Merge tag 'power-utilities-2026.10.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
Pull x86 power utilities updates from Len Brown:
"Turbostat:
- Fix --cpu option to work more than once
- Fix --Joules option to work with --show power
- Remove hard-coded 8192-CPU limit
- Decode Uncore Frequency Agent Types
- Dump RDT (Resource Director Technology) config
- Dump RP (Resource Priority) config
- Recognize Rugged Panther Lake
- Fix PMT mmap size, bounds check, and mask computation
- Misc cleanups and minor fixes
x86_energy_perf_policy:
- Harden input parsing and bounds checks
- Fix optarg keyword matching
- Rewrite MSR device path discovery
- Misc cleanups and minor fixes"
[23 lines not shown]
Merge tag 'sound-fix-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of fixes across the sound subsystem. Nothing particularly
stands out, mostly driver- and device-specific fixes along with a few
race / UAF fixes and cleanups. Here are some highlights:
ALSA core:
- Fix potential race in PCM proc handling at disconnection
- Fix potential race in UMP sequencer callback at releasing
HD-audio:
- Reject codec reset/reconfig on ASoC buses to prevent deadlock
- Force MSI for Hygon H34M51A board
- Usual Realtek quirks for ASUS and HP laptops/AiO
USB-audio:
- Bound packet copies by PCM buffer size in generic and ua101 drivers
- Rate-limit URB submission errors at stream start
[47 lines not shown]
Merge tag 'ovl-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fixes for bugs found by Chris Mason's AI review, several of them
reachable by unprivileged users: an info leak, use-after-free and
NULL deref bugs, an RCU walk stall with remote layers and data loss
with nfs_export
- Fix copy up of files with an empty security.capability xattr, which
any user could set to block copy up
- Fix a regression from v6.16 with the override_creds mount option
- Two casefold fixes
* tag 'ovl-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
ovl: check the casefold flag of directories only
ovl: reserve space for the casefolded name terminator
[18 lines not shown]
tools/power x86_energy_perf_policy: Version 2026.10.31
Since 2026.04.25:
Harden input parsing and bounds checks.
Fix optarg keyword matching.
Rewrite MSR device path discovery.
Misc cleanups and minor fixes.
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Version 2026.10.31
Since version 2026.09.28:
Fix --cpu option to work more than once.
Fix --Joules option to work with --show power.
Remove hard-coded 8192-CPU limit.
Decode Uncore Frequency Agent Types.
Dump RDT (Resource Director Technology) config.
Dump RP (Resource Priority) config.
Recognize Rugged Panther Lake.
Fix PMT mmap size, bounds check, and mask computation.
Misc cleanups and minor fixes.
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Fix undefined behavior in pmt_gen_value_mask()
The function uses plain int literal '1' for bit shifting, which causes
undefined behavior when msb >= 31. This is because shifting a 32-bit int
by 32 or more bits is undefined behavior in C. Fix by using 1ULL
(unsigned long long) instead of 1 to ensure 64-bit arithmetic on all
platforms.
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar at intel.com>
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Fix PMT mmap size and bounds check
Remove assert(offset == 0), to allow non-zero PMT offsets.
Fix the pmt_mmio_open() mapping to round-up (offset + size).
Fix the offset bounds check to disallow running past the end of the region.
[lenb: commit message re-write]
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar at intel.com>
Signed-off-by: Len Brown <len.brown at intel.com>
tools/power turbostat: Fix --Joules when used with --show power
The "--Joules" option displays energy in Joules,
replacing the same metrics displayed as power in Watts.
But when used with --show power, it deletes the power
metrics without replacing them with their energy counterparts:
$ sudo ./turbostat -q --list --show power --Joules
CoreTmp,PkgTmp,RAM_J,PKG_%,RAM_%
Fix it thus:
$ sudo ./turbostat -q --list --show power --Joules
CoreTmp,PkgTmp,Pkg_J,Cor_J,GFX_J,RAM_J,PKG_%,RAM_%,Sys_J
Signed-off-by: Len Brown <len.brown at intel.com>
Merge tag 'asoc-fix-v7.4-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v7.4
A moderately large collection of fixes and quirks that have come in
during the merge window, everything here is driver specific and none of
it unusually severe.
Merge tag 'ksmbd-for-7.4-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server fixes from Namjae Jeon:
- Fix compound CREATE response buffer sizing and reserve space for
final response padding to prevent buffer overflows and out-of-bounds
reads
- Allocate sufficient space for UTF-16 directory-name conversion,
including the terminating NUL
- Fix an RDMA transfer length underflow that can cause out-of-bounds
reads or writes when processing multiple remote buffer descriptors
- Fix use-after-free bugs during failed durable reconnect cleanup and
AppInstanceId supersede racing with session teardown
- Keep retry timeout clamp bounds constant to fix a MIPS build failure
with CONFIG_HZ=1024
[33 lines not shown]
Merge tag 'perf-tools-for-v7.4-1-2026-10-30' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next
Pull perf tool updates from Arnaldo Carvalho de Melo:
- Support instruction tracking on arm64 for data type profiling,
resolving stack, global, per-CPU and 'current' variable accesses, so
that 'perf annotate --data-type' resolves types on arm64 the way it
does on x86.
- Port the Python scripts to the perf module and standalone execution,
and improve the module: lazy sample callchains and event copies, GIL
handling, better session/thread lookup, new treport, flamegraph and
sqlite/postgres exporters.
- Reenable and fix the attribute expectation test suite: per-PMU bit
masks, other core PMUs' events, dummy tracking events, group checks
and spelled out skip reasons.
- perf trace: filter the target's tasks in BPF, open the BPF output
[94 lines not shown]
Merge tag 'apparmor-pr-2026-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor
Pull AppArmor fixes from John Johansen:
"Leaks:
- fix a leak on a rejected string table entry
- fix refcount leak in aa_get_newest_profile()
- fix profile leak when a policy load fails
- remove fs entries created by a failed policy load
- on failed load ensure profile files are removed before parent
- Fix namespace reference leak in __aa_find_or_create_ns()
Use after free/double free:
- fix a use-after-free in aa_lookupn_ns()
- avoid potential double free when remapping DFA tables
Bounds checking by-passes:
- fix table_size() integer overflow on 32 bit
- check accept index + 1 is in bounds
[48 lines not shown]
Merge tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull more driver core fixes from Danilo Krummrich:
- Revert TAINT_FORCED_BIND, introduced to flag manual sysfs bind/unbind
operations associated with misleading fuzzing reports. It also taints
established workflows, including VFIO device passthrough; a more
targeted approach will be revisited after 7.4.
- Rate limit synthetic uevent failure messages to prevent log flooding
from repeated invalid writes to sysfs uevent files
* tag 'driver-core-7.4-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers"
driver core: Limit the messages on a refused uevent
Merge branch 'fixes-from-sasha'
Misc fixes for this merge window from Sasha Levin that were posted for
issues found in linux-next but not picked up by maintainers.
In an almost certainly futile attempt to clean up the disaster area that
is my inbox, I'm merging them directly rather than leaving them pending
and wait for them to come in through the proper channels.
* fixes-from-sasha:
selftests/fuse: add the missing symlink caching test
fuse: fix link error with CONFIG_FUSE_PASSTHROUGH=n
xprtrdma: fix up the nfs/nfs-anna merge of the Write chunk head trim
selftests/fuse: add the missing symlink caching test
Commit 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
registered fuse_symlink_cache_test in the fuse selftest Makefile and
.gitignore, but the test source was not part of the applied commit, so
building the fuse selftests fails:
make[1]: *** No rule to make target 'fuse_symlink_cache_test.c', needed by '.../fuse_symlink_cache_test'.
Add fuse_symlink_cache_test.c as posted in Luis Henriques's v5
submission. The test serves a file and a symlink to it from a libfuse
low-level filesystem, resolves the symlink 100 times, and counts the
readlink requests that reach the server: one when FUSE_CAP_CACHE_SYMLINKS
is set during FUSE_INIT, and all 100 when it is not.
Fixes: 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
Reported-by: kernel test robot <lkp at intel.com>
Closes: https://lore.kernel.org/r/202610170822.oEJ1Autq-lkp@intel.com/
Link: https://lore.kernel.org/r/20261001164916.15311-8-luis@igalia.com
[4 lines not shown]
fuse: fix link error with CONFIG_FUSE_PASSTHROUGH=n
Commit 2f19d54c055d ("fuse: support 64 bit, server allocated backing ID")
moved the CONFIG_FUSE_PASSTHROUGH check out of the backing ioctl handlers
and into fuse_get_conn_for_passthrough(). The calls from the handlers
into backing.c, which is only built with CONFIG_FUSE_PASSTHROUGH, are now
only removed if the compiler inlines that helper. It does not have to,
and with gcc 11 and CONFIG_CC_OPTIMIZE_FOR_SIZE it doesn't:
dev.c:(.text+0x355c): undefined reference to `fuse_backing_open'
nios2-linux-ld: dev.c:(.text+0x3594): undefined reference to `fuse_backing_open_64'
nios2-linux-ld: dev.c:(.text+0x35d0): undefined reference to `fuse_backing_close'
Check CONFIG_FUSE_PASSTHROUGH in each handler again, as
fuse_notify_backing_remove() does. The check still comes after the
fuse_get_dev() and -ENOTCONN checks, so the errors userspace sees do not
change.
Fixes: 2f19d54c055d ("fuse: support 64 bit, server allocated backing ID")
[5 lines not shown]
xprtrdma: fix up the nfs/nfs-anna merge of the Write chunk head trim
Two fixes for the same Write chunk payload corruption meet in
linux-next. In the nfs tree, commit a0db57fee35e ("xprtrdma: Fix Write
chunk payload corruption on a short reply header") trims
head[0].iov_len in rpcrdma_decode_msg(). In the nfs-anna tree,
commit 9ee534a75912 ("xprtrdma: trim head iovec when the payload
arrives via a Write chunk") trims it in rpcrdma_inline_fixup() and
reduces buflen by the same amount.
The merge resolution keeps the caller-side trim. By the time
rpcrdma_inline_fixup() runs, head[0].iov_len already equals copy_len,
so the block added by the nfs-anna commit never runs and its buflen
reduction in rq_rcv_buf and rq_private_buf is lost. The helper is also
still passed xdr_pad_size(writelist), while its kernel-doc now
describes @writelist as the number of bytes conveyed by the Write
chunk.
Drop the caller-side trim and pass the full Write chunk length, so
[12 lines not shown]
Merge tag 'kbuild-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fixes from Nathan Chancellor:
- Move probing of '-mfentry' back into Makefile instead of Kconfig
because it does not interact well with toolchains that support
multiple bit widths
- Add a big comment in scripts/Kconfig.toolchain of two pitfalls when
moving cc-option checks from Kbuild to Kconfig
* tag 'kbuild-fixes-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild
kbuild: Move testing of '-mfentry' back to Makefile from Kconfig
Merge tag 'ktest-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest
Pull ktest updates from Steven Rostedt:
- Sort configs before writing config file
Currently the .config file is created from the perl hash array from
reading the applied min-configs. The order is determined by how perl
hashes the values. This causes the .config file to be created in
different orders for each run, and the order may determine the final
value of the .config file after it goes through a make oldconfig.
Sort the values when creating the .config so that the result is the
same for every run.
- Add total test time to run output
Have ktest display the total test time of running all the tests. This
is useful to find issues in the build, install, boot or test run
[19 lines not shown]
Merge tag 'cifs-fixes-7.4-rc1' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara:
- Validate the offsets and lengths a server puts in its responses
before using them, so that a malicious or broken server can no longer
make the client read past the received data:
- POSIX lock data (which leaked kernel bytes through F_GETLK)
- NT transaction responses and SMB1 EA lists (both wrapping their
pointer checks on 32-bit)
- short SESSION_SETUP responses (which sent stale buffer content
back to the server in the NTLMv2 AUTHENTICATE message)
- SMB2 READ data areas
- empty truncated fiemap responses
- Fix a heap overflow in SMB2_tcon() with UNC paths longer than
MAX_SHARENAME_LENGTH
- Fix a slab-out-of-bounds write when chmod() rewrites a security
[27 lines not shown]
Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux
Pull fsverity fixes from Eric Biggers:
"Fixes for several bugs found by LLMs:
- Fix bypass of IPE's fsverity support, and a use-after-free in
certain cases, when FS_IOC_ENABLE_VERITY fails when almost done
- Fix FS_IOC_MEASURE_VERITY and FS_IOC_READ_VERITY_METADATA to no
longer bypass Landlock and AppArmor's read permission checks
- Be robust against the filesystem returning different values for a
file's verity descriptor length in two successive queries"
* tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux:
fsverity: Set S_VERITY only after rollback is no longer possible
fsverity: Tell LSMs about signature only after verity is enabled
fsverity: Be more careful with return value of ->get_verity_descriptor()
fsverity: Explicitly require FMODE_READ to retrieve hashes
Merge tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fixes from Rafael Wysocki:
"These fix three issues related to thermal control:
- Fix CPU mask truncation in power limit trace event used by the
power allocator thermal governor (Hungyu Lin)
- Fix code indentation in create_s32_tzp_attr() and rearrange it to
use early return when applicable (Thorsten Blum)
- Allow cross builds of the Intel thermal tests (Sasha Levin)"
* tag 'thermal-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
thermal: sysfs: Fix indentation in create_s32_tzp_attr()
thermal: Fix CPU mask truncation in power limit trace event
selftests/thermal: allow cross builds of the Intel tests
Merge tag 'pm-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These address assorted issues in the power management code and update
documentation:
- Fix potential out-of-bounds access in deferred reset in the cpufreq
statistics code (Zhongqiu Han)
- Cancel HWP notify work in the intel_pstate driver cleanup to
prevent possible use-after-free from occurring (Tristan Madani)
- Adjust state names and descriptions for ACPI _LPI idle states in
the intel_idle driver to make them follow the driver's idle state
naming convention (Rafael Wysocki)
- Document the new pm_runtime_use_autosuspend() undo mechanism that
triggers automatically on driver exit (Joshua Crofts)
[14 lines not shown]
Merge tag 'acpi-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI support fixes from Rafael Wysocki:
"These address assorted issues in ACPI support code and work around
concurrency-related issues in AML on some platforms:
- Separate handler locking from sysfs lifetime in the ACPI platform
profile driver to avoid possible deadlocks due to sysfs accesses
during driver removal (Daniel Lezcano)
- Introduce additional locking around the evaluation of selected ACPI
control methods in a few places to work around issues related to
concurrency in AML on some platforms (Ali Ahmet Memiş)
- Address two issues reported by Sashiko in the ACPI table data sysfs
interface (Jamie Nguyen)
- Initialize parser_state.aml_end in acpi_install_method() properly
to avoid out-of-bounds accesses during control method installation
[11 lines not shown]
Merge branch 'thermal-intel'
Merge a fix for Intel thermal tests for 7.4-rc1:
- Allow cross builds of the Intel thermal tests (Sasha Levin)
* thermal-intel:
selftests/thermal: allow cross builds of the Intel tests
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull more KVM updates from Paolo Bonzini:
"ARM64:
- Fix a couple of embarrassing merge mistakes in kvmarm-7.4
- Cleanup the HCR_EL2 bit fields to exclusively use the generated
definitions, fixings a nasty regression introduced in 6.16, where
barriers were not upgraded from NSH to ISH anymore
- Fix publication of state when a vcpu is forced out of the guest
- Let vcpu pausing nest correctly
- Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the
architecture
- Don't warn on SMCCC filter reserved range allocation failure
[73 lines not shown]
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Three fixes that turned up during the merging window: shadow stack not
freed during a failed fork or it is unmapped from parent when a worker
thread exits (same commit covers both); PTE_CONT set on PROT_NONE
entries but subsequently ignored by the unfolding code since
pte_valid() is false (pte_present() is true); an MPAM lock not
released on the error path.
Summary:
- Release the GCS on a failed fork.
copy_thread() can allocate a GCS for CLONE_VM threads but a later
copy_process() failure left the VMA in the parent's mm. Implement
exit_thread() to free it and stop kernel threads and user workers
inheriting the parent's GCS base/size. Add a kselftest for the
clone3() failure case
[16 lines not shown]
Merge tag 'loongarch-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch updates from Huacai Chen:
- Add LoongArch-specific ACPI initialization
- Set NX compat flag in PE/COFF efi header
- Use pa_to_nid()/nid_to_addrbase() rather than hard-code
- Detect and expose LAMCAS/DIV32 feature existence
- Fix and improve perf hardware breakpoints
- Fix and improve BPF JIT (trampoline and 32-bit operations)
- Add arch_crash_save_vmcoreinfo() support
- Some bug fixes and other small changes
[23 lines not shown]
