Lkft-triage July 2026

lkft-triage@lists.linaro.org

38 participants
46 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.260 release. There are 96 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.260-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.260-rc1 Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Modify bnxt_disable_int_sync() to be called more than once. Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Set merge to zero early in af_alg_sendmsg Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: fix action bind logic Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Jiacheng Shi <billsjc(a)sjtu.edu.cn> vfio/iommu_type1: replace kfree with kvfree Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Wang Yufen <wangyufen(a)huawei.com> netdevsim: Fix memory leak of nsim_dev->fa_cookie Hangyu Hua <hbh25y(a)gmail.com> net: 9p: fix refcount leak in p9_read_work() error handling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Eric Dumazet <edumazet(a)google.com> net/sched: cls_u32: use skb_header_pointer_careful() Eric Dumazet <edumazet(a)google.com> net: add skb_header_pointer_careful() helper Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Max Tottenham <mtottenh(a)akamai.com> net/sched: act_pedit: Parse L3 Header for L4 offset Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: remove extra check for key type Pedro Tammela <pctammela(a)mojatatu.com> net/sched: simplify tcf_pedit_act Pedro Tammela <pctammela(a)mojatatu.com> net/sched: transition act_pedit to rcu and percpu stats Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 427 ++++++++++----------- Makefile | 4 +- arch/mips/dec/prom/console.c | 7 +- arch/x86/kvm/svm/sev.c | 1 + crypto/af_alg.c | 2 + drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 421 +------------------- drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/basics/vector.c | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 12 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 56 ++- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 9 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 + drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/netdevsim/dev.c | 1 + drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/regulator/core.c | 10 +- drivers/slimbus/qcom-ngd-ctrl.c | 11 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/usb/cdns3/gadget.c | 3 + drivers/vfio/vfio_iommu_type1.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/fuse/dev.c | 4 + fs/fuse/file.c | 8 +- fs/nfs/pnfs.c | 2 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ocfs2/suballoc.c | 22 ++ include/keys/request_key_auth-type.h | 2 + include/linux/ring_buffer.h | 4 +- include/linux/skbuff.h | 12 + include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 80 +++- kernel/bpf/cgroup.c | 2 +- kernel/trace/ring_buffer.c | 74 +--- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- net/9p/trans_fd.c | 1 + net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 3 +- net/batman-adv/tp_meter.c | 115 ++++-- net/batman-adv/translation-table.c | 40 +- net/batman-adv/tvlv.c | 69 +++- net/batman-adv/types.h | 21 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/protocol.c | 8 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 420 +++++++++++--------- net/sched/cls_u32.c | 13 +- net/tipc/crypto.c | 9 + security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- 86 files changed, 1206 insertions(+), 1246 deletions(-)

1 month

「ペット愛」溢れる、経営者様へ

by 日本ペットホテル協会

　　「ペット愛」溢れる、経営者様へ　　地域で愛犬を安心して預けられる　ペットホテル・トリミング事業を始めませんか。　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン “ONE LUKE” 　　　※経験や資格が無くても始められます　　■　開催方式　　　オンライン（申込後に参加方法をご案内）　　■　日程　　　7月7日（火）13:00-14:00 　　　7月10日（金）13:00-14:00　残2席　　　7月13日（月）11:00-12:00 　　　7月16日（木）13:00-14:00 　■　定員　　　5名　　■　ご視聴・詳細はこちら　　　https://oneluke-fc-seminar.jp/lp/ 　　　お世話になります。　　ペットホテル・トリミングサロンの　フラチャイズ説明会のご案内でございます。　ペットホテルとトリミングサービスを提供する　ONE LUKE（ワンルーク）　　ワンちゃんが好きすぎる創業者が　ペットホテルに預けたときに感じた　不安や思ったことを施設づくりに活かしています。　　　例えばワンちゃんが泊まるときに、少しでも　広く、心地よく過ごして欲しいという思いから　鉄のゲージではなくオーダーで職人さんに　「お部屋」を作っていただいています。　　そうした愛犬家目線のきめ細かいサービスが支持され　利用した方は高い確率でリピートしてくれます。　　　日本ではいまや「8世帯に1世帯」がペットを飼うまでに　増えてきましたが、ペットホテルはまだまだ店舗数が　足りていないため、今後も成長が期待できます。　　　ここまでこの文章を読まれたということは、　あなたもワンちゃんが大好きなのではないでしょうか。　　ワンルークのFCオーナー様も愛犬家が多く、中には　ご自身が利用者だった、という方もいらっしゃいます。　　説明会にて詳しいビジネスモデルをお伝えしますので、　新規事業を探している愛犬家の経営者様は　この機会にぜひご参加ください。　　地域のペットライフを豊かにし、愛犬が安心して　過ごせる空間を一緒につくっていきましょう。　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン　　　“ONE LUKE（ワンルーク）” 　　■　ご視聴はこちら　　　https://oneluke-fc-seminar.jp/lp/ 　 *********************************************************************** 本メールのご不要な方には大変ご迷惑をおかけいたしました。お手数お掛けしますが、メール不要のお手続きは下記URLよりお願いいたします。 <メール停止フォーム> 　https://oneluke-fc-seminar.jp/mail/ *********************************************************************** 日本ペットホテル協会株式会社愛知県名古屋市千種区内山3丁目9-23 3F TEL:052-784-8416 ***********************************************************************

1 month

[PATCH 6.12 000/204] 6.12.95-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.95 release. There are 204 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.95-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.95-rc1 Hangbin Liu <liuhangbin(a)gmail.com> bonding: do not set usable_slaves for broadcast mode Eric Dumazet <edumazet(a)google.com> bonding: annotate data-races arcound churn variables Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: update the slave array for broadcast mode John Stultz <jstultz(a)google.com> locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Fix linuxppc-dev mailto link Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Sean Christopherson <seanjc(a)google.com> KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: constify file ptr in backing_file accessor helpers Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore MMIO requests of length '0' Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Petr Machata <petrm(a)nvidia.com> net: ipv6: Make udp_tunnel6_xmit_skb() void Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Peter Zijlstra <peterz(a)infradead.org> locking/mutex: Remove wakeups from under mutex::wait_lock Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Jann Horn <jannh(a)google.com> fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: fix buffer over-read in rtw_update_protection Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix NULL pointer dereference in actor_port_prio setting Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Eric Dumazet <edumazet(a)google.com> bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu <liuhangbin(a)gmail.com> bonding: print churn state via netlink Hangbin Liu <liuhangbin(a)gmail.com> bonding: add support for per-port LACP actor priority Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: add broadcast_neighbor option for 802.3ad Kevin Berry <kpberry(a)google.com> Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix error returns in CoW fork repair Christoph Hellwig <hch(a)lst.de> xfs: remove the expr argument to XFS_TEST_ERROR Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Petr Machata <petrm(a)nvidia.com> Reapply "selftest/ptp: update ptp selftest to exercise the gettimex options" Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net: Drop the lock in skb_may_tx_timestamp() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Jani Nikula <jani.nikula(a)intel.com> drm/xe/display: fix oops in suspend/shutdown without display Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Remove redundant assignment of return variable Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Extract gpiochip_choose_fwnode() for wider use Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix a potential scan no APs Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain ------------- Diffstat: Documentation/networking/bonding.rst | 15 + Documentation/userspace-api/ioctl/ioctl-number.rst | 485 +++++---- Makefile | 4 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 113 +- block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/acpi/scan.c | 41 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 416 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpio/gpiolib.c | 156 +-- drivers/gpu/drm/v3d/v3d_drv.h | 7 +- drivers/gpu/drm/v3d/v3d_gem.c | 7 +- drivers/gpu/drm/v3d/v3d_irq.c | 62 +- drivers/gpu/drm/v3d/v3d_sched.c | 42 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/bh1780.c | 4 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/mtd/spi-nor/macronix.c | 31 + drivers/net/bonding/bond_3ad.c | 131 ++- drivers/net/bonding/bond_main.c | 86 +- drivers/net/bonding/bond_netlink.c | 37 +- drivers/net/bonding/bond_options.c | 71 ++ drivers/net/bonding/bond_procfs.c | 11 +- drivers/net/bonding/bond_sysfs_slave.c | 17 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7921/init.c | 7 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 14 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 22 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/fhandle.c | 16 +- fs/file_table.c | 40 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 4 +- fs/mount.h | 10 +- fs/namespace.c | 6 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 3 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- fs/xfs/libxfs/xfs_ag_resv.c | 8 +- fs/xfs/libxfs/xfs_alloc.c | 5 +- fs/xfs/libxfs/xfs_attr_leaf.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 17 +- fs/xfs/libxfs/xfs_btree.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 2 +- fs/xfs/libxfs/xfs_dir2.c | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 4 +- fs/xfs/libxfs/xfs_ialloc.c | 2 +- fs/xfs/libxfs/xfs_inode_buf.c | 4 +- fs/xfs/libxfs/xfs_inode_fork.c | 3 +- fs/xfs/libxfs/xfs_refcount.c | 5 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/cow_repair.c | 7 +- fs/xfs/scrub/repair.c | 2 +- fs/xfs/xfs_attr_item.c | 2 +- fs/xfs/xfs_buf.c | 4 +- fs/xfs/xfs_error.c | 5 +- fs/xfs/xfs_error.h | 10 +- fs/xfs/xfs_inode.c | 28 +- fs/xfs/xfs_iomap.c | 2 +- fs/xfs/xfs_log.c | 8 +- fs/xfs/xfs_trans_ail.c | 2 +- include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/fs.h | 19 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/net/phonet/pn_dev.h | 2 +- include/net/rtnetlink.h | 2 + include/net/sock.h | 2 +- include/net/udp_tunnel.h | 14 +- include/uapi/linux/if_link.h | 3 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- kernel/bpf/cgroup.c | 2 +- kernel/futex/pi.c | 6 +- kernel/futex/requeue.c | 6 + kernel/locking/mutex.c | 16 +- kernel/locking/rtmutex.c | 51 +- kernel/locking/rtmutex_api.c | 14 +- kernel/locking/rtmutex_common.h | 3 +- kernel/locking/rwbase_rt.c | 8 +- kernel/locking/rwsem.c | 4 +- kernel/locking/spinlock_rt.c | 5 +- kernel/locking/ww_mutex.h | 30 +- kernel/sched/core.c | 12 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/rtnetlink.c | 8 + net/core/skbuff.c | 23 +- net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 20 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_udp_tunnel.c | 15 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 21 +- net/sctp/ipv6.c | 9 +- net/sctp/protocol.c | 2 + net/socket.c | 2 +- net/tipc/crypto.c | 9 + net/tipc/udp_media.c | 10 +- net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 109 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 35 +- .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + tools/testing/selftests/ptp/testptp.c | 62 +- virt/kvm/eventfd.c | 12 +- 217 files changed, 3867 insertions(+), 2335 deletions(-)

1 month, 1 week

[PATCH 6.18 000/108] 6.18.38-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.38 release. There are 108 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.38-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.38-rc1 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered NeilBrown <neil(a)brown.name> lockd: fix TEST handling when not all permissions are available. Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 ++- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 + drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 17 +- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/checkpoint.c | 14 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/f2fs/node.c | 2 +- fs/file_table.c | 27 ++- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 3 +- fs/lockd/svc4proc.c | 13 +- fs/lockd/svclock.c | 4 +- fs/lockd/svcproc.c | 15 +- fs/lockd/svcsubs.c | 35 ++- fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 ++ fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 2 +- fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/f2fs_fs.h | 1 + include/linux/fs.h | 13 ++ include/linux/kvm_host.h | 7 +- include/linux/lockd/lockd.h | 2 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 ++ include/linux/skmsg.h | 15 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 12 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +-- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +-- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +++++- net/batman-adv/tp_meter.c | 115 +++++---- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +++++- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 +++ net/core/rtnetlink.c | 8 + net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 ++ net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + security/apparmor/include/policy_unpack.h | 19 ++ security/apparmor/lsm.c | 16 +- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 ++- security/security.c | 109 +++++++++ security/selinux/hooks.c | 256 +++++++++++++++------ security/selinux/include/objsec.h | 11 + virt/kvm/eventfd.c | 12 +- 126 files changed, 1354 insertions(+), 401 deletions(-)

1 month, 1 week

[PATCH 6.18 00/60] 6.18.37-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.37 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.37-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.37-rc1 Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: do not copy page tables unnecessarily for VM_UFFD_WP Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - iterative IRQ handler Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix type overflow in register counts Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix register descriptor address calculation Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Faicker Mo <faicker.mo(a)gmail.com> net: net_failover: Fix the deadlock in slave register Mike Marciniszyn (Meta) <mike.marciniszyn(a)gmail.com> net: export netif_open for self_test usage Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> testing/selftests/mm: add soft-dirty merge self-test Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: propagate VM_SOFTDIRTY on merge Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: set the VM_MAYBE_GUARD flag on guard region install Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: implement sticky VMA flags Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: update vma_modify_flags() to handle residual flags, document Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: add atomic VMA flags and set VM_MAYBE_GUARD as such Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix cross-thread RX length corruption Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: don't free fd-owned sockets when reaping in the heartbeat Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer in rose_kill_by_device() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: cancel neighbour timers in rose_neigh_put() before freeing Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: drop CALL_REQUEST in loopback timer when device is not running Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: release netdev ref and destroy orphaned incoming sockets Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_make_new() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: disconnect orphaned STATE_2 sockets when device is gone Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix notifier unregistered too early in rose_exit() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_rx_call_request() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: guard rose_neigh_put() against NULL in timer expiry Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer after rose_neigh_put() in state machines Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix race between loopback timer and module removal Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: hold loopback neighbour reference across timer callback Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix dev_put() leak in rose_loopback_timer() Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Yang Erkun <yangerkun(a)huawei.com> Revert "NFSD: Defer sub-object cleanup in export put callbacks" Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: fix stm32 (and potentially others) resume regression Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data ------------- Diffstat: Documentation/filesystems/proc.rst | 5 +- Documentation/userspace-api/ioctl/ioctl-number.rst | 1 - Makefile | 4 +- drivers/acpi/scan.c | 41 +-- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +-------------------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/firmware/samsung/exynos-acpm.c | 14 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/input/rmi4/rmi_driver.c | 171 +++++---- drivers/input/rmi4/rmi_driver.h | 4 +- drivers/input/rmi4/rmi_f12.c | 7 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/net_failover.c | 12 +- drivers/regulator/core.c | 10 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- fs/fuse/dev.c | 19 +- fs/fuse/file.c | 8 +- fs/nfsd/export.c | 67 +--- fs/nfsd/export.h | 7 +- fs/nfsd/nfsctl.c | 8 +- fs/proc/task_mmu.c | 1 + fs/smb/server/smb2pdu.c | 5 + include/linux/mm.h | 104 ++++++ include/net/rose.h | 12 + include/trace/events/mmflags.h | 1 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- lib/debugobjects.c | 58 ++- mm/khugepaged.c | 71 ++-- mm/madvise.c | 24 +- mm/memory.c | 16 +- mm/mlock.c | 2 +- mm/mprotect.c | 2 +- mm/mseal.c | 7 +- mm/vma.c | 81 +++-- mm/vma.h | 130 +++++-- net/core/dev.c | 1 + net/core/failover.c | 6 +- net/rose/af_rose.c | 49 ++- net/rose/rose_in.c | 6 + net/rose/rose_loopback.c | 61 +++- net/rose/rose_timer.c | 87 ++++- net/sctp/ipv6.c | 2 + net/sctp/protocol.c | 2 + tools/testing/selftests/mm/soft-dirty.c | 127 ++++++- tools/testing/vma/vma.c | 3 +- tools/testing/vma/vma_internal.h | 49 +++ 63 files changed, 1023 insertions(+), 972 deletions(-)

1 month, 1 week

[PATCH 7.0 00/49] 7.0.14-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.14 release. There are 49 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.14-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.14-rc1 Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - iterative IRQ handler Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix type overflow in register counts Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix register descriptor address calculation Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Faicker Mo <faicker.mo(a)gmail.com> net: net_failover: Fix the deadlock in slave register Mike Marciniszyn (Meta) <mike.marciniszyn(a)gmail.com> net: export netif_open for self_test usage Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: don't free fd-owned sockets when reaping in the heartbeat Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer in rose_kill_by_device() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: cancel neighbour timers in rose_neigh_put() before freeing Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: drop CALL_REQUEST in loopback timer when device is not running Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: release netdev ref and destroy orphaned incoming sockets Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_make_new() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: disconnect orphaned STATE_2 sockets when device is gone Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix notifier unregistered too early in rose_exit() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_rx_call_request() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: guard rose_neigh_put() against NULL in timer expiry Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer after rose_neigh_put() in state machines Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix race between loopback timer and module removal Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: hold loopback neighbour reference across timer callback Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix dev_put() leak in rose_loopback_timer() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Weiming Shi <bestswngs(a)gmail.com> bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Yang Erkun <yangerkun(a)huawei.com> Revert "NFSD: Defer sub-object cleanup in export put callbacks" Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix cross-thread RX length corruption Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Count number of commands in acpm_xfer NeilBrown <neil(a)brown.name> lockd: fix TEST handling when not all permissions are available. Mark Rutland <mark.rutland(a)arm.com> arm64/entry: Fix arm64-specific rseq brokenness Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 1 - Makefile | 4 +- arch/arm64/kernel/entry-common.c | 29 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +-------------------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/firmware/samsung/exynos-acpm-dvfs.c | 12 +- drivers/firmware/samsung/exynos-acpm-pmic.c | 14 +- drivers/firmware/samsung/exynos-acpm.c | 109 ++++-- drivers/firmware/samsung/exynos-acpm.h | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/input/rmi4/rmi_driver.c | 171 +++++---- drivers/input/rmi4/rmi_driver.h | 4 +- drivers/input/rmi4/rmi_f12.c | 7 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/net_failover.c | 12 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- fs/fuse/dev.c | 19 +- fs/fuse/file.c | 8 +- fs/lockd/svc4proc.c | 13 +- fs/lockd/svclock.c | 4 +- fs/lockd/svcproc.c | 15 +- fs/lockd/svcsubs.c | 35 +- fs/nfsd/export.c | 67 +--- fs/nfsd/export.h | 7 +- fs/nfsd/nfsctl.c | 8 +- fs/smb/server/smb2pdu.c | 5 + include/linux/irq-entry-common.h | 8 - include/linux/lockd/lockd.h | 2 +- include/linux/rseq_entry.h | 19 - include/net/rose.h | 12 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- net/core/bpf_sk_storage.c | 13 +- net/core/dev.c | 1 + net/core/failover.c | 6 +- net/rose/af_rose.c | 49 ++- net/rose/rose_in.c | 6 + net/rose/rose_loopback.c | 61 +++- net/rose/rose_timer.c | 87 ++++- 53 files changed, 567 insertions(+), 906 deletions(-)

1 month, 1 week

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage July 2026