January 2025 - Linux-stable-mirror

[PATCH v3] cdx: Fix possible UAF error in driver_override_show()

by Qiu-ji Chen

Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs. The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users. Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues. This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Cc: stable(a)vger.kernel.org Signed-off-by: Qiu-ji Chen <chenqiuji666(a)gmail.com> --- V2: Modified the title and description. Removed the changes to cdx_bus_match(). V3: Revised the description to reduce the confusion it caused. --- drivers/cdx/cdx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c index 07371cb653d3..e696ba0b573e 100644 --- a/drivers/cdx/cdx.c +++ b/drivers/cdx/cdx.c @@ -470,8 +470,11 @@ static ssize_t driver_override_show(struct device *dev, struct device_attribute *attr, char *buf) { struct cdx_device *cdx_dev = to_cdx_device(dev); + ssize_t len; - return sysfs_emit(buf, "%s\n", cdx_dev->driver_override); + device_lock(dev); + len = sysfs_emit(buf, "%s\n", cdx_dev->driver_override); + device_unlock(dev); } static DEVICE_ATTR_RW(driver_override); -- 2.34.1

8 months

2
2
0 0

[PATCH net v2 1/5] vsock/virtio: discard packets if the transport changes

by Stefano Garzarella

If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when we access vsk->transport. A possible scenario is described by Hyunwoo Kim in the attached link, where after a first connect() interrupted by a signal, and a second connect() failed, we can find `vsk->transport` at NULL, leading to a NULL pointer dereference. Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Cc: stable(a)vger.kernel.org Reported-by: Hyunwoo Kim <v4bel(a)theori.io> Reported-by: Wongi Lee <qwerty(a)theori.io> Closes: https://lore.kernel.org/netdev/Z2LvdTTQR7dBmPb5@v4bel-B760M-AORUS-ELITE-AX/ Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> --- net/vmw_vsock/virtio_transport_common.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index 9acc13ab3f82..51a494b69be8 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1628,8 +1628,11 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, lock_sock(sk); - /* Check if sk has been closed before lock_sock */ - if (sock_flag(sk, SOCK_DONE)) { + /* Check if sk has been closed or assigned to another transport before + * lock_sock (note: listener sockets are not assigned to any transport) + */ + if (sock_flag(sk, SOCK_DONE) || + (sk->sk_state != TCP_LISTEN && vsk->transport != &t->transport)) { (void)virtio_transport_reset_no_sock(t, skb); release_sock(sk); sock_put(sk); -- 2.47.1

8 months

3
13
0 0

[PATCH 6.6] KVM: x86: Make x2APIC ID 100% readonly

by Gavin Guo

From: Sean Christopherson <seanjc(a)google.com> [ Upstream commit 4b7c3f6d04bd53f2e5b228b6821fb8f5d1ba3071 ] Ignore the userspace provided x2APIC ID when fixing up APIC state for KVM_SET_LAPIC, i.e. make the x2APIC fully readonly in KVM. Commit a92e2543d6a8 ("KVM: x86: use hardware-compatible format for APIC ID register"), which added the fixup, didn't intend to allow userspace to modify the x2APIC ID. In fact, that commit is when KVM first started treating the x2APIC ID as readonly, apparently to fix some race: static inline u32 kvm_apic_id(struct kvm_lapic *apic) { - return (kvm_lapic_get_reg(apic, APIC_ID) >> 24) & 0xff; + /* To avoid a race between apic_base and following APIC_ID update when + * switching to x2apic_mode, the x2apic mode returns initial x2apic id. + */ + if (apic_x2apic_mode(apic)) + return apic->vcpu->vcpu_id; + + return kvm_lapic_get_reg(apic, APIC_ID) >> 24; } Furthermore, KVM doesn't support delivering interrupts to vCPUs with a modified x2APIC ID, but KVM *does* return the modified value on a guest RDMSR and for KVM_GET_LAPIC. I.e. no remotely sane setup can actually work with a modified x2APIC ID. Making the x2APIC ID fully readonly fixes a WARN in KVM's optimized map calculation, which expects the LDR to align with the x2APIC ID. WARNING: CPU: 2 PID: 958 at arch/x86/kvm/lapic.c:331 kvm_recalculate_apic_map+0x609/0xa00 [kvm] CPU: 2 PID: 958 Comm: recalc_apic_map Not tainted 6.4.0-rc3-vanilla+ #35 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.2-1-1 04/01/2014 RIP: 0010:kvm_recalculate_apic_map+0x609/0xa00 [kvm] Call Trace: <TASK> kvm_apic_set_state+0x1cf/0x5b0 [kvm] kvm_arch_vcpu_ioctl+0x1806/0x2100 [kvm] kvm_vcpu_ioctl+0x663/0x8a0 [kvm] __x64_sys_ioctl+0xb8/0xf0 do_syscall_64+0x56/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fade8b9dd6f Unfortunately, the WARN can still trigger for other CPUs than the current one by racing against KVM_SET_LAPIC, so remove it completely. Reported-by: Michal Luczaj <mhal(a)rbox.co> Closes: https://lore.kernel.org/all/814baa0c-1eaa-4503-129f-059917365e80@rbox.co Reported-by: Haoyu Wu <haoyuwu254(a)gmail.com> Closes: https://lore.kernel.org/all/20240126161633.62529-1-haoyuwu254@gmail.com Reported-by: syzbot+545f1326f405db4e1c3e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000c2a6b9061cbca3c3@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-ID: <20240802202941.344889-2-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Gavin Guo <gavinguo(a)igalia.com> --- arch/x86/kvm/lapic.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 34766abbabd8..cd9c1e1f6fd3 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -338,10 +338,8 @@ static void kvm_recalculate_logical_map(struct kvm_apic_map *new, * reversing the LDR calculation to get cluster of APICs, i.e. no * additional work is required. */ - if (apic_x2apic_mode(apic)) { - WARN_ON_ONCE(ldr != kvm_apic_calc_x2apic_ldr(kvm_x2apic_id(apic))); + if (apic_x2apic_mode(apic)) return; - } if (WARN_ON_ONCE(!kvm_apic_map_get_logical_dest(new, ldr, &cluster, &mask))) { @@ -2964,18 +2962,28 @@ static int kvm_apic_state_fixup(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s, bool set) { if (apic_x2apic_mode(vcpu->arch.apic)) { + u32 x2apic_id = kvm_x2apic_id(vcpu->arch.apic); u32 *id = (u32 *)(s->regs + APIC_ID); u32 *ldr = (u32 *)(s->regs + APIC_LDR); u64 icr; if (vcpu->kvm->arch.x2apic_format) { - if (*id != vcpu->vcpu_id) + if (*id != x2apic_id) return -EINVAL; } else { + /* + * Ignore the userspace value when setting APIC state. + * KVM's model is that the x2APIC ID is readonly, e.g. + * KVM only supports delivering interrupts to KVM's + * version of the x2APIC ID. However, for backwards + * compatibility, don't reject attempts to set a + * mismatched ID for userspace that hasn't opted into + * x2apic_format. + */ if (set) - *id >>= 24; + *id = x2apic_id; else - *id <<= 24; + *id = x2apic_id << 24; } /* @@ -2984,7 +2992,7 @@ static int kvm_apic_state_fixup(struct kvm_vcpu *vcpu, * split to ICR+ICR2 in userspace for backwards compatibility. */ if (set) { - *ldr = kvm_apic_calc_x2apic_ldr(*id); + *ldr = kvm_apic_calc_x2apic_ldr(x2apic_id); icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) | (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32; -- 2.43.0

8 months

3
5
0 0

[PATCH v1] clk: imx: imx8-acm: fix flags for acm clocks

by Stefan Eichenberger

From: Stefan Eichenberger <stefan.eichenberger(a)toradex.com> Currently, the flags for the ACM clocks are set to 0. This configuration causes the fsl-sai audio driver to fail when attempting to set the sysclk, returning an EINVAL error. The following error messages highlight the issue: fsl-sai 59090000.sai: ASoC: error at snd_soc_dai_set_sysclk on 59090000.sai: -22 imx-hdmi sound-hdmi: failed to set cpu sysclk: -22 By setting the flag CLK_SET_RATE_NO_REPARENT, we signal that the ACM driver does not support reparenting and instead relies on the clock tree as defined in the device tree. This change resolves the issue with the fsl-sai audio driver. CC: stable(a)vger.kernel.org Fixes: d3a0946d7ac9 ("clk: imx: imx8: add audio clock mux driver") Signed-off-by: Stefan Eichenberger <stefan.eichenberger(a)toradex.com> --- drivers/clk/imx/clk-imx8-acm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/clk/imx/clk-imx8-acm.c b/drivers/clk/imx/clk-imx8-acm.c index c169fe53a35f..f20832a17ea3 100644 --- a/drivers/clk/imx/clk-imx8-acm.c +++ b/drivers/clk/imx/clk-imx8-acm.c @@ -371,7 +371,8 @@ static int imx8_acm_clk_probe(struct platform_device *pdev) for (i = 0; i < priv->soc_data->num_sels; i++) { hws[sels[i].clkid] = devm_clk_hw_register_mux_parent_data_table(dev, sels[i].name, sels[i].parents, - sels[i].num_parents, 0, + sels[i].num_parents, + CLK_SET_RATE_NO_REPARENT, base + sels[i].reg, sels[i].shift, sels[i].width, 0, NULL, NULL); -- 2.45.2

8 months

2
11
0 0

[REGRESSION] Cuttlefish boot issue on lts branches

by Terry Tritton

Hi all, We've seen a regression on several lts branches(at least 5.10,5.15,6.1) causing boot issues on cuttlefish/crossvm android emulation on arm64. The offending patch is: PCI: Use preserve_config in place of pci_flags It looks like this patch was added to stable by AUTOSEL but without the other 3 patches in the series: https://lore.kernel.org/all/20240508174138.3630283-1-vidyas@nvidia.com/ Applying the missing patches resolves the issue but they do not apply cleanly. Can we revert this patch on the lts branches?

8 months

2
5
0 0

RE: Patch "drm/radeon: Delay Connector detecting when HPD singals is unstable" has been added to the 6.6-stable tree

by Deucher, Alexander

[Public] > -----Original Message----- > From: Sasha Levin <sashal(a)kernel.org> > Sent: Thursday, January 2, 2025 7:42 PM > To: stable-commits(a)vger.kernel.org; oushixiong(a)kylinos.cn > Cc: Deucher, Alexander <Alexander.Deucher(a)amd.com>; Koenig, Christian > <Christian.Koenig(a)amd.com>; Pan, Xinhui <Xinhui.Pan(a)amd.com>; David Airlie > <airlied(a)gmail.com>; Simona Vetter <simona(a)ffwll.ch> > Subject: Patch "drm/radeon: Delay Connector detecting when HPD singals is > unstable" has been added to the 6.6-stable tree > > This is a note to let you know that I've just added the patch titled > > drm/radeon: Delay Connector detecting when HPD singals is unstable > > to the 6.6-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > drm-radeon-delay-connector-detecting-when-hpd-singal.patch > and it can be found in the queue-6.6 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, please let > <stable(a)vger.kernel.org> know about it. > > > > commit 20430c3e75a06c4736598de02404f768653d953a > Author: Shixiong Ou <oushixiong(a)kylinos.cn> > Date: Thu May 9 16:57:58 2024 +0800 > > drm/radeon: Delay Connector detecting when HPD singals is unstable > > [ Upstream commit 949658cb9b69ab9d22a42a662b2fdc7085689ed8 ] > > In some causes, HPD signals will jitter when plugging in > or unplugging HDMI. > > Rescheduling the hotplug work for a second when EDID may still be > readable but HDP is disconnected, and fixes this issue. > > Signed-off-by: Shixiong Ou <oushixiong(a)kylinos.cn> > Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> > Stable-dep-of: 979bfe291b5b ("Revert "drm/radeon: Delay Connector detecting > when HPD singals is unstable"") Please drop both of these patches. There is no need to pull back a patch just so that you can apply the revert. Thanks, Alex > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c > b/drivers/gpu/drm/radeon/radeon_connectors.c > index b84b58926106..cf0114ca59a4 100644 > --- a/drivers/gpu/drm/radeon/radeon_connectors.c > +++ b/drivers/gpu/drm/radeon/radeon_connectors.c > @@ -1267,6 +1267,16 @@ radeon_dvi_detect(struct drm_connector *connector, > bool force) > goto exit; > } > } > + > + if (dret && radeon_connector->hpd.hpd != RADEON_HPD_NONE && > + !radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) && > + connector->connector_type == DRM_MODE_CONNECTOR_HDMIA) { > + DRM_DEBUG_KMS("EDID is readable when HPD > disconnected\n"); > + schedule_delayed_work(&rdev->hotplug_work, > msecs_to_jiffies(1000)); > + ret = connector_status_disconnected; > + goto exit; > + } > + > if (dret) { > radeon_connector->detected_by_load = false; > radeon_connector_free_edid(connector);

8 months

3
3
0 0

[PATCH net 1/1] tools: Sync if_xdp.h uapi tooling header

by Song Yoong Siang

From: Vishal Chourasia <vishalc(a)linux.ibm.com> Sync if_xdp.h uapi header to remove following warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/if_xdp.h' differs from latest version at 'include/uapi/linux/if_xdp.h' Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support") Cc: <stable(a)vger.kernel.org> # 6.8 Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Song Yoong Siang <yoong.siang.song(a)intel.com> --- RFC: https://patchwork.kernel.org/project/netdevbpf/patch/Z4TjzzB8NSnTy_Wa@linux… --- tools/include/uapi/linux/if_xdp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/include/uapi/linux/if_xdp.h b/tools/include/uapi/linux/if_xdp.h index 2f082b01ff22..42ec5ddaab8d 100644 --- a/tools/include/uapi/linux/if_xdp.h +++ b/tools/include/uapi/linux/if_xdp.h @@ -117,12 +117,12 @@ struct xdp_options { ((1ULL << XSK_UNALIGNED_BUF_OFFSET_SHIFT) - 1) /* Request transmit timestamp. Upon completion, put it into tx_timestamp - * field of union xsk_tx_metadata. + * field of struct xsk_tx_metadata. */ #define XDP_TXMD_FLAGS_TIMESTAMP (1 << 0) /* Request transmit checksum offload. Checksum start position and offset - * are communicated via csum_start and csum_offset fields of union + * are communicated via csum_start and csum_offset fields of struct * xsk_tx_metadata. */ #define XDP_TXMD_FLAGS_CHECKSUM (1 << 1) -- 2.34.1

8 months

3
2
0 0

[PATCH v5 0/3] of: fix bugs and improve codes

by Zijun Hu

This patch series is to fix bugs and improve codes for drivers/of/*. Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> --- Changes in v5: - Drop 12 patches and add 1 patch - Correct based on Rob's comments - Link to v4: https://lore.kernel.org/r/20250109-of_core_fix-v4-0-db8a72415b8c@quicinc.com Changes in v4: - Remove 2 modalias relevant patches, and add more patches. - Link to v3: https://lore.kernel.org/r/20241217-of_core_fix-v3-0-3bc49a2e8bda@quicinc.com Changes in v3: - Drop 2 applied patches and pick up patch 4/7 again - Fix build error for patch 6/7. - Include of_private.h instead of function declaration for patch 2/7 - Correct tile and commit messages. - Link to v2: https://lore.kernel.org/r/20241216-of_core_fix-v2-0-e69b8f60da63@quicinc.com Changes in v2: - Drop applied/conflict/TBD patches. - Correct based on Rob's comments. - Link to v1: https://lore.kernel.org/r/20241206-of_core_fix-v1-0-dc28ed56bec3@quicinc.com --- Zijun Hu (3): of: Do not expose of_alias_scan() and correct its comments of: reserved-memory: Warn for missing static reserved memory regions of: Correct element count for two arrays in API of_parse_phandle_with_args_map() drivers/of/base.c | 7 +++---- drivers/of/of_private.h | 2 ++ drivers/of/of_reserved_mem.c | 5 +++++ drivers/of/pdt.c | 2 ++ include/linux/of.h | 1 - 5 files changed, 12 insertions(+), 5 deletions(-) --- base-commit: c141ecc3cecd764799e17c8251026336cab86800 change-id: 20241206-of_core_fix-dc3021a06418 Best regards, -- Zijun Hu <quic_zijuhu(a)quicinc.com>

8 months

2
2
0 0

[PATCH v5.15-v5.4] ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()

by hsimeliere.opensource＠witekio.com

From: Eric Dumazet <edumazet(a)google.com> [ Upstream commit 04ccecfa959d3b9ae7348780d8e379c6486176ac ] Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856 addrconf_notify+0x3cb/0x1020 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352 unregister_netdevice_many net/core/dev.c:11414 [inline] unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289 unregister_netdevice include/linux/netdevice.h:3129 [inline] __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1acc77def9 Code: Unable to access opcode bytes at 0x7f1acc77decf. RSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 RBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline] RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914 Code: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06 RSP: 0018:ffffc900047374e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0 RBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c R10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18 R13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: e332bc67cf5e ("ipv6: Don't call with rt6_uncached_list_flush_dev") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Acked-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20240913083147.3095442-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: BRUNO VERNAY <bruno.vernay(a)se.com> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource(a)witekio.com> --- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 5dbf60dd4aa2..d7d600cb15a8 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -174,7 +174,7 @@ static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev) struct inet6_dev *rt_idev = rt->rt6i_idev; struct net_device *rt_dev = rt->dst.dev; - if (rt_idev->dev == dev) { + if (rt_idev && rt_idev->dev == dev) { rt->rt6i_idev = in6_dev_get(loopback_dev); in6_dev_put(rt_idev); } -- 2.43.0

8 months

1
0
0 0

Linux 6.12.10

by Greg Kroah-Hartman

I'm announcing the release of the 6.12.10 kernel. All users of the 6.12 kernel series must upgrade. The updated 6.12.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/cgroup-v2.rst | 2 Makefile | 2 arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi | 2 arch/arm64/boot/dts/freescale/imx95.dtsi | 2 arch/arm64/boot/dts/qcom/sa8775p.dtsi | 5 arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 arch/riscv/include/asm/page.h | 1 arch/riscv/include/asm/pgtable.h | 2 arch/riscv/include/asm/sbi.h | 1 arch/riscv/kernel/entry.S | 21 +- arch/riscv/kernel/module.c | 18 - arch/riscv/kernel/probes/kprobes.c | 2 arch/riscv/kernel/stacktrace.c | 4 arch/riscv/kernel/traps.c | 6 arch/riscv/mm/init.c | 17 + arch/x86/kernel/fpu/regset.c | 3 block/bfq-iosched.c | 12 + drivers/acpi/resource.c | 18 + drivers/base/topology.c | 24 ++ drivers/bluetooth/btmtk.c | 7 drivers/bluetooth/btnxpuart.c | 1 drivers/cpuidle/cpuidle-riscv-sbi.c | 4 drivers/gpio/gpio-loongson-64bit.c | 6 drivers/gpio/gpio-virtuser.c | 44 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 2 drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 17 + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 3 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 35 --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 drivers/gpu/drm/amd/display/dc/core/dc_state.c | 8 drivers/gpu/drm/amd/display/dc/dc.h | 4 drivers/gpu/drm/amd/display/dc/dc_stream.h | 2 drivers/gpu/drm/amd/display/dc/dc_types.h | 1 drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 8 drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c | 2 drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 2 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 12 - drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 1 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 1 drivers/gpu/drm/mediatek/Kconfig | 5 drivers/gpu/drm/mediatek/mtk_crtc.c | 25 +- drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 69 +++--- drivers/gpu/drm/mediatek/mtk_dp.c | 46 ++-- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 drivers/gpu/drm/mediatek/mtk_dsi.c | 49 +++- drivers/gpu/drm/xe/xe_gt.c | 8 drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 4 drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 3 drivers/hwmon/drivetemp.c | 8 drivers/iio/adc/ad7124.c | 3 drivers/iio/adc/ad7173.c | 10 - drivers/iio/adc/at91_adc.c | 2 drivers/iio/adc/rockchip_saradc.c | 2 drivers/iio/adc/ti-ads1119.c | 4 drivers/iio/adc/ti-ads124s08.c | 4 drivers/iio/adc/ti-ads1298.c | 2 drivers/iio/adc/ti-ads8688.c | 2 drivers/iio/dummy/iio_simple_dummy_buffer.c | 2 drivers/iio/gyro/fxas21002c_core.c | 9 drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 22 ++ drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c | 3 drivers/iio/imu/kmx61.c | 2 drivers/iio/inkern.c | 2 drivers/iio/light/bh1745.c | 2 drivers/iio/light/vcnl4035.c | 2 drivers/iio/pressure/zpa2326.c | 2 drivers/md/dm-ebs-target.c | 2 drivers/md/dm-thin.c | 5 drivers/md/dm-verity-fec.c | 40 ++-- drivers/md/persistent-data/dm-array.c | 19 + drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 4 drivers/net/ethernet/amd/pds_core/devlink.c | 2 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 38 +++ drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 3 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 5 drivers/net/ethernet/google/gve/gve_main.c | 14 - drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 96 +++------ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 1 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 45 +++- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c | 9 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 41 +++- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c | 9 drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 2 drivers/net/ethernet/intel/ice/ice_dpll.c | 35 ++- drivers/net/ethernet/intel/ice/ice_ptp_consts.h | 4 drivers/net/ethernet/intel/igc/igc_base.c | 6 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 1 drivers/net/ethernet/realtek/rtase/rtase_main.c | 2 drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 14 + drivers/net/ethernet/wangxun/libwx/wx_hw.c | 24 +- drivers/net/ieee802154/ca8210.c | 6 drivers/net/mctp/mctp-i3c.c | 4 drivers/perf/riscv_pmu_sbi.c | 17 - drivers/platform/x86/amd/pmc/pmc.c | 8 drivers/platform/x86/intel/pmc/core_ssram.c | 4 drivers/staging/iio/frequency/ad9832.c | 2 drivers/staging/iio/frequency/ad9834.c | 2 drivers/thermal/thermal_of.c | 1 drivers/tty/serial/8250/8250_core.c | 3 drivers/tty/serial/stm32-usart.c | 4 drivers/ufs/core/ufshcd-priv.h | 6 drivers/ufs/core/ufshcd.c | 1 drivers/ufs/host/ufs-qcom.c | 13 - drivers/usb/chipidea/ci_hdrc_imx.c | 25 +- drivers/usb/class/usblp.c | 7 drivers/usb/core/hub.c | 6 drivers/usb/core/port.c | 7 drivers/usb/dwc3/core.h | 1 drivers/usb/dwc3/dwc3-am62.c | 1 drivers/usb/dwc3/gadget.c | 4 drivers/usb/gadget/Kconfig | 4 drivers/usb/gadget/configfs.c | 6 drivers/usb/gadget/function/f_fs.c | 2 drivers/usb/gadget/function/f_uac2.c | 1 drivers/usb/gadget/function/u_serial.c | 8 drivers/usb/host/xhci-plat.c | 3 drivers/usb/serial/cp210x.c | 1 drivers/usb/serial/option.c | 4 drivers/usb/storage/unusual_devs.h | 7 drivers/usb/typec/tcpm/maxim_contaminant.c | 4 drivers/usb/typec/tcpm/tcpci.c | 25 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 4 drivers/vfio/pci/vfio_pci_core.c | 17 - fs/afs/afs.h | 2 fs/afs/afs_vl.h | 1 fs/afs/vl_alias.c | 8 fs/afs/vlclient.c | 2 fs/btrfs/extent_io.c | 7 fs/btrfs/inode.c | 2 fs/btrfs/scrub.c | 4 fs/btrfs/zlib.c | 4 fs/buffer.c | 4 fs/exfat/dir.c | 3 fs/exfat/fatent.c | 10 + fs/exfat/file.c | 6 fs/ext4/page-io.c | 2 fs/f2fs/data.c | 9 fs/fs-writeback.c | 8 fs/fuse/dir.c | 2 fs/iomap/buffered-io.c | 68 +++++- fs/jbd2/commit.c | 4 fs/jbd2/revoke.c | 2 fs/mount.h | 15 - fs/mpage.c | 2 fs/namespace.c | 24 +- fs/netfs/buffered_read.c | 28 +- fs/netfs/direct_write.c | 7 fs/netfs/read_collect.c | 9 fs/netfs/read_pgpriv2.c | 4 fs/netfs/read_retry.c | 5 fs/netfs/write_collect.c | 9 fs/nfs/fscache.c | 9 fs/notify/fdinfo.c | 4 fs/overlayfs/copy_up.c | 16 - fs/overlayfs/export.c | 49 ++-- fs/overlayfs/namei.c | 4 fs/overlayfs/overlayfs.h | 2 fs/smb/client/namespace.c | 19 + fs/smb/server/smb2pdu.c | 43 ++++ fs/smb/server/smb2pdu.h | 10 + fs/smb/server/vfs.c | 3 include/linux/bus/stm32_firewall_device.h | 2 include/linux/iomap.h | 2 include/linux/mount.h | 3 include/linux/netfs.h | 1 include/linux/writeback.h | 4 include/net/inet_connection_sock.h | 2 include/ufs/ufshcd.h | 2 io_uring/eventfd.c | 2 io_uring/io_uring.c | 5 io_uring/sqpoll.c | 6 io_uring/timeout.c | 4 kernel/cgroup/cpuset.c | 35 --- kernel/sched/ext.c | 76 ++++++- kernel/sched/ext.h | 8 kernel/sched/idle.c | 5 net/802/psnap.c | 4 net/bluetooth/hci_sync.c | 11 - net/bluetooth/mgmt.c | 38 +++ net/bluetooth/rfcomm/tty.c | 4 net/core/dev.c | 43 +++- net/core/dev.h | 3 net/core/link_watch.c | 10 - net/core/netdev-genl.c | 9 net/ipv4/tcp_ipv4.c | 2 net/mptcp/ctrl.c | 17 - net/netfilter/nf_conntrack_core.c | 5 net/netfilter/nf_tables_api.c | 15 + net/rds/tcp.c | 39 +++ net/sched/cls_flow.c | 3 net/sched/sch_cake.c | 140 +++++++------- net/sctp/sysctl.c | 14 - net/tls/tls_sw.c | 2 sound/soc/codecs/rt722-sdca.c | 7 sound/soc/mediatek/common/mtk-afe-platform-driver.c | 4 tools/testing/selftests/alsa/Makefile | 2 tools/testing/selftests/cgroup/test_cpuset_prs.sh | 33 +-- 201 files changed, 1419 insertions(+), 790 deletions(-) Akash M (1): usb: gadget: f_fs: Remove WARN_ON in functionfs_bind Alex Hung (1): drm/amd/display: Remove unnecessary amdgpu_irq_get/put Alex Williamson (1): vfio/pci: Fallback huge faults for unaligned pfn Amir Goldstein (4): fuse: respect FOPEN_KEEP_CACHE on opendir ovl: pass realinode to ovl_encode_real_fh() instead of realdentry ovl: support encoding fid from inode with no alias fs: relax assertions on failure to encode file handles Andrea Righi (1): sched_ext: idle: Refresh idle masks during idle-to-idle transitions André Draszik (1): usb: dwc3: gadget: fix writing NYET threshold AngeloGioacchino Del Regno (1): drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188 Antonio Pastor (1): net: 802: LLC+SNAP OID:PID lookup on start of skb data Anumula Murali Mohan Reddy (1): cxgb4: Avoid removal of uninserted tid Arkadiusz Kubalewski (1): ice: fix max values for dpll pin phase adjust Arnd Bergmann (1): drm/mediatek: stop selecting foreign drivers Arunpravin Paneer Selvam (1): drm/amdgpu: Add a lock when accessing the buddy trim function Atish Patra (2): drivers/perf: riscv: Fix Platform firmware event data drivers/perf: riscv: Return error for default case Ben Wolsieffer (1): serial: stm32: use port lock wrappers for break control Benjamin Coddington (1): tls: Fix tls_sw_sendmsg error handling Binbin Zhou (1): gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset Carlos Song (1): iio: gyro: fxas21002c: Fix missing data update in trigger handler Changwoo Min (1): sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() Charles Han (1): iio: adc: ti-ads1298: Add NULL check in ads1298_init Chen Ridong (1): cgroup/cpuset: remove kernfs active break Chen-Yu Tsai (1): ASoC: mediatek: disable buffer pre-allocation Chenguang Zhao (1): net/mlx5: Fix variable not being completed when function returns Chris Lu (1): Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. Christian Brauner (1): fs: kill MNT_ONRB Chukun Pan (1): USB: serial: option: add MeiG Smart SRM815 Chun-Kuang Hu (1): Revert "drm/mediatek: dsi: Correct calculation formula of PHY Timing" Clément Léger (3): riscv: module: remove relocation_head rel_entry member allocation riscv: stacktrace: fix backtracing through exceptions riscv: use local label names instead of global ones in assembly Dan Carpenter (2): rtase: Fix a check for error in rtase_alloc_msix() usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm() Daniel Borkmann (1): tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset Daniel Golle (1): drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported Daniil Stas (1): hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur David E. Box (1): platform/x86: intel/pmc: Fix ioremap() of bad address David Howells (9): netfs: Fix enomem handling in buffered reads nfs: Fix oops in nfs_netfs_init_request() when copying to cache netfs: Fix missing barriers by using clear_and_wake_up_bit() netfs: Fix ceph copy to cache on write-begin netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled netfs: Fix is-caching check in read-retry afs: Fix the maximum cell name length netfs: Fix kernel async DIO netfs: Fix read-retry for fs with no ->prepare_read() David Lechner (1): iio: adc: ad7173: fix using shared static info struct En-Wei Wu (1): igc: return early when failing to read EECD register Eric Dumazet (1): net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute Fabio Estevam (1): iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() GONG Ruiqi (1): usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() Greg Kroah-Hartman (1): Linux 6.12.10 Guoqing Jiang (1): drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err Hans de Goede (2): ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] Hao Lan (4): net: hns3: fixed reset failure issues caused by the incorrect reset type net: hns3: fix missing features due to dev->features configuration too early net: hns3: Resolved the issue that the debugfs query result is inconsistent. net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue He Wang (1): ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked Honglei Wang (1): sched_ext: switch class when preempted by higher priority scheduler Ilpo Järvinen (1): tty: serial: 8250: Fix another runtime PM usage counter underflow Ingo Rohloff (1): usb: gadget: configfs: Ignore trailing LF for user strings to cdev Jakub Kicinski (3): net: don't dump Tx and uninitialized NAPIs eth: gve: use appropriate helper to set xdp_features netdev: prevent accessing NAPI instances from another namespace Jason-JH.Lin (2): drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb() drm/mediatek: Add support for 180-degree rotation in the display driver Javier Carrasco (10): cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu iio: pressure: zpa2326: fix information leak in triggered buffer iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer iio: light: vcnl4035: fix information leak in triggered buffer iio: light: bh1745: fix information leak in triggered buffer iio: imu: kmx61: fix information leak in triggered buffer iio: adc: rockchip_saradc: fix information leak in triggered buffer iio: adc: ti-ads8688: fix information leak in triggered buffer iio: adc: ti-ads1119: fix information leak in triggered buffer iio: adc: ti-ads1119: fix sample size in scan struct for triggered buffer Jean-Baptiste Maneyrol (2): iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on iio: imu: inv_icm42600: fix spi burst write not supported Jens Axboe (1): io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period Jesse Taube (1): ARM: dts: imxrt1050: Fix clocks for mmc Jesse.zhang(a)amd.com (1): drm/amdkfd: fixed page fault when enable MES shader debugger Jian Shen (2): net: hns3: don't auto enable misc vector net: hns3: initialize reset_timer before hclgevf_misc_irq_init() Jiawen Wu (1): net: libwx: fix firmware mailbox abnormal return Jie Gan (1): arm64: dts: qcom: sa8775p: fix the secure device bootup issue Jie Wang (1): net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Joe Hattori (4): thermal: of: fix OF node leak in of_thermal_zone_find() usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe() iio: adc: at91: call input_free_device() on allocated iio_dev iio: inkern: call iio_device_put() only on mapped devices Johan Hovold (1): USB: serial: cp210x: add Phoenix Contact UPS Device Jun Yan (1): USB: usblp: return error when setting unsupported protocol Kai-Heng Feng (1): USB: core: Disable LPM only for non-suspended ports Kalesh AP (1): bnxt_en: Fix possible memory leak when hwrm_req_replace fails Keisuke Nishimura (1): ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() Koichiro Den (2): gpio: virtuser: fix missing lookup table cleanups gpio: virtuser: fix handling of multiple conn_ids in lookup table Krister Johansen (1): dm thin: make get_first_thin use rcu-safe list first function Kun Liu (1): drm/amd/pm: fix BUG: scheduling while atomic Kuniyuki Iwashima (1): ipvlan: Fix use-after-free in ipvlan_get_iflink(). Leo Yang (1): mctp i3c: fix MCTP I3C driver multi-thread issue Li Huafei (1): topology: Keep the cpumask unchanged when printing cpumap Li Zhijian (1): selftests/alsa: Fix circular dependency involving global-timer Liankun Yang (3): drm/mediatek: Fix YCbCr422 color format issue for DP drm/mediatek: Fix mode valid issue for dp drm/mediatek: Add return value check when reading DPCD Lianqin Hu (1): usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null Long Li (2): iomap: pass byte granular end position to iomap_add_to_ioend iomap: fix zero padding data issue in concurrent append writes Lubomir Rintel (1): usb-storage: Add max sectors quirk for Nokia 208 Lucas De Marchi (1): drm/xe: Fix tlb invalidation when wedging Luiz Augusto von Dentz (2): Bluetooth: hci_sync: Fix not setting Random Address when required Bluetooth: MGMT: Fix Add Device to responding before completing Ma Ke (1): usb: fix reference leak in usb_new_device() Maciej S. Szmigiero (1): platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it Manivannan Sadhasivam (2): scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence() arm64: dts: qcom: sa8775p: Fix the size of 'addr_space' regions Matthieu Baerts (NGI0) (9): mptcp: sysctl: avail sched: remove write access mptcp: sysctl: sched: avoid using current->nsproxy mptcp: sysctl: blackhole timeout: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy sctp: sysctl: rto_min/max: avoid using current->nsproxy sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: udp_port: avoid using current->nsproxy sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy Meetakshi Setiya (1): smb: client: sync the root session and superblock context passwords before automounting Melissa Wen (3): drm/amd/display: fix divide error in DM plane scale calcs drm/amd/display: fix page fault due to max surface definition mismatch drm/amd/display: increase MAX_SURFACES to the value supported by hw Michael Chan (1): bnxt_en: Fix DIM shutdown Michal Hrusecky (1): USB: serial: option: add Neoway N723-EA support Mikhail Zaslonko (1): btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Miklos Szeredi (1): fs: fix is_mnt_ns_file() Mikulas Patocka (1): dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY Milan Broz (1): dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) Ming-Hung Tsai (3): dm array: fix releasing a faulty array block twice in dm_array_cursor_end dm array: fix unreleased btree blocks on closing a faulty array cursor dm array: fix cursor index when skipping across block boundaries Nam Cao (2): riscv: Fix sleeping in invalid context in die() riscv: kprobes: Fix incorrect address calculation Namjae Jeon (1): ksmbd: Implement new SMB3 POSIX type Neeraj Sanjay Kale (1): Bluetooth: btnxpuart: Fix driver sending truncated data Pablo Neira Ayuso (2): netfilter: nf_tables: imbalance in flowtable binding netfilter: conntrack: clamp maximum hashtable size to INT_MAX Pankaj Raghav (1): fs/writeback: convert wbc_account_cgroup_owner to take a folio Parker Newman (1): net: stmmac: dwmac-tegra: Read iommu stream id from device tree Pavel Begunkov (3): io_uring/timeout: fix multishot updates io_uring/sqpoll: zero sqd->thread on tctx errors io_uring: don't touch sqd->thread off tw add Peter Geis (1): arm64: dts: rockchip: add hevc power domain clock to rk3328 Prashanth K (2): usb: dwc3-am62: Disable autosuspend during remove usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints Przemyslaw Korba (1): ice: fix incorrect PHY settings for 100 GB/s Qiang Yu (1): arm64: dts: qcom: x1e80100: Fix up BAR space size for PCIe6a Qu Wenruo (1): btrfs: avoid NULL pointer dereference if no valid extent tree Rengarajan S (2): misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config Rick Edgecombe (1): x86/fpu: Ensure shadow stack is active before "getting" registers Roman Li (1): drm/amd/display: Add check for granularity in dml ceil/floor helpers Shannon Nelson (1): pds_core: limit loop over fw name list Shuming Fan (1): ASoC: rt722: add delay time to wait for the calibration procedure Takashi Iwai (1): usb: gadget: midi2: Reverse-select at the right place Toke Høiland-Jørgensen (1): sched: sch_cake: add bounds checks to host bulk flow fairness counts Uwe Kleine-König (1): iio: adc: ad7124: Disable all channels at probe time Waiman Long (1): cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains Wei Fang (1): arm64: dts: imx95: correct the address length of netcmix_blk_ctrl Wentao Liang (1): ksmbd: fix a missing return value check bug Xu Lu (1): riscv: mm: Fix the out of bound issue of vmemmap address Xu Yang (2): usb: typec: tcpci: fix NULL pointer issue on shared irq case usb: host: xhci-plat: set skip_phy_initialization if software node has XHCI_SKIP_PHY_INIT property Yu Kuai (1): block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Yuezhang Mo (3): exfat: fix the infinite loop in exfat_readdir() exfat: fix the new buffer was not zeroed before writing exfat: fix the infinite loop in __exfat_free_cluster() Zhang Yi (2): jbd2: increase IO priority for writing revoke records jbd2: flush filesystem device before updating tail sequence Zhongqiu Duan (1): tcp/dccp: allow a connection when sk_max_ack_backlog is zero Zhu Lingshan (1): drm/amdkfd: wq_release signals dma_fence only when available Zicheng Qu (2): staging: iio: ad9834: Correct phase range check staging: iio: ad9832: Correct phase range check guanjing (1): firewall: remove misplaced semicolon from stm32_firewall_get_firewall

8 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror January 2025