Linux kernel documentation tree maintained by Jonathan Corbet http://mirrors.hust.edu.cn/git/lwn.git/atom?h=docs-fixes 2026-04-25T23:20:52+00:00 2026-04-25T23:20:52+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-25T23:20:52+00:00 urn:sha1:1d9f1b5e4374c6b40df1a56b35901312ec98c9af Pull tpm updates from Jarkko Sakkinen: "Here are the accumulated fixes for 7.1-rc1 and a single structural change worth mentioning separately: Rafael's commit converting tpm_crb from ACPI driver to a platform driver" * tag 'for-next-tpm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: tpm_tis: stop transmit if retries are exhausted tpm: tpm_tis: add error logging for data transfer tpm: avoid -Wunused-but-set-variable tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm: Fix auth session leak in tpm2_get_random() error path tpm: i2c: atmel: fix block comment formatting tpm_crb: Convert ACPI driver to a platform one tpm: Make tcpci_pm_ops variable static const 2026-04-24T22:06:55+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-24T22:06:55+00:00 urn:sha1:f3e3dbcea15e20f7413afd8c791a496f0b80e80b Pull block fixes from Jens Axboe: - Series for zloop, fixing a variety of issues - t10-pi code cleanup - Fix for a merge window regression with the bio memory allocation mask - Fix for a merge window regression in ublk, caused by an issue with the maple tree iteration code at teardown - ublk self tests additions - Zoned device pgmap fixes - Various little cleanups and fixes * tag 'block-7.1-20260424' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (21 commits) Revert "floppy: fix reference leak on platform_device_register() failure" ublk: avoid unpinning pages under maple tree spinlock ublk: refactor common helper ublk_shmem_remove_ranges() ublk: fix maple tree lockdep warning in ublk_buf_cleanup selftests: ublk: add ublk auto integrity test selftests: ublk: enable test_integrity_02.sh on fio 3.42 selftests: ublk: remove unused argument to _cleanup block: only restrict bio allocation gfp mask asked to block block/blk-throttle: Add WQ_PERCPU to alloc_workqueue users block: Add WQ_PERCPU to alloc_workqueue users block: relax pgmap check in bio_add_page for compatible zone device pages block: add pgmap check to biovec_phys_mergeable floppy: fix reference leak on platform_device_register() failure ublk: use unchecked copy helpers for bio page data t10-pi: reduce ref tag code duplication zloop: remove irq-safe locking zloop: factor out zloop_mark_{full,empty} helpers zloop: set RQF_QUIET when completing requests on deleted devices zloop: improve the unaligned write pointer warning zloop: use vfs_truncate ... 2026-04-24T21:20:03+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-24T21:20:03+00:00 urn:sha1:b85900e91c8402bedc1db14e6d293e26f25d30d4 Pull NFS client updates from Trond Myklebust: "Bugfixes: - Fix handling of ENOSPC so that if we have to resend writes, they are written synchronously - SUNRPC RDMA transport fixes from Chuck - Several fixes for delegated timestamps in NFSv4.2 - Failure to obtain a directory delegation should not cause stat() to fail with NFSv4 - Rename was failing to update timestamps when a directory delegation is held on NFSv4 - Ensure we check rsize/wsize after crossing a NFSv4 filesystem boundary - NFSv4/pnfs: - If the server is down, retry the layout returns on reboot - Fallback to MDS could result in a short write being incorrectly logged Cleanups: - Use memcpy_and_pad in decode_fh" * tag 'nfs-for-7.1-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (21 commits) NFS: Fix RCU dereference of cl_xprt in nfs_compare_super_address NFS: remove redundant __private attribute from nfs_page_class NFSv4.2: fix CLONE/COPY attrs in presence of delegated attributes NFS: fix writeback in presence of errors nfs: use memcpy_and_pad in decode_fh NFSv4.1: Apply session size limits on clone path NFSv4: retry GETATTR if GET_DIR_DELEGATION failed NFS: fix RENAME attr in presence of directory delegations pnfs/flexfiles: validate ds_versions_cnt is non-zero NFS/blocklayout: print each device used for SCSI layouts xprtrdma: Post receive buffers after RPC completion xprtrdma: Scale receive batch size with credit window xprtrdma: Replace rpcrdma_mr_seg with xdr_buf cursor xprtrdma: Decouple frwr_wp_create from frwr_map xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot xprtrdma: Avoid 250 ms delay on backlog wakeup xprtrdma: Close sendctx get/put race that can block a transport nfs: update inode ctime after removexattr operation nfs: fix utimensat() for atime with delegated timestamps NFS: improve "Server wrote zero bytes" error ... 2026-04-24T20:23:50+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-24T20:23:50+00:00 urn:sha1:cb4eb6771c0f8fd1c52a8f6fdec7762fb087380a Pull char / misc / IIO / and others driver updates from Greg KH: "Here is the char/misc/iio and other smaller driver subsystem updates for 7.1-rc1. Lots of stuff in here, all tiny, but relevant for the different drivers they touch. Major points in here is: - the usual large set of new IIO drivers and updates for that subsystem (the large majority of this diffstat) - lots of comedi driver updates and bugfixes - coresight driver updates - interconnect driver updates and additions - mei driver updates - binder (both rust and C versions) updates and fixes - lots of other smaller driver subsystem updates and additions All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (405 commits) coresight: tpdm: fix invalid MMIO access issue mei: me: add nova lake point H DID mei: lb: add late binding version 2 mei: bus: add mei_cldev_uuid w1: ds2490: drop redundant device reference bus: mhi: host: pci_generic: Add Telit FE912C04 modem support mei: csc: wake device while reading firmware status mei: csc: support controller with separate PCI device mei: convert PCI error to common errno mei: trace: print return value of pci_cfg_read mei: me: move trace into firmware status read mei: fix idle print specifiers mei: me: use PCI_DEVICE_DATA macro sonypi: Convert ACPI driver to a platform one misc: apds990x: fix all kernel-doc warnings most: usb: Use kzalloc_objs for endpoint address array hpet: Convert ACPI driver to a platform one misc: vmw_vmci: Fix spelling mistakes in comments parport: Remove completed item from to-do list char: remove unnecessary module_init/exit functions ... 2026-04-24T20:16:36+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-24T20:16:36+00:00 urn:sha1:b2680ba4a2ad259c7bbd856ed830b459e11d88ba Pull spi fixes from Mark Brown: "This is quite a big set of fixes, almost all from Johan Hovold who is on an ongoing quest to clean up issues with probe and removal handling in drivers. There isn't anything too concerning here especially with the deregistration stuff which will very rarely get run in production systems since this is all platform devices in the SoC on embedded hardware, but it's all real issues which should be fixed. There's more in flight here. We also have a few other minor fixes, one from Felix Gu along the same lines as Johan's work and a couple of documentation things" * tag 'spi-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (23 commits) spi: fix controller cleanup() documentation spi: fix resource leaks on device setup failure spi: axiado: clean up probe return value spi: axiado: rename probe error labels spi: axiado: fix runtime pm imbalance on probe failure spi: orion: clean up probe return value spi: orion: fix clock imbalance on registration failure spi: orion: fix runtime pm leak on unbind spi: imx: fix runtime pm leak on probe deferral spi: mpc52xx: fix use-after-free on registration failure spi: Fix the error description in the `ptp_sts_word_post` comment spi: topcliff-pch: fix use-after-free on unbind spi: topcliff-pch: fix controller deregistration spi: orion: fix controller deregistration spi: mxic: fix controller deregistration spi: mpc52xx: fix use-after-free on unbind spi: mpc52xx: fix controller deregistration spi: cadence-quadspi: fix controller deregistration spi: cadence: fix controller deregistration spi: mtk-snfi: fix memory leak in probe ... 2026-04-24T16:41:58+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-24T16:41:58+00:00 urn:sha1:64edfa65062dc4509ba75978116b2f6d392346f5 Pull networking deletions from Jakub Kicinski: "Delete some obsolete networking code Old code like amateur radio and NFC have long been a burden to core networking developers. syzbot loves to find bugs in BKL-era code, and noobs try to fix them. If we want to have a fighting chance of surviving the LLM-pocalypse this code needs to find a dedicated owner or get deleted. We've talked about these deletions multiple times in the past and every time someone wanted the code to stay. It is never very clear to me how many of those people actually use the code vs are just nostalgic to see it go. Amateur radio did have occasional users (or so I think) but most users switched to user space implementations since its all super slow stuff. Nobody stepped up to maintain the kernel code. We were lucky enough to find someone who wants to help with NFC so we're giving that a chance. Let's try to put the rest of this code behind us" * tag 'net-deletions' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: drivers: net: 8390: wd80x3: Remove this driver drivers: net: 8390: ultra: Remove this driver drivers: net: 8390: AX88190: Remove this driver drivers: net: fujitsu: fmvj18x: Remove this driver drivers: net: smsc: smc91c92: Remove this driver drivers: net: smsc: smc9194: Remove this driver drivers: net: amd: nmclan: Remove this driver drivers: net: amd: lance: Remove this driver drivers: net: 3com: 3c589: Remove this driver drivers: net: 3com: 3c574: Remove this driver drivers: net: 3com: 3c515: Remove this driver drivers: net: 3com: 3c509: Remove this driver net: packetengines: remove obsolete yellowfin driver and vendor dir net: packetengines: remove obsolete hamachi driver net: remove unused ATM protocols and legacy ATM device drivers net: remove ax25 and amateur radio (hamradio) subsystem net: remove ISDN subsystem and Bluetooth CMTP caif: remove CAIF NETWORK LAYER 2026-04-24T00:08:04+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-24T00:08:04+00:00 urn:sha1:dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b Pull vfs fixes from Christian Brauner: - eventpoll: fix ep_remove() UAF and follow-up cleanup - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error - writeback: Fix use after free in inode_switch_wbs_work_fn() - fuse: reject oversized dirents in page cache - fs: aio: reject partial mremap to avoid Null-pointer-dereference error - nstree: fix func. parameter kernel-doc warnings - fs: Handle multiply claimed blocks more gracefully with mmb * tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: eventpoll: drop vestigial epi->dying flag eventpoll: drop dead bool return from ep_remove_epi() eventpoll: refresh eventpoll_release() fast-path comment eventpoll: move f_lock acquisition into ep_remove_file() eventpoll: fix ep_remove struct eventpoll / struct file UAF eventpoll: move epi_fget() up eventpoll: rename ep_remove_safe() back to ep_remove() eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() eventpoll: kill __ep_remove() eventpoll: split __ep_remove() eventpoll: use hlist_is_singular_node() in __ep_remove() fs: Handle multiply claimed blocks more gracefully with mmb nstree: fix func. parameter kernel-doc warnings fs: aio: reject partial mremap to avoid Null-pointer-dereference error fuse: reject oversized dirents in page cache writeback: Fix use after free in inode_switch_wbs_work_fn() fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error 2026-04-23T23:50:42+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-04-23T23:50:42+00:00 urn:sha1:e728258debd553c95d2e70f9cd97c9fde27c7130 Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter. Steady stream of fixes. Last two weeks feel comparable to the two weeks before the merge window. Lots of AI-aided bug discovery. A newer big source is Sashiko/Gemini (Roman Gushchin's system), which points out issues in existing code during patch review (maybe 25% of fixes here likely originating from Sashiko). Nice thing is these are often fixed by the respective maintainers, not drive-bys. Current release - new code bugs: - kconfig: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP Previous releases - regressions: - add async ndo_set_rx_mode and switch drivers which we promised to be called under the per-netdev mutex to it - dsa: remove duplicate netdev_lock_ops() for conduit ethtool ops - hv_sock: report EOF instead of -EIO for FIN - vsock/virtio: fix MSG_PEEK calculation on bytes to copy Previous releases - always broken: - ipv6: fix possible UAF in icmpv6_rcv() - icmp: validate reply type before using icmp_pointers - af_unix: drop all SCM attributes for SOCKMAP - netfilter: fix a number of bugs in the osf (OS fingerprinting) - eth: intel: fix timestamp interrupt configuration for E825C Misc: - bunch of data-race annotations" * tag 'net-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (148 commits) rxrpc: Fix error handling in rxgk_extract_token() rxrpc: Fix re-decryption of RESPONSE packets rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets rxrpc: Fix missing validation of ticket length in non-XDR key preparsing rxgk: Fix potential integer overflow in length check rxrpc: Fix conn-level packet handling to unshare RESPONSE packets rxrpc: Fix potential UAF after skb_unshare() failure rxrpc: Fix rxkad crypto unalignment handling rxrpc: Fix memory leaks in rxkad_verify_response() net: rds: fix MR cleanup on copy error m68k: mvme147: Make me the maintainer net: txgbe: fix firmware version check selftests/bpf: check epoll readiness during reuseport migration tcp: call sk_data_ready() after listener migration vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() ipv6: Cap TLV scan in ip6_tnl_parse_tlv_enc_lim tipc: fix double-free in tipc_buf_append() llc: Return -EINPROGRESS from llc_ui_connect() ipv4: icmp: validate reply type before using icmp_pointers selftests/net: packetdrill: cover RFC 5961 5.2 challenge ACK on both edges ... 2026-04-23T22:36:50+00:00 Christian Brauner brauner@kernel.org 2026-04-23T09:56:11+00:00 urn:sha1:33e92e9ecf48c08cb4807e9a36f9eb01619c1a1e The old comment justified the lockless READ_ONCE(file->f_ep) check with "False positives simply cannot happen because the file is on the way to be removed and nobody ( but eventpoll ) has still a reference to this file." That reasoning was the root of the UAF fixed in "eventpoll: fix ep_remove struct eventpoll / struct file UAF": __ep_remove() could clear f_ep while another close raced past the fast path and freed the watched eventpoll / recycled the struct file slot. With ep_remove() now pinning @file via epi_fget() across the f_ep clear and hlist_del_rcu(), the invariant is re-established for the right reason: anyone who might clear f_ep holds @file alive for the duration, so a NULL observation really does mean no concurrent eventpoll path has work left on this file. Refresh the comment accordingly so the next reader doesn't inherit the broken model. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-8-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> 2026-04-23T22:34:59+00:00 Randy Dunlap rdunlap@infradead.org 2026-04-16T21:54:29+00:00 urn:sha1:43eb354ecb471426e97b0ce6a0c922ec20f82027 Use the correct parameter name ("__ns") for function parameter kernel-doc to avoid 3 warnings: Warning: include/linux/nstree.h:68 function parameter '__ns' not described in 'ns_tree_add_raw' Warning: include/linux/nstree.h:77 function parameter '__ns' not described in 'ns_tree_add' Warning: include/linux/nstree.h:88 function parameter '__ns' not described in 'ns_tree_remove' Fixes: 885fc8ac0a4d ("nstree: make iterator generic") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260416215429.948898-1-rdunlap@infradead.org Signed-off-by: Christian Brauner <brauner@kernel.org>