Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v7.3-rc1 2026-08-30T17:53:24+00:00 2026-08-30T17:53:24+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-30T17:53:24+00:00 urn:sha1:78bb208b99e7d3314f670710fa9ee0a793682bca Pull i2c fixes from Andi Shyti: "Fixes mainly for teardown and resource handling, runtime PM and hardware-specific controller issues: - fix debugfs use-after-free when removing the adapter - designware: apply interrupt mask quirk for HJMC3001 - imx-lpi2c: avoid target accesses on master-only controllers - mux: release channel node when adapter registration fails - qcom-cci: fix autosuspend and runtime PM cleanup on removal - qcom-geni: fix timing parameters for 32 MHz clock" * tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: core: fix debugfs UAF on adapter removal i2c: imx-lpi2c: avoid accessing target registers on master-only controllers i2c: qcom-cci: fix autosuspend cleanup i2c: designware: Enable interrupt mask workaround for HJMC3001 i2c: qcom-geni: update frequency table to fix timing parameters i2c: mux: Fix channel node leak on adapter add failure 2026-08-29T18:55:36+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-29T18:55:36+00:00 urn:sha1:08dbfad3f5040f5bdb6c529da20d6d4e81fefd72 Pull more SCSI updates from Martin Petersen: "Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits) scsi: snic: Fix SCSI host leak on workqueue allocation failure scsi: MAINTAINERS: Update my email address scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers scsi: leapraid: Standardize NCQ priority sysfs attributes scsi: leapraid: Serialize firmware log mmap with teardown scsi: leapraid: Balance host references for firmware log VMAs scsi: lpfc: Remove unnnecessary NULL check scsi: qla2xxx: Fix an loop timeout test scsi: qla2xxx: Fix an error code in qla_get_tmf() scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work() scsi: core: Enable context analysis for hosts.o scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() scsi: core: Enable context analysis scsi: core: Protect host state changes with the host lock scsi: core: Add lock context annotations scsi: core: Pass the SCSI host pointer directly to scanning functions ... 2026-08-28T23:37:55+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-28T23:37:55+00:00 urn:sha1:a99d741df7372f2175677673d78a6335f3e0706f Pull more drm updates from Dave Airlie: "As mentioned last week, an msm pull request fell down the side of the couch or whatever the email equivalent of that is. This has the msm next stuff + the usual fixes for amd/intel. core: - use drm_warn instead of warn msm: - Bindings: - Added Shikra support - Document a840, a704, a722 - Core: - Use drm_client buffers for fbdev emulation - teardown fixes - ARM32 DMA fixup - Remove objects from evict list when re-validated - Bunch of corner case and error path fixes - DPU: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Fixed SSPP offsets of Kaanapali - DP: - Dropped dev_pm_opp_set_rate(0) preventing burnout - Cleaned up core code in preparation for MST support - Fixed prepare() to let Pipewire continue in case of the unplugged cable - GPU: - Add support for a704 - Add support for a722 - HDMI: - Simplifed register access amdgpu: - eGPU fixes - Runtime PM fix - UserQ fixes - Backlight fix - Discovery sysfs fix - Reset handling fixes - Buffer func handling fix for xgmi - VCN boundary check fix - DC lut handling fixes - MES fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - Fix return value - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix radeon: - iMac display fix xe: - error message cleanups - i2c global register definitions as dependency for xe/i2c fixes - Media workardound - Add CCS to gt_idle debugfs print - Page fault related fix - i2c related fixes - System Controller mailbox bit fix" * tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits) drm/xe/sysctrl: Read mailbox phase bit from hardware drm/xe/i2c: Keep the i2c controller always enabled drm/xe/i2c: Fix the interrupt handling i2c: designware: Global register definitions drm/xe: Reject page faults from non-fault-mode scratch VMs drm/xe/xe_gt_idle: Add CCS to the powergating info print drm/xe: Do not apply WA 14025883347 to media 3503 drm/amd/display: fix dc_lock leak on GPU reset error paths drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore drm/amdgpu/userq: fix lock missing for userq fence error set drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram drm/amdkfd: Fix error path at svm_migrate_copy_to_ram drm/amd/display: Log details when failing to register HPD IRQ drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE drm/amdgpu: clamp the isolation index for rings outside a partition drm/amdkfd: Reject zero-sized AQL queue allocations after size halving drm/amdgpu: Fix VCE 3 ring align_mask drm/kfd: Add CU occupancy support to GFX12.1 ... 2026-08-28T23:32:12+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-28T23:32:12+00:00 urn:sha1:4cc4cc367fd5c37ddef3279038bccbf152ef68d9 Pull ipmi updates from Corey Minyard: "Several cleanup on error fixes and a missing RCU wait and proper validation on a received message in one place. The biggest change is the initialization of the driver can be done asynchronously on a work queue. That saves significant boot time" * tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() ipmi:msghandler: Cancel work cleanly on an error ipmi:si: Add async init to ipmi_si char: ipmi: use named initializers for acpi_device_id ipmi: Fix leak in __ipmi_bmc_register ipmi: Remove all sysfs files on registration failure ipmi: si: Fix NULL pointer dereference after failed registration ipmi: ipmb: validate write message length 2026-08-28T17:59:07+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-28T17:59:07+00:00 urn:sha1:ce727a090be04dc7c51edd5c0da2a41d2fb6e106 Pull UBI and UBIFS updates from Richard Weinberger: "UBI: - Support for a per-device wear-leveling threshold - Various fixes and cleanups of error paths - Correctly preserve torture flag up wear-leveling UBIFS: - Various fixes and cleanups of error paths and kernel-doc" * tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: UBI: support per-device wear-leveling threshold UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC mtd: ubi: Release device reference on busy detach ubi: Fix rollback for explicit UBI device numbers ubifs: fix out-of-bounds read in signature length check UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs UBI: Preserve torture flag when rescheduling failed erasures ubifs: ubifs.h: clean up kernel-doc comments ubifs: key.h: use correct function parameter name ubifs: debug.h: fix kernel-doc struct prototypes 2026-08-28T16:53:43+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-28T16:53:43+00:00 urn:sha1:275bc4eedf2c6081200998954efcb5eb90413a41 Pull RTC updates from Alexandre Belloni: "The RZN1 driver got a fairly comprehensive cleanup. More DT binding are converted to DT schema, leaving only 5 remaining files to convert. Subsystem: - patchwork project is moving to kernel.org - fully initialize clk_init_data - add missing MODULE_DEVICE_TABLE() - DT bindings conversions to DT schema Drivers: - ds1307: fix WADA bit for alarms on RX8130 - rzn1: add support for RZ/T2H and RZ/N2H, many fixes" * tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (42 commits) MAINTAINERS: update rtc subsystem patchwork location rtc: msc313: Select by default on MSTARV7 rtc: microcrystal: Make sure clk_init_data is fully initialized rtc: philips: Make sure clk_init_data is fully initialized rtc: nct3018y: Make sure clk_init_data is fully initialized rtc: m41t80: Make sure clk_init_data is fully initialized rtc: hym8563: Make sure clk_init_data is fully initialized rtc: rzn1: Add support for Renesas RZ/T2H and RZ/N2H SoCs rtc: rzn1: Drop trailing comma from OF match table sentinel rtc: rzn1: Add OF match data to gate SUBU register access rtc: rzn1: use FIELD_PREP/FIELD_GET and GENMASK for register access rtc: rzn1: Consistently use dev_err_probe() rtc: rzn1: Use temporary variable for struct device rtc: rzn1: Dynamically calculate synchronization delay based on clock rate rtc: rzn1: Replace remove callback with devm_add_action_or_reset() rtc: rzn1: Use pm_runtime_put_sync() rtc: Kconfig: Broaden RTC_DRV_RZN1 dependency to ARCH_RENESAS rtc: rzn1: Fix malformed MODULE_AUTHOR string rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers rtc: rzn1: Fix alarm range check truncation on 32-bit systems ... 2026-08-28T16:36:27+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-28T16:36:27+00:00 urn:sha1:afe0579334f622c803f2864f22c04c20c320bd80 Pull TPM updates from Jarkko Sakkinen: "The bulk of this is Ross Philipson's TPM enablement for Trenchboot. That exposes TPM constants, and decouple and improve robustness of tpm_buf a bit in order to implement a minimal early TPM driver. Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on Intel before jumping into kernel's entry point. They re-initalize TPM PCRs but leave up to the early boot code measure initrd, boot_params and Trenchboot associated metadata. The motivation here is just that we would want in future iterations of the series put our full focus to the x86 part of the review, and call it a day as per TPM changes. Further, even if Trenchboot turned out to be empty lottery the worst possible outcome for TPM driver is that things get cleaned up a bit" * tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm-buf: Add TPM buffer support header for standalone reuse tpm-buf: Memory-safe allocations tpm-buf: Remove chip parameter from tpm_buf_append_handle() tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW tpm: Remove main TPM header from TPM event log header tpm: Move platform specific definitions to the new PTP header tpm: Move TPM common base definitions to the command header tpm: Move TPM2 specific definitions to the command header tpm: Move TPM1 specific definitions to the command header tpm: Initial step to reorganize TPM public headers tpm: st33zp24: Validate locality read result tpm: st33zp24: Return zero on status read failure tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null tpm: atmel: depend on X86 tpm: Remove redundant dev_err() tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout 2026-08-28T16:09:01+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-28T16:09:01+00:00 urn:sha1:344be13211d0fceb791a7da70ef810ad13340fe0 Pull ACPI support fix from Rafael Wysocki: "Revert an incomplete recent commit that may cause ACPI device power management to stop working" * tag 'acpi-7.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: scan: Defer device power initialization" 2026-08-28T03:31:33+00:00 Dave Airlie airlied@redhat.com 2026-08-28T03:27:51+00:00 urn:sha1:a8b02aa825803e6c5b6b27340f583900afa0861d amd-drm-next-7.3-2026-08-27: amdgpu: - MES fixes - Userq fixes - UVD fix - VCE 3 fix - Enforce isolation fix - HPD fix for VGA/LVDS - DML fix - DCN 6 fixes - DC gpu reset fix amdkfd: - CU occupancy for GFX 11 - CU occupancy for GFX 12/12.1 - Queue bounds checking fix - SVM fixes - CRIU bounds checking fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260827203610.3249084-1-alexander.deucher@amd.com 2026-08-28T01:12:01+00:00 Vasileios Almpanis vasilisalmpanis@gmail.com 2026-08-12T09:14:48+00:00 urn:sha1:b15b548d52b43ba8ac4652bc2c7244a8dd1e9622 i2c_del_adapter() frees the adapter's debugfs directory before it unregisters the adapter device, but the new_device sysfs attribute stays writable until device_del(). A write racing with removal still reaches i2c_device_probe(), which passes the freed adap->debugfs to debugfs_create_dir() as the new client's parent: BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090 lookup_noperm_common+0x407/0x430 simple_start_creating+0x9c/0x110 debugfs_start_creating+0xdb/0x1a0 debugfs_create_dir+0x24/0x350 i2c_device_probe+0x814/0xbf0 It's technically possible to create a client after i2c_deregister_clients has run. That client will never be unregistered and make wait_for_completion hang. Close the window by removing the new_device attribute at the start of i2c_del_adapter(). device_remove_file() will drain any clients left. Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter") Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7 Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com> Cc: <stable@vger.kernel.org> # v6.8+ Tested-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/20260812-i2c-v2-1-5efaab4c3334@gmail.com