Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v7.1-rc6 2026-05-30T22:39:47+00:00 2026-05-30T22:39:47+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-30T22:39:47+00:00 urn:sha1:9d87d0fc8c8e0a2a2b5026a169db2f270b4828c1 Pull liveupdate fixes from Mike Rapoport: "Two kexec handover regression fixes: - fix order calculation for kho_unpreserve_pages() to make sure sure that the order calculation in kho_unpreserve_pages() mathes the order calculation in kho_preserve_pages(). - fix math in calculation of KHO_TREE_MAX_DEPTH to make it work with 16KB pages" * tag 'liveupdate-fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: kho: fix order calculation for kho_unpreserve_pages() kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes 2026-05-30T15:34:03+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-30T15:34:03+00:00 urn:sha1:495fb8dd7f1da991c5325f4a0a50d0b042f19523 Pull tty/serial driver fixes from Greg KH: "Here are some small serial driver fixes for 7.1-rc6. Included in here are: - mips serial driver fixes to resolve some long-standing issues with how they interacted with the console. That's the "majority" of the changes in this merge request - sh-sci driver regression fix - 8250 driver regression fixes - other small serial driver fixes for reported problems. All of these have been in linux-next for over a week with no reported issues" * tag 'tty-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: dz: Enable modular build serial: zs: Convert to use a platform device serial: dz: Convert to use a platform device serial: zs: Switch to using channel reset serial: zs: Fix bootconsole handover lockup serial: dz: Fix bootconsole handover lockup serial: dz: Fix bootconsole message clobbering at chip reset serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() serial: 8250: dispatch SysRq character in serial8250_handle_irq() serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) tty: serial: samsung: Remove redundant port lock acquisition in rx helpers serial: altera_jtaguart: handle uart_add_one_port() failures serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma tty: add missing tty_driver include to tty_port.h serial: qcom-geni: fix UART_RX_PAR_EN bit position serial: sh-sci: fix memory region release in error path tty: serial: pch_uart: add check for dma_alloc_coherent() serial: zs: Fix swapped RI/DSR modem line transition counting 2026-05-30T15:30:12+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-30T15:30:12+00:00 urn:sha1:25447851777a53bd4b501e7f2cb418332ad584cc Pull char/misc/iio fixes from Greg KH: "Here are some small char/misc/iio driver fixes for 7.1-rc6. Included in here are: - lots of small IIO driver fixes for reported problems. - Android binder bugfixes for reported issues. - small comedi test driver fixes - counter driver fix - parport driver fix (people still use this?) - rpi driver fix - uio driver fix All of these have been in linux-next for over a week with no reported problems" * tag 'char-misc-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (41 commits) Revert "gpib: cb7210: Fix region leak when request_irq fails" misc: rp1: Send IACK on IRQ activate to fix kdump/kexec gpib: cb7210: Fix region leak when request_irq fails parport: Fix race between port and client registration uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory rust_binder: Avoid holding lock when dropping delivered_death rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw iio: gyro: itg3200: fix i2c read into the wrong stack location iio: dac: ad5686: fix powerdown control on dual-channel devices iio: dac: ad5686: acquire lock when doing powerdown control iio: temperature: tsys01: fix broken PROM checksum validation iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings iio: buffer: hw-consumer: fix use-after-free in error path iio: dac: ad5686: fix input raw value check iio: dac: ad5686: fix ref bit initialization for single-channel parts iio: ssp_sensors: cancel delayed work_refresh on remove iio: adc: meson-saradc: fix calibration buffer leak on error ... 2026-05-29T22:46:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-29T22:46:40+00:00 urn:sha1:f3be0c984ecbcb82b0bec408022c4ef738cb3843 Pull more networking fixes from Jakub Kicinski: "Quick follow up, nothing super urgent here. Main reason I'm sending this out is because the IPsec and Bluetooth PRs did not make it yesterday. I don't want to have to send you all of this + whatever comes next week, for rc7. The fixes under "Previous releases - regressions" are for real user-reported regressions from v7.0. Previous releases - regressions: - Revert "ipv6: preserve insertion order for same-scope addresses" - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU on netns exit got backported to stable and was causing serious accumulation of dying netns's for real workloads - pcs-mtk-lynxi: fix bpi-r3 serdes configuration Previous releases - always broken: - usual grab bag of race, locking and leak fixes for Bluetooth - handful of page handling fixes for IPsec" * tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits) wireguard: send: append trailer after expanding head Revert "ipv6: preserve insertion order for same-scope addresses" net: skbuff: fix pskb_carve leaking zcopy pages ipv6: fix possible infinite loop in fib6_select_path() ipv6: fix possible infinite loop in rt6_fill_node() bpf: sockmap: fix tail fragment offset in bpf_msg_push_data vsock/virtio: bind uarg before filling zerocopy skb Revert "esp: fix page frag reference leak on skb_to_sgvec failure" net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration sctp: fix race between sctp_wait_for_connect and peeloff net: mana: Skip redundant detach on already-detached port net: mana: Add NULL guards in teardown path to prevent panic on attach failure Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Bluetooth: ISO: fix UAF in iso_recv_frame Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading ... 2026-05-29T22:17:53+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-29T22:17:53+00:00 urn:sha1:77590cacabb3bffba7e2e95c359889bc44241b68 Pull clang build fix from Nathan Chancellor: "A small fix to disable -Wattribute-alias for clang in the few places it is already disabled for GCC, now that tip of tree clang has implemented -Wattribute-alias as GCC has" * tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux: Disable -Wattribute-alias for clang-23 and newer 2026-05-29T19:57:23+00:00 Jakub Kicinski kuba@kernel.org 2026-05-29T19:57:22+00:00 urn:sha1:c84ff04def255edb51e57c9f969efdfade0da16a Steffen Klassert says: ==================== pull request (net): ipsec 2026-05-29 1) xfrm: route MIGRATE notifications to caller's netns Thread the caller's netns through km_migrate() so that MIGRATE notifications go to the issuing netns, fixing both the init_net listener leak and MOBIKE notifications inside non-init netns. From Maoyi Xie. 2) xfrm: ipcomp: Free destination pages on acomp errors Move the out_free_req label up so that allocated destination pages are released on decompression errors, not only on success. From Herbert Xu. 3) xfrm: Check for underflow in xfrm_state_mtu Reject configurations that cause xfrm_state_mtu() to underflow, preventing a negative TFCPAD value from becoming a memset size that triggers an out-of-bounds write of several terabytes. From David Ahern. 4) xfrm: ah: use skb_to_full_sk in async output callbacks Convert the possibly-incomplete skb->sk to a full socket pointer in async AH callbacks so that a request_sock or timewait_sock never reaches xfrm_output_resume() downstream consumers. From Michael Bommarito. 5) Add and revert: esp: fix page frag reference leak on skb_to_sgvec failure The patch does not fix te issue completely. 6) xfrm: esp: restore combined single-frag length gate Check the aligned post-trailer combined length against a page limit in the fast path, preventing skb_page_frag_refill() from falling back to a page too small for the destination scatterlist. From Jingguo Tan. 7) xfrm: iptfs: reset runtime state when cloning SAs Reinitialise the clone's mode_data runtime objects before publishing it, preventing queued skbs from being freed with list state copied from the original SA when migration fails. From Shaomin Chen. 8) xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Flush policy tables and drain the workqueue in a .pre_exit handler so that cleanup_net() pays one RCU grace period per batch instead of one per namespace, fixing stalls at high CLONE_NEWNET rates. From Usama Arif. 9) xfrm: input: hold netns during deferred transport reinjection Take a netns reference when queueing deferred transport reinjection work and drop it after the callback completes, keeping the skb->cb net pointer valid until the deferred work runs. From Zhengchuan Liang. * tag 'ipsec-2026-05-29' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: Revert "esp: fix page frag reference leak on skb_to_sgvec failure" xfrm: input: hold netns during deferred transport reinjection xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit xfrm: iptfs: reset runtime state when cloning SAs xfrm: esp: restore combined single-frag length gate esp: fix page frag reference leak on skb_to_sgvec failure xfrm: ah: use skb_to_full_sk in async output callbacks xfrm: Check for underflow in xfrm_state_mtu xfrm: ipcomp: Free destination pages on acomp errors xfrm: route MIGRATE notifications to caller's netns ==================== Link: https://patch.msgid.link/20260529092648.3878973-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> 2026-05-29T16:25:58+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-29T16:25:58+00:00 urn:sha1:b0ab604210059c3626c9c77142b51f39e9842504 Pull iommu fixes from Joerg Roedel: - Fix compile warning with gcc-16.1 - Intel VT-d: Simplify calculate_psi_aligned_address() - MAINTAINERS updates * tag 'iommu-fixes-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: MAINTAINERS: Add my employer to my entries MAINTAINERS: Add Vasant Hegde to reviewers of AMD IOMMU iommu, debugobjects: avoid gcc-16.1 section mismatch warnings iommu/vt-d: Simplify calculate_psi_aligned_address() 2026-05-29T15:51:46+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-29T15:51:46+00:00 urn:sha1:e6f4f084ecd876a333c4cf13d0229217dbfcd8e8 Pull HID fixes from Benjamin Tissoires: - buffer overflow fix for lenovo (Kean) and wacom (Lee Jones) drivers - segfaults prevention in lenovo-go driver when used with an emulated device (Louis Clinckx) - cleanup of resources in u2fzero (Myeonghun Pak) - a quirk for a USB mouse and a cleanup in hid.h (hlleng and Liu Kai) * tag 'hid-for-linus-2026052801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() HID: lenovo-go: drop dead NULL check on to_usb_interface() HID: lenovo-go: reject non-USB transports in probe HID: lenovo: Fix buffer over-read and unaligned access in X12 Tab raw_event handler HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse HID: remove duplicate hid_warn_ratelimited definition HID: u2fzero: free allocated URB on probe errors 2026-05-28T20:45:10+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-28T20:45:10+00:00 urn:sha1:8fde5d1d47f69db6082dfa34500c27f8485389a5 Pull ACPI support fixes from Rafael Wysocki: "Fix three issues in the ACPI button driver: a possible crash due to a button press after unloading the driver (introduced during the 6.15 development cycle), function keys breakage on Toshiba Tecra X40 due to missing ACPI events (introduced during the 7.0 development cycle), and a missing probe rollback path item that has not been added by mistake during a recent update" * tag 'acpi-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: button: Add missing device class clearing on probe failures ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time ACPI: button: Fix ACPI GPE handler leak during removal 2026-05-28T20:13:48+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-28T20:13:48+00:00 urn:sha1:3e20009988e2470063824c58b19d1c80816cc46d Pull networking fixes from Paolo Abeni: "This is again significantly bigger than the same point into the previous cycle, but at least smaller than last week. I'm not aware of any pending regression for the current cycle. Including fixes from netfilter. Current release - regressions: - netfilter: walk fib6_siblings under RCU Previous releases - regressions: - netlink: fix sending unassigned nsid after assigned one - bridge: fix sleep in atomic context in netlink path - sched: fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop - ipv4: fix net->ipv4.sysctl_local_reserved_ports UaF - eth: tun: free page on short-frame rejection in tun_xdp_one() Previous releases - always broken: - skbuff: fix missing zerocopy reference in pskb_carve helpers - handshake: drain pending requests at net namespace exit - ethtool: - rss: avoid modifying the RSS context response - module: avoid leaking a netdev ref on module flash errors - coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES - netfilter: fix dst corruption in same register operation - nfc: hci: fix out-of-bounds read in HCP header parsing - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - eth: - vti: use ip6_tnl.net in vti6_changelink(). - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()" * tag 'net-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits) dpll: zl3073x: make frequency monitor a per-device attribute dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work dpll: export __dpll_device_change_ntf() for use under dpll_lock net/handshake: Drain pending requests at net namespace exit net/handshake: Verify file-reference balance in submit paths net/handshake: Close the submit-side sock_hold race net/handshake: hand off the pinned file reference to accept_doit net/handshake: Take a long-lived file reference at submit net/handshake: Pass negative errno through handshake_complete() nvme-tcp: store negative errno in queue->tls_err net/handshake: Use spin_lock_bh for hn_lock net: skbuff: fix missing zerocopy reference in pskb_carve helpers net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path net: hibmcge: disable Relaxed Ordering to fix RX packet corruption selftests/tc-testing: Add netem test case exercising loops selftests/tc-testing: Add mirred test cases exercising loops net/sched: act_mirred: Fix return code in early mirred redirect error paths net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop net/sched: fix packet loop on netem when duplicate is on ...