kernel/git/stable/linux-stable.git/Documentation, branch master

Merge tag 'char-misc-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-10-03T16:05:47Z

Pull char/misc/IIO fixes from Greg KH: "Here is a set of char/misc/iio and other small driver subsystem fixes for 7.3-rc6 that resolve a number of reported issues. Included in here are: - lots of small iio driver fixes for reported problems - interconnect driver revert to resolve a regression - nitro_enclaves driver fix for a use-after-free - binder driver fixes for reported problems (in both the rust and C versions) All of these have been in linux-next with no reported issues" * tag 'char-misc-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (63 commits) iio: adc: ad_sigma_delta: fix use-after-free on unbind iio: accel: kxcjk-1013: reject duplicate event disable iio: buffer: serialize buffer teardown with mode claims iio: cdc: ad7150: fix OF matching and publish module aliases iio: adc: ade9000: fix NULL pointer dereference in clkout registration iio: adc: ad4030: fix invalid oversampling_ratio validation iio: adc: ad7173: Fix digital filter configuration iio: adc: stm32-adc: fix possible division by zero in processed channel iio: adc: stm32-adc: fix check on internal channel availability iio: proximity: isl29501: Fix return type of isl29501_register_write iio: imu: inv_icm42607: restore runtime PM on system resume errors iio: imu: inv_icm42607: propagate runtime suspend errors iio: adc: pac1934: check ACPI label duplication rust_binderfs: add transaction_report feature entry rust_binder: reschedule node refcount update on thread exit rust_binder: cancel deferred work items in thread exit binderfs: fix UAF write in binder_add_device binder: fix is_failure flag for superseded transaction cleanup binder: fix leaked fd fixups on TF_UPDATE_TXN supersede Revert "interconnect: qcom: x1e80100: enable QoS configuration" ...

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

2026-10-03T14:54:58Z

Pull arm64 fixes from Will Deacon: "Half of this is broken hardware (AMU counters and TLB invalidation) and the other half is broken software (frequency scaling and signals). So it seems as though we're all as bad as each other. The AMU workaround is a little noisy, as it refactors an existing workaround so that it can more easily be applied to additional CPUs. Summary: - Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems arm64: errata: Add Cortex-A725 erratum 3821522 workaround arm64: errata: Factor out broken AMU const counter cap arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz arm64: mm: Fix the break-before-make flush range for erratum 2645198

Merge tag 'cifs-fixes-7.3-rc6' of https://git.manguebit.org/linux

2026-10-02T21:04:11Z

Pull smb client fixes from Paulo Alcantara: "Fix a series of data corruption and I/O error bugs found by running generic/363 (fsx) in a loop against Windows Server 2022 and Samba. - Stop data dirtied past EOF through an mmap from reappearing as file content once the file is extended by a write, truncate, zero range, copy range or clone range - Flush dirty data and drain in-flight I/O before operations that assume the pagecache and the server agree on the file: querying allocated ranges, the O_TRUNC open, interior zero range, and server-side copy/clone - Stop a genuine size-extending zero range or preallocate from being refused with -EOPNOTSUPP when the inode is not read caching, by querying the server's authoritative EOF instead of trusting a stale cached i_size - Zero the untransferred tail of a short read, both in the netfs read-gaps path (where stale folio content could otherwise be written back to the server) and in the DIO/unbuffered read collector, and tell a real EOF apart from a stale cached remote_i_size after a lease downgrade - Require stable pages on signed connections so a buffered write can't modify a folio whose signature has already been computed and is in flight, which the server rejected with STATUS_ACCESS_DENIED and the client surfaced as -EIO - Split several cifsFileInfo flags out of a shared bitfield byte so concurrent updates taken under different locks no longer clobber each other through a byte-level RMW" * tag 'cifs-fixes-7.3-rc6' of https://git.manguebit.org/linux: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races smb: client: require stable pages for signed connections smb: client: distinguish real EOF from a stale remote_i_size on read netfs: zero the tail of a short DIO/unbuffered read smb: client: only require read lease for size-extending preallocate netfs: zero gaps in read-gaps folio to avoid writing back stale data smb: client: only require read lease for size-extending zero range smb: client: drain and invalidate before server-side copy/clone smb: client: flush dirty data before zeroing a range smb: client: drain outstanding I/O before truncating on O_TRUNC open smb: client: flush and commit data before querying allocated ranges smb: client: discard post-EOF pagecache when extending a file via clone range smb: client: discard post-EOF pagecache when extending a file via copy range smb: client: discard post-EOF pagecache when extending a file via zero range smb: client: clear post-EOF pagecache when extending a file via truncate netfs: clear post-EOF pagecache when extending a file via write

Merge tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2026-10-02T19:17:24Z

Pull io_uring fixes from Jens Axboe: - Fix a task_work add use-after-free with SQPOLL. The sqpoll thread could pop and complete the last request while io_req_normal_work_add() was still looking at them after the mpscq push. Use the same approach as DEFER_TASKRUN to protect from that, holding an RCU read lock across the add, and have exit wait for an RCU grace period for SQPOLL rings as well. - CQE32 ring fixes: correct the free entry check for 32b CQEs, zero the big_cqe for aux CQEs, and only post the dummy skip CQE on CQE_MIXED rings - Mark the source filter table as COW when cloning bpf filters, so registering another filter on the source doesn't modify the shared table in place - Initialize the task context before running the BPF loop - Requeue zcrx multishot receives stopped by a local resource - End a TX_TIMESTAMP multishot cmd when the CQ is full (lollipopkit) * tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix task_work add use-after-free with SQPOLL io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full io_uring/zcrx: requeue multishot receives stopped by a local resource io_uring: initialize task context before running the BPF loop io_uring: zero big_cqe for aux CQEs on CQE32 rings io_uring: fix free entry check for 32b CQEs on CQE32 rings io_uring: only post the dummy skip CQE on CQE_MIXED rings io_uring/bpf_filter: mark source as COW when cloning filters

arm64: errata: Add Cortex-A725 erratum 3821522 workaround

2026-10-01T12:22:40Z

Cortex-A725 erratum 3821522 affects the CNT_CYCLES event, which can incur a significant increment error when a CPU enters and subsequently exits WFE or WFI, and may no longer track the system counter frequency. The AMEVCNTR01_EL0 counter is used as the AMU constant counter for frequency invariance and CPPC FFH feedback counters. Wire the affected Cortex-A725 range into the shared broken AMU constant-counter capability so the affected counter is treated as unavailable by returning zero in the AMU counter paths. This prevents the broken counter from being used as a reference source. The erratum can also affect PMUv3 users of the CNT_CYCLES event, but this workaround intentionally does not change PMU event handling. Hiding or rejecting the PMU event from the erratum code would change the perf-visible PMU event interface, including raw event selection, and would need a separate PMU-specific approach rather than being folded into the AMU reference-counter workaround. Cc: stable@vger.kernel.org Signed-off-by: Beata Michalska Reviewed-by: Vladimir Murzin Signed-off-by: Will Deacon

netfs: zero the tail of a short DIO/unbuffered read

2026-09-30T17:24:12Z

The buffered read collector zero-fills the tail of a short read that stops below the inode's i_size (netfs_clear_unread()), so a read that races an extending write still returns the expected number of bytes. The non-buffered collector path does no such thing: it just records how much was transferred. Add the same zero-fill for the non-buffered case, gated on NETFS_SREQ_CLEAR_TAIL: a subreq's source sets that flag when a short result from it is known to be safe to treat as a hole, as opposed to NETFS_SREQ_HIT_EOF, which means the read genuinely ran off the end of the file and should be reported short as-is. Only CLEAR_TAIL should zero-fill here; a real EOF must stay a real short read. No source currently sets CLEAR_TAIL on an unbuffered/DIO subrequest, so this is inert on its own -- a following change teaches cifs to set it in the one case that needs it. Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Reviewed-by: David Howells Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara Cc: Christian Brauner Cc: Matthew Wilcox Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Bharath SM Cc: stable@vger.kernel.org

arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

2026-09-23T12:34:30Z

__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message. Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits. Fixes: 858c7bfcb35e1 ("arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9") Cc: stable@vger.kernel.org Signed-off-by: Fuad Tabba Reviewed-by: Anshuman Khandual Reviewed-by: Oliver Upton Signed-off-by: Will Deacon

Merge tag 'iio-fixes-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus

2026-09-11T09:52:17Z

Jonathan writes: IIO: 1st set of fixes for the 7.3 cycle. A couple of core fixes, the rest usual mix of driver issues that surfaced from merge window until now. core - buffer: Ensure that when using the iio_push_to_buffers_with_ts_unaligned() that the full buffer is zeroed. - trigger: Cancel reenable_work() before freeing the trigger that might be re-enabled. dma-buffer - Fix wrong sizing for a mapped sg_list. If an IOMMU was using a fused entry the mapping might walk off the end. adi,ade9000 - Wait for power up before requesting interrupts. - Fix overlap in scan index for current and voltage channels. - Ensure Phase C dip event included in IRQ1 handler. adi,adf4377 - Initialize all of a clk_init_data. adi,adis* - Ensure debugfs reads are finished before unbind. adi,axi-adc - Initialize mutex. adi,admv1013 - Ensure mutex is intialized before notifier that might use it is registered. - Fix wrong channel field used for read_raw. allwinner,sun4i - Drop a pm_runtime_put() when there was no get. - Ensure correct cleanup on driver probe fail due to any issues with the thermal zone. aspeed,adc, - Don't eat reset deassert errors. awinic,aw96103 - Make sure firmware length is validated rather than blindly trusting it. bosch,bmp280 - Fix out of bounds lookup of sampling frequency due to indexing based on elements in matrix rather than just the correct dimension. invensense,timestamp library - Ensure time estimate doesn't invert wrt to current time in a corner case occasionally seen. kionix,kx022a - Off by one in array boundary check. - Close a memory leak and state corruption in error path. maxim,max1363 - Sign extend bipolar values to ensure correct reporting to userspace. maxim,max30102 - Fix NULL dereference by checking there is data in the FIFO before trying to do anything with it. microchip,mcp47a1 - Ensure highest possible value actually settable. pulsed-light,lidar-lite - Don't leak the IIO device registration if runtime pm setup fails particularly as it was being freed. rockchip,saradc - Fix wrong fallback compatible for rv1106 that lead to trying to use too many channels (correct support will follow next merge window) rohm,bd79124 - Correct limit used for rising alarms. - Fix which registers related to limits are used in initialization. - Apply GPIO mask to allow subset of GPIOs to be toggled. - Add missing regmap error handling in a few places. - Ensures scale is read only. rohm,bm1390 - Don't silently eat a data read error. rohm,bu27034 - Don't silently eat error when reading gain. - Ensure we infinite delay doesn't happen on error. semtech,sx9324 - Fix wrong proximity channel resolution. sharp,gp2ap020a00f - Make sure to drain irq_work in remove path. st,vl5310x - Ensure direct mode is claimed for read_raw avoiding corruption of buffered accesses. vishay,vcnl3020 - Use write bits for ISR mask and ensure right event reported. vti,sca3000 - Fix up a condition check for the frequency divider. xilinx,xadc - Swap registration of cleanup of work with that of irq to ensure that no irqs can cause work that has been freed to be queued. x-powers,axp288 - Add bias override quirk for Haier HV103H. Fix because we used to always override then moved to trusting the firmware setup - which fixed some boards, but broke others. * tag 'iio-fixes-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (42 commits) iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler iio: proximity: vl53l0x-i2c: claim direct mode for raw reads iio: dac: mcp47a1: Allow full-scale output iio: accel: kionix-kx022a: Prevent memory leak and fix state iio: light: rohm-bu27034: Fix infinite delay on error iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls iio: adc: axp288: Add TS bias override for Haier HV103H dt-bindings: iio: adc: rockchip-saradc: Fix RV1106 compatible dt-bindings: iio: adc: rockchip-saradc: Group single-entries into an enum list iio: inv_sensors: fix estimated value larger than interrupt timestamp iio: adc: aspeed: propagate reset deassert errors iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure iio: trigger: cancel reenable_work before freeing trigger iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() iio: accel: sca3000: fix frequency divider condition check iio: admv1013: initialize callback mutex before registering notifier iio: gyro: adis16136: fix unprotected debugfs reads iio: imu: adis16400: fix unprotected debugfs reads ...

iio: proximity: vl53l0x-i2c: claim direct mode for raw reads

2026-09-07T01:24:53Z

vl53l0x_read_raw() starts a single-shot ranging measurement and reads back the result. Once the triggered buffer is enabled the sensor runs in continuous mode and its data-ready interrupt is routed to the trigger, so a concurrent in_distance_raw read disturbs the streaming setup and never gets its completion, returning -ETIMEDOUT. The original submission claimed direct mode here, but it was dropped during review because the driver had no buffer support at the time [1]. Continuous (buffered) mode was later added without restoring the claim [2], reintroducing the conflict. Reject direct reads while buffered capture is active by claiming direct mode around the measurement, as the vl53l1x sibling already does. Fixes: 762186c6e7b1 ("iio: proximity: vl53l0x-i2c: Added continuous mode support") Link: https://lore.kernel.org/linux-iio/20180911160300.GA9212@himanshu-Vostro-3559/ [1] Link: https://lore.kernel.org/linux-iio/20240909101508.263085-3-abhashkumarjha123@gmail.com/ [2] Signed-off-by: Donggeun Yoo Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron

Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-09-06T17:35:24Z

Pull IRQ subsystem fixes from Ingo Molnar: - Revert a commit to the mbigen irqchip driver that caused a regression on two-port Hi1616 chips (Caina) - Fix a too-long-preemption-off bug in the stm32mp-exti irqchip driver, caused by a time unit ambiguity & mismatch (Ju Nan) - Remove the now completely unused irq_domain_add_linear() inline function (Jiri Slaby) * tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Revert "irqchip/mbigen: Fix mbigen node address layout" irqdomain: Delete irq_domain_add_linear()