Linux kernel mainline source http://mirrors.hust.edu.cn/git/linux.git/atom?h=master 2026-07-17T19:55:24+00:00 2026-07-17T19:55:24+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T19:55:24+00:00 urn:sha1:94515f3a7d4256a5062176b7d6ed0471938cd51a Pull bpf fixes from Kumar Kartikeya Dwivedi: - Fix a UAF in socket clone early bailout paths (Matt Bobrowski) - Reject unhashed UDP sockets on sockmap update to prevent refcount leaks (Michal Luczaj) - Account for receive queue data in FIONREAD on sockmap sockets without a verdict program (Mattia Meleleo) - Reject negative constant offsets for verifier buffer pointers (Sun Jian) - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Cover tracing implicit kfunc args bpf: Fix tracing of kfuncs with implicit args selftests/bpf: Cover negative buffer pointer offsets bpf: Reject negative const offsets for buffer pointers selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program bpf, sockmap: Account for receive queue in FIONREAD without a verdict program selftests/bpf: Fail unbound UDP on sockmap update selftests/bpf: Adapt sockmap update error handling bpf, sockmap: Reject unhashed UDP sockets on sockmap update selftests/bpf: Ensure UDP sockets are bound bpf: Fix UAF in sock clone early bailouts 2026-07-17T18:04:46+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T18:04:46+00:00 urn:sha1:8fc574321e59a2484063b2e75016772815038608 Pull selinux fix from Paul Moore: "A single SELinux patch to correct a problem with the overlayfs mmap() and mprotect() fixes from earlier this year where we inadvertenly included an additional SELinux execmem permission check on some operations" * tag 'selinux-pr-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix incorrect execmem checks on overlayfs 2026-07-17T17:53:57+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T17:53:57+00:00 urn:sha1:0dde292a4c23090459655ada697e948ff4adc7c3 Pull crypto library fixes from Eric Biggers: - Fix a build error in certain configurations - Clarify some parts of the documentation - Remove unused code that I forgot to remove in commit cf52058dcdd9 ("lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code") * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: aes - Fix conditions for selecting MAC dependencies lib/crypto: docs: Improve introduction sentence lib/crypto: docs: Fix some sentence fragments lib/crypto: md5: Remove support for md5_mod_init_arch() 2026-07-17T17:25:13+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T17:25:13+00:00 urn:sha1:e13caf1c26587434f0b768193100440939c0fb91 Pull networking fixes from Paolo Abeni: "Including fixes from Wireless, IPsec, Netfilter and Bluetooth. Current release - new code bugs: - netfilter: flowtable: use correct direction to set up tunnel route Previous releases - regressions: - wifi: - mac80211: - free AP_VLAN bc_buf SKBs outside IRQ lock - defer link RX stats percpu free to RCU - fix double free on alloc failure - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock - ipv4: free fib_alias with kfree_rcu() on insert error path - sched: act_tunnel_key: Defer dst_release to RCU callback - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bluetooth: fix locking in unpair_device/disconnect_sync - can: add locking for raw flags bitfield - openvswitch: reject oversized nested action attrs - eth: - bnxt_en: handle partially initialized auxiliary devices - ppp: defer channel free to an RCU grace period to fix UAF Previous releases - always broken: - netfilter: xt_nat: reject unsupported target families - wifi: - brcmfmac: fix heap overflow on a short auth frame - cfg80211: add missing FTM API validation - xfrm: - reject optional IPTFS templates in outbound policies - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - bluetooth: revalidate LOAD_CONN_PARAM queued update - can: fix lockless bound/ifindex race and silent RX_SETUP failure - eth: mlx5: free mlx5_st_idx_data on final dealloc" * tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n llc: fix SAP refcount leak when creating incoming sockets selftests: netconsole: only restore MAC when it changed on resume bnxt_en: Handle partially initialized auxiliary devices sctp: fix auth_hmacs array size in struct sctp_cookie net/sched: act_tunnel_key: Defer dst_release to RCU callback dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() tcp: fix TIME_WAIT socket reference leak on PSP policy failure net/mlx5: free mlx5_st_idx_data on final dealloc can: isotp: serialize TX state transitions under so->rx_lock can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: use unconditional synchronize_rcu() in isotp_release() can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: add missing rcu list annotations and operations can: bcm: fix CAN frame rx/tx statistics ... 2026-07-17T16:30:17+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T16:30:17+00:00 urn:sha1:af5e34a41cd607c00ef752e00331736570992354 Pull mtd fixes from Miquel Raynal: "Among the most important fixes that we have here, there are: - the revert of the uclinux map driver which was presumed to be no longer used but in fact was - the use of SPI match data to get chip capabilities in the mchp23k256 driver - several fixes addressing the newly introduced virt-concat support - a missing build dependency on ndfc as well as the usual load (if not actually bigger than usual) of uninitialized variables, leaks, double free, and AI fuzzed issues being fixed" * tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: Revert "mtd: maps: remove uclinux map driver" mtd: onenand: samsung: report DMA completion timeouts mtd: rawnand: fsl_ifc: return errors for failed page reads mtd: mchp23k256: use SPI match data for chip caps mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout mtd: fix double free and WARN_ON in add_mtd_device() error paths mtd: virt-concat: free duplicate generated name mtd: nand: mtk-ecc: stop on ECC idle timeouts mtd: mtdswap: remove debugfs stats file on teardown mtd: mtdpart: validate partition bounds in mtd_add_partition() mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path mtd: rawnand: ndfc: add CONFIG_OF dependency mtd: spinand: initialize ret in regular page reads mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy() mtd: rawnand: ingenic: handle ECC clock enable failures mtd: nand: ecc-mtk: handle ECC clock enable failures mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins() mtd: rawnand: ndfc: fix gcc uninitialized var 2026-07-17T16:27:02+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T16:27:02+00:00 urn:sha1:45419d06c943246229ecbc392f5d1038551e9b9b Pull MMC fixes from Ulf Hansson: "MMC core: - Fix RPMB device unregister ordering - Fix __counted_by handling in mmc_test MMC host: - mtk-sd: Document missing clocks for MT8189 - sdhci-esdhc-imx: Fix the support for system suspend/resume for SDIO - sdhci-of-dwcmshc: Fix error handling for clock prepare/enable - vub300: - Fix lockdep issue for the cmd_mutex - Fix use-after-free on probe failure MEMSTICK: - Reject a card that reports too many blocks" * tag 'mmc-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-esdhc-imx: fix resume error handling mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore mmc: block: fix RPMB device unregister ordering memstick: ms_block: reject a card that reports too many blocks dt-bindings: mmc: mtk-sd: Document extra clocks for MT8189 mmc: vub300: defer reset until cmd_mutex is unlocked mmc: vub300: fix use-after-free on probe failure mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method 2026-07-17T15:52:09+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T15:52:09+00:00 urn:sha1:111e7b23e5b05e2298f2e1a4d2a632bee4dde8b0 Pull SoC fixes from Arnd Bergmann: "There are only three devicetree fixes this time: one critical memory corruption fix for Renesas and three minor corrections for Tegra. The MAINTAINERS file is updated for a new maintainer of the CIX platform and two address changes. The rest is all driver fixes, mostly firmware: - multiple runtime issues in ARM SCMI and FF-A firmware code, dealing with error handling for corner cases in firmware. - multiple fixes for reset drivers, dealing with individual platform specific mistakes and more error handling - minor build and runtime fixes for the Tegra SoC drivers" * tag 'soc-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: renesas: ironhide: Describe inline ECC carveouts MAINTAINERS: Update maintainer and git tree for CIX SoC ARM: Don't let ARMv5 platforms select USE_OF MAINTAINERS: Update SpacemiT SoC git tree repository firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context firmware: arm_scmi: Use 64-bit division for clock rate rounding reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ reset: sunxi: fix memory region leak on ioremap failure dt-bindings: reset: altr: add COMBOPHY_RESET for Agilex5 reset: spacemit: k3: fix USB2 ahb reset firmware: arm_scmi: Grammar s/may needed/may be needed/ firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits arm64: tegra: Fix CPU1 node unit-address on Tegra264 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 MAINTAINERS: .mailmap: update Jens Wiklander's email address soc/tegra: fuse: Fix spurious straps warning on SMCCC platforms soc/tegra: pmc: fix #ifdef block in header drm/tegra: Fix a strange error handling path arm64: tegra: Remove fallback compatible for GPCDMA 2026-07-17T15:46:56+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-07-17T15:46:56+00:00 urn:sha1:6917aa77675f48e7bd33392ed6590c8837001697 Pull powerpc fixes from Madhavan Srinivasan: - Enable CONFIG_VPA_PMU to be used with KVM - Initialize starttime at boot for native accounting - Set CPU_FTR_P11_PVR for Power11 and later processors - fix memory leak on krealloc failure in papr_init - Misc fixes and cleanups Thanks to Amit Machhiwal, Christophe Leroy (CS GROUP), Ethan Nelson-Moore, Gautam Menghani, Harsh Prateek Bora, Junrui Luo, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM), Rosen Penev, Shrikanth Hegde, Thorsten Blum, and Yuhao Jiang * tag 'powerpc-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Remove dead non-preemption code powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors powerpc/pseries: fix memory leak on krealloc failure in papr_init powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address() powerpc/vtime: Initialize starttime at boot for native accounting powerpc/85xx: Add fsl,ifc to common device ids powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM 2026-07-17T11:20:38+00:00 Weiming Shi bestswngs@gmail.com 2026-07-11T11:50:00+00:00 urn:sha1:56d96fededd61192cd7cc8d2b0f36adfd59036c3 On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference. RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189) Call Trace: mpls_dump_routes (net/mpls/af_mpls.c:2236) netlink_dump (net/netlink/af_netlink.c:2331) __netlink_dump_start (net/netlink/af_netlink.c:2446) rtnetlink_rcv_msg (net/core/rtnetlink.c:7033) netlink_rcv_skb (net/netlink/af_netlink.c:2556) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) __sys_sendmsg (net/socket.c:2770) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Skip unset attributes, as ip_valid_fib_dump_req() does. Fixes: 196cfebf8972 ("net/mpls: Handle kernel side filtering of route dumps") Assisted-by: Claude:claude-opus-4-8 Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260711114958.1009619-3-bestswngs@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> 2026-07-17T11:17:46+00:00 Xuanqiang Luo luoxuanqiang@kylinos.cn 2026-07-12T13:03:43+00:00 urn:sha1:2c72eb6286347d05a885412fb076993bd5286b53 llc_sap_add_socket() takes a SAP reference for each socket added to a SAP, and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes an additional SAP reference after adding the child socket. This extra reference was balanced by an explicit llc_sap_put() in llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling") removed that put. The corresponding hold in the accept path was left behind. When such a child socket is removed, only the reference taken by llc_sap_add_socket() is released. The extra reference keeps the SAP alive after its last socket is removed. Remove the obsolete hold. Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling") Cc: stable@vger.kernel.org Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn> Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev Signed-off-by: Paolo Abeni <pabeni@redhat.com>