linux.git/include, branch v7.2-rc6 Linux kernel source tree Merge tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 2026-08-02T17:12:21+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-02T17:12:21+00:00 bd1dde877520385f6638af2d0f2bd4f212eb8f34 Pull vfs fixes from Christian Brauner: "binfmt_misc: - Don't let an 'F' entry pin its own instance. An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed, so an entry nobody removes by hand is only closed once the binfmt_misc superblock is shut down. If the interpreter lives on a mount that keeps that superblock alive the two pin each other and the file is never closed. That's reachable by pointing the interpreter at the instance itself or by using the instance as an overlayfs lower layer, and once the mount namespace is gone there's nothing left to unregister through either. - Restore write access when removing an entry. Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access for as long as the entry exists, but removal only did filp_close() and never restored it. The inode's i_writecount stayed permanently negative and opening the interpreter for writing kept failing with ETXTBSY long after the entry was gone. - Use exe_file_deny_write_access() for the interpreter clone so both sides base their decision on the same mode. - Reject a flag character as the field delimiter. create_entry() pads the buffer with the delimiter so the field parsers terminate even on a truncated string, but check_special_flags() consumes flag characters instead of scanning for the delimiter. If the delimiter is itself a flag character the padding stops acting as a terminator and the scan keeps reading past the end of the allocation. Such a registration was always rejected, just only after the out of bounds read has already happened. - Don't leak the user namespace when the mount fails. bm_get_tree() hands its reference to get_tree_keyed() and sget_fc() moves it into sb->s_fs_info, but generic_shutdown_super() only calls ->put_super() from inside the if (sb->s_root) branch and bm_fill_super() can fail before either s_root or s_op is in place. Drop the reference in ->kill_sb() instead, which runs unconditionally. netfs: - Clear PG_private_2 on a copy-to-cache append failure. - Handle a rolling buffer allocation failure in single-object writeback and drop the extra folio reference netfs_write_folio_single() took before the append. - Release the previously batched readahead folios when rolling_buffer_load_from_ra() fails in netfs_prepare_read_iterator() - Fix the folio_queue ENOMEM in writeback by adding a mempool and passing gfp flags into the rolling buffer helpers. iomap: - Add a separate bio_set for iomap_split_ioend(). It can split bios that already come from iomap_ioend_bioset and deadlock once that bioset is exhausted. afs: - Set call->async for an asynchronous afs_fs_fetch_data() the way afs_fs_fetch_data64() already does. - Subtract subreq->transferred from subreq->len in afs_fs_fetch_data() rather than adding it. - Fix a UAF when sending a message" * tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: add a separate bio_set for iomap_split_ioend binfmt_misc: don't leak the user namespace when the mount fails binfmt_misc: reject a flag character as the field delimiter binfmt_misc: use exe_file_deny_write_access() for the interpreter clone binfmt_misc: restore write access when removing an entry binfmt_misc: don't let an 'F' entry pin its own instance netfs: Fix folio_queue ENOMEM in writeback by adding a mempool netfs: release readahead folios on iterator preparation failure netfs: handle single writeback rolling buffer allocation failure netfs: clear PG_private_2 on copy-to-cache append failure afs: Fix UAF when sending a message afs: Fix afs_fs_fetch_data() to subtract transferred from len afs: Fix afs_fs_fetch_data() to set call->async 
Pull vfs fixes from Christian Brauner:
 "binfmt_misc:

   - Don't let an 'F' entry pin its own instance.

     An entry registered with 'F' opens its interpreter at registration
     time and holds that file until the entry is freed, so an entry
     nobody removes by hand is only closed once the binfmt_misc
     superblock is shut down.

     If the interpreter lives on a mount that keeps that superblock
     alive the two pin each other and the file is never closed. That's
     reachable by pointing the interpreter at the instance itself or by
     using the instance as an overlayfs lower layer, and once the mount
     namespace is gone there's nothing left to unregister through
     either.

   - Restore write access when removing an entry.

     Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter
     via open_exec() which denies write access for as long as the entry
     exists, but removal only did filp_close() and never restored it.
     The inode's i_writecount stayed permanently negative and opening
     the interpreter for writing kept failing with ETXTBSY long after
     the entry was gone.

   - Use exe_file_deny_write_access() for the interpreter clone so both
     sides base their decision on the same mode.

   - Reject a flag character as the field delimiter. create_entry() pads
     the buffer with the delimiter so the field parsers terminate even
     on a truncated string, but check_special_flags() consumes flag
     characters instead of scanning for the delimiter.

     If the delimiter is itself a flag character the padding stops
     acting as a terminator and the scan keeps reading past the end of
     the allocation. Such a registration was always rejected, just only
     after the out of bounds read has already happened.

   - Don't leak the user namespace when the mount fails.

     bm_get_tree() hands its reference to get_tree_keyed() and sget_fc()
     moves it into sb->s_fs_info, but generic_shutdown_super() only
     calls ->put_super() from inside the if (sb->s_root) branch and
     bm_fill_super() can fail before either s_root or s_op is in place.

     Drop the reference in ->kill_sb() instead, which runs
     unconditionally.

  netfs:

   - Clear PG_private_2 on a copy-to-cache append failure.

   - Handle a rolling buffer allocation failure in single-object
     writeback and drop the extra folio reference
     netfs_write_folio_single() took before the append.

   - Release the previously batched readahead folios when
     rolling_buffer_load_from_ra() fails in
     netfs_prepare_read_iterator()

   - Fix the folio_queue ENOMEM in writeback by adding a mempool and
     passing gfp flags into the rolling buffer helpers.

  iomap:

   - Add a separate bio_set for iomap_split_ioend(). It can split bios
     that already come from iomap_ioend_bioset and deadlock once that
     bioset is exhausted.

  afs:

   - Set call->async for an asynchronous afs_fs_fetch_data() the way
     afs_fs_fetch_data64() already does.

   - Subtract subreq->transferred from subreq->len in
     afs_fs_fetch_data() rather than adding it.

   - Fix a UAF when sending a message"

* tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  iomap: add a separate bio_set for iomap_split_ioend
  binfmt_misc: don't leak the user namespace when the mount fails
  binfmt_misc: reject a flag character as the field delimiter
  binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
  binfmt_misc: restore write access when removing an entry
  binfmt_misc: don't let an 'F' entry pin its own instance
  netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
  netfs: release readahead folios on iterator preparation failure
  netfs: handle single writeback rolling buffer allocation failure
  netfs: clear PG_private_2 on copy-to-cache append failure
  afs: Fix UAF when sending a message
  afs: Fix afs_fs_fetch_data() to subtract transferred from len
  afs: Fix afs_fs_fetch_data() to set call->async
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 2026-08-02T16:32:07+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-02T16:32:07+00:00 a84c804215062d17c14141988ff3c69af961b49d Pull SCSI fixes from James Bottomley" "No core changes. The largest driver fix is the reversion of threaded interrupt handlers in UFS and the next is the resume deadlock fix in hisi_sas which extends into libsas" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Initialize hba->rpmbs list in ufshcd scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit scsi: target: Clear cmd_cnt when initial counter enrollment fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" scsi: ufs: core: Cancel RTC work in active-active suspend scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer 
Pull SCSI fixes from James Bottomley"
 "No core changes. The largest driver fix is the reversion of threaded
  interrupt handlers in UFS and the next is the resume deadlock fix in
  hisi_sas which extends into libsas"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
  scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
  scsi: target: Clear cmd_cnt when initial counter enrollment fails
  scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
  scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
  scsi: ufs: core: Cancel RTC work in active-active suspend
  scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
  scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
  scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
  scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
  scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
Merge tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine 2026-08-02T16:19:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-02T16:19:40+00:00 49c9f4657b2d584690b050169b646cbcee6e7958 Pull dmaengine fixes from Vinod Koul: - switchtec fix for register programming - sun6i descriptor reclaim fix - Intel idxd fixes for double free in error and setup failure - Qualcomm bam dma command element fix * tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() dmaengine: idxd: fix double free of wq, engine, and group structs dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold 
Pull dmaengine fixes from Vinod Koul:

 - switchtec fix for register programming

 - sun6i descriptor reclaim fix

 - Intel idxd fixes for double free in error and setup failure

 - Qualcomm bam dma command element fix

* tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
  dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
  dmaengine: idxd: fix double free of wq, engine, and group structs
  dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
  dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold
Merge tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux 2026-08-01T00:05:13+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-01T00:05:13+00:00 f30ca2ce7d5e2739773f00eeeb22daf6f7b18dd9 Pull ata fixes from Damien Le Moal: - Fix PCI resource initialization in the sata_mv driver to keep legacy Marvell boards functional (Rosen) - Fix ahci_ceva driver initialization error path (Radhey) - Fix libata header file to remove a kernel doc compilation warning (Randy) - Increase the timeout for the STANDBY IMMEDIATE command to avoid suspend failures with drives that are slow to respond to this command (Matt) - Fixes for the handling of timed out commands in the presence of deferred non-NCQ commands, to avoid excessive delays in executing the error handler (me) - Disable link power management for a couple of WD drives that have been identified as not functioning properly when power management is used (Niklas) - Fix the device iteration loop when checking for link power management support to correctly handle port multiplier setups (Niklas) * tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-sata: fix ata_scsi_lpm_supported() iteration ata: libata-core: Disable LPM on WD Green 2.5 480GB ata: libata-core: Disable LPM on some WD drives scsi: libsas: terminate deferred commands on time out ata: libata-scsi: schedule deferred atapi command ata: libata-scsi: terminate deferred commands on time out ata: libata-eh: Increase STANDBY IMMEDIATE timeout ata: libata: avoid kernel-doc warnings ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() ata: sata_mv: accept 1 or 2 resources in platform probe 
Pull ata fixes from Damien Le Moal:

 - Fix PCI resource initialization in the sata_mv driver to keep legacy
   Marvell boards functional (Rosen)

 - Fix ahci_ceva driver initialization error path (Radhey)

 - Fix libata header file to remove a kernel doc compilation warning
   (Randy)

 - Increase the timeout for the STANDBY IMMEDIATE command to avoid
   suspend failures with drives that are slow to respond to this command
   (Matt)

 - Fixes for the handling of timed out commands in the presence of
   deferred non-NCQ commands, to avoid excessive delays in executing the
   error handler (me)

 - Disable link power management for a couple of WD drives that have
   been identified as not functioning properly when power management is
   used (Niklas)

 - Fix the device iteration loop when checking for link power management
   support to correctly handle port multiplier setups (Niklas)

* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-sata: fix ata_scsi_lpm_supported() iteration
  ata: libata-core: Disable LPM on WD Green 2.5 480GB
  ata: libata-core: Disable LPM on some WD drives
  scsi: libsas: terminate deferred commands on time out
  ata: libata-scsi: schedule deferred atapi command
  ata: libata-scsi: terminate deferred commands on time out
  ata: libata-eh: Increase STANDBY IMMEDIATE timeout
  ata: libata: avoid kernel-doc warnings
  ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
  ata: sata_mv: accept 1 or 2 resources in platform probe
Merge tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux 2026-07-31T20:37:41+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-31T20:37:41+00:00 de8c3b8e05e14cc8c0654881257c49a78c3e5259 Pull hyper-v fixes from Wei Liu: - Multiple fixes for the MSHV driver (Stanislav Kinsburskii, Wei Liu, Yi Xie, Yousef Alhouseen) - Multiple fixes for the VMBus driver (Hardik Garg, Michael Kelley, Sebastian Andrzej Siewior) * tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv_vtl: bounds-check cpu index in vtl mmap fault handler mshv: Publish VP to pt_vp_array before installing the file descriptor Drivers: hv: vmbus: add VTL2 redirect connection ID mshv: Order pt_vp_array publish against irqfd assertion path mshv: Fix missing error code on VP allocation failure mshv: Fix level-triggered check on uninitialized data mshv: Fix race in mshv_irqfd_deassign mshv: Use kfree_rcu in mshv_portid_free mshv: Fix sleeping under spinlock in mshv_portid_alloc mshv: Fix duplicate GSI detection for GSI 0 Drivers: hv: vmbus: Remove vmbus_irq_initialized Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() mshv_vtl: clear hypercall output before copyout Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices mshv: fix hv_input_get_system_property struct 
Pull hyper-v fixes from Wei Liu:

 - Multiple fixes for the MSHV driver (Stanislav Kinsburskii, Wei Liu,
   Yi Xie, Yousef Alhouseen)

 - Multiple fixes for the VMBus driver (Hardik Garg, Michael Kelley,
   Sebastian Andrzej Siewior)

* tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  mshv_vtl: bounds-check cpu index in vtl mmap fault handler
  mshv: Publish VP to pt_vp_array before installing the file descriptor
  Drivers: hv: vmbus: add VTL2 redirect connection ID
  mshv: Order pt_vp_array publish against irqfd assertion path
  mshv: Fix missing error code on VP allocation failure
  mshv: Fix level-triggered check on uninitialized data
  mshv: Fix race in mshv_irqfd_deassign
  mshv: Use kfree_rcu in mshv_portid_free
  mshv: Fix sleeping under spinlock in mshv_portid_alloc
  mshv: Fix duplicate GSI detection for GSI 0
  Drivers: hv: vmbus: Remove vmbus_irq_initialized
  Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
  mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
  mshv_vtl: clear hypercall output before copyout
  Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices
  mshv: fix hv_input_get_system_property struct
Merge tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 2026-07-31T16:32:39+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-31T16:32:39+00:00 c5d3fe9d25e321211229d09fcd431c45718a2f03 Pull sound fixes from Takashi Iwai: "A collection of sound fixes for the 7.2-rc6 cycle. Again, it became far larger than wished; I'll throttle from now on. There are no major changes, just a normal flow of small fixes. The majority of them are device-specific quirks and ASoC SDCA/codec updates, but it includes a few ALSA core fixes as well. ALSA Core: - Fix for ALSA sequencer timer division-by-zero - Fix potential race in ALSA timer core - Wake up linked drain waiters on PCM stream unlink - Fix double-free of converter objects on UMP rawmidi error path USB-audio: - Fix a few potential out-of-bounds access bugs - Prevent stack info leak in RME Digiface status - Fix UAF during UMP endpoint destruction - Fix UAF at error handling during probe in Line6 6fire driver - Quirks for C-Media CM6206, Corsair Virtuoso, Razer Barracuda X 2.4, JKY Technology, and generic USB headphones HD-audio: - Quirks for HP Victus 16, HP Dragonfly Folio G3, Lenovo Legion 7, HP Laptop 14s, Acer Nitro 5, TongFang X6SP45xU, Infinix INBOOK X3, and HP Pavilion All-in-One ASoC: - Comprehensive cleanups and bug fixes for SoundWire/SDCA drivers - DMI quirks for AMD ACP/YC on Lenovo Legion 7, Acer Aspire, MSI Crosshair A16, and ASUS ExpertBook - ACPI match table entry for SOF RT5682 on Intel Nova Lake - Device-specific mixer / clock, irq fixes for TI TAS2562, TI TAS2781, Sophgo cv1800b ADC, Maxim MAX98090/98095, FSL ASRC/EASRC and Realtek RT5640" * tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits) ASoC: rt722: reset codec to fix abnormal sound ASoC: dt-bindings: realtek,rt5640: Make interrupts optional ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) ALSA: usb-audio: Add GET_SAMPLE_RATE quirk for C-Media CM6206 ALSA: usb-audio: Clamp frame size in implicit-feedback mode ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) ALSA: pcm: wake linked drain waiters on unlink ASoC: amd: acp: Add DMI quirk for Lenovo Legion 7 15ASH11 ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set() ASoC: tas2781: Use correct calibration data for SINEGAIN2 register ASoC: SDCA: Move kcontrol search out of IRQ ASoC: SDCA: Switch to fixup_controls callback for IRQ registration ASoC: Add a component fixup_controls callback ASoC: SDCA: Populate IRQ data earlier ASoC: SDCA: Remove devm from primary IRQ cleanup ASoC: SDCA: Add sdca_irq_cleanup_late() ASoC: SDCA: Rename sdca_irq_allocate() to include devm ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) ALSA:hda/realtek:ALC269 fixup for Legion 7 15ASH11 Mic Mute LED ... 
Pull sound fixes from Takashi Iwai:
 "A collection of sound fixes for the 7.2-rc6 cycle. Again, it became
  far larger than wished; I'll throttle from now on.

  There are no major changes, just a normal flow of small fixes. The
  majority of them are device-specific quirks and ASoC SDCA/codec
  updates, but it includes a few ALSA core fixes as well.

  ALSA Core:
   - Fix for ALSA sequencer timer division-by-zero
   - Fix potential race in ALSA timer core
   - Wake up linked drain waiters on PCM stream unlink
   - Fix double-free of converter objects on UMP rawmidi error path

  USB-audio:
   - Fix a few potential out-of-bounds access bugs
   - Prevent stack info leak in RME Digiface status
   - Fix UAF during UMP endpoint destruction
   - Fix UAF at error handling during probe in Line6 6fire driver
   - Quirks for C-Media CM6206, Corsair Virtuoso, Razer Barracuda X 2.4,
     JKY Technology, and generic USB headphones

  HD-audio:
   - Quirks for HP Victus 16, HP Dragonfly Folio G3, Lenovo Legion 7, HP
     Laptop 14s, Acer Nitro 5, TongFang X6SP45xU, Infinix INBOOK X3, and
     HP Pavilion All-in-One

  ASoC:
   - Comprehensive cleanups and bug fixes for SoundWire/SDCA drivers
   - DMI quirks for AMD ACP/YC on Lenovo Legion 7, Acer Aspire, MSI
     Crosshair A16, and ASUS ExpertBook
   - ACPI match table entry for SOF RT5682 on Intel Nova Lake
   - Device-specific mixer / clock, irq fixes for TI TAS2562, TI
     TAS2781, Sophgo cv1800b ADC, Maxim MAX98090/98095, FSL ASRC/EASRC
     and Realtek RT5640"

* tag 'sound-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
  ASoC: rt722: reset codec to fix abnormal sound
  ASoC: dt-bindings: realtek,rt5640: Make interrupts optional
  ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)
  ALSA: usb-audio: Add GET_SAMPLE_RATE quirk for C-Media CM6206
  ALSA: usb-audio: Clamp frame size in implicit-feedback mode
  ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
  ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
  ALSA: pcm: wake linked drain waiters on unlink
  ASoC: amd: acp: Add DMI quirk for Lenovo Legion 7 15ASH11
  ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
  ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
  ASoC: SDCA: Move kcontrol search out of IRQ
  ASoC: SDCA: Switch to fixup_controls callback for IRQ registration
  ASoC: Add a component fixup_controls callback
  ASoC: SDCA: Populate IRQ data earlier
  ASoC: SDCA: Remove devm from primary IRQ cleanup
  ASoC: SDCA: Add sdca_irq_cleanup_late()
  ASoC: SDCA: Rename sdca_irq_allocate() to include devm
  ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
  ALSA:hda/realtek:ALC269 fixup for Legion 7 15ASH11 Mic Mute LED
  ...
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd 2026-07-30T22:12:31+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-30T22:12:31+00:00 e05b559f9cda350d0ab33c44a8c1151ca62d2875 Pull iommufd fixes from Jason Gunthorpe: "Several bug fixes found by tools and fuzzing: - Incorrect domain passed during replace to ack faults - Block the access API from using dmabuf - Missing unlock on error unwind - Race seeing a partially setup vdevice in the xarray - Do not allow vdevices to have multiple stream ids in SMMUv3 - Possible UAF if racing faults with domain changes" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommu/iommufd: Fix IOPF group ownership UAF iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds iommufd/viommu: Release the igroup lock on the vdevice_size error path iommufd: Reject DMABUF pages from the access pin path iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace 
Pull iommufd fixes from Jason Gunthorpe:
 "Several bug fixes found by tools and fuzzing:

   - Incorrect domain passed during replace to ack faults

   - Block the access API from using dmabuf

   - Missing unlock on error unwind

   - Race seeing a partially setup vdevice in the xarray

   - Do not allow vdevices to have multiple stream ids in SMMUv3

   - Possible UAF if racing faults with domain changes"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommu/iommufd: Fix IOPF group ownership UAF
  iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
  iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
  iommufd/viommu: Release the igroup lock on the vdevice_size error path
  iommufd: Reject DMABUF pages from the access pin path
  iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
Merge tag 'pm-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 2026-07-30T19:03:50+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-30T19:03:50+00:00 3708dd9488440e35a165aee2bb2a1a7b1d0d5777 Pull power management fixes from Rafael Wysocki: "These fix issues related to cpufreq, in the ACPI CPPC library and the generic CPPC cpufreq driver, in the powernow-k8 and amd-pstate drivers, and in the schedutil governor: - Allow fast frequency switching in the ACPI CPPC library only when every supported control used by the driver callback has an address space already accepted for fast access (Christian Loehle) - Skip writes to unsupported performance controls in the ACPI CPPC library (Christian Loehle) - Update cppc_cpufreq_update_perf_limits() to read policy->min and policy->max once and, if the lockless snapshot is inconsistent, reduce the minimum to the observed maximum, along the lines of cpufreq_driver_resolve_freq() (Christian Loehle) - Fix a possible memory leak in the powernowk8_cpu_init() error paths (Abdun Nihaal) - Loosen the requirement on lowest nonlinear frequency != min freq in the amd-pstate driver that is too tight for new systems some of which actually have the lowest nonlinear frequency identical to the minimum frequency (Mario Limonciello) - Prevent amd-pstate from loading on unsupported hardware (Rong Zhang) - Address an initialization race in the schedutil governor when it runs on multi-CPU cpufreq policies, by making it initialize all per-CPU structures first and only then publish the per-CPU utilization update hooks (Zhongqiu Han)" * tag 'pm-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() ACPI: CPPC: Skip writes to unsupported performance controls cpufreq/amd-pstate: Prevent the driver from loading on unsupported hardware cpufreq/amd-pstate: Loosen requirement on lowest nonlinear frequency != min freq cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized cpufreq: cppc: Sanitize lockless policy limit snapshots ACPI: CPPC: Check all controls for fast switching 
Pull power management fixes from Rafael Wysocki:
 "These fix issues related to cpufreq, in the ACPI CPPC library and the
  generic CPPC cpufreq driver, in the powernow-k8 and amd-pstate
  drivers, and in the schedutil governor:

   - Allow fast frequency switching in the ACPI CPPC library only when
     every supported control used by the driver callback has an address
     space already accepted for fast access (Christian Loehle)

   - Skip writes to unsupported performance controls in the ACPI CPPC
     library (Christian Loehle)

   - Update cppc_cpufreq_update_perf_limits() to read policy->min and
     policy->max once and, if the lockless snapshot is inconsistent,
     reduce the minimum to the observed maximum, along the lines of
     cpufreq_driver_resolve_freq() (Christian Loehle)

   - Fix a possible memory leak in the powernowk8_cpu_init() error paths
     (Abdun Nihaal)

   - Loosen the requirement on lowest nonlinear frequency != min freq in
     the amd-pstate driver that is too tight for new systems some of
     which actually have the lowest nonlinear frequency identical to the
     minimum frequency (Mario Limonciello)

   - Prevent amd-pstate from loading on unsupported hardware (Rong
     Zhang)

   - Address an initialization race in the schedutil governor when it
     runs on multi-CPU cpufreq policies, by making it initialize all
     per-CPU structures first and only then publish the per-CPU
     utilization update hooks (Zhongqiu Han)"

* tag 'pm-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
  ACPI: CPPC: Skip writes to unsupported performance controls
  cpufreq/amd-pstate: Prevent the driver from loading on unsupported hardware
  cpufreq/amd-pstate: Loosen requirement on lowest nonlinear frequency != min freq
  cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
  cpufreq: cppc: Sanitize lockless policy limit snapshots
  ACPI: CPPC: Check all controls for fast switching
Merge tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-30T16:18:49+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-30T16:18:49+00:00 2812e64e1575e05500a35c405aaa6e99b7d7930b Pull networking fixes from Paolo Abeni: "This is again larger than usual: the backlog accumulated in the past weeks is not done yet. I'm not aware of any known pending regression. Including fixes from netfilter, Bluetooth, WiFi and CAN. Current release - regressions: - bluetooth: remove unnecessary hci_conn_get in create_conn_sync - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - eth: - tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is present Previous releases - regressions: - core: do not send ICMP/NDISC Redirects when peer allocation fails - ipv6: take nexthop lock for f6i_list walks in replace check and notify - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072. - netfilter: nf_tables: make nft_object rhltable per table - af_unix: fix listen() succeeding on sockets in the wrong state - openvswitch: fix potential UAF on meter attach failure - bluetooth: - fix advertising data UAFs - avoid deadlocks in iso_sock_timeout - smc: fix socket use-after-free during link group termination - dpll: use pin owner's dpll ref for pin-level attribute reporting - eth: - veth: convert frag_list skbs before running XDP - ice: wait for reset completion in ice_resume() - igc: remove napi_synchronize() in igc_down() - vxlan: use pskb_network_may_pull() for transmit path header pulls Previous releases - always broken: - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim - psp: fix NULL genl_sock deref race with concurrent netns teardown - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp() - can: peak_usb: fix double free of transfer buffer on URB submit error - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister - sctp: prevent peer transport count overflow - dsa: mt7530: error out on failed reads in MT7531 PHY polling - eth: - idpf: bound interrupt-vector register fill to the allocated array" * tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (156 commits) qede: sync udp_tunnel ports outside qede_lock in the recovery path net: openvswitch: fix potential UAF on meter attach failure octeontx2-pf: Set correct sequence for carrier off and tx queue stop net: libwx: fix FDIR ATR queue mismatch for software VLAN packets net: dsa: realtek: use devm_mutex_init for l2_lock net: dsa: realtek: use devm_mutex_init for vlan_lock net: dsa: realtek: use devm_mutex_init for regmap lock net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock ptp: netc: fix potential interrupt storm caused by incorrect unbind order net: mana: Return error code from mana_create_rxq() net: openvswitch: fix skb leak on flow key update failure during ct net: openvswitch: fix skb leak on flow key update failure during recirculation net: stmmac: Fix E2E delay mechanism net: dsa: mt7530: error out on failed reads in MT7531 PHY polling net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup" Revert "vhost-net: wake queue of tun/tap after ptr_ring consume" Revert "ptr_ring: move free-space check into separate helper" Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present" ... 
Pull networking fixes from Paolo Abeni:
 "This is again larger than usual: the backlog accumulated in the past weeks
  is not done yet. I'm not aware of any known pending regression.

  Including fixes from netfilter, Bluetooth, WiFi and CAN.

  Current release - regressions:

   - bluetooth: remove unnecessary hci_conn_get in create_conn_sync

   - can: isotp: fix timer drain order, wakeup handling and tx_gen
     ordering

   - eth:
       - tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is
         present

  Previous releases - regressions:

   - core: do not send ICMP/NDISC Redirects when peer allocation fails

   - ipv6: take nexthop lock for f6i_list walks in replace check and
     notify

   - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072.

   - netfilter: nf_tables: make nft_object rhltable per table

   - af_unix: fix listen() succeeding on sockets in the wrong state

   - openvswitch: fix potential UAF on meter attach failure

   - bluetooth:
       - fix advertising data UAFs
       - avoid deadlocks in iso_sock_timeout

   - smc: fix socket use-after-free during link group termination

   - dpll: use pin owner's dpll ref for pin-level attribute reporting

   - eth:
       - veth: convert frag_list skbs before running XDP
       - ice: wait for reset completion in ice_resume()
       - igc: remove napi_synchronize() in igc_down()
       - vxlan: use pskb_network_may_pull() for transmit path header pulls

  Previous releases - always broken:

   - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim

   - psp: fix NULL genl_sock deref race with concurrent netns teardown

   - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp()

   - can: peak_usb: fix double free of transfer buffer on URB submit error

   - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

   - sctp: prevent peer transport count overflow

   - dsa: mt7530: error out on failed reads in MT7531 PHY polling

   - eth:
       - idpf: bound interrupt-vector register fill to the allocated array"

* tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (156 commits)
  qede: sync udp_tunnel ports outside qede_lock in the recovery path
  net: openvswitch: fix potential UAF on meter attach failure
  octeontx2-pf: Set correct sequence for carrier off and tx queue stop
  net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
  net: dsa: realtek: use devm_mutex_init for l2_lock
  net: dsa: realtek: use devm_mutex_init for vlan_lock
  net: dsa: realtek: use devm_mutex_init for regmap lock
  net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock
  ptp: netc: fix potential interrupt storm caused by incorrect unbind order
  net: mana: Return error code from mana_create_rxq()
  net: openvswitch: fix skb leak on flow key update failure during ct
  net: openvswitch: fix skb leak on flow key update failure during recirculation
  net: stmmac: Fix E2E delay mechanism
  net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
  net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
  net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
  Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"
  Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"
  Revert "ptr_ring: move free-space check into separate helper"
  Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present"
  ...
Revert "vhost-net: wake queue of tun/tap after ptr_ring consume" 2026-07-30T00:12:27+00:00 Simon Schippers simon.schippers@tu-dortmund.de 2026-07-28T09:22:39+00:00 8f83be72d9f5ef16c4a908450d0d993e8ec99d34 This reverts commit baf808fe4fcd35767ab732b4ab2ea80dabfd97a6. There is no netdev queue left to wake after reverting commit 1d6e569b7d0c ("tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present"). Signed-off-by: Simon Schippers <simon.schippers@tu-dortmund.de> Acked-by: Michael S. Tsirkin <mst@redhat.com> Link: https://patch.msgid.link/20260728092240.250257-4-simon.schippers@tu-dortmund.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
This reverts commit baf808fe4fcd35767ab732b4ab2ea80dabfd97a6.

There is no netdev queue left to wake after reverting
commit 1d6e569b7d0c ("tun/tap & vhost-net: avoid ptr_ring tail-drop
when a qdisc is present").

Signed-off-by: Simon Schippers <simon.schippers@tu-dortmund.de>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20260728092240.250257-4-simon.schippers@tu-dortmund.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>