Lkft-triage May 2026

lkft-triage@lists.linaro.org

34 participants
29 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 268 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:20 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 264 files changed, 2397 insertions(+), 1123 deletions(-)

4 months, 2 weeks

[PATCH 6.12 000/206] 6.12.88-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 206 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 41 ++--- drivers/crypto/nx/nx-842.h | 15 +- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 227 files changed, 1903 insertions(+), 785 deletions(-)

4 months, 2 weeks

[PATCH 6.12 000/202] 6.12.88-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 202 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:24 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 8 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 220 files changed, 1766 insertions(+), 684 deletions(-)

4 months, 2 weeks

[PATCH 7.0 000/305] 7.0.7-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 305 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:27 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc2.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 19 +- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3030 insertions(+), 1615 deletions(-)

4 months, 2 weeks

[PATCH 6.18 000/270] 6.18.30-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 270 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 +++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +--- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 ++- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 ++-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 269 files changed, 2440 insertions(+), 1165 deletions(-)

4 months, 2 weeks

[PATCH 7.0 000/307] 7.0.7-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail Tejun Heo <tj(a)kernel.org> sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 28 ++- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3041 insertions(+), 1615 deletions(-)

4 months, 2 weeks

[PATCH 6.12 000/215] 6.12.86-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.86 release. There are 215 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:52 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.86-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.86-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue David Hildenbrand <david(a)redhat.com> mm/migrate: move movable_ops page handling out of move_to_new_folio() David Hildenbrand <david(a)redhat.com> mm/migrate: factor out movable_ops page handling into migrate_movable_ops_page() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace connection list with hash table Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use msleep instaed of schedule_timeout_interruptible() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Jinjiang Tu <tujinjiang(a)huawei.com> mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Miguel Ojeda <ojeda(a)kernel.org> rust: init: fix `clippy::undocumented_unsafe_blocks` warnings Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: Makefile | 5 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/mm/mmu.c | 36 ++- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/um/drivers/cow_user.c | 8 +- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 55 ++-- arch/x86/kvm/svm/svm.c | 32 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 62 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 2 + block/bio.c | 14 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +++- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/powerz.c | 11 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/bonding/bond_main.c | 12 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + fs/ceph/dir.c | 6 +- fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 +- fs/jbd2/revoke.c | 8 +- fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/smb/client/cifsacl.c | 116 +++++-- fs/smb/server/connection.c | 28 +- fs/smb/server/connection.h | 6 +- fs/smb/server/smb2pdu.c | 4 +- fs/smb/server/transport_rdma.c | 5 + fs/smb/server/transport_tcp.c | 25 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + include/linux/device.h | 45 +++ include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 4 +- include/linux/padata.h | 4 - include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- init/main.c | 1 - io_uring/poll.c | 15 +- io_uring/timeout.c | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/padata.c | 136 +++------ kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 3 +- mm/internal.h | 10 + mm/memory_hotplug.c | 10 +- mm/migrate.c | 152 +++++---- mm/mlock.c | 10 +- mm/mmap.c | 4 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 86 +++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 25 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/init/macros.rs | 7 +- scripts/check-uapi.sh | 7 +- security/apparmor/lsm.c | 16 +- sound/aoa/codecs/onyx.c | 104 ++----- sound/aoa/codecs/tas.c | 113 +++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++----- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/pcmtest.c | 19 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/annotate/instructions.c | 1 + tools/perf/util/disasm.c | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/landlock/net_test.c | 2 +- .../testing/selftests/mqueue/{setting => settings} | 0 218 files changed, 2506 insertions(+), 1555 deletions(-)

4 months, 2 weeks

[PATCH 6.18 000/275] 6.18.27-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.27 release. There are 275 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:54 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.27-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.27-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: return NULL early from kmalloc_nolock() in NMI on UP Harry Yoo (Oracle) <harry(a)kernel.org> mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP Marco Elver <elver(a)google.com> vmalloc: fix buffer overflow in vrealloc_node_align() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Elson Serrao <elson.serrao(a)oss.qualcomm.com> phy: qcom: m31-eusb2: clear PLL_EN during init Ronak Raheja <ronak.raheja(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add nova lake point H DID Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: use PCI_DEVICE_DATA macro Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Fix rodata=full block mapping support for realm guests Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: mm: Simplify check in arch_kfence_init_pool() Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Andrea Righi <arighi(a)nvidia.com> sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle David Howells <dhowells(a)redhat.com> rxgk: Fix potential integer overflow in length check Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Tushar Sariya <tushar.97(a)hotmail.com> NFSv4.1: Apply session size limits on clone path Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: acomp - fix wrong pointer stored by acomp_save_req() Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: raise barrier before state machine transition Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: skip reading rdevs that are not in_sync David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Do not double count the reader_page Brian Ruley <brian.ruley(a)gehealthcare.com> ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Add missing save/restore handling of LBR MSRs Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Switch svm_copy_lbrs() to a macro Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp Jackie Liu <liuyun01(a)kylinos.cn> mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() Jackie Liu <liuyun01(a)kylinos.cn> mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Hans Holmberg <hans.holmberg(a)wdc.com> xfs: start gc on zonegc_low_space attribute updates Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix IRQ cleanup on 6xxx probe failure Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Brahmajit Das <listout(a)listout.xyz> ASoC: Intel: avs: replace strcmp with sysfs_streq Tiezhu Yang <yangtiezhu(a)loongson.cn> drm/amd: Fix set but not used warnings Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Sanman Pradhan <psanman(a)juniper.net> hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Reject registration of a registered fprobe before init Marco Elver <elver(a)google.com> slub: fix data loss and overflow in krealloc() Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix memory leak in remove and probe error paths David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix error handling in rxgk_extract_token() David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: remove switch to one-shot mode Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Spencer Payton <spayton681(a)gmail.com> ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Skip stale records in audit_match_record() Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix snprintf truncation checks in audit helpers Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Drain stale audit records on init Mickaël Salaün <mic(a)digikod.net> landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Aksh Garg <a-garg7(a)ti.com> PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access Helge Deller <deller(a)gmx.de> parisc: Drop ip_fast_csum() inline assembly implementation Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Thorsten Blum <thorsten.blum(a)linux.dev> mm/hugetlb: fix early boot crash on parameters without '=' separator SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damon_call() vs kdamond_fn() exit race Hao Ge <hao.ge(a)linux.dev> mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Jens Axboe <axboe(a)kernel.dk> io_uring/register: fix ring resizing with mixed/large SQEs/CQEs Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Sean Christopherson <seanjc(a)google.com> KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX Felix Gu <ustc.gu(a)gmail.com> EDAC/versalnet: Fix device_node leak in mc_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Swamil Jain <s-jain1(a)ti.com> dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Douya Le <ldy3087146292(a)gmail.com> crypto: algif_aead - snapshot IV for async AEAD requests Matthew Wilcox (Oracle) <willy(a)infradead.org> mm: call ->free_folio() directly in folio_unmap_invalidate() Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Alex Williamson <alex.williamson(a)nvidia.com> vfio/virtio: Convert list_lock from spinlock to mutex Manish Honap <mhonap(a)nvidia.com> vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: edt-ft5x06 - fix use-after-free in debugfs teardown Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> fs: afs: revert mmap_prepare() change Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` Danilo Krummrich <dakr(a)kernel.org> rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: .../bindings/display/ti/ti,am65x-dss.yaml | 70 +++-- Documentation/scheduler/sched-ext.rst | 14 +- Makefile | 5 +- arch/arm/mm/flush.c | 4 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/mmu.h | 2 + arch/arm64/mm/init.c | 9 +- arch/arm64/mm/mmu.c | 92 +++--- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/kvm/vcpu.c | 2 +- arch/parisc/Kconfig | 3 + arch/parisc/include/asm/checksum.h | 89 +----- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/parisc/lib/Makefile | 2 +- arch/parisc/lib/checksum.c | 99 ------ arch/um/drivers/cow_user.c | 8 +- arch/x86/Kconfig | 1 + arch/x86/kernel/shstk.c | 42 +-- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 195 +++++++----- arch/x86/kvm/svm/svm.c | 139 +++++++-- arch/x86/kvm/svm/svm.h | 11 +- arch/x86/kvm/x86.c | 65 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 6 +- block/bio.c | 6 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/acompress.c | 8 +- crypto/algif_aead.c | 10 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 13 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 4 +- drivers/crypto/nx/nx-842.c | 10 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/edac/versalnet_edac.c | 6 +- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +++- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/isl28022.c | 5 +- drivers/hwmon/powerz.c | 11 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 16 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/input/touchscreen/edt-ft5x06.c | 3 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/md-llbitmap.c | 11 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/misc/mei/bus-fixup.c | 6 +- drivers/misc/mei/hw-me-regs.h | 163 +++++----- drivers/misc/mei/hw-me.h | 6 - drivers/misc/mei/pci-me.c | 163 +++++----- drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus_provider.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 56 ++-- drivers/pci/controller/dwc/pci-imx6.c | 1 + drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 4 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/reset/reset-rzv2h-usb2phy.c | 64 ++-- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + drivers/vfio/pci/virtio/common.h | 2 +- drivers/vfio/pci/virtio/migrate.c | 33 +- fs/afs/file.c | 12 +- fs/ceph/dir.c | 6 +- fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/file_table.c | 22 +- fs/jbd2/revoke.c | 8 +- fs/nfs/internal.h | 2 + fs/nfs/nfs4client.c | 4 +- fs/nfs/nfs4proc.c | 3 + fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + fs/xfs/xfs_sysfs.c | 7 +- fs/xfs/xfs_zone_alloc.h | 4 + fs/xfs/xfs_zone_gc.c | 17 ++ include/linux/alloc_tag.h | 2 + include/linux/damon.h | 1 + include/linux/device.h | 45 +++ include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 4 +- include/linux/pgalloc_tag.h | 2 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- init/main.c | 1 - io_uring/poll.c | 6 +- io_uring/register.c | 32 +- io_uring/timeout.c | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/fprobe.c | 21 +- kernel/trace/ring_buffer.c | 13 +- lib/alloc_tag.c | 109 +++++++ lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 60 ++-- mm/damon/stat.c | 5 +- mm/filemap.c | 3 +- mm/hugetlb.c | 3 + mm/internal.h | 11 +- mm/mempolicy.c | 23 +- mm/migrate.c | 17 ++ mm/mlock.c | 10 +- mm/page_alloc.c | 15 +- mm/slub.c | 29 +- mm/truncate.c | 6 +- mm/vma.c | 4 +- mm/vmalloc.c | 3 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 2 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 86 +++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 20 +- net/rxrpc/conn_event.c | 43 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxgk_app.c | 3 +- net/rxrpc/rxgk_common.h | 1 + net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/dma.rs | 3 - scripts/check-uapi.sh | 7 +- security/apparmor/lsm.c | 16 +- security/landlock/cred.c | 6 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 71 +++-- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/aloop.c | 43 ++- sound/drivers/pcmtest.c | 19 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/soc/intel/avs/path.c | 2 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/annotate/instructions.c | 1 + tools/perf/util/disasm.c | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/kvm/x86/msrs_test.c | 2 +- tools/testing/selftests/landlock/audit.h | 105 +++++-- tools/testing/selftests/landlock/audit_test.c | 124 ++++++-- tools/testing/selftests/landlock/net_test.c | 2 +- tools/testing/selftests/landlock/ptrace_test.c | 1 - .../selftests/landlock/scoped_abstract_unix_test.c | 1 - .../testing/selftests/mqueue/{setting => settings} | 0 tools/testing/selftests/vfio/lib/vfio_pci_device.c | 4 +- tools/testing/vma/vma_internal.h | 7 +- 274 files changed, 3267 insertions(+), 1877 deletions(-)

4 months, 3 weeks

[PATCH 7.0 000/307] 7.0.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.4 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:49 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.4-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: return NULL early from kmalloc_nolock() in NMI on UP Harry Yoo (Oracle) <harry(a)kernel.org> mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP Marco Elver <elver(a)google.com> vmalloc: fix buffer overflow in vrealloc_node_align() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Brajesh Gupta <brajesh.gupta(a)imgtec.com> drm/imagination: Fix segfault when updating ftrace mask Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add nova lake point H DID Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: use PCI_DEVICE_DATA macro Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm: avoid deadlock when holding rmap on mmap_prepare error Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm: various small mmap_prepare cleanups Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable WANG Rui <r(a)hev.cc> perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Andrea Righi <arighi(a)nvidia.com> sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle David Howells <dhowells(a)redhat.com> rxgk: Fix potential integer overflow in length check Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Tushar Sariya <tushar.97(a)hotmail.com> NFSv4.1: Apply session size limits on clone path Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: acomp - fix wrong pointer stored by acomp_save_req() Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Pierre Barre <pierre(a)barre.sh> 9p: fix access mode flags being ORed instead of replaced Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: raise barrier before state machine transition Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: skip reading rdevs that are not in_sync David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Do not double count the reader_page Brian Ruley <brian.ruley(a)gehealthcare.com> ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Add missing save/restore handling of LBR MSRs Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Switch svm_copy_lbrs() to a macro Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 Marc Zyngier <maz(a)kernel.org> KVM: arm64: Account for RESx bits in __compute_fgt() Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp Jackie Liu <liuyun01(a)kylinos.cn> mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() Jackie Liu <liuyun01(a)kylinos.cn> mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() Chenghao Duan <duanchenghao(a)kylinos.cn> mm/memfd_luo: fix physical address conversion in put_folios cleanup Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Hans Holmberg <hans.holmberg(a)wdc.com> xfs: start gc on zonegc_low_space attribute updates Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix IRQ cleanup on 6xxx probe failure Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Fix AXIRX_VBLANK register write Daniel Scally <dan.scally+renesas(a)ideasonboard.com> media: rzv2h-ivc: Revise default VBLANK formula Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Sanman Pradhan <psanman(a)juniper.net> hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Daniel J Blueman <daniel(a)quora.org> apparmor: Fix string overrun due to missing termination Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers Petr Mladek <pmladek(a)suse.com> printf: Compile the kunit test with DISABLE_BRANCH_PROFILING DISABLE_BRANCH_PROFILING hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Reject registration of a registered fprobe before init Marco Elver <elver(a)google.com> slub: fix data loss and overflow in krealloc() Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix memory leak in remove and probe error paths David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix error handling in rxgk_extract_token() David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: remove switch to one-shot mode Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Spencer Payton <spayton681(a)gmail.com> ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Helge Deller <deller(a)gmx.de> module.lds.S: Fix modules on 32-bit parisc architecture Joe Lawrence <joe.lawrence(a)redhat.com> module.lds,codetag: force 0 sh_addr for sections Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: fix user_struct uaf Jens Axboe <axboe(a)kernel.dk> io_uring/register: fix ring resizing with mixed/large SQEs/CQEs David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: return back two step unregistration Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Matthew Brost <matthew.brost(a)intel.com> mm/zone_device: do not touch device folio after calling ->folio_free() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Skip stale records in audit_match_record() Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix snprintf truncation checks in audit helpers Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Drain stale audit records on init Mickaël Salaün <mic(a)digikod.net> landlock: Allow TSYNC with LOG_SUBDOMAINS_OFF and fd=-1 Mickaël Salaün <mic(a)digikod.net> landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Franz Schnyder <franz.schnyder(a)toradex.com> PCI: imx6: Fix reference clock source selection for i.MX95 Aksh Garg <a-garg7(a)ti.com> PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access Helge Deller <deller(a)gmx.de> parisc: Drop ip_fast_csum() inline assembly implementation Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Thorsten Blum <thorsten.blum(a)linux.dev> mm/hugetlb: fix early boot crash on parameters without '=' separator SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damos_walk() vs kdamond_fn() exit race SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damon_call() vs kdamond_fn() exit race Hao Ge <hao.ge(a)linux.dev> mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Michael Riesch <michael.riesch(a)collabora.com> media: rockchip: rkcif: comply with minimum number of buffers requirement Dan Carpenter <dan.carpenter(a)linaro.org> media: rockchip: rkcif: fix off by one bugs Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Sean Christopherson <seanjc(a)google.com> KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Elson Serrao <elson.serrao(a)oss.qualcomm.com> phy: qcom: m31-eusb2: clear PLL_EN during init Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX Felix Gu <ustc.gu(a)gmail.com> EDAC/versalnet: Fix device_node leak in mc_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Swamil Jain <s-jain1(a)ti.com> dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Douya Le <ldy3087146292(a)gmail.com> crypto: algif_aead - snapshot IV for async AEAD requests Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Alex Williamson <alex.williamson(a)nvidia.com> vfio/virtio: Convert list_lock from spinlock to mutex Michał Winiarski <michal.winiarski(a)intel.com> vfio/xe: Add a missing vfio_pci_core_release_dev() Manish Honap <mhonap(a)nvidia.com> vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: edt-ft5x06 - fix use-after-free in debugfs teardown Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Lance Yang <lance.yang(a)linux.dev> mm: fix deferred split queue races during migration Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Fix rodata=full block mapping support for realm guests Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> fs: afs: revert mmap_prepare() change Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` Danilo Krummrich <dakr(a)kernel.org> rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Thomas Weißschuh <linux(a)weissschuh.net> sysfs: attribute_group: Respect is_visible_const() when changing owner Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: .../bindings/display/ti/ti,am65x-dss.yaml | 70 ++-- Documentation/scheduler/sched-ext.rst | 14 +- Makefile | 5 +- arch/Kconfig | 7 + arch/arm/mm/flush.c | 4 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/mmu.h | 2 + arch/arm64/kvm/config.c | 4 +- arch/arm64/mm/init.c | 9 +- arch/arm64/mm/mmu.c | 81 +++-- arch/loongarch/include/asm/irq_work.h | 2 +- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/kvm/vcpu.c | 2 +- arch/parisc/Kconfig | 4 + arch/parisc/include/asm/checksum.h | 89 +---- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/parisc/lib/Makefile | 2 +- arch/parisc/lib/checksum.c | 99 ------ arch/um/drivers/cow_user.c | 8 +- arch/x86/Kconfig | 1 + arch/x86/kernel/shstk.c | 42 +-- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 201 +++++++----- arch/x86/kvm/svm/svm.c | 150 +++++++-- arch/x86/kvm/svm/svm.h | 17 +- arch/x86/kvm/x86.c | 65 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 6 +- block/bio.c | 6 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/acompress.c | 8 +- crypto/algif_aead.c | 10 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 13 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/clk/samsung/clk-acpm.c | 4 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 4 +- drivers/crypto/nx/nx-842.c | 10 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 ++++++++++++-------- drivers/edac/versalnet_edac.c | 6 +- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/firmware/samsung/exynos-acpm-dvfs.c | 4 +- drivers/firmware/samsung/exynos-acpm-dvfs.h | 4 +- drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 ++- drivers/gpu/drm/imagination/pvr_fw_trace.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/isl28022.c | 5 +- drivers/hwmon/powerz.c | 16 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 16 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/input/touchscreen/edt-ft5x06.c | 3 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/md-llbitmap.c | 11 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + .../platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 9 +- .../media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 2 +- .../platform/rockchip/rkcif/rkcif-capture-mipi.c | 10 +- .../media/platform/rockchip/rkcif/rkcif-stream.c | 44 +-- drivers/media/rc/igorplugusb.c | 16 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/sec-acpm.c | 10 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/misc/mei/bus-fixup.c | 6 +- drivers/misc/mei/hw-me-regs.h | 163 +++++----- drivers/misc/mei/hw-me.h | 6 - drivers/misc/mei/pci-me.c | 163 +++++----- drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++-- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus_provider.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 ++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 56 ++-- drivers/pci/controller/dwc/pci-imx6.c | 5 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/reset/reset-rzv2h-usb2phy.c | 64 ++-- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + drivers/vfio/pci/virtio/common.h | 2 +- drivers/vfio/pci/virtio/migrate.c | 33 +- drivers/vfio/pci/xe/main.c | 1 + drivers/video/fbdev/core/fb_defio.c | 178 +++++++--- fs/9p/v9fs.c | 4 + fs/afs/file.c | 12 +- fs/backing-file.c | 18 +- fs/ceph/addr.c | 4 + fs/ceph/dir.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 28 +- fs/erofs/ishare.c | 10 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/file_table.c | 43 ++- fs/fuse/passthrough.c | 2 +- fs/internal.h | 3 +- fs/jbd2/revoke.c | 8 +- fs/nfs/internal.h | 2 + fs/nfs/nfs4client.c | 4 +- fs/nfs/nfs4proc.c | 3 + fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 2 +- fs/sysfs/group.c | 7 +- fs/udf/super.c | 4 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + fs/xfs/xfs_sysfs.c | 7 +- fs/xfs/xfs_zone_alloc.h | 4 + fs/xfs/xfs_zone_gc.c | 17 + include/asm-generic/codetag.lds.h | 2 +- include/linux/alloc_tag.h | 2 + include/linux/backing-file.h | 4 +- include/linux/damon.h | 2 + include/linux/device.h | 45 +++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 40 +-- include/linux/fs.h | 15 +- include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 2 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/mm.h | 7 +- include/linux/pgalloc_tag.h | 2 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/security.h | 22 ++ include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- include/uapi/linux/landlock.h | 4 +- init/main.c | 1 - io_uring/io_uring.c | 4 + io_uring/poll.c | 6 +- io_uring/register.c | 32 +- io_uring/timeout.c | 4 + io_uring/zcrx.c | 48 ++- io_uring/zcrx.h | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/fprobe.c | 21 +- kernel/trace/ring_buffer.c | 13 +- lib/alloc_tag.c | 109 +++++++ lib/test_hmm.c | 112 ++++--- lib/tests/Makefile | 2 + lib/ts_kmp.c | 18 +- mm/damon/core.c | 101 +++--- mm/damon/stat.c | 5 +- mm/huge_memory.c | 15 +- mm/hugetlb.c | 3 + mm/internal.h | 42 ++- mm/memfd_luo.c | 7 +- mm/memory.c | 53 +-- mm/mempolicy.c | 23 +- mm/memremap.c | 2 +- mm/migrate.c | 17 + mm/mlock.c | 10 +- mm/page_alloc.c | 15 +- mm/slub.c | 28 +- mm/swapfile.c | 21 +- mm/util.c | 131 ++++---- mm/vma.c | 39 ++- mm/vmalloc.c | 3 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 2 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 79 ++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 20 +- net/rxrpc/conn_event.c | 43 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxgk_app.c | 3 +- net/rxrpc/rxgk_common.h | 1 + net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/dma.rs | 3 - scripts/check-uapi.sh | 7 +- scripts/module.lds.S | 14 +- security/apparmor/lsm.c | 16 +- security/apparmor/path.c | 8 +- security/landlock/cred.c | 6 +- security/landlock/syscalls.c | 14 +- security/lsm.h | 1 + security/lsm_init.c | 9 + security/security.c | 102 ++++++ security/selinux/hooks.c | 256 +++++++++++---- security/selinux/include/objsec.h | 11 + sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 71 ++-- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/aloop.c | 43 ++- sound/drivers/pcmtest.c | 19 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 ++- sound/usb/caiaq/device.c | 35 +- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/util/Build | 1 - tools/perf/util/annotate-arch/annotate-loongarch.c | 1 + tools/perf/util/disasm.c | 2 +- tools/perf/util/disasm.h | 2 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/kvm/x86/msrs_test.c | 2 +- tools/testing/selftests/landlock/audit.h | 105 ++++-- tools/testing/selftests/landlock/audit_test.c | 357 +++++++++++++++++++-- tools/testing/selftests/landlock/net_test.c | 2 +- tools/testing/selftests/landlock/ptrace_test.c | 1 - .../selftests/landlock/scoped_abstract_unix_test.c | 1 - tools/testing/selftests/landlock/tsync_test.c | 77 +++++ .../testing/selftests/mqueue/{setting => settings} | 0 tools/testing/selftests/vfio/lib/vfio_pci_device.c | 4 +- tools/testing/vma/include/dup.h | 7 +- tools/testing/vma/include/stubs.h | 13 +- 329 files changed, 4508 insertions(+), 2269 deletions(-)

4 months, 3 weeks

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage May 2026