wireguard-linux/include/linux, branch davem/net

net: iptunnel: fix stale transport header during tunnel decapsulation

2026-08-28T22:53:46Z

Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale transport_header offset after tunnel decapsulation. BUG: unable to handle page fault for address: ffffed102091a42e Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__asan_load2 qdisc_pkt_len_segs_init (net/core/dev.c:4145) __dev_queue_xmit (net/core/dev.c:4787) br_dev_queue_push_xmit (net/bridge/br_forward.c:53) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:315) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6099) __netif_receive_skb_list_core (net/core/dev.c:6287) netif_receive_skb_list_internal (net/core/dev.c:6445) napi_complete_done (net/core/dev.c:6813) gro_cell_poll (net/core/gro_cells.c:74) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7798 net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) do_softirq (kernel/softirq.c:523 kernel/softirq.c:510 ) __local_bh_enable_ip (kernel/softirq.c:450) tun_get_user (drivers/net/tun.c:1986 (discriminator 1)) tun_chr_write_iter (drivers/net/tun.c:2032) The issue is completely latent until qdisc read transport header in commit 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()"). The crash requires four conditions to line up: 1. The incoming packet is encapsulated and carries GSO metadata. The outer transport header offset is stored in skb->transport_header while the packet is still in the outer tunnel context. 2. The tunnel receiver strips the outer headers. skb->data is advanced to the inner frame, but skb->transport_header is left pointing to the now-removed outer L4 header, so it becomes a negative offset relative to the new data. 3. The inner frame is not delivered to the local IP stack. Instead, it is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and the transport header is not reset to the inner L4 offset. 4. The forwarding path calls __dev_queue_xmit(), which enters qdisc_pkt_len_segs_init(). That function computes the GSO header length from skb_transport_offset(skb). Because the offset is negative, the unsigned cast overflows and pskb_may_pull(skb, hdr_len + sizeof(struct tcphdr)) reads past the end of the skb, triggering a KASAN fault or page fault. The issue specifically requires GSO packets (shinfo->gso_size != 0), which are processed/aggregated through gro_cells. Fix this by clearing transport_header to the ~0U sentinel in gro_cell for all tunnnel driver. GTP does not support GRO/GSO, drop the evil GSO packets in GTP directly. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+83181a31faf9455499c5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69de2bee.a00a0220.475f0.0041.GAE@google.com/T/ Suggested-by: Eric Dumazet Signed-off-by: Dong Chenchen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260825123909.1463121-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski

Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-27T20:53:43Z

Pull networking fixes from Jakub Kicinski: "Including fixes from Bluetooth, IPSec and Netfilter. Current release - fix to a fix: - netfilter: ipset: remove need to allocate memory on delete operations Current release - regressions: - macb: drop CONFIG_OF #if block, fix build Previous releases - always broken: - stream of fixes for SCTP continues - inet: frags: strip GSO state from fragments before reassembly - virtio-net: ensure that TCP packets don't overflow gso_segs - tcp-ao: fix use-after-free of current_key on reconnect to another peer - page_pool: remove zone/policy GFP flags when allocating XArray entries - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN - tls: device: fix out-of-bounds write in tls_append_frag() - eth: bnxt: - ring the doorbell when SW USO exits early, avoid packets stuck in Tx - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid users of older NICs seeing non-actionable warning messages - eth: qede: fix NULL pointer dereference in TPA fragment processing" * tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits) inet: frags: strip GSO state from fragments before reassembly net/sched: sch_htb: limit htb_classify inner-class filter hops selftests/net: packetdrill: add tcp_urg_ptr_retransmit tcp: fix corruption of urgent data on multi-segment retransmit usb: atm: usbatm: fix invalid ci_range initialization net: fec: only stop PTP if it was initialized slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() net: bridge: mcast: fix use-after-free of a master VLAN's multicast context net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup net: dsa: mxl862xx: enable assisted learning on CPU port net: stmmac: restore NET_IP_ALIGN in the RX DMA offset net: stmmac: drop gso_enabled_types and rely on netdev features net: stmmac: selftests: Don't test flow control for small rx fifos net: stmmac: selftests: Account for the UC filter list for filtering tests net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering net: stmmac: dwmac4: Account for the primary MAC address for UC filtering net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering net: stmmac: selftests: Check multiple MMC counters selftests: net: Fix slow configurations in big_tcp_tunnels.sh selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh ...

Merge tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds

2026-08-27T18:05:51Z

Pull LED updates from Lee Jones: "New Support & Features: - Core: Extend netdev trigger speeds up to 100G - PWM Multicolor: Introduce default-intensity property - Analog Devices LTC3220: Add support for 18 channel LED driver - NXP PCA963x: Add multicolor LED class support Improvements & Fixes: - GPIO: Clear error pointers for skipped LEDs - Broadcom BCM63138: Use %pe to print pinctrl error instead of %ld - ISSI IS31FL319x: Modernize device registration by using fwnode APIs - NXP PCA9532: Fix inverted GPIO output polarity - NXP PCA9532: Fix phantom device registration on missing hardware - STMicroelectronics ST1202: Correct and extend hw_pattern documentation - STMicroelectronics ST1202: Fix channel disable logic on zero brightness and ensure brightness changes are applied in active mode - STMicroelectronics ST1202: Fix hardware pattern sequence programming, validate inputs, and correct pattern duration calculations - STMicroelectronics ST1202: Validate LED reg property against channel count - TI LP5860: Fix a potential double-unlock during device initialization and fix error handling path by using devm_mutex_init() Cleanups & Refactoring: - GPIO: Make legacy gpiolib interface optional Device Tree Binding Updates: - Core: Add default-intensity property - Core: Document "gpio" trigger - Analog Devices LTC3220: Add DT binding for LTC3220 18 channel LED driver - Broadcom BCM6358: Convert to DT schema - LaCie NS2: Convert to DT schema - NXP PCA963x: Add multicolor LED support - NXP PCA963x: Fix reg maximum for pca9635 - TI TPS65217: Convert backlight bindings to DT schema" * tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (29 commits) leds: is31fl319x: Modernize registration dt-bindings: leds: lacie,ns2-leds: Convert to DT schema leds: pca963x: Add multicolor LED class support dt-bindings: leds: nxp,pca963x: Add multicolor LED support dt-bindings: leds: nxp,pca963x: Fix reg maximum for pca9635 leds: gpio: Clear error pointers for skipped LEDs dt-bindings: leds: backlight: Convert TPS65217 to DT schema leds: pca9532: Fix phantom device registration on missing hardware leds: gpio: Make legacy gpiolib interface optional leds: bcm63138: Use %pe to print pinctrl error instead of %ld dt-bindings: leds: Add default-intensity property leds: ltc3220: Add Support for LTC3220 18 channel LED Driver dt-bindings: leds: Add LTC3220 18 channel LED Driver dt-bindings: leds: bcm6358: Convert to DT schema dt-bindings: leds: Document "gpio" trigger leds: st1202: Correct and extend hw_pattern documentation leds: st1202: Validate LED reg property against channel count leds: st1202: Disable channel when brightness is set to zero leds: st1202: Fix brightness having no effect while pattern mode is active leds: st1202: Fix spurious pattern sequence start in setup ...

Merge tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

2026-08-27T17:45:08Z

Pull MFD updates from Lee Jones: "New Support & Features: - MediaTek MT6397: Add mt6323 AUXADC support - MediaTek MT6397: Add mt6323 EFUSE support - Spreadtrum SC27xx: Add SC2730 regulator cell Improvements & Fixes: - Apple SMC: Fix key count endianness annotation - Azoteq IQS62x: Reject zero-length firmware records - ChromeOS EC: Introduce cros_ec_read_features helper and read features during probe to catch transfer errors - Cirrus Logic CS42L43: Fix regmap defaults ordering - Cirrus Logic CS42L43: Remove redundant NULL checks on SoundWire - Congatec Board Controller: Fix teardown ordering in cgbc_remove() - HP iPAQ Micro: Fix out-of-bounds stack read in ipaq_micro_str - Marvell 88PM886: Initialize the battery page - QNAP MCU: Keep the reply buffer alive past a command timeout - RAVE SP: Validate received frame payload lengths - Silicon Labs Si476x: Drop duplicate NULL checks - Silicon Labs Si476x: Modernize GPIO handling - Silicon Motion SM501: Fix potential memory leaks during remove - UCB1x00: Convert Assabet gpio-keys to use software nodes and register software node for GPIO controller - Viperboard: Fix native fields type in structures as little-endian - Viperboard: Remove redundant NULL check before kfree() - X-Powers AXP20x: Preserve other control bits when powering off Cleanups & Refactoring: - Core: Drop unused assignment of spi_device_id driver data - Core: Initialize spi_device_id arrays using member names - Core: Unify style of spi_device_id arrays - Maintainers: Add Intel LPSS section to follow the changes - Maintainers: Add a mailing list entry to MFD - Cirrus Logic CS42L43: Format sdw_device_id table - Cirrus Logic CS42L43: Use new SoundWire enumeration helper - ROHM PMIC: Factor out power button registration and convert gpio-keys to use software nodes - ST-Ericsson DB8500: Fold dbx500 header into db8500 Device Tree Binding Updates: - Core: Add techvision vendor prefix - Marvell 88PM886: Allow vbus regulator - MediaTek MT8195 SCP: Add support for MT8189 SoC - Qualcomm SPMI PMIC: Document PMG1110 - Qualcomm SPMI PMIC: Document haptics device - Qualcomm TCSR: Add compatible for Hawi and Maili SoCs - Qualcomm TCSR: Add compatible for Shikra - Qualcomm TCSR: Document the IPQ9650 TCSR block - STMicroelectronics STMPE: Fix typo st,stmpe601 (should be st,stmpe610) - Syscon: Add ESWIN EIC7700 compatible - Syscon: Allow syscon compatible for Loongson-2K0300 chip id - Syscon: Disallow simple-bus with syscon - Syscon: Drop custom select for older dtschema - TI OMAP USBHS TLL: Convert to DT schema" * tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (45 commits) mfd: cs42l43: Fix regmap defaults ordering dt-bindings: mfd: syscon: Allow syscon compatible for Loongson-2K0300 chip id dt-bindings: mfd: syscon: Add ESWIN EIC7700 compatible mfd: qnap-mcu: keep the reply buffer alive past a command timeout dt-bindings: mfd: qcom,tcsr: Document the IPQ9650 TCSR block mfd: macsmc: Fix key count endianness annotation dt-bindings: mfd: qcom,spmi-pmic: Document haptics device mfd: iqs62x: Reject zero-length firmware records mfd: rave-sp: validate received frame payload lengths mfd: sm501: Fix potential memory leaks during remove mfd: viperboard: Fix native fields type in structures as little-endian mfd: si476x-i2c: Get rid of duplicate NULL checks dt-bindings: mfd: Convert OMAP USB TLL to DT schema mfd: cgbc: Fix teardown ordering in cgbc_remove() mfd: mt6397-core: Add mt6323 AUXADC support dt-bindings: mfd: qcom,tcsr: Add compatible for Hawi and Maili SoCs mfd: rohm: Factor out power button registration mfd: ucb1x00: Convert Assabet gpio-keys to use software nodes mfd: ucb1x00: Register software node for GPIO controller mfd: cs42l43: Tidy up formatting on sdw_device_id table ...

Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-08-27T16:17:06Z

Pull more MM updates from Andrew Morton: - "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff" (Lorenzo Stoakes) Index MAP_PRIVATE file-backed folios by their anonymous page offset to resolve confusion around reverse mapping for zeroed and CoW'd file-backed memory. Use this new VMA anonymous page offset tracking to eliminate index conflicts and lay the foundation for scalable CoW performance improvements. - "promote mapped executable folios after first usage for MGLRU" (Baolin Wang) Make MGLRU's protection of mapped executable file folios more reliable. Follow the classical LRU's logic, promoting mapped executable file folios after their first usage to give executable code a better chance to stay in memory and improve workload performance. - "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong Chen) Fix per-node proactive reclaim interface's ignoring the swappiness parameter when CONFIG_MEMCG is disabled by consolidating sc_swappiness() into a single function that checks proactive_swappiness regardless of kernel configuration. - "mm/vmscan: reduce lru_lock contention via vmstat-derived scan-balance cost" (Usama Arif) Reduce lru_lock contention in the reclaim path by deriving scan-balance costs from vmstat counters rather than lock-acquired producer updates. Read and decay these cost signals on the reclaim side under a dedicated per-lruvec lock, reducing total LRU lock wait time by over 60% without impacting scan throughput. - "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky) Fix two low-risk zram bugs which Sashiko spotted in drive-by review. - "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's memcg" (Zi Yan) Fix xas_split_alloc() by enabling target folio memcg charging during splits and adding the missing __GFP_ACCOUNT flag for proper XArray node memory accounting. - "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick) Replace hardcoded binary names in selftests/mm/.gitignore with a generic pattern-matching rule to automatically ignore generated test files and avoid manual updates when adding new tests. - "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon) Make the incompatibility between FLATMEM and NUMA explicit in mm/Kconfig and remove the unused pgdat_page_ext_init() function. - "zram: fix zstd error paths and add parameter validation" (Haoqin Huang) Clean up zram compression backends by removing redundant error cleanup, adding parameter and dictionary validation, auto-prefixing algorithm error logs, and resetting parameters prior to reinitialization. - "zram: fix stale scan bounds after reinitialization" (Longlong Xia) Prevent out-of-bounds slot accesses during concurrent zram resets by moving table scan bound calculations under dev_lock in writeback_store() and read_block_state(). - "add anon mTHP collapse test cases" (Baolin Wang) Extend selftests helper functions to support arbitrary page orders and add new test cases and options for mTHP collapse in khugepaged. - "selftests/mm: Handle unsupported and transient test conditions" (Muhammad Usama Anjum) Update MM selftests to report a SKIP status instead of a failure when required kernel or filesystem features are unsupported, while adding retry logic for transient page migration errors. - "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia) Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled and extend shrink_memcg() to support batch writeback for improved writeback efficiency. - "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren Baghdasaryan) Introduce an IOCTL-based binary interface for memory allocation profiling that enables kernel-side filtering before per-CPU counter aggregation. This eliminates the text-parsing overhead of /proc/allocinfo and provides up to a 20x speedup by transferring only filtered allocation data to userspace. - "better block swap batching and a different take on swap_ops v5" (Christoph Hellwig) Refactor block swap I/O to use swap_iocb for batching instead of single-bio requests and rebase the swap_ops interface, achieving faster swap throughput during kernel builds. - "mm: kmemleak: reduce transient false positives by confirming leaks" (Catalin Marinas) Reduce false-positive kmemleak reports by combining two kmemleak enhancements that add a second confirmation scan and a configurable minimum unreferenced scan count module parameter. - "mm: kmemleak: default min_unref_scans to 2 for verbose kernels" (Breno Leitao) Auto-scanning kernels can generate false-positive memory leak reports on single scans, so this patch defaults min_unref_scans to 2 when CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second confirming scan. - "swap_ops updates" (Christoph Hellwig) Batching I/O for synchronous swap devices causes performance regressions and filesystem-based swap suffers from double-indirection overhead. This series resolves both issues by reintroducing per-folio writes for synchronous swap and allowing filesystems to directly export their own swap_ops. - "mm/khugepaged: several cleanups" (Nico Pache) khugepaged accumulated redundant state-checking patterns and outdated comments following mTHP integration. Introduce dedicated helpers for PTE validation and event counting while refreshing the internal documentation. - "maple_tree: lock checking and clean ups" (Liam Howlett) Syzbot reports incorrectly blame memory management exit paths for locking bugs, maple tree erase operations risk allocation failures without gfp flags and internal documentation lacks clarity. Improve lock error detection, update docs, fix race and allocation edge cases and optimize erase allocations using a fallback to GFP_KERNEL | GFP_NOFAIL. * tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (172 commits) selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC memcg: move LRU size accounting on reparenting instead of copying it mm/vmscan: fix comment logic in balance_pgdat maple_tree: add helper mas_make_walkable() maple_tree: avoid extra gap calculation maple_tree: fix argument name in header maple_tree: change two GFP flags in tests maple_tree: document erase and allocations better maple_tree: avoid mas_erase() and mtree_erase() failures maple_tree: document that erase may use GFP_KERNEL for allocations maple_tree: catch race in mas_alloc_cyclic() maple_tree: add bulk parent set helper maple_tree: micro optimisation of mas_wr_store_type() maple_tree: optimise mas_wr_node_store() when not in rcu mode maple_tree: use prefetched value in mas_wr_store_type() maple_tree: clarify comments on mas_nomem() maple_tree: drop MAPLE_ALLOC_SLOTS maple_tree: drop dead code from mas_extend_spanning_null() maple_tree: documentation fix maple_tree: add write lock checking with lockdep sequence numbers ...

virtio-net: Ensure that TCP packets don't overflow gso_segs

2026-08-27T13:47:17Z

The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size. Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649. Fixes: 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") Signed-off-by: Alice Mikityanska Suggested-by: Eric Dumazet Link: https://patch.msgid.link/20260822120117.1163423-2-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni

Merge tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

2026-08-26T23:47:40Z

Pull hyperv updates from Wei Liu: - Decrypt netvsc buffer on contiguous direct-map addresses (Kameron Carr) - Drop WS2012/2012R2 & Win8/8.1 Hyper-V support (Michael Kelley) - Use more meaningful errnos for hypercall status code (Hardik Garg) - Fix lost interrupts on CPU hot-unplug for Hyper-V PCI/MSI (Naman Jain) - Reserve more MSHV vectors for Linux root partition (Wei Liu) * tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: clocksource: hyper-v: Remove support for stimer interrupts in message mode scsi: storvsc: Remove support for storvsc protocol of old Hyper-V hosts hv_netvsc: Remove GPADL teardown special case for old Hyper-V hosts hv_sock: Remove check for old Hyper-V hosts Drivers: hv: Remove support for WS2012/2012R2 & Win8/8.1 version of Hyper-V hv_netvsc: Allocate send/receive buffers using vmbus_alloc_buffer() Drivers: hv: vmbus: Add vmbus_alloc_buffer()/vmbus_free_buffer() for CoCo VMs Drivers: hv: vmbus: add vmbus_establish_gpadl_caller_decrypted() Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition x86/hyperv: reserve more vectors PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Drivers: hv: Use meaningful errnos for hypercall status codes

Merge tag 'nfs-for-7.3-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

2026-08-26T22:09:21Z

Pull NFS client updates from Trond Myklebust: "Highlights include: Stable fixes: - Use-after-free fixes for the sunrpc client code - Delegation hash table leak - NULL dereference on lockowner allocation failure - Fix a handshake completion race in the TLS code - Fix an error sign checking issue when deciding whether the pNFS layout is still in use, or can be returned - Fix a layout segment leak in pnfs_layout_process() Other bugfixes: - Fix a missing NULL check in the rpcbind client - annotate shared socket callbacks with READ_ONCE/WRITE_ONCE - nfs_inode_set_delegation() error paths should return the delegation - Use clear_and_wake_up_bit() in nfs_clear_invalid_mapping() and the pNFS code. - Fix the nfs4_alloc_client() error paths to free the IDR allocation - fix folio dereference before NULL check in nfs_inode_remove_request() - Fix delayed delegation return - Fix another state manager race with umount - Fix device leaks on parse failure - Avoid cancelling in-flight I/O during a layout recall if the server doesn't require it - flexfiles: report cancelled I/O as a layout error - flexfiles: fix NULL dereference for NFSv4.0 data servers - Fix incorrect argument passed to nfs4_delete_lease() - Fix several symlink issues resulting from nfs_atomic_open_v23() - Fix an uninitialised variable issue in the NFSv4.1 callback code - fix LAYOUTSTATS send buffer exhaustion Features and cleanups: - NFSv4.2: Allow the server to specify that file data may not be cached - localio: optimise I/O submission when when not doing memory reclaim - localio: Remove duplicate wait code in nfs_local_commit - flexfiles: support loosely coupled NFSv4.x data servers - pNFS: key the data server cache on the NFS version" * tag 'nfs-for-7.3-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (33 commits) NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path NFSv4/pnfs: key the data server cache on the NFS version NFSv4.2: fix LAYOUTSTATS send buffer exhaustion pNFS: Fix EBUSY check in pnfs_layout_need_return NFSv4.1: zero referring call lists before decoding nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3 SUNRPC: wait for in-flight client TLS handshake callback NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() lockd: fix NULL dereference on lockowner allocation failure NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails NFSv4/flexfiles: support loosely coupled data servers NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers NFSv4: pin the superblock for active state owners sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir NFS/localio: issue commit inline when not in a memory-reclaim context NFS/localio: remove dead FLUSH_SYNC handling from nfs_local_commit NFS/localio: issue IO inline when not in a memory-reclaim context NFS: Fix delayed delegation return list handling NFS: Verify symlink inode before caching target NFS: fix folio dereference before NULL check in nfs_inode_remove_request() ...

Merge tag 'thermal-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2026-08-26T21:21:30Z

Pull more thermal control updates from Rafael Wysocki: "This mostly consists of assorted updates of thermal drivers, including new hardware support (Airoha AN7583, Qualcomm Master BandGap thermal monitor, QCom PMIC5 Gen3 ADC), but it also includes two reverts of recent cosmetic thermal core updates that went against driver core plans to eliminate class_create(): - Fix missing bitfield include headers in Armada and QCom SPM BMG drivers (Daniel Lezcano) - Fix missed file when manually applying a change after a conflict resolution for the QCom SPMI ADC TM5 Gen3 (Daniel Lezcano) - Move thermal_zone_device_enable() to the right place in order to prevent calling it if the thermal zone registration failed (Dan Carpenter) - Improve bitfield manipulations on Armada (Bryan B. Lima) - Remove unneeded 'fast_io' on Sun8i and Armada (Wolfram Sang) - Fix wrong boundary when clamping the low values in the set_trips() callback and fix wrong mask when setting the temperature interval on Airoha (Christian Marangi) - Make use of the regmap API to support Airoha AN7583 (Christian Marangi) - Fix adc_tm5_get_temp() return check value on the QCom SPMI ADC sensor (Rakesh Kota) - Fix unbalanced clock enablement when the resume fails on the iMX driver (Can Peng) - Add Qualcomm Master BandGap thermal monitor support (Satya Priya Kakitapalli) - Add Maili Temperature bindings compatible (Haritha S K) - Add a devm action to clean hardware interrupts, sampling, and control registers on Spacemit K1 (Pei Xiao) - Fix trivial typo in a thermal OF code comment (Marek Vasut) - Remove unnecessary print on Qcom SPMI ADC driver when a call to devm_request_threaded_irq() fails as this one already prints a message (Jishnu Prakash) - Add support for QCom PMIC5 Gen3 ADC by using auxiliary driver and shared interrupt with the IIO driver (Jishnu Prakash) - Make resets optional on MT8196 and add the corresponding property in the DT bindings (AngeloGioacchino Del Regno) - Fix clock staying enabled on failing resume operation on Qoriq (Can Peng) - Fix wrong closing brace position in thermal library header (Andreas Haufler) - Fix low and high trip point validation by moving the check after the clamp on the spacemit driver (surendra) - Remove redundant error messages on IRQ request failure (Pan Chuang) - Add IIO_CONSUMER namespace import to the qcom-spmi-mbg-tm thermal driver to avoid modpost warnings that would appear after merging the iio tree against the thermal updates (Nathan Chancellor) - Revert two recent cosmetic updates of the thermal core conflicting with driver core plans to eliminate class_create() (Rafael Wysocki)" * tag 'thermal-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (32 commits) thermal/drivers/qcom-spmi-mbg-tm: Add module namespace import for IIO_CONSUMER Revert "thermal/core: Allocate the thermal class dynamically" Revert "thermal/core: Use the thermal class pointer as init guard" thermal/drivers/armada: Fix missing bitfields include thermal/drivers/qcom/spm mbg tm: Fix missing bitfield header thermal/drivers/qcom: Fix missing spmi adc tm5 gen3 file thermal/drivers: Remove redundant error messages on IRQ request failure thermal/drivers/spacemit: Validate clamped trip thresholds tools/lib/thermal: Fix misplaced extern "C" closing brace thermal/drivers/qoriq: Disable clock on resume failure thermal/drivers/mediatek/lvts_thermal: Make reset optional for MT8196 dt-bindings: thermal: mediatek: Make resets optional for MT8196 thermal/drivers/qcom: add support for PMIC5 Gen3 ADC thermal monitoring iio: adc: qcom-spmi-adc5-gen3: Share SDAM0 IRQ with ADC_TM auxiliary driver iio: adc: qcom-spmi-adc5-gen3: Remove an unnecessary print thermal/of: Fix trivial enabled typo thermal/drivers/spacemit/k1: Add shutdown action and reorder registration order dt-bindings: thermal: qcom-tsens: Document the Maili Temperature Sensor thermal/drivers/qcom: Add support for Qualcomm MBG thermal monitoring dt-bindings: thermal: Add Qualcomm MBG thermal monitor support ...

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

2026-08-26T18:14:30Z

Pull clk updates from Stephen Boyd: "Mostly the usual clk driver updates and new SoC additions plus non-critical data fixes for things that weren't used yet. One thing that's new here in the core is SSC spread spectrum support (SSC) in the clk provider API. The idea is that DT authors will configure SSC for certain clks and they'll be configured at clk provider registration time or when a consumer device is probed, similar to how we handle assigned clk rates or parents. On the clk driver side we have Qualcomm adding almost half the diff because they add support for 4 different SoCs and then a long tail of other SoCs like Mediatek, Renesas, Rockchip, SpaceMiT, etc. add more SoC support this time around. Luckily it's mostly clk data for these new SoCs because the actual clk_ops are already there. Beyond the new drivers we get all the little fixups for more compilation coverage or usage of more modern APIs. That all looks normal. Finally, I kinda buried the lede, I'm bringing on Brian and Jerome to help out with maintaining the clk subsystem. The current working model is already semi-distributed in that silicon vendors typically take care of their drivers and send me pull requests but I'm becoming a bottleneck for new drivers and core framework review because this has become a 100% volunteer effort on my part. Mike is stepping down after all these years (thanks Mike!) and that jump started the conversation around finding co-maintainers. Brian and Jerome have graciously offered to help me with the work load, meaning in the future they'll be sending pull requests and committing directly to the clk.git tree. They've both been around on the list for a while, I've met them both in person, and they've been making changes to the core clk framework along with helping review patches so I'm pretty confident this will work well. Core: - devm_clk_bulk_get_enable() consumer API - devm_clk_hw_register_composite_pdata() provider API - Spread Spectrum Clock (SSC) support via DT bindings and provider APIs - Divider clk rounding improved (and tested) New Drivers: - Cix Sky1 audio subsystem (AUDSS) - UltraRISC DP1000 - MediaTek MT8173 MFG_TOP - Si549 - Aspeed AST2700 PECI - Airoha EN7523 PCIe - Rockchip RV1106 - Mobileye EyeQ7H - Qualcomm Maili GCC, TCSR, RPMh, and video clks - Qualcomm Shikra GCC, RPM, GPU, display, and audio clks - Qualcomm Nord display and graphics clks - Qualcomm Glymur camera and EVA clks - Qualcomm Hawi video clks - Amlogic A9 AO and peripheral clks - Renesas R-Car X5H (R8A78000) CPG" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (269 commits) clk: microchip: mpfs: fix regmap_update_bits() mask/val order clk: visconti: Make sure clk_init_data is fully initialized clk: ti: Make sure clk_init_data is fully initialized MAINTAINERS: Add Brian Masney and Jerome Brunet as co-maintainers for clk subsystem Drop Michael Turquette's clk maintainer entry clk: ti: composite: resolve parent clocks by DT index, not by name clk: ti: mux: resolve parent clocks by DT index, not by name clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() dt-bindings: clock: ti,keystone-gate: Convert to DT schema dt-bindings: clock: ti: Convert APLL clock to DT schema clk: zynq: pll: Fix kernel-doc after determine_rate() conversion dt-bindings: clock: ti,clockdomain: Convert to DT schema dt-bindings: clock: Correct white-space style clk: samsung: Don't include clk: at91: Read "reg" with helper clk: renesas: Add R-Car X5H CPG driver clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 clk: rockchip: Add clock controller for the RV1106 dt-bindings: clock: rockchip: Add RV1106 CRU support dt-bindings: clock: Document Renesas R-Car X5H Clock Pulse Generator ...