
  potentially leading to a deadlock"

* tag 'firewire-fixes-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: ohci: avoid potential deadlock when queueing AT local requests
DeltaFile
+5-4drivers/firewire/ohci.c
+5-41 files

Linux/linux 2651f6d — arch/mips/alchemy/common irq.c prom.c, arch/mips/mm cex-gen.S

Merge tag 'mips-fixes_7.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fixes from Thomas Bogendoerfer:
 "Alchemy:
   - Fix /proc/interrups
   - Preserve ethernet address from PROM

  SGI:
   - IP27: Fix NMI dump
   - IP30: make defconfig more useful
   - IP32: added workarounds for crime revision 1.1

  Others:
   - Fix compressed kernel linked with ld.lld
   - Fix IDE ports on Cobalt devices
   - Reject wrong affinity settings on SB1250 platforms"

* tag 'mips-fixes_7.4_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: SB1250: Validate and update IRQ affinity

    [12 lines not shown]
DeltaFile
+3-42arch/mips/sgi-ip32/ip32-irq.c
+19-7arch/mips/pci/ops-mace.c
+21-5arch/mips/sgi-ip32/crime.c
+20-3arch/mips/alchemy/common/prom.c
+16-0arch/mips/mm/cex-gen.S
+9-2arch/mips/alchemy/common/irq.c
+88-5911 files not shown
+133-7717 files

Linux/linux 11b6438 — Documentation/filesystems resctrl.rst, arch/x86/entry syscall_64.c

Merge tag 'x86-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:

 - Select the BHI mitigation based on the attack vector properly
   (Breno Leitao)

 - Fix i386-gcov build bug in csum_ipv6_magic() due to overly
   strict asm constraints that cannot be met in that build mode
   (Rosen Penev)

 - Fix Vmware-guest i386 high-bandwidth hypercall arguments
   under UNWINDER_GUESS & disabled frame-pointers (Zack Rusin)

 - Fix resctrl AMD ABMC counter ID field width (Babu Moger)

 - Fix restctrl pqos tool ABI breakage by reverting the
   mbm_assign_mode to default mode at boot (Babu Moger)


    [36 lines not shown]
DeltaFile
+51-36Documentation/filesystems/resctrl.rst
+22-4arch/x86/entry/syscall_64.c
+14-10arch/x86/include/asm/vmware.h
+7-13arch/x86/virt/svm/sev.c
+11-5arch/x86/mm/tlb.c
+5-7arch/x86/kernel/cpu/bugs.c
+110-7510 files not shown
+137-8416 files

Linux/linux 2ebb9de — kernel/sched pelt.c deadline.c

Merge tag 'sched-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fixes from Ingo Molnar:

 - Fix this_bw on class change of a dying SCHED_DEADLINE task
   (Nickolai Zeldovich)

 - Account I/O waits independently of delayed dequeue
   (Christian Loehle)

 - Clear throttle state when leaving the fair class (Daehyeon Ko)

 - Fix u32 truncation of the PELT period count (Hui Su)

 - Fix imbalanced cluster static-key updates that can mistakenly
   disable cluster-aware scheduling (Hui Su)

 - Fix active load balancing logic to ignore non-fair current
   in alb_break_llc() (Kayra Cizmeci)

    [8 lines not shown]
DeltaFile
+20-13kernel/sched/core.c
+14-2kernel/sched/topology.c
+10-3kernel/sched/fair.c
+0-5kernel/sched/sched.h
+1-1kernel/sched/pelt.c
+1-1kernel/sched/deadline.c
+46-251 files not shown
+48-257 files

Linux/linux 40f3717 — arch/x86/events/amd ibs.c, arch/x86/events/intel pt.c

Merge tag 'perf-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Fix sideband event output when only requesting attr.defer_output
   (Ian Rogers)

 - Clamp deferred callchain entry count to fit u16 header.size
   (Ian Rogers)

 - Various AMD IBS fixes (Ravi Bangoria):
    - Reset CPU0 IBS state on syscore resume
    - Fix kernel address leak via REGS_USER and REGS_INTR
    - Simplify/fix event state handling with IBS_CAPS_DIS

 - Revert AUX page allocation order default to be continuous (Leo Yan)

 - Don't send SIGTRAP after exec removed the event (Danish Khateeb)


    [8 lines not shown]
DeltaFile
+174-25arch/x86/events/amd/ibs.c
+26-11kernel/events/core.c
+9-20kernel/events/ring_buffer.c
+8-3include/linux/perf_event.h
+0-2arch/x86/events/intel/pt.c
+217-615 files

Linux/linux d1829eb — kernel/locking lockdep.c osq_lock.c

Merge tag 'locking-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fixes from Ingo Molnar:

 - Fix lockdep message output (Zhuangzhuang Wang)

 - Fix OSQ memory ordering bugs, one of which can cause
   unlink queue corruption (Peter Zijlstra)

* tag 'locking-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking/osq: Fix unlink queue corruption
  locking/osq: Switch osq_wait_next()/atomic_cmpxchg() ordering
  locking/lockdep: Fix inverted "on"/"last" CPU label in lockdep_print_held_locks()
DeltaFile
+46-16kernel/locking/osq_lock.c
+1-1kernel/locking/lockdep.c
+47-172 files

Linux/linux bef911b — rust Makefile, rust/kernel cpufreq.rs

Merge tag 'rust-fixes-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Fix build error with bindgen 0.73 in certain configs such as
     allmodconfig by deriving 'Zeroable' for opaque array wrappers.

  'kernel' crate:

   - 'cpufreq' module: clean 'undocumented_unsafe_blocks' Clippy warning
     for Rust <= 1.86"

* tag 'rust-fixes-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: bindings: derive Zeroable for bindgen's opaque array wrappers
  rust: cpufreq: fix `undocumented_unsafe_blocks` in `PolicyCpu::from_cpu()`
DeltaFile
+8-1rust/Makefile
+2-2rust/kernel/cpufreq.rs
+10-32 files

Linux/linux fa4ad79 — fs/btrfs volumes.c defrag.c

Merge tag 'for-7.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:
 "A btrfs fixes. The ones that could have some user noticeable impact
  are enumerated, the rest is one-liners.

   - fix chattr failing on files with nodatasum and compress flags

   - fix inode defrag status with concurrent truncation so it's not
     skipped in defrag in the future

   - fix merging compressed extent in fiemap output

   - fix deleting wrong subvolume by id if it gets renamed during the
     ioctl

   - error handling fixes: sysfs, quotas, fs-verity, scrub, zoned mode"

* tag 'for-7.4-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:

    [16 lines not shown]
DeltaFile
+24-0fs/btrfs/ioctl.c
+17-5fs/btrfs/scrub.c
+20-0fs/btrfs/disk-io.c
+7-5fs/btrfs/qgroup.c
+10-1fs/btrfs/defrag.c
+6-1fs/btrfs/volumes.c
+84-125 files not shown
+97-1511 files

Linux/linux 7f75cd8 — fs/smb/server smb2pdu.c smbacl.c, fs/smb/server/mgmt user_session.c

Merge tag 'ksmbd-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb

Pull smb server updates from Namjae Jeon:

 - Validate EA-name NUL termination to prevent out-of-bounds reads in
   debug logging. Return STATUS_EA_LIST_INCONSISTENT for malformed EA
   names in CREATE and SET_INFO requests.

 - Grant the owner's implicit READ_CONTROL and WRITE_DAC rights when no
   ACE names it, including MAXIMUM_ALLOWED handling, while respecting
   applicable OWNER RIGHTS ACEs.

 - Check group membership before granting permissions from a POSIX ACL
   group entry, preventing unintended access when a caller's UID matches
   the group's numeric GID.

 - Avoid reading past the DACL when logging an access denial by printing
   the requested and allowed access masks instead.


    [23 lines not shown]
DeltaFile
+36-7fs/smb/server/smbacl.c
+31-3fs/smb/server/smb2pdu.c
+4-0fs/smb/server/mgmt/user_session.c
+71-103 files

Linux/linux 12419f3 — fs/ntfs index.h ea.c

Merge tag 'ntfs-for-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs

Pull ntfs fixes from Namjae Jeon:

 - Don't allow compression to be enabled through system.ntfs_attrib on
   volumes with clusters larger than 4 KiB, preventing out-of-bounds
   accesses in the compressed read path.

 - Don't allow resident attribute values to overlap the attribute
   header, preventing malformed records from causing writes outside the
   MFT record buffer.

 - Fix recursive acquisition of the mapping invalidate lock when writing
   to non-resident named streams through NTFS_IOC_STREAM_WRITE.

 - Keep the file size unchanged when extending the initialized size
   fails, avoiding unintended truncation and page-cache removal.

 - Avoid integer overflow when limiting attribute reads to the attribute

    [21 lines not shown]
DeltaFile
+39-2fs/ntfs/index.c
+29-9fs/ntfs/inode.c
+6-3fs/ntfs/attrib.c
+4-2fs/ntfs/namei.c
+5-0fs/ntfs/ea.c
+1-0fs/ntfs/index.h
+84-166 files

Linux/linux a41e364 — drivers/scsi BusLogic.c, drivers/scsi/aic7xxx aic7xxx_core.c aic7xxx_pci.c

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Mostly fixes in drivers.

  The three core changes are moving the target reap into the main exit
  path of pseudo device allocation to fix a leak and a couple of minor
  error propagation updates in bsg.

  The largest driver fix is the rethreading of Buslogic to enable
  context locking that was held back from the merge window pull due to
  problems spotted by the maintainer"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store
  scsi: target: Verify the iSCSI ISID is null-terminated
  scsi: bsg: Report io_uring data copyback failures
  scsi: bsg: Report synchronous data copyback failures
  scsi: target: Validate REGISTER AND MOVE TransportID length

    [12 lines not shown]
DeltaFile
+59-40drivers/scsi/BusLogic.c
+21-5drivers/scsi/aic7xxx/aic79xx_osm.h
+19-1drivers/scsi/aic7xxx/aic7xxx_pci.c
+13-5drivers/ufs/core/ufshcd.c
+15-3drivers/target/target_core_device.c
+7-3drivers/scsi/aic7xxx/aic7xxx_core.c
+134-5712 files not shown
+180-7318 files

Linux/linux c1c70a8 — drivers/spi spi-pic32-sqi.c spi-cadence-quadspi.c

Merge tag 'spi-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "As well as a few driver specific fixes we have a couple of core fixes
  here.

  One avoids requesting interrupts until we have validated that we have
  a SPI device, avoiding triggering warnings on boot.

  The other avoids a request for a zero length scatterlist triggering a
  BUG_ON() in swiotlb on 64k page systems, this was due to using both
  DIV_ROUND_UP() and min() to compute lengths"

* tag 'spi-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: cadence-quadspi: Fix race between DMA completion and transfer start
  spi: ljca: Don't require data in write replies
  spi: acpi: only look up the IRQ of confirmed SPI devices
  spi: pic32-sqi: fail transfer when the BD ring is exhausted
  spi: fix zero-length scatterlist entries for vmalloc buffers

    [2 lines not shown]
DeltaFile
+46-10drivers/spi/spi.c
+10-14drivers/spi/spi-amd.c
+13-0drivers/spi/spi-rtk-nor.c
+3-2drivers/spi/spi-ljca.c
+2-2drivers/spi/spi-cadence-quadspi.c
+2-1drivers/spi/spi-pic32-sqi.c
+76-296 files

Linux/linux 91fd3a1 — drivers/regulator Kconfig qcom_spmi-regulator.c, include/linux/regulator mt6363-regulator.h

Merge tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "A small collection of mostly fairly standard driver specific fixes.

  The mt6363 changes are a little large but are the result of two
  independent users running into the same issues and testing each
  other's changes so given that it's only -rc1 it seemed sensible to
  take the changes as fixes"

* tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: mt6363: Fix VEMC voltage selection
  regulator: mt6363: Use 8-bit register values
  regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs
  regulator: qcom_spmi: don't take a sleeping lock in the SAW IPI
DeltaFile
+52-104drivers/regulator/mt6363-regulator.c
+27-8drivers/regulator/qcom_spmi-regulator.c
+1-0include/linux/regulator/mt6363-regulator.h
+1-0drivers/regulator/Kconfig
+81-1124 files

Linux/linux d164c7d — Documentation/devicetree/bindings/pwm raspberrypi,rp1-pwm.yaml, Documentation/devicetree/bindings/usb cypress,hx3.yaml altr,agilex5-dwc3.yaml

Merge tag 'devicetree-fixes-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

Pull devicetree fixes from Rob Herring:
 "All of these are patches that didn't get picked up for the merge
  window. They all fix new warnings because the corresponding .dts
  changes did get applied

   - Add Altera Agilex5 DWC3 controller and Raspberry Pi RP1 PWM
     controller bindings

   - Make "peer-hub" property optional on cypress,hx3 USB hubs"

* tag 'devicetree-fixes-for-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  dt-bindings: usb: add Altera Agilex5 DWC3 controller
  dt-bindings: pwm: Add Raspberry Pi RP1 PWM controller
  dt-bindings: usb: cypress,hx3: make peer-hub property optional
DeltaFile
+112-0Documentation/devicetree/bindings/usb/altr,agilex5-dwc3.yaml
+66-0Documentation/devicetree/bindings/pwm/raspberrypi,rp1-pwm.yaml
+0-1Documentation/devicetree/bindings/usb/cypress,hx3.yaml
+178-13 files

Linux/linux fd7e9dc — sound/hda/codecs ca0132.c, sound/hda/codecs/hdmi nvhdmi.c

Merge tag 'sound-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of (unsurprisingly high amount of) small fixes since the
  previous PR. Majority of changes are device-specific quirks and driver
  fixes, along with a few ALSA core fixes and USB-audio driver
  hardening.

  ALSA Core:
   - Fix page leak on WC DMA buffer allocation failure
   - Prevent O_APPEND on OSS streams to avoid UAF
   - A PCM regression fix for PulseAudio to allow hw_refine with mmap
   - Serialize DSP image loading requests in hwdep
   - Clear user-provided numid before adding a control
   - Fix dropped data bytes in UMP to MIDI 1.0 System message conversion

  HD-audio:
   - Fix double-free on stream page allocation failure in core
   - Stop capability walk cleanly on empty capability header

    [52 lines not shown]
DeltaFile
+97-0sound/hda/codecs/hdmi/nvhdmi.c
+67-0sound/soc/codecs/cs35l41-lib.c
+41-2sound/hda/codecs/ca0132.c
+42-1sound/usb/usx2y/usbusx2yaudio.c
+31-10sound/hda/codecs/realtek/alc269.c
+35-0sound/soc/amd/acp-config.c
+313-1354 files not shown
+701-19260 files

Linux/linux 5cdc374 — arch/x86/mm tlb.c

x86/mm: Fix global ASID handed out to two processes

On AMD CPUs with INVLPGB, two live processes can get the same MAX_ASID_AVAILABLE
global ASID value. The two then hit each other's TLB entries, so each can read
or corrupt the other's memory.

The global ASID space is managed lazily. When a global ASID is freed, its bit is
set in the global_asid_freed bitmap. Once the free ASID search reaches the end
of the global_asid_used bitmap, a global flush is done to really reclaim the
lazily freed global ASIDs.

However, the current code can assign the same global ASID to two different
processes, if one process is assigned MAX_ASID_AVAILABLE - 1, another process
MAX_ASID_AVAILABLE, and both stick around (keeping their global ASID numbers in
use) until the search wraps around again.  At that point a third process could
also get assigned MAX_ASID_AVAILABLE.

    the highest ASID stays in use, so it is not handed out again
      last_global_asid stays below it, so no reset

    [25 lines not shown]
DeltaFile
+11-5arch/x86/mm/tlb.c
+11-51 files

Linux/linux 543b7d2 — drivers/gpu/drm/amd/amdgpu amdgpu_vcn.c amdgpu_device.c, drivers/gpu/drm/etnaviv etnaviv_buffer.c

Merge tag 'drm-fixes-2026-11-07' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "This is the weekly drm fixes, amdgpu leading the way with some i915,
  nouveau and other fixes.

  There should be a bunch of xe fixes, but their tree got screwed up so
  I guess I'll send those next week once they cleanup whatever happened.

  atomic:
   - Fix CRTC dma-fence handling

  drm:
   - Add parsing for additional HDMI 2.2 FRL rates

  bridge:
   - nwl-dsi: Fix LCDIF handling

  dma-buf:

    [105 lines not shown]
DeltaFile
+43-53drivers/gpu/drm/i915/display/intel_psr.c
+40-4drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+22-19drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+40-1drivers/gpu/drm/amd/amdgpu/navi10_ih.c
+18-22drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+35-1drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+198-100116 files not shown
+1,123-470122 files

Linux/linux a4845f0 — drivers/ata libata-scsi.c

ata: libata-scsi: reject data-in commands with a data-out buffer

SG_IO can submit a data-in SCSI command with DMA_TO_DEVICE. The
scatterlist can then contain pages pinned without write access.
ata_scsi_rbuf_fill() writes simulated replies to that scatterlist;
in the reported case, the copy tried to write the shared zero page
and faulted in the kernel.

The same mismatch can affect SG_IO commands translated by libata.
ZBC IN and GET PHYSICAL ELEMENT STATUS completion handlers can modify
the receive buffer even if the drive aborts the command. For ATAPI,
the successful INQUIRY completion also rewrites the buffer in
atapi_fixup_inquiry().

Reject these mismatched commands before the buffer is written or the
command is issued. Report ABORTED COMMAND / DATA IN BUFFER ERROR because
the CDB itself can be valid; the supplied transfer direction is wrong.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

    [8 lines not shown]
DeltaFile
+28-0drivers/ata/libata-scsi.c
+28-01 files

Linux/linux 6b67cdb — drivers/ata libata-pmp.c

ata: libata-pmp: disable the SEMB port on Marvell 88SM9705

The Marvell 88SM9705 is a 1-to-5 SATA port multiplier with one
additional SEMB (SATA Enclosure Management Bridge) port [1].  Ports
0-4 are device ports and port 5 is the SEMB.  The number of fan-out
ports in GSCR[2] is 6 when the SEMB is enabled and 5 when it is not,
so on boards without the SEMB there is no link 5 and this quirk does
nothing.  That includes the common 8-port PCIe cards that pair an
88SE9215 with an 88SM9705, which report 5 ports.

The SEMB port never answers SRST.  libata probes it like a device
port, and every EH round on the PMP ends in a retry loop that lasts
about a minute before EH gives up, then starts over:

  ata19.15: Port Multiplier 1.2, 0x1b4b:0x9705 r160, 6 ports, feat 0x1/0x1f
  ata19.05: hard resetting link
  ata19.05: failed to resume link (SControl 0)
  ata19.05: softreset failed (1st FIS failed)
  ata19.05: hard resetting link

    [36 lines not shown]
DeltaFile
+14-0drivers/ata/libata-pmp.c
+14-01 files

Linux/linux 0fdb8ee — drivers/ata libata-scsi.c

ata: libata-scsi: pass the whole mode page to the MODE SELECT handlers

ata_scsi_mode_select_xlat() strips the mode page header before calling
the mode page handlers, which report the position of an invalid field
as an offset relative to the mode page data. It then converts this
offset into an offset in the parameter list by adding the length of the
mode parameter header and of the block descriptors, but not the length
of the mode page header. As a result, the FIELD POINTER of the INVALID
FIELD IN PARAMETER LIST sense data points 2 bytes (page_0 format) or 4
bytes (sub_page format) before the byte that is actually invalid. For
example, changing byte 3 of the caching mode page in a MODE SELECT(10)
parameter list without block descriptors reports byte 9 instead of
byte 11.

Pass the whole mode page, starting with its mode page header, to the
handlers instead, like the ata_msense_*() functions, which generate the
whole mode page. Offsets in buf are then the byte numbers of the mode
page, as used in the mode page definitions of SPC, SBC and SAT, the
handlers can compare buf with the mode page generated by the matching

    [14 lines not shown]
DeltaFile
+82-51drivers/ata/libata-scsi.c
+82-511 files

Linux/linux 2a4c61c — drivers/ata libata-scsi.c

ata: libata-scsi: fix MODE SELECT field pointer for unsupported subpages

When the mode page of a MODE SELECT parameter list has an unsupported
SUBPAGE CODE, ata_scsi_mode_select_xlat() sets the FIELD POINTER of the
INVALID FIELD IN PARAMETER LIST sense data to the SUBPAGE CODE byte of
the mode page header (byte 1 of the page) if the SPF bit is set, and to
the PAGE CODE byte (byte 0 of the page) otherwise.

However, the SPF bit is tested on p[0] after p has already been advanced
past the mode page header, so the test reads bit 6 of the first byte of
the mode page data instead. If the parameter list ends with the mode
page header, it even reads the byte that follows the parameter list in
buffer, which is not initialized when no data beyond the parameter list
was transferred.

The test is not needed anyway: spg can only be non-zero for a mode page
in sub_page format, i.e. with the SPF bit set, and the field in error is
the SUBPAGE CODE. Always set the FIELD POINTER to the SUBPAGE CODE byte,
which follows the mode parameter header, the block descriptors and the

    [6 lines not shown]
DeltaFile
+1-2drivers/ata/libata-scsi.c
+1-21 files

Linux/linux a1eb72c — drivers/ata libata-scsi.c

ata: libata-scsi: reject MODE SELECT mode pages with a wrong SPF bit

ata_scsi_mode_select_xlat() accepts the caching and control mode pages
both in page_0 format and in sub_page format with SUBPAGE CODE 00h.

However, SAT-2 and later versions of SAT define the SPF bit of the
Caching mode page and of the Control mode page as not changeable and
set to zero (see SAT-6, 10.4.9 and 10.4.6), and SPC-7 (6.12, MODE
SELECT(10) command) requires the device server to terminate a MODE
SELECT command with INVALID FIELD IN PARAMETER LIST if the application
client sets any field that is reported as not changeable to a value
other than its current value.

Reject a mode page with the SPF bit set to one and SUBPAGE CODE 00h,
with the FIELD POINTER set to the byte containing the SPF bit. The only
mode page with the SPF bit set to one that remains accepted is the ATA
Feature Control mode page (control mode page, sub-page f2h), for which
SAT-6 (12.3.4) requires the SPF bit to be set to one. The opposite case
does not need a check: a mode page in page_0 format always has subpage

    [8 lines not shown]
DeltaFile
+10-0drivers/ata/libata-scsi.c
+10-01 files

Linux/linux 7c972e7 — drivers/ata libata-scsi.c

ata: libata-scsi: set the field pointer when rejecting CDL

ata_mselect_control_ata_feature() rejects enabling CDL while NCQ
priority is enabled, but unlike its other error branches it returns
without setting *fp.

ata_scsi_mode_select_xlat() initializes fp to 0xffff and, when the
handler fails, adds the offset of the mode page in the parameter list
to it, i.e. the length of the mode parameter header and of the block
descriptors. As fp is a u16, this wraps around, so the resulting sense
data reports the byte before the mode page, i.e. the last byte of the
mode parameter header or of the block descriptors, as the FIELD
POINTER, instead of the byte containing the CDL_CTRL field that
requests enabling CDL.

Set *fp to 4, i.e. to the byte containing the CDL_CTRL field, like the
branch rejecting an invalid CDL_CTRL value does.

Fixes: df60f9c64576 ("scsi: ata: libata: Add ATA feature control sub-page translation")

    [5 lines not shown]
DeltaFile
+1-0drivers/ata/libata-scsi.c
+1-01 files

Linux/linux a3e52dc — drivers/ata libata-scsi.c

ata: libata-scsi: fix MODE SELECT field pointer for block descriptor length

ata_scsi_mode_select_xlat() only accepts MODE SELECT parameter lists
without block descriptors or with a single 8 byte block descriptor. For
any other BLOCK DESCRIPTOR LENGTH, it terminates the command with
INVALID FIELD IN PARAMETER LIST, and the FIELD POINTER should point at
the BLOCK DESCRIPTOR LENGTH field, i.e. at byte 3 of the mode parameter
header(6) or at byte 6 of the mode parameter header(10), as SPC requires
the FIELD POINTER of a multiple-byte field to point at its first byte.

However, the mode parameter header length and the BLOCK DESCRIPTOR
LENGTH are added to the offset of the field, so the FIELD POINTER points
3 or 6 bytes after the end of the block descriptors instead. For
example, a MODE SELECT(10) with a BLOCK DESCRIPTOR LENGTH of 16 reports
byte 30 instead of byte 6.

Do not add the mode parameter header length and the BLOCK DESCRIPTOR
LENGTH to the offset of the BLOCK DESCRIPTOR LENGTH field.


    [4 lines not shown]
DeltaFile
+0-1drivers/ata/libata-scsi.c
+0-11 files

Linux/linux b29c40d — drivers/ata libata-scsi.c

ata: libata-scsi: do not accept subpage code FFh in MODE SELECT

When the SUBPAGE CODE of the mode page in a MODE SELECT parameter list
is FFh, ata_scsi_mode_select_xlat() rejects it for the control mode
page, but accepts it for all other mode pages, i.e. for the caching
mode page, the only other mode page that it supports.

However, FFh is not the subpage code of an actual mode page: SPC-7
(7.5.2) only defines it as the MODE SENSE request code for all
subpages. SUBPAGE CODE FFh only means "all subpages" in requests, i.e.
in the MODE SENSE CDB for mode pages and in the LOG SELECT CDB for log
pages (see SPC-5, 6.8), while the SUBPAGE CODE of a mode page in a MODE
SELECT parameter list identifies a specific mode page. Also, SAT-2 and
later versions of SAT define the Caching mode page with the SPF bit set
to zero (see SAT-6, 10.4.9), i.e. without a SUBPAGE CODE field.

Remove the ALL_SUB_MPAGES case, so that SUBPAGE CODE FFh is rejected
like any other unsupported subpage.


    [4 lines not shown]
DeltaFile
+2-10drivers/ata/libata-scsi.c
+2-101 files

Linux/linux 6fde044 — drivers/ata libata-scsi.c

ata: libata-scsi: fix MODE SELECT handling of data after the mode page

ata_scsi_mode_select_xlat() only supports one mode page per MODE SELECT
command, and rejects a parameter list with data after the mode page with
INVALID FIELD IN PARAMETER LIST. However:

- It does not set the field pointer, so the sense data reports 0xffff as
  the FIELD POINTER.

- It only checks for data after the mode page after the mode page
  handler has been called. ata_mselect_control_ata_feature() has then
  already updated the CDL enabled flag of the device, even though the
  command is rejected and the CDL setting of the device is not changed.

- For the control mode page, ata_mselect_control_spg0() does not need an
  ATA command, so the check is skipped, and the data after the mode page
  is silently ignored.

Check for data after the mode page before calling the mode page

    [11 lines not shown]
DeltaFile
+11-7drivers/ata/libata-scsi.c
+11-71 files

Linux/linux d487237 — arch/arm64/include/asm suspend.h sdei.h, arch/arm64/kernel entry-common.c sdei.c

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Catalin Marinas:
 "Fix SDEI (software delegated exception interface) handlers taking
  nested exceptions (looping on the KPTI trampoline vectors and
  clobbering the interrupted context's exception registers), TPIDR2_EL0
  preservation across CPU suspend, a kexec_file_load() memory leak and
  an overflow in the /dev/mem valid_mmap_phys_addr_range() check:

   - Fix nested exceptions taken by SDEI event handlers.

     With KPTI, an event interrupting user space left the trampoline
     vectors installed and any exception in the handler looped forever.
     Also save and restore ELR/SPSR/ESR/FAR around the handler since an
     event can interrupt exception entry or return where these registers
     are live

   - Save and restore TPIDR2_EL0 across CPU suspend.


    [15 lines not shown]
DeltaFile
+48-11arch/arm64/kernel/sdei.c
+39-1arch/arm64/kernel/entry-common.c
+8-0arch/arm64/mm/proc.S
+3-1arch/arm64/mm/mmap.c
+2-1arch/arm64/include/asm/sdei.h
+1-1arch/arm64/include/asm/suspend.h
+101-151 files not shown
+103-157 files

Linux/linux bdeb84e — . MAINTAINERS, kernel/printk printk_ringbuffer.c printk.c

Merge tag 'printk-for-7.4-fixups' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux

Pull printk fixes from Petr Mladek:

 - Prevent possible use-after-free when printk kthreads
   could not be created

 - Fix computation of the free space when allocating a
   bigger ring buffer

 - Add info about the new printk mailing list for
   printk-related subsystems

* tag 'printk-for-7.4-fixups' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  printk: Avoid multiple unregistration in unregister_console_locked()
  MAINTAINERS: Add new "printk" mailing list for PRINTK, PRINTK INDEXING, and VSPRINTF
  printk_ringbuffer: Fix space_used() when blk_lpos->next overflows
DeltaFile
+30-4kernel/printk/printk.c
+3-5kernel/printk/printk_ringbuffer.c
+3-0MAINTAINERS
+36-93 files