linux.git/include, branch v7.2-rc5 Linux kernel source tree Merge tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 2026-07-26T19:22:57+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-26T19:22:57+00:00 4235cb24ec1e8e96843f3671ba4da2a6ccca2c7b Pull vfs fixes from Christian Brauner: - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl(). ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL. The helper replaced it with ACL_NOT_CACHED, silently re-enabling the cache, and as fuse doesn't invalidate the cache for such servers a properly timed get_acl() returned stale ACLs. Comes with a fuse selftest reproducing this. - pidfs: - Preserve PIDFD_THREAD when a thread pidfd is reopened via open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which do_dentry_open() strips after the flags have been validated, so the reopened pidfd silently became a process pidfd. Comes with a selftest. - Add a pidfs_dentry_open() helper so the regular pidfd allocation path and the file handle path share the code that forces O_RDWR and reapplies the pidfd flags that do_dentry_open() strips. - Handle FS_IOC32_GETVERSION in the compat ioctl path. - Make pidfs_ino_lock static. - iomap: - Fix the block range calculation in ifs_clear_range_dirty() so a partial clear doesn't drop the dirty state of blocks the range only partially covers. - Support invalidating partial folios so a partial truncate or hole punch with blocksize < foliosize doesn't leave stale dirty bits behind. - Only set did_zero when iomap_zero_iter() actually zeroed something. - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against zero-length ranges where the unsigned last-block calculation underflows and bitmap_set() writes far beyond the ifs->state allocation. - Don't merge ioends with different io_private values as the merge could leak or corrupt the private data of the individual ioends. - exec: - Raise bprm->have_execfd only once the binfmt_misc interpreter has actually been opened. The flag was set as soon as a matching 'O' or 'C' entry was found. If the interpreter open failed with ENOEXEC the exec fell through to the next binary format with have_execfd raised but no executable staged and begin_new_exec() NULL derefed past the point of no return. - Fix an unsigned loop counter wrap in transfer_args_to_stack() on nommu. An overlong argument or environment string pushes bprm->p below PAGE_SIZE, the stop index becomes zero, and the loop never terminates, wrapping its counter and copying garbage from in front of the page array into the new process stack. - Make binfmt_elf_fdpic only honour the first PT_INTERP like binfmt_elf does. Each additional PT_INTERP overwrote the previous interpreter, leaking the name allocation and the interpreter file reference together with the write denial open_exec() took, leaving the file unwritable for as long as the system runs. - overlayfs: - Compare the full escaped xattr prefix including the trailing dot. An xattr like "trusted.overlay.overlayfoo" was misclassified as an escaped overlay xattr. - Check read access to the copy_file_range() source with the source's mounter credentials. - super: Thawing a filesystem whose block device was frozen with bdev_freeze() deadlocked. Dropping the last block layer freeze reference from under s_umount ends up in fs_bdev_thaw() which reacquires s_umount on the same task. Pin the superblock with an active reference instead and call bdev_thaw() without holding s_umount. - procfs: Return EACCES instead of success when the ptrace access check for namespace links fails. - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add(). - Push the memcg gating of ->nr_cached_objects() down into the btrfs and shmem callbacks instead of skipping every callback during non-root memcg reclaim. The blanket check short-circuited XFS whose inode reclaim hook is intentionally driven from per-memcg contexts to free memcg-charged slab. - eventpoll: Pin files while checking reverse paths. Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close could free and recycle the file under the check which then took and dropped the f_lock of whatever live file now occupies that slot. * tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits) super: fix emergency thaw deadlock on frozen block devices pidfs: make pidfs_ino_lock static eventpoll: pin files while checking reverse paths fs: push nr_cached_objects memcg gating into individual filesystems afs: Fix afs_edit_dir_remove() to get, not find, block 0 iomap: prevent ioend merge when io_private differs iomap: add comments for ifs_clear/set_range_dirty() iomap: fix out-of-bounds bitmap_set() with zero-length range iomap: fix incorrect did_zero setting in iomap_zero_iter() iomap: support invalidating partial folios iomap: correct the range of a partial dirty clear fs/super: fix emergency thaw double-unlock of s_umount pidfs: handle FS_IOC32_GETVERSION in compat ioctl ovl: check access to copy_file_range source with src mounter creds proc: Fix broken error paths for namespace links pidfs: add pidfs_dentry_open() helper selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at() pidfs: preserve thread pidfds reopened by file handle ovl: fix trusted xattr escape prefix matching selftests/fuse: add ACL_DONT_CACHE regression test ... 
Pull vfs fixes from Christian Brauner:

 - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().

   ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
   which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
   The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
   cache, and as fuse doesn't invalidate the cache for such servers a
   properly timed get_acl() returned stale ACLs. Comes with a fuse
   selftest reproducing this.

 - pidfs:

     - Preserve PIDFD_THREAD when a thread pidfd is reopened via
       open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
       do_dentry_open() strips after the flags have been validated, so
       the reopened pidfd silently became a process pidfd. Comes with a
       selftest.

     - Add a pidfs_dentry_open() helper so the regular pidfd allocation
       path and the file handle path share the code that forces O_RDWR
       and reapplies the pidfd flags that do_dentry_open() strips.

     - Handle FS_IOC32_GETVERSION in the compat ioctl path.

     - Make pidfs_ino_lock static.

 - iomap:

     - Fix the block range calculation in ifs_clear_range_dirty() so a
       partial clear doesn't drop the dirty state of blocks the range
       only partially covers.

     - Support invalidating partial folios so a partial truncate or hole
       punch with blocksize < foliosize doesn't leave stale dirty bits
       behind.

     - Only set did_zero when iomap_zero_iter() actually zeroed
       something.

     - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
       zero-length ranges where the unsigned last-block calculation
       underflows and bitmap_set() writes far beyond the ifs->state
       allocation.

     - Don't merge ioends with different io_private values as the merge
       could leak or corrupt the private data of the individual ioends.

 - exec:

     - Raise bprm->have_execfd only once the binfmt_misc interpreter has
       actually been opened. The flag was set as soon as a matching 'O'
       or 'C' entry was found. If the interpreter open failed with
       ENOEXEC the exec fell through to the next binary format with
       have_execfd raised but no executable staged and begin_new_exec()
       NULL derefed past the point of no return.

     - Fix an unsigned loop counter wrap in transfer_args_to_stack() on
       nommu. An overlong argument or environment string pushes bprm->p
       below PAGE_SIZE, the stop index becomes zero, and the loop never
       terminates, wrapping its counter and copying garbage from in
       front of the page array into the new process stack.

     - Make binfmt_elf_fdpic only honour the first PT_INTERP like
       binfmt_elf does. Each additional PT_INTERP overwrote the previous
       interpreter, leaking the name allocation and the interpreter file
       reference together with the write denial open_exec() took,
       leaving the file unwritable for as long as the system runs.

 - overlayfs:

     - Compare the full escaped xattr prefix including the trailing dot.
       An xattr like "trusted.overlay.overlayfoo" was misclassified as
       an escaped overlay xattr.

     - Check read access to the copy_file_range() source with the
       source's mounter credentials.

 - super: Thawing a filesystem whose block device was frozen with
   bdev_freeze() deadlocked. Dropping the last block layer freeze
   reference from under s_umount ends up in fs_bdev_thaw() which
   reacquires s_umount on the same task. Pin the superblock with an
   active reference instead and call bdev_thaw() without holding
   s_umount.

 - procfs: Return EACCES instead of success when the ptrace access check
   for namespace links fails.

 - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
   block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().

 - Push the memcg gating of ->nr_cached_objects() down into the btrfs
   and shmem callbacks instead of skipping every callback during
   non-root memcg reclaim. The blanket check short-circuited XFS whose
   inode reclaim hook is intentionally driven from per-memcg contexts to
   free memcg-charged slab.

 - eventpoll: Pin files while checking reverse paths.

   Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
   could free and recycle the file under the check which then took and
   dropped the f_lock of whatever live file now occupies that slot.

* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  super: fix emergency thaw deadlock on frozen block devices
  pidfs: make pidfs_ino_lock static
  eventpoll: pin files while checking reverse paths
  fs: push nr_cached_objects memcg gating into individual filesystems
  afs: Fix afs_edit_dir_remove() to get, not find, block 0
  iomap: prevent ioend merge when io_private differs
  iomap: add comments for ifs_clear/set_range_dirty()
  iomap: fix out-of-bounds bitmap_set() with zero-length range
  iomap: fix incorrect did_zero setting in iomap_zero_iter()
  iomap: support invalidating partial folios
  iomap: correct the range of a partial dirty clear
  fs/super: fix emergency thaw double-unlock of s_umount
  pidfs: handle FS_IOC32_GETVERSION in compat ioctl
  ovl: check access to copy_file_range source with src mounter creds
  proc: Fix broken error paths for namespace links
  pidfs: add pidfs_dentry_open() helper
  selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
  pidfs: preserve thread pidfds reopened by file handle
  ovl: fix trusted xattr escape prefix matching
  selftests/fuse: add ACL_DONT_CACHE regression test
  ...
Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 2026-07-26T17:47:58+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-26T17:47:58+00:00 09b2124a472d93e74f5c4430ae15d1f9e364e81d Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: Update wine-devel list address rust_binder: only print failure if error has source intel_th: fix MSC output device reference leak misc: nsm: pin the module while the device is open mei: bus: access mei_device under device_lock on cleanup misc: nsm: only unlock nsm_dev on post-lock error paths selftests: ntsync: correct CONFIG_NTSYNC name comedi: comedi_parport: deal with premature interrupt uio_hv_generic: Bind to FCopy device by default MAINTAINERS: Add Greg Kroah-Hartman to GPIB firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs 
Pull char/misc driver fixes from Greg KH:
 "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that
  resolve a bunch of different reported issues. Included in here are:

   - rust_binder error message reporting fix

   - stratix10-svc firmware driver fixes

   - mei driver fix

   - intel_th hardware tracing driver fix

   - comedi driver fix

   - uio_hv_generic driver fix

   - ntsync selftest fix

   - nsm misc driver fix

   - some MAINTAINER file updates

  All of these have been in linux-next for over a week with no reported
  issues"

* tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  MAINTAINERS: Update wine-devel list address
  rust_binder: only print failure if error has source
  intel_th: fix MSC output device reference leak
  misc: nsm: pin the module while the device is open
  mei: bus: access mei_device under device_lock on cleanup
  misc: nsm: only unlock nsm_dev on post-lock error paths
  selftests: ntsync: correct CONFIG_NTSYNC name
  comedi: comedi_parport: deal with premature interrupt
  uio_hv_generic: Bind to FCopy device by default
  MAINTAINERS: Add Greg Kroah-Hartman to GPIB
  firmware: stratix10-svc: fix teardown order in remove to prevent race
  firmware: stratix10-svc: handle NO_RESPONSE in async poll
  firmware: stratix10-svc: fix FCS SMC call kernel-doc
  firmware: stratix10-svc: fix memory leaks and list corruption bugs
Merge tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 2026-07-25T02:58:03+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-25T02:58:03+00:00 73387b89d99f7b588870c5a98eb6a89689c65a1a Pull io_uring fixes from Jens Axboe: - Fix a missing ERESTARTSYS conversion in the read paths, which got messed up back when some code consolidation was done for read multishot support - zcrx UAPI rename, dropping the abbreviated "notif" naming in favor of "event" for consistency and to be less ambiguous for users. This was added for 7.2, so let's rename it while we still can. No functional or code changes, just a strict rename * tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/zcrx: rename notif to event io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS io_uring/zcrx: drop "notif" from stats struct names io_uring/rw: fix missing ERESTARTSYS conversion in read paths 
Pull io_uring fixes from Jens Axboe:

 - Fix a missing ERESTARTSYS conversion in the read paths, which got
   messed up back when some code consolidation was done for read
   multishot support

 - zcrx UAPI rename, dropping the abbreviated "notif" naming in favor of
   "event" for consistency and to be less ambiguous for users. This was
   added for 7.2, so let's rename it while we still can. No functional
   or code changes, just a strict rename

* tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/zcrx: rename notif to event
  io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS
  io_uring/zcrx: drop "notif" from stats struct names
  io_uring/rw: fix missing ERESTARTSYS conversion in read paths
Merge tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel 2026-07-24T21:11:53+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-24T21:11:53+00:00 e2a936998ab25cf7272847356390041c3143b498 Pull drm fixes from Dave Airlie: "Weekly drm pull request, small and scattered seems to be the new normal, the ttm change is probably the largest, with xe being the most. Alex was out this week so amdgpu is smaller and only has some urgent fixes. MAINTAINERS: - update mailmap address ttm: - backup pages using correct order gpusvm: - fix mm leak on eviction - properly zero page array in mm scanning tests: - fix dma mask errors in tests panel: - fix dependency issues - ilitek-ili9881c - fix probing i915: - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight xe: - Skip invalidation for purgeable state updates - Add drm_dev guards when detaching CCS read / write buffers - Alloc per domain unique i2c id - Fix SVM leak on resv obj alloc failure in xe_vm_create amdgpu: - Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset appletbdrm: - fix issue in damage handling amdxdna: - fix command timeout race imagination: - fix gpu vm locking vc4: - prevent trusted bo from being mapped again - prevent timer rearm on shutdown v3d: - fix NULL deref in unbind - idle AXI before clock disable on suspend - use proper GMP access for newer hw vmwgfx: - validate shader array size ethosu: - fix length calculations - handle internal chaining buffers gma500: - return errors from HDMI i2c reads" * tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel: (31 commits) drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() drm/amd/display: Fix flip-done timeouts on mode1 reset Revert "drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION" drm/vc4: Shut down BO cache timer before teardown drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() drm/xe/i2c: Allow per domain unique id drm/gma500: return errors from Oaktrail HDMI I2C reads drm/vc4: hvs/v3d: Fix null dereference in unbind drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T drm/panel: ilitek-ili9881c: do not fail probe if iovcc is absent drm/v3d: Idle AXI transactions before disabling the clock on suspend drm/v3d: Reach the GMP through the hub registers on V3D 7.x mailmap: Update Maíra Canal's email address drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION drm/pagemap: Clear driver-provided PFNs from migration PFN array drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers accel: ethosu: Handle U85 internal chaining buffer ... 
Pull drm fixes from Dave Airlie:
 "Weekly drm pull request, small and scattered seems to be the new
  normal, the ttm change is probably the largest, with xe being the
  most. Alex was out this week so amdgpu is smaller and only has some
  urgent fixes.

  MAINTAINERS:
   - update mailmap address

  ttm:
   - backup pages using correct order

  gpusvm:
   - fix mm leak on eviction
   - properly zero page array in mm scanning

  tests:
   - fix dma mask errors in tests

  panel:
   - fix dependency issues
   - ilitek-ili9881c - fix probing

  i915:
   - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight

  xe:
   - Skip invalidation for purgeable state updates
   - Add drm_dev guards when detaching CCS read / write buffers
   - Alloc per domain unique i2c id
   - Fix SVM leak on resv obj alloc failure in xe_vm_create

  amdgpu:
   - Fix a backport mistake for dm_gpureset_toggle_interrupts()
   - Fix a failure on flip-done timeouts for mode1 reset

  appletbdrm:
   - fix issue in damage handling

  amdxdna:
   - fix command timeout race

  imagination:
   - fix gpu vm locking

  vc4:
   - prevent trusted bo from being mapped again
   - prevent timer rearm on shutdown

  v3d:
   - fix NULL deref in unbind
   - idle AXI before clock disable on suspend
   - use proper GMP access for newer hw

  vmwgfx:
   - validate shader array size

  ethosu:
   - fix length calculations
   - handle internal chaining buffers

  gma500:
   - return errors from HDMI i2c reads"

* tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel: (31 commits)
  drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
  drm/amd/display: Fix flip-done timeouts on mode1 reset
  Revert "drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION"
  drm/vc4: Shut down BO cache timer before teardown
  drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
  drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
  drm/xe/i2c: Allow per domain unique id
  drm/gma500: return errors from Oaktrail HDMI I2C reads
  drm/vc4: hvs/v3d: Fix null dereference in unbind
  drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A
  drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
  drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T
  drm/panel: ilitek-ili9881c: do not fail probe if iovcc is absent
  drm/v3d: Idle AXI transactions before disabling the clock on suspend
  drm/v3d: Reach the GMP through the hub registers on V3D 7.x
  mailmap: Update Maíra Canal's email address
  drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION
  drm/pagemap: Clear driver-provided PFNs from migration PFN array
  drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
  accel: ethosu: Handle U85 internal chaining buffer
  ...
Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux 2026-07-24T20:12:43+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-24T20:12:43+00:00 981f4a2baaf15a15fd4a22d311f15d066e28833b Pull fscrypt fixes from Eric Biggers: "A couple fixes for AI-detected bugs" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: Avoid dynamic allocation in fscrypt_get_devices() fscrypt: Add missing superblock check in find_or_insert_direct_key() 
Pull fscrypt fixes from Eric Biggers:
 "A couple fixes for AI-detected bugs"

* tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux:
  fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
  fscrypt: Add missing superblock check in find_or_insert_direct_key()
Merge tag 'slab-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab 2026-07-24T14:28:35+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-24T14:28:35+00:00 86ba24c41adcf1d6e63827a828a9b5120a86917d Pull slab fixes from Vlastimil Babka: - Prevent unbounded recursion in free path with memory allocation profiling, which has caused a stack overflow on a Meta production host due to a 125-deep __free_slab<->kfree recursion (Harry Yoo) - Fix type-based partitioning confusing sparse which does not know __builtin_infer_alloc_token() (Marco Elver) - Fix a potential memory leak in bulk freeing path on NUMA machines (Shengming Hu) * tag 'slab-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: silence sparse warning with type-based partitioning mm/slab: prevent unbounded recursion in free path with new kmalloc type lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT mm/slab: fix a memory leak due to bootstrapping sheaves twice mm/slub: fix lost local objects when bulk remote free batch fills 
Pull slab fixes from Vlastimil Babka:

 - Prevent unbounded recursion in free path with memory allocation
   profiling, which has caused a stack overflow on a Meta production
   host due to a 125-deep __free_slab<->kfree recursion (Harry Yoo)

 - Fix type-based partitioning confusing sparse which does not know
   __builtin_infer_alloc_token() (Marco Elver)

 - Fix a potential memory leak in bulk freeing path on NUMA machines
   (Shengming Hu)

* tag 'slab-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  slab: silence sparse warning with type-based partitioning
  mm/slab: prevent unbounded recursion in free path with new kmalloc type
  lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
  mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
  mm/slab: fix a memory leak due to bootstrapping sheaves twice
  mm/slub: fix lost local objects when bulk remote free batch fills
Merge tag 'drm-misc-fixes-2026-07-24' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes 2026-07-24T08:30:29+00:00 Dave Airlie airlied@redhat.com 2026-07-24T08:30:23+00:00 e24b02df4e9a1a78b2dbbf6ab21ebf24918f5c6a drm-misc-fixes for v7.2-rc5: - Improve damage handling in appletbdrm. - Fix harmful fragmenting of MM by backing up TTM pages at native page order. - Fix timeout handling in amdxdna. - Fix imagination locking for map/unmap operations. - Fix mm leak in gpusvm eviction. - Properly zero page array in gpusvm mm scanning. - Prevent trusted shader bo's from being mapped again in vc4. - Validate shader array size in vmwgfx. - Fix length calculation bugs in ethosu. - Better error handling during pagemap migration. - Improve v3d suspend. - Kconfig updates for some panels. - Handle missing iovcc in ili9881c panel. - Fix vc4 unbind. - Add i2c error handling in gma500. - Fix kunit tests on pp64le and s390x. - Prevent rearming vc4 timer on shutdown. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/07284633-6b9b-40f9-8949-b1516a42a34c@linux.intel.com 
drm-misc-fixes for v7.2-rc5:
- Improve damage handling in appletbdrm.
- Fix harmful fragmenting of MM by backing up TTM pages at native
  page order.
- Fix timeout handling in amdxdna.
- Fix imagination locking for map/unmap operations.
- Fix mm leak in gpusvm eviction.
- Properly zero page array in gpusvm mm scanning.
- Prevent trusted shader bo's from being mapped again in vc4.
- Validate shader array size in vmwgfx.
- Fix length calculation bugs in ethosu.
- Better error handling during pagemap migration.
- Improve v3d suspend.
- Kconfig updates for some panels.
- Handle missing iovcc in ili9881c panel.
- Fix vc4 unbind.
- Add i2c error handling in gma500.
- Fix kunit tests on pp64le and s390x.
- Prevent rearming vc4 timer on shutdown.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/07284633-6b9b-40f9-8949-b1516a42a34c@linux.intel.com
Merge tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-23T19:58:08+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-23T19:58:08+00:00 d326f83e819c53aa05c40d64f5805d6237b6aa1b Pull networking fixes from Jakub Kicinski: "Lots of fixes, double the count even for the 'new normal'. Largely due to my time off followed by a networking conference which distracted most maintainers (less so the AI generators). Including fixes from Bluetooth and WiFi. Current release - regressions: - wifi: mt76: fix MAC address for non OF pcie cards Current release - new code bugs: - mptcp: fix BUILD_BUG_ON on legacy ARM config - wifi: cfg80211: guard optional PMSR nominal time Previous releases - regressions: - qrtr: ns: raise node count limit to 512, we arbitrarily picked 256 as a limit, turns out it was too low for real world deployments - vhost-net: fix TX stall when vhost owns virtio-net header - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - wifi: ath12k: fix low MLO RX throughput on WCN7850 Previous releases - always broken: - number of random AI fixes for SCTP, RDS and TIPC protocols - more AI-looking fixes for WiFi drivers - number of fixes for missing pointer reloading after skb pull - reject BPF redirect use from qdisc qevent block - tcp: initialize standalone TCP-AO response padding - vsock/virtio: collapse receive queue under memory pressure to avoid client OOMing the host with tiny messages - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup, make sure the ICMP response routing follows the routing policy - gro: fix double aggregation of flush-marked skbs - ovpn: fix various refcount bugs - tls: device: push pending open record on splice EOF - eth: mlx5: - use sender devcom for MPV master-up - fix MCIA register buffer overflow on 32 dword reads" * tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits) drop_monitor: perform u64_stats updates under IRQ-disabled section drop_monitor: fix size calculations for 64-bit attributes net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD mptcp: fix BUILD_BUG_ON on legacy ARM config selftests: mptcp: userspace_pm: fix undefined variable port mptcp: fix stale skb->sk reference on subflow close mptcp: pm: userspace: fix use-after-free in get_local_id mptcp: decrement subflows counter on failed passive join mac802154: hold an interface reference across the scan worker sctp: don't free the ASCONF's own transport in DEL-IP processing phonet: check register_netdevice_notifier() error in phonet_device_init() phonet: pep: fix use-after-free in pep_get_sb() bnge/bng_re: fix ring ID widths tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() mctp: check register_netdevice_notifier() error in mctp_device_init() ptp: netc: explicitly clear TMR_OFF during initialization rds: tcp: unregister sysctl before tearing down listen socket ipv6: Change allocation flags to match rcu_read_lock section requirements net: slip: serialize receive against buffer reallocation ... 
Pull networking fixes from Jakub Kicinski:
 "Lots of fixes, double the count even for the 'new normal'. Largely due
  to my time off followed by a networking conference which distracted
  most maintainers (less so the AI generators).

  Including fixes from Bluetooth and WiFi.

  Current release - regressions:

   - wifi: mt76: fix MAC address for non OF pcie cards

  Current release - new code bugs:

   - mptcp: fix BUILD_BUG_ON on legacy ARM config

   - wifi: cfg80211: guard optional PMSR nominal time

  Previous releases - regressions:

   - qrtr: ns: raise node count limit to 512, we arbitrarily picked
     256 as a limit, turns out it was too low for real world deployments

   - vhost-net: fix TX stall when vhost owns virtio-net header

   - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

   - wifi: ath12k: fix low MLO RX throughput on WCN7850

  Previous releases - always broken:

   - number of random AI fixes for SCTP, RDS and TIPC protocols

   - more AI-looking fixes for WiFi drivers

   - number of fixes for missing pointer reloading after skb pull

   - reject BPF redirect use from qdisc qevent block

   - tcp: initialize standalone TCP-AO response padding

   - vsock/virtio: collapse receive queue under memory pressure to avoid
     client OOMing the host with tiny messages

   - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,
     make sure the ICMP response routing follows the routing policy

   - gro: fix double aggregation of flush-marked skbs

   - ovpn: fix various refcount bugs

   - tls: device: push pending open record on splice EOF

   - eth: mlx5:
      - use sender devcom for MPV master-up
      - fix MCIA register buffer overflow on 32 dword reads"

* tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits)
  drop_monitor: perform u64_stats updates under IRQ-disabled section
  drop_monitor: fix size calculations for 64-bit attributes
  net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  mptcp: fix BUILD_BUG_ON on legacy ARM config
  selftests: mptcp: userspace_pm: fix undefined variable port
  mptcp: fix stale skb->sk reference on subflow close
  mptcp: pm: userspace: fix use-after-free in get_local_id
  mptcp: decrement subflows counter on failed passive join
  mac802154: hold an interface reference across the scan worker
  sctp: don't free the ASCONF's own transport in DEL-IP processing
  phonet: check register_netdevice_notifier() error in phonet_device_init()
  phonet: pep: fix use-after-free in pep_get_sb()
  bnge/bng_re: fix ring ID widths
  tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  mctp: check register_netdevice_notifier() error in mctp_device_init()
  ptp: netc: explicitly clear TMR_OFF during initialization
  rds: tcp: unregister sysctl before tearing down listen socket
  ipv6: Change allocation flags to match rcu_read_lock section requirements
  net: slip: serialize receive against buffer reallocation
  ...
bnge/bng_re: fix ring ID widths 2026-07-23T17:24:12+00:00 Vikas Gupta vikas.gupta@broadcom.com 2026-07-21T06:37:31+00:00 b9e558976bb968162c35ddccdb076a77fc906993 Firmware requires more than 16 bits to address TX ring IDs for its internal QP management. Widen the associated HSI ring ID fields to 32 bits. The values firmware assigns remain within 24 bits, bounded by the hardware doorbell XID field. The fw_ring_id field belongs to bnge_ring_struct, a common struct shared by all ring types, so widening it to u32 applies uniformly across TX, RX, CP, and NQ rings but firmware assigns values within 16-bit range for all ring types except TX, which requires the wider field. Note that, Thor Ultra hardware has not yet been deployed and no firmware has been released to field, so backward compatibility is not a concern. Fixes: 42d1c54d6248 ("bnge/bng_re: Add a new HSI") Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Siva Reddy Kallam <siva.kallam@broadcom.com> Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com> Reviewed-by: Yendapally Reddy Dhananjaya Reddy <yendapally.reddy@broadcom.com> Link: https://patch.msgid.link/20260721063731.2622500-1-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
Firmware requires more than 16 bits to address TX ring IDs for its
internal QP management. Widen the associated HSI ring ID fields to
32 bits. The values firmware assigns remain within 24 bits, bounded
by the hardware doorbell XID field.

The fw_ring_id field belongs to bnge_ring_struct, a common struct
shared by all ring types, so widening it to u32 applies uniformly
across TX, RX, CP, and NQ rings but firmware assigns values within
16-bit range for all ring types except TX, which requires the wider
field.

Note that, Thor Ultra hardware has not yet been deployed and no
firmware has been released to field, so backward compatibility
is not a concern.

Fixes: 42d1c54d6248 ("bnge/bng_re: Add a new HSI")
Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Reviewed-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Yendapally Reddy Dhananjaya Reddy <yendapally.reddy@broadcom.com>
Link: https://patch.msgid.link/20260721063731.2622500-1-vikas.gupta@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
tcp: challenge ACK for non-exact RST in SYN-RECEIVED 2026-07-23T15:27:22+00:00 Yuxiang Yang yangyx22@mails.tsinghua.edu.cn 2026-07-17T08:14:42+00:00 a28c4fcbf774e23b4779cae468e3497a5ad1f4a1 The SYN-RECEIVED request-socket path in tcp_check_req() accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request instead of eliciting a challenge ACK. RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in SYN-RECEIVED: an exact RST resets the connection, while a non-exact in-window RST must trigger a challenge ACK and be dropped. Apply that check before the ACK-field validation, following the RFC sequence-number, RST, then ACK processing order. Factor the per-netns challenge ACK quota out of tcp_send_challenge_ack() so request sockets can share it. Use the request socket's send_ack() callback and its own out-of-window ACK timestamp to send and rate-limit the response. Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn> Reported-by: Ao Wang <wangao@seu.edu.cn> Reported-by: Xuewei Feng <fengxw06@126.com> Reported-by: Qi Li <qli01@tsinghua.edu.cn> Reported-by: Ke Xu <xuke@tsinghua.edu.cn> Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2") Cc: stable@vger.kernel.org Signed-off-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260717081443.809393-2-yangyx22@mails.tsinghua.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
The SYN-RECEIVED request-socket path in tcp_check_req() accepts an
in-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A
non-exact RST therefore removes the request instead of eliciting a
challenge ACK.

RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in
SYN-RECEIVED: an exact RST resets the connection, while a non-exact
in-window RST must trigger a challenge ACK and be dropped.

Apply that check before the ACK-field validation, following the RFC
sequence-number, RST, then ACK processing order.  Factor the per-netns
challenge ACK quota out of tcp_send_challenge_ack() so request sockets
can share it.  Use the request socket's send_ack() callback and its own
out-of-window ACK timestamp to send and rate-limit the response.

Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
Cc: stable@vger.kernel.org
Signed-off-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260717081443.809393-2-yangyx22@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>