linux-stable.git, branch v7.3-rc2 Linux kernel stable tree Linux 7.3-rc2 2026-09-06T22:07:20+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-06T22:07:20+00:00 df2908090cda368b01ff43709f51890076c56157 






Merge tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
2026-09-06T21:21:24+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T21:21:24+00:00

b1e00ffaf91c41eb752a1c200295c9ab7abfae1d

Pull tracing fixes from Steven Rostedt:

 - Fix several tracefs files that did not take the trace_array reference

   A trace instance can be created and destroyed in the tracefs
   "instances" directory via mkdir and rmdir respectively. The instance
   is represented by a trace_array descriptor.

   Most tracefs files pass the trace_array as the private data of the
   inode to the open/read/write functions. Since there is no locking
   between the time a task opens a file and the deletion of the instance
   (and the freeing of the trace_array), each open needs to get a
   reference to the trace_array and each close must remove it.

   An instance can't be removed if there's any reference taken on its
   trace_array. The open function uses trace_array_get() that takes a
   lock (preventing removal of instances) and iterates the list of all
   existing trace_arrays and if it finds a match, it takes the reference
   and releases the lock. If it doesn't find a match, it causes the open
   to return -ENODEV.

   There were some added files that did not take the trace_array
   reference on open that needed to be fixed. Sashiko also correctly
   pointed out that there were some files that took an address of an
   field or element of the trace_array which had a pointer back to the
   trace_array to take its reference on open. But this leaves a slight
   race between referencing this element to get the trace_array as the
   element itself could be freed. To solve this, some helper functions
   were created to look for trace_arrays with this field or element in
   the search so that the element did not have to be dereferenced before
   the trace_array's reference was taken.

 - Add a lock around ftrace_ops initialization

   When a ftrace_ops is first used by ftrace, some internal
   initialization is performed on the ops. But if multiple tasks were
   calling functions that did this initialization, it could race and
   perform doing the initialization more than once, corrupting the
   internal data. Add a lock in the initialization code to prevent this
   from happening.

 - Fix splice reads on mmapped buffers

   The logic in the ring buffer splice code for mmapped buffers is
   supposed to do a copy of the memory as the mapped buffers can't be
   given to splice. But there was an if statement within the copy code
   that would return a -1 if a request for a full page was done and it
   wasn't a partial read. This is because this logic was written before
   mmapped buffers existed and this case didn't make sense at the time.
   For mmapped buffers it makes perfect sense and by returning early can
   drop a lot of pages unnecessarily.

 - Have the persistent ring buffer validation check nr_subbufs

   Sashiko reported that the validation code was relying on the saved
   nr_subbufs to match the calculated nr_pages + 1 and if they were off,
   that the code could cause corruption. Sashiko is correct, and the
   saved nr_subbufs should be validated before assuming it is correct.

 - Do not allow more than one instance with the same name on cmdline

   If an admin were to add more than one trace instances with the same
   name they all would be created, but only the first one would be
   accessible via tracefs. This used to not be allowed but some
   restructuring of code has since made it possible.

 - Fix the race between subbuf resize and trace_pipe_raw readers

   If a task was reading trace_pipe_raw while another task was changing
   the ring buffer subbuf size, it could crash the reader. The
   trace_pipe_raw readers do get their own copy of the page from the
   buffer, but the code needs some restructuring to not have the resize
   of the subbuffers cause issues.

 - Cap the size of the mapped (static) ring buffer nr_pages

   The meta data used for ring buffer mapped buffers is 32 bit in size.
   A normal ring buffer could (in theory) have more than 4 billion
   pages. But this is not allowed by mapped buffers, so enforce it.

* tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Use a macro for static buffer bits
  tracing: Fix comment in tracing_buffers_splice_read()
  ring-buffer: Prevent truncation of nr_pages / nr_subbufs
  ring-buffer: Cap static ring buffer nr_pages
  tracing: Fix subbuf resize races with trace_pipe_raw readers
  tracing: Fix to avoid creating trace instances with duplicate names
  ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
  ring-buffer: Allow splice reads on static buffers
  tracing: Take trace_array reference when opening options file
  ftrace: Synchronize the initialization of ftrace_ops
  ftrace: Take trace_array reference before accessing its ftrace_ops
  tracing: Have show_event_filters/triggers files take trace array ref





Pull tracing fixes from Steven Rostedt:

 - Fix several tracefs files that did not take the trace_array reference

   A trace instance can be created and destroyed in the tracefs
   "instances" directory via mkdir and rmdir respectively. The instance
   is represented by a trace_array descriptor.

   Most tracefs files pass the trace_array as the private data of the
   inode to the open/read/write functions. Since there is no locking
   between the time a task opens a file and the deletion of the instance
   (and the freeing of the trace_array), each open needs to get a
   reference to the trace_array and each close must remove it.

   An instance can't be removed if there's any reference taken on its
   trace_array. The open function uses trace_array_get() that takes a
   lock (preventing removal of instances) and iterates the list of all
   existing trace_arrays and if it finds a match, it takes the reference
   and releases the lock. If it doesn't find a match, it causes the open
   to return -ENODEV.

   There were some added files that did not take the trace_array
   reference on open that needed to be fixed. Sashiko also correctly
   pointed out that there were some files that took an address of an
   field or element of the trace_array which had a pointer back to the
   trace_array to take its reference on open. But this leaves a slight
   race between referencing this element to get the trace_array as the
   element itself could be freed. To solve this, some helper functions
   were created to look for trace_arrays with this field or element in
   the search so that the element did not have to be dereferenced before
   the trace_array's reference was taken.

 - Add a lock around ftrace_ops initialization

   When a ftrace_ops is first used by ftrace, some internal
   initialization is performed on the ops. But if multiple tasks were
   calling functions that did this initialization, it could race and
   perform doing the initialization more than once, corrupting the
   internal data. Add a lock in the initialization code to prevent this
   from happening.

 - Fix splice reads on mmapped buffers

   The logic in the ring buffer splice code for mmapped buffers is
   supposed to do a copy of the memory as the mapped buffers can't be
   given to splice. But there was an if statement within the copy code
   that would return a -1 if a request for a full page was done and it
   wasn't a partial read. This is because this logic was written before
   mmapped buffers existed and this case didn't make sense at the time.
   For mmapped buffers it makes perfect sense and by returning early can
   drop a lot of pages unnecessarily.

 - Have the persistent ring buffer validation check nr_subbufs

   Sashiko reported that the validation code was relying on the saved
   nr_subbufs to match the calculated nr_pages + 1 and if they were off,
   that the code could cause corruption. Sashiko is correct, and the
   saved nr_subbufs should be validated before assuming it is correct.

 - Do not allow more than one instance with the same name on cmdline

   If an admin were to add more than one trace instances with the same
   name they all would be created, but only the first one would be
   accessible via tracefs. This used to not be allowed but some
   restructuring of code has since made it possible.

 - Fix the race between subbuf resize and trace_pipe_raw readers

   If a task was reading trace_pipe_raw while another task was changing
   the ring buffer subbuf size, it could crash the reader. The
   trace_pipe_raw readers do get their own copy of the page from the
   buffer, but the code needs some restructuring to not have the resize
   of the subbuffers cause issues.

 - Cap the size of the mapped (static) ring buffer nr_pages

   The meta data used for ring buffer mapped buffers is 32 bit in size.
   A normal ring buffer could (in theory) have more than 4 billion
   pages. But this is not allowed by mapped buffers, so enforce it.

* tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Use a macro for static buffer bits
  tracing: Fix comment in tracing_buffers_splice_read()
  ring-buffer: Prevent truncation of nr_pages / nr_subbufs
  ring-buffer: Cap static ring buffer nr_pages
  tracing: Fix subbuf resize races with trace_pipe_raw readers
  tracing: Fix to avoid creating trace instances with duplicate names
  ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
  ring-buffer: Allow splice reads on static buffers
  tracing: Take trace_array reference when opening options file
  ftrace: Synchronize the initialization of ftrace_ops
  ftrace: Take trace_array reference before accessing its ftrace_ops
  tracing: Have show_event_filters/triggers files take trace array ref







Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
2026-09-06T20:49:44+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T20:49:44+00:00

2beb1b31a12b57e19cd5c82ea6d54e56520605e8

Pull bpf fixes from Alexei Starovoitov:
 "This mainly contains verifier fixes that address bugs reported by
  Nicholas Carlini.

   - Fix incorrect non-NULL inference in pointer comparisons: pointer
     types that may be NULL at runtime, pointers with unbounded offsets,
     JMP32 comparisons with zero, and imprecise zero registers (Eduard
     Zingerman)

   - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
     implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
     NULL call arguments (Eduard Zingerman)

   - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
     extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
     patterns entered by a jump (Eduard Zingerman)

   - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
     (Hui Su)

   - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
     and reject key-less BTF for hash maps (Jiayuan Chen)

   - Various fixes (Kumar Kartikeya Dwivedi):
       - Fix out-of-bounds access in disassembler on invalid LDSX
         instruction
       - mark siginfo of signal tracepoints as scalar and
         sched_process_wait argument as nullable
       - mark faultable stack helpers as sleepable
       - reject tail calls and legacy packet loads from callbacks
       - enforce rbtree callback lock restrictions for resilient locks
       - require MEM_PERCPU for percpu kptr stores
       - clear NON_OWN_REF after RCU protection ends
       - mark NULL kptr stores precise
       - preserve inner map identity in callback frames
       - reject non-scalar bpf_loop() iteration counts

   - Fix trampoline allocation slowdown on x86 by using
     EXECMEM_MODULE_DATA (Mike Rapoport)

   - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
     reject untrusted allocated-object pointers (Ning Ding)

   - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
     Yuan Chen)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
  bpf, riscv: Make arena support depend on ZACAS
  selftests/bpf: Test pointer bpf_loop iteration count rejection
  bpf: Reject non-scalar bpf_loop iteration counts
  bpf: use mark_arg_precision() in check_mem_size_reg()
  bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
  selftests/bpf: precision of a NULL global subprogram BTF_ID argument
  bpf: mark a NULL BTF_ID argument of a global subprogram precise
  selftests/bpf: precision of a NULL kfunc argument
  bpf: mark a NULL kfunc argument precise
  selftests/bpf: precision of a NULL global subprogram memory argument
  bpf: mark a NULL memory argument of a call precise
  selftests/bpf: precision of a NULL helper argument
  bpf: mark a NULL call argument precise
  selftests/bpf: Test inner map identities in callbacks
  bpf: Preserve inner map identity in callback frames
  selftests/bpf: Test imprecise scalar kptr stores
  bpf: Mark NULL kptr stores precise
  selftests/bpf: Test rhtab kptr cancellation semantics
  bpf: Cancel special fields when recycling rhtab elements
  selftests/bpf: Test timer field on recycled rhtab element
  ...





Pull bpf fixes from Alexei Starovoitov:
 "This mainly contains verifier fixes that address bugs reported by
  Nicholas Carlini.

   - Fix incorrect non-NULL inference in pointer comparisons: pointer
     types that may be NULL at runtime, pointers with unbounded offsets,
     JMP32 comparisons with zero, and imprecise zero registers (Eduard
     Zingerman)

   - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
     implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
     NULL call arguments (Eduard Zingerman)

   - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
     extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
     patterns entered by a jump (Eduard Zingerman)

   - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
     (Hui Su)

   - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
     and reject key-less BTF for hash maps (Jiayuan Chen)

   - Various fixes (Kumar Kartikeya Dwivedi):
       - Fix out-of-bounds access in disassembler on invalid LDSX
         instruction
       - mark siginfo of signal tracepoints as scalar and
         sched_process_wait argument as nullable
       - mark faultable stack helpers as sleepable
       - reject tail calls and legacy packet loads from callbacks
       - enforce rbtree callback lock restrictions for resilient locks
       - require MEM_PERCPU for percpu kptr stores
       - clear NON_OWN_REF after RCU protection ends
       - mark NULL kptr stores precise
       - preserve inner map identity in callback frames
       - reject non-scalar bpf_loop() iteration counts

   - Fix trampoline allocation slowdown on x86 by using
     EXECMEM_MODULE_DATA (Mike Rapoport)

   - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
     reject untrusted allocated-object pointers (Ning Ding)

   - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
     Yuan Chen)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
  bpf, riscv: Make arena support depend on ZACAS
  selftests/bpf: Test pointer bpf_loop iteration count rejection
  bpf: Reject non-scalar bpf_loop iteration counts
  bpf: use mark_arg_precision() in check_mem_size_reg()
  bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
  selftests/bpf: precision of a NULL global subprogram BTF_ID argument
  bpf: mark a NULL BTF_ID argument of a global subprogram precise
  selftests/bpf: precision of a NULL kfunc argument
  bpf: mark a NULL kfunc argument precise
  selftests/bpf: precision of a NULL global subprogram memory argument
  bpf: mark a NULL memory argument of a call precise
  selftests/bpf: precision of a NULL helper argument
  bpf: mark a NULL call argument precise
  selftests/bpf: Test inner map identities in callbacks
  bpf: Preserve inner map identity in callback frames
  selftests/bpf: Test imprecise scalar kptr stores
  bpf: Mark NULL kptr stores precise
  selftests/bpf: Test rhtab kptr cancellation semantics
  bpf: Cancel special fields when recycling rhtab elements
  selftests/bpf: Test timer field on recycled rhtab element
  ...







Merge tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-09-06T18:08:44+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T18:08:44+00:00

88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8

Pull scheduler fixes from Ingo Molnar:

 - Fix a timestamping bug in pick_task_fair() and yield_task_fair()
   (Zhan Xusheng)

 - Skip migrate-disabled tasks when picking a push candidate in the
   RT and DL schedulers (Seiji Nishikawa)

 - Skip rq->avg_idle update without a valid idle_stamp (Shubhang
   Kaushik)

 - Fix throttling bug in throttle_cfs_rq(), caused by the recent
   single-runqueue conversion (Wanwu Li)

 - Fix bandwidth calculation bug in distribute_cfs_runtime(),
   caused by the single-runqueue conversion (Wanwu Li)

 - Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello)

 - Avoid creating misfits during cache-aware load-balancing on hybrid
   systems (Tim Chen)

* tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Avoid creating misfits during cache-aware balancing
  x86/itmt: Don't make ITMT enablement depend on debugfs
  sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime()
  sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq()
  sched/core: Skip rq->avg_idle update without a valid idle_stamp
  sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
  sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers





Pull scheduler fixes from Ingo Molnar:

 - Fix a timestamping bug in pick_task_fair() and yield_task_fair()
   (Zhan Xusheng)

 - Skip migrate-disabled tasks when picking a push candidate in the
   RT and DL schedulers (Seiji Nishikawa)

 - Skip rq->avg_idle update without a valid idle_stamp (Shubhang
   Kaushik)

 - Fix throttling bug in throttle_cfs_rq(), caused by the recent
   single-runqueue conversion (Wanwu Li)

 - Fix bandwidth calculation bug in distribute_cfs_runtime(),
   caused by the single-runqueue conversion (Wanwu Li)

 - Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello)

 - Avoid creating misfits during cache-aware load-balancing on hybrid
   systems (Tim Chen)

* tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Avoid creating misfits during cache-aware balancing
  x86/itmt: Don't make ITMT enablement depend on debugfs
  sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime()
  sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq()
  sched/core: Skip rq->avg_idle update without a valid idle_stamp
  sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
  sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers







Merge tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-09-06T18:06:09+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T18:06:09+00:00

c4a3928e7d0c08f2946ec3cf2814ba7738a08347

Pull perf events fixes from Ingo Molnar:

 - Skip empty AUX records with only format flags (Leo Yan)

 - Fix use-after-free when perf mmap() revival races with the
   last munmap() (Yilin Zhang, Weiming Shi)

* tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix use-after-free when perf mmap() revival races with the last munmap()
  perf/core: Skip empty AUX records with only format flags





Pull perf events fixes from Ingo Molnar:

 - Skip empty AUX records with only format flags (Leo Yan)

 - Fix use-after-free when perf mmap() revival races with the
   last munmap() (Yilin Zhang, Weiming Shi)

* tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix use-after-free when perf mmap() revival races with the last munmap()
  perf/core: Skip empty AUX records with only format flags







Merge tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-09-06T17:45:46+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T17:45:46+00:00

c8990f3179e5636832fc22e6a262de5d50c797e3

Pull locking fixes from Ingo Molnar:

 - Fix a softirq processing delay bug in local_interrupt_disable(),
   which should mostly only affect the Rust runtime (Boqun Feng)

 - Remove the hardirq_disable_count() function which caused the
   previous bug and is now unused & unnecessary (Boqun Feng)

 - lockdep: Invalidate stale class_cache entries for zapped classes
   (Eric Dumazet)

 - Fix rt_mutex specific futex scheduling helpers
   (Sebastian Andrzej Siewior)

 - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)

* tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Prevent rcuwait use-after-free during requeue PI
  futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
  locking/lockdep: Invalidate stale class_cache entries for zapped classes
  preempt: Remove hardirq_disable_count()
  interrupt: Disable interrupt before modifying hardirq_disable counter





Pull locking fixes from Ingo Molnar:

 - Fix a softirq processing delay bug in local_interrupt_disable(),
   which should mostly only affect the Rust runtime (Boqun Feng)

 - Remove the hardirq_disable_count() function which caused the
   previous bug and is now unused & unnecessary (Boqun Feng)

 - lockdep: Invalidate stale class_cache entries for zapped classes
   (Eric Dumazet)

 - Fix rt_mutex specific futex scheduling helpers
   (Sebastian Andrzej Siewior)

 - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)

* tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Prevent rcuwait use-after-free during requeue PI
  futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
  locking/lockdep: Invalidate stale class_cache entries for zapped classes
  preempt: Remove hardirq_disable_count()
  interrupt: Disable interrupt before modifying hardirq_disable counter







Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-09-06T17:35:24+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T17:35:24+00:00

b485131995544741ba6dcc313d7eb573bca7bebc

Pull IRQ subsystem fixes from Ingo Molnar:

 - Revert a commit to the mbigen irqchip driver that caused
   a regression on two-port Hi1616 chips (Caina)

 - Fix a too-long-preemption-off bug in the stm32mp-exti
   irqchip driver, caused by a time unit ambiguity & mismatch
   (Ju Nan)

 - Remove the now completely unused irq_domain_add_linear()
   inline function (Jiri Slaby)

* tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
  Revert "irqchip/mbigen: Fix mbigen node address layout"
  irqdomain: Delete irq_domain_add_linear()





Pull IRQ subsystem fixes from Ingo Molnar:

 - Revert a commit to the mbigen irqchip driver that caused
   a regression on two-port Hi1616 chips (Caina)

 - Fix a too-long-preemption-off bug in the stm32mp-exti
   irqchip driver, caused by a time unit ambiguity & mismatch
   (Ju Nan)

 - Remove the now completely unused irq_domain_add_linear()
   inline function (Jiri Slaby)

* tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
  Revert "irqchip/mbigen: Fix mbigen node address layout"
  irqdomain: Delete irq_domain_add_linear()







Merge tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2026-09-06T16:55:20+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T16:55:20+00:00

d3cbb9af7242873aae6fc2b7e8a991101a322201

Pull virtio console fix from Greg KH:
 "Here is a single virtio console fix for 7.3-rc2 to fix a much reported
  regression in 7.3-rc1, sorry about that. It's not been in linux-next,
  but it has been sent by many different developers to resolve the issue
  and is 'obviously' correct"

* tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  virtio_console: allocate the port_buffer with the caller's gfp





Pull virtio console fix from Greg KH:
 "Here is a single virtio console fix for 7.3-rc2 to fix a much reported
  regression in 7.3-rc1, sorry about that. It's not been in linux-next,
  but it has been sent by many different developers to resolve the issue
  and is 'obviously' correct"

* tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  virtio_console: allocate the port_buffer with the caller's gfp







Merge tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
2026-09-06T16:49:06+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T16:49:06+00:00

bf979ab8f24657ebc6193183cfef1669029e84a5

Pull staging driver fixes from Greg KH:
 "Here are some small staging driver fixes to resolve some reported bugs
  that have been found, and tested, in a few staging drivers in 7.3-rc1.
  Included in here are:

   - OOB read problem fixes in the rtl8723bs driver

   - fbtft driver fix

   - sm750fb driver fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
  staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
  staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
  staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
  staging: fbtft: make dirty_lock IRQ-safe





Pull staging driver fixes from Greg KH:
 "Here are some small staging driver fixes to resolve some reported bugs
  that have been found, and tested, in a few staging drivers in 7.3-rc1.
  Included in here are:

   - OOB read problem fixes in the rtl8723bs driver

   - fbtft driver fix

   - sm750fb driver fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
  staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
  staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
  staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
  staging: fbtft: make dirty_lock IRQ-safe







Merge tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2026-09-06T15:50:20+00:00

Linus Torvalds
torvalds@linux-foundation.org

2026-09-06T15:50:20+00:00

65538a8f02fe6e4f07228a816529b039b544f051

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes for reported problems and
  regressions. Include in here are:

   - xhci driver fixes

   - cdns3 driver fixes

   - usb gadget driver fixes for syzbot found problems

   - typec driver fixes for broken hardware and other bugs found

   - kernel data leaks in mdc800 driver

   - usb storage driver fixes

   - other small USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
  usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
  usb: gadget: fix null pointer dereference in usb_put_function_instance()
  usb: typec: qcom-pmic: cancel reset_work on stop
  usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
  usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
  usb: storage: realtek_cr: fix use-after-free on disconnect
  usb: cdnsp: fix wakeup from S3 after controller context loss
  usb-storage: ene_ub6250: fix race between scan work and probe
  USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
  usb: gadget: f_midi: initialize work in f_midi_alloc()
  usb: gadget: f_midi2: fix use-after-free in string attribute show path
  usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
  usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
  usb: typec: hd3ss3220: track VBUS enable state per consumer
  usb: dwc3: clear forceRM when issuing EndTransfer
  usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
  usb: typec: mux: avoid duplicated mux switches
  usb: typec: mux: Fix typec_switch_match()
  usb: image: mdc800: change kmalloc() to kzalloc()
  ...





Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes for reported problems and
  regressions. Include in here are:

   - xhci driver fixes

   - cdns3 driver fixes

   - usb gadget driver fixes for syzbot found problems

   - typec driver fixes for broken hardware and other bugs found

   - kernel data leaks in mdc800 driver

   - usb storage driver fixes

   - other small USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
  usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
  usb: gadget: fix null pointer dereference in usb_put_function_instance()
  usb: typec: qcom-pmic: cancel reset_work on stop
  usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
  usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
  usb: storage: realtek_cr: fix use-after-free on disconnect
  usb: cdnsp: fix wakeup from S3 after controller context loss
  usb-storage: ene_ub6250: fix race between scan work and probe
  USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
  usb: gadget: f_midi: initialize work in f_midi_alloc()
  usb: gadget: f_midi2: fix use-after-free in string attribute show path
  usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
  usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
  usb: typec: hd3ss3220: track VBUS enable state per consumer
  usb: dwc3: clear forceRM when issuing EndTransfer
  usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
  usb: typec: mux: avoid duplicated mux switches
  usb: typec: mux: Fix typec_switch_match()
  usb: image: mdc800: change kmalloc() to kzalloc()
  ...