Lkft-triage August 2026

lkft-triage@lists.linaro.org

31 participants
46 discussions

by Natalie Foster

Hi, Hope you are doing great! As I can see that you are one of the exhibitors at Integrated Systems Europe, would you like to get your hands on verified AV & Systems Integration Industry Contacts? We can help you connect with AV Professionals, System Integrators, AV Consultants, AV Designers, IT Specialists, Facilities Managers, Technology Decision-Makers, Corporate AV Teams, Education Institutions, Retailers, Hospitality Groups, and many more. Let me know if you are interested to see a sample, counts and pricing. please let me know your target audience and geography. Regards, Natalie Foster Sr. Marketing Manager To stop receiving future emails, reply with Omit.

1 month, 2 weeks

[PATCH 6.18 00/94] 6.18.47-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.47 release. There are 94 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.47-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.47-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Peter Zijlstra <peterz(a)infradead.org> futex: Fix might_sleep() warning in futex_pivot_pending() Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: uniform announced addresses helpers Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: rename add_entry structure to add_addr Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: use for_each_subflow helper Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper Darrick J. Wong <djwong(a)kernel.org> xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error Christoph Hellwig <hch(a)lst.de> xfs: add a xchk_ip_set_corrupt helper Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/xe/display/xe_fb_pin.c | 32 +-- drivers/gpu/drm/xe/xe_vram.c | 23 ++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 64 +++++- drivers/hid/hid-nintendo.c | 22 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/usbhid/hid-pidff.c | 13 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 18 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/tty/serial/sc16is7xx.c | 40 ++-- fs/exec.c | 8 +- fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 16 +- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/scrub/agheader.c | 94 ++++++--- fs/xfs/scrub/agheader_repair.c | 17 +- fs/xfs/scrub/bmap.c | 8 +- fs/xfs/scrub/common.c | 10 +- fs/xfs/scrub/common.h | 2 + fs/xfs/scrub/dir.c | 2 +- fs/xfs/scrub/dirtree.c | 4 +- fs/xfs/scrub/metapath.c | 6 +- fs/xfs/scrub/nlinks.c | 12 +- fs/xfs/scrub/parent.c | 6 +- fs/xfs/scrub/rtbitmap.c | 12 +- fs/xfs/scrub/rtsummary.c | 12 +- include/linux/futex.h | 2 + include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/linux/wait.h | 1 + include/linux/wait_bit.h | 1 + io_uring/futex.c | 11 + io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/opdef.c | 2 +- io_uring/rsrc.c | 2 +- io_uring/uring_cmd.c | 8 +- kernel/futex/core.c | 122 +++++++---- kernel/futex/futex.h | 9 + kernel/futex/pi.c | 125 +++++++++--- kernel/kcov.c | 90 ++++---- kernel/sched/wait.c | 15 ++ kernel/sched/wait_bit.c | 14 +- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 ++++- net/bluetooth/iso.c | 32 ++- net/bluetooth/mgmt.c | 8 + net/bluetooth/rfcomm/core.c | 24 ++- net/ceph/osd_client.c | 5 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 2 +- net/mptcp/pm.c | 74 ++++--- net/mptcp/pm_kernel.c | 22 +- net/mptcp/pm_userspace.c | 10 +- net/mptcp/protocol.h | 25 +-- net/mptcp/subflow.c | 4 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 36 +++- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 +++- security/selinux/ss/avtab.h | 13 ++ security/selinux/ss/conditional.c | 18 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 248 +++++++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/usb/fcp.c | 38 ++-- sound/usb/mixer.c | 6 + sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++---- 109 files changed, 1533 insertions(+), 570 deletions(-)

1 month, 3 weeks

[PATCH 7.2 00/82] 7.2.1-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.1 release. There are 82 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.1-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.1-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jann Horn <jannh(a)google.com> HID: rapoo: fix missing hid_is_usb() check Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Jann Horn <jannh(a)google.com> HID: huawei: fix missing hid_is_usb() check Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Yun Zhou <yun.zhou(a)windriver.com> xfs: restore nofs context unconditionally in xfs_trans_roll Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring: defer eventfd signaling when queued from a wakeup handler Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: only mark private futex waits as inflight Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Felix Hoffmann <f3lix.dev(a)gmx.de> futex: Avoid private hash use-after-free on final put Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +++- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/xe/xe_vram.c | 23 ++++- drivers/hid/Kconfig | 1 + drivers/hid/hid-asus.c | 2 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-ft260.c | 25 ++++- drivers/hid/hid-huawei.c | 5 +- drivers/hid/hid-hyperv.c | 27 ++++- drivers/hid/hid-input.c | 20 +++- drivers/hid/hid-magicmouse.c | 73 +++++++++++-- drivers/hid/hid-nintendo.c | 22 ++-- drivers/hid/hid-rapoo.c | 2 +- drivers/hid/hid-sensor-custom.c | 21 ++-- drivers/hid/hid-uclogic-core.c | 12 ++- drivers/hid/usbhid/hid-pidff.c | 13 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 ++- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 ++- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++++ drivers/nfc/microread/microread.c | 31 +++++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 19 +++- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 +++ fs/exec.c | 7 +- fs/ext4/crypto.c | 40 ++++---- fs/ext4/fast_commit.c | 16 ++- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +++- fs/ocfs2/xattr.c | 18 ++-- fs/xfs/libxfs/xfs_attr_leaf.c | 14 +++ fs/xfs/xfs_trans.c | 16 +-- include/linux/futex.h | 2 + include/linux/hid.h | 2 + include/linux/io_uring_types.h | 8 ++ include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 ++ io_uring/eventfd.c | 8 +- io_uring/eventfd.h | 2 +- io_uring/futex.c | 32 ++++-- io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/io_uring.c | 2 +- io_uring/opdef.c | 2 +- io_uring/poll.c | 23 +++-- io_uring/rsrc.c | 2 +- io_uring/tw.c | 2 +- io_uring/uring_cmd.c | 8 +- io_uring/waitid.c | 2 +- kernel/futex/core.c | 96 +++++++++++------ kernel/futex/pi.c | 125 +++++++++++++++++------ kernel/kcov.c | 90 ++++++++-------- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 +++++++-- net/bluetooth/iso.c | 32 ++++-- net/bluetooth/mgmt.c | 8 ++ net/bluetooth/rfcomm/core.c | 24 ++++- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +++- net/nfc/llcp_core.c | 15 ++- net/nfc/nci/ntf.c | 36 +++++-- net/nfc/nci/rsp.c | 1 + sound/drivers/dummy.c | 6 ++ sound/usb/fcp.c | 38 ++++--- sound/usb/mixer.c | 6 ++ sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++++++++------- 86 files changed, 1042 insertions(+), 357 deletions(-)

1 month, 3 weeks

[PATCH 6.1 00/79] 6.1.185-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.185 release. There are 79 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.185-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.185-rc1 Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Sukrut Bellary <sukrut.bellary(a)linux.com> misc: fastrpc: Fix double free of 'buf' in error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Jakub Kicinski <kuba(a)kernel.org> tls: handle data disappearing from under the TLS ULP Sabrina Dubroca <sd(a)queasysnail.net> tls: fix lockless read of strp->msg_ready in ->poll Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Eric Dumazet <edumazet(a)google.com> net/packet: convert po->pressure to an atomic flag Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: convert bitmask definitions to use BIT() macro Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Yeoreum Yun <yeoreum.yun(a)arm.com> perf/core: Fix child_total_time_enabled accounting bug at task exit Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 26 +++ drivers/hid/hid-nintendo.c | 7 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/input/mouse/byd.c | 2 +- drivers/misc/fastrpc.c | 64 +++--- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/skb.c | 2 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/s390/cio/vfio_ccw_chp.c | 26 ++- drivers/s390/cio/vfio_ccw_cp.c | 30 ++- drivers/s390/cio/vfio_ccw_drv.c | 26 ++- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 27 +++ drivers/s390/cio/vfio_ccw_private.h | 9 +- drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/sc16is7xx.c | 222 ++++++++++---------- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/xfs_attr_item.c | 24 +-- fs/xfs/xfs_bmap_item.c | 18 +- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 91 +++++--- fs/xfs/xfs_dquot_item_recover.c | 20 +- fs/xfs/xfs_extfree_item.c | 43 ++-- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +-- fs/xfs/xfs_log_recover.c | 16 +- fs/xfs/xfs_refcount_item.c | 16 +- fs/xfs/xfs_rmap_item.c | 16 +- fs/xfs/xfs_trans.h | 1 - include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/netdevice.h | 6 +- include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/net/tls.h | 3 +- kernel/events/core.c | 121 +++++------ kernel/kcov.c | 90 ++++---- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 2 + net/bluetooth/rfcomm/core.c | 24 ++- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 +++++++++++++++++++++-------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/mptcp/pm_netlink.c | 36 ++-- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 79 ++++--- net/packet/internal.h | 2 +- net/tls/tls.h | 4 +- net/tls/tls_strp.c | 17 +- net/tls/tls_sw.c | 3 +- net/xfrm/xfrm_state.c | 4 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- 90 files changed, 1283 insertions(+), 670 deletions(-)

1 month, 3 weeks

[PATCH 6.12 00/77] 6.12.106-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.106 release. There are 77 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.106-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.106-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Eric Dumazet <edumazet(a)google.com> ipv4: start using dst_dev_rcu() Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Darrick J. Wong <djwong(a)kernel.org> xfs: namespace the maximum length/refcount symbols Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Ryan Wilbur <rwilbur633(a)gmail.com> serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Eric Dumazet <edumazet(a)google.com> inet: frags: save a pair of atomic operations in reassembly Eric Dumazet <edumazet(a)google.com> inet: frags: change inet_frag_kill() to defer refcount updates Eric Dumazet <edumazet(a)google.com> ipv4: frags: remove ipq_put() Eric Dumazet <edumazet(a)google.com> inet: frags: add inet_frag_putn() helper David Howells <dhowells(a)redhat.com> netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90(a)mail.toshiba> hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() Jordan Rhee <jordanrhee(a)google.com> gve: fix zero-length skb frag with header-split Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 ++- drivers/bluetooth/hci_aml.c | 18 ++++- drivers/gpio/gpio-ml-ioh.c | 36 ++++----- drivers/gpu/drm/xe/display/xe_fb_pin.c | 24 ++---- drivers/hid/hid-core.c | 11 ++- drivers/hid/hid-hyperv.c | 27 ++++++- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 64 +++++++++++++++- drivers/hid/hid-nintendo.c | 22 ++++-- drivers/hid/hid-sensor-custom.c | 21 ++--- drivers/hwmon/pmbus/ltc4286.c | 2 +- drivers/input/keyboard/atkbd.c | 23 +++++- drivers/input/mouse/byd.c | 2 +- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 6 ++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/ntb_netdev.c | 15 ++-- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++++++ drivers/nfc/microread/microread.c | 31 +++++++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 18 ++++- drivers/pci/controller/pci-host-generic.c | 11 +-- drivers/pci/ecam.c | 13 ++++ drivers/tty/serial/8250/8250_of.c | 41 ++++++++++ drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/sc16is7xx.c | 40 +++++----- fs/ext4/fast_commit.c | 16 +++- fs/ext4/xattr.c | 7 +- fs/netfs/buffered_read.c | 4 +- fs/netfs/read_collect.c | 2 +- fs/netfs/read_retry.c | 2 +- fs/ocfs2/xattr.c | 18 +++-- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++++ fs/xfs/libxfs/xfs_format.h | 4 +- fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/libxfs/xfs_refcount.c | 18 ++--- fs/xfs/scrub/agheader.c | 94 +++++++++++++++++------ fs/xfs/scrub/agheader_repair.c | 17 +++- fs/xfs/scrub/refcount.c | 2 +- fs/xfs/scrub/refcount_repair.c | 4 +- fs/xfs/xfs_attr_item.c | 32 ++++---- fs/xfs/xfs_bmap_item.c | 18 ++--- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 95 ++++++++++++++--------- fs/xfs/xfs_dquot_item_recover.c | 20 ++--- fs/xfs/xfs_exchmaps_item.c | 8 +- fs/xfs/xfs_extfree_item.c | 43 ++++++----- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +++---- fs/xfs/xfs_log_recover.c | 16 ++-- fs/xfs/xfs_refcount_item.c | 16 ++-- fs/xfs/xfs_rmap_item.c | 16 ++-- fs/xfs/xfs_trans.h | 1 - include/linux/netfs.h | 2 +- include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 ++ include/net/inet_frag.h | 6 +- include/net/ipv6_frag.h | 5 +- kernel/kcov.c | 90 +++++++++++----------- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/iso.c | 30 ++++++-- net/bluetooth/rfcomm/core.c | 24 +++++- net/ceph/osd_client.c | 5 +- net/ieee802154/6lowpan/reassembly.c | 27 ++++--- net/ipv4/icmp.c | 6 +- net/ipv4/inet_fragment.c | 33 ++++---- net/ipv4/ip_fragment.c | 54 ++++++------- net/ipv4/ip_output.c | 4 + net/ipv4/ipmr.c | 2 +- net/ipv4/route.c | 4 +- net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 27 ++++--- net/ipv6/reassembly.c | 29 +++---- net/mptcp/pm_netlink.c | 9 ++- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 9 +++ net/mptcp/protocol.h | 7 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 ++++- net/nfc/llcp_core.c | 15 +++- net/nfc/nci/ntf.c | 10 ++- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/ss/policydb.c | 57 ++++++++++++-- sound/drivers/dummy.c | 6 ++ sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/usb/mixer.c | 6 ++ sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++++++++++++--------- 99 files changed, 1128 insertions(+), 543 deletions(-)

1 month, 3 weeks

[PATCH 6.6 00/87] 6.6.154-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.154 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.154-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.154-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Christian Göttsche <cgzones(a)googlemail.com> selinux: make more use of str_read() when loading the policy Christian Göttsche <cgzones(a)googlemail.com> selinux: avoid unnecessary indirection in struct level_datum Christian Göttsche <cgzones(a)googlemail.com> selinux: use known type instead of void pointer Paul Moore <paul(a)paul-moore.com> selinux: fix style issues in security/selinux/ss/policydb.c Paul Moore <paul(a)paul-moore.com> selinux: fix style issues in security/selinux/ss/policydb.h Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Move period/buffer configuration print after platform open Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: Relocate and rework functionality for PCM stream freeing Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: sof: pcm: use snd_pcm_direction_name() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Ilya Bakoulin <Ilya.Bakoulin(a)amd.com> drm/amd/display: Fix BT2020 YCbCr limited/full range input Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: disable ASPM in some situations Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Eric Dumazet <edumazet(a)google.com> inet: frags: save a pair of atomic operations in reassembly Eric Dumazet <edumazet(a)google.com> inet: frags: change inet_frag_kill() to defer refcount updates Eric Dumazet <edumazet(a)google.com> ipv4: frags: remove ipq_put() Eric Dumazet <edumazet(a)google.com> inet: frags: add inet_frag_putn() helper Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: convert bitmask definitions to use BIT() macro Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Peter Zijlstra <peterz(a)infradead.org> perf: Unify perf_event_free_task() / perf_event_exit_task_context() Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 100 ++- drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- drivers/gpu/drm/amd/display/dc/basics/dc_common.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 34 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 4 +- .../drm/amd/display/dc/dce/dce_stream_encoder.c | 3 +- .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 3 +- .../display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c | 3 +- drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 6 +- .../amd/display/modules/info_packet/info_packet.c | 4 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 +- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 45 +- drivers/hid/hid-nintendo.c | 7 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 +- drivers/input/mouse/byd.c | 2 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 + drivers/nfc/microread/microread.c | 31 +- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 + drivers/s390/cio/vfio_ccw_chp.c | 26 +- drivers/s390/cio/vfio_ccw_cp.c | 43 +- drivers/s390/cio/vfio_ccw_cp.h | 2 + drivers/s390/cio/vfio_ccw_drv.c | 6 + drivers/s390/cio/vfio_ccw_ops.c | 4 + drivers/s390/cio/vfio_ccw_private.h | 4 + drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/qcom_geni_serial.c | 51 +- drivers/tty/serial/sc16is7xx.c | 222 +++--- fs/ext4/xattr.c | 7 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 + fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/xfs_attr_item.c | 24 +- fs/xfs/xfs_bmap_item.c | 18 +- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 95 ++- fs/xfs/xfs_dquot_item_recover.c | 20 +- fs/xfs/xfs_extfree_item.c | 43 +- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +- fs/xfs/xfs_log_recover.c | 16 +- fs/xfs/xfs_refcount_item.c | 16 +- fs/xfs/xfs_rmap_item.c | 16 +- fs/xfs/xfs_trans.h | 1 - include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/net/inet_frag.h | 6 +- include/net/ipv6_frag.h | 5 +- kernel/events/core.c | 161 ++--- kernel/kcov.c | 90 +-- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 137 +++- net/bluetooth/rfcomm/core.c | 24 +- net/ceph/osd_client.c | 5 +- net/ieee802154/6lowpan/reassembly.c | 27 +- net/ipv4/inet_fragment.c | 33 +- net/ipv4/ip_fragment.c | 48 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 27 +- net/ipv6/reassembly.c | 29 +- net/mptcp/pm_netlink.c | 9 +- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 9 + net/mptcp/protocol.h | 7 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 45 +- security/selinux/ss/avtab.h | 23 +- security/selinux/ss/conditional.c | 40 +- security/selinux/ss/conditional.h | 6 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/ebitmap.c | 4 +- security/selinux/ss/ebitmap.h | 5 +- security/selinux/ss/mls.c | 6 +- security/selinux/ss/policydb.c | 743 +++++++++++++-------- security/selinux/ss/policydb.h | 249 +++---- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/soc/sof/ipc3-pcm.c | 13 +- sound/soc/sof/ipc3-topology.c | 20 +- sound/soc/sof/ipc4-pcm.c | 35 +- sound/soc/sof/ipc4-topology.c | 18 +- sound/soc/sof/pcm.c | 157 +++-- sound/soc/sof/sof-audio.c | 36 - sound/soc/sof/sof-audio.h | 17 +- 115 files changed, 2047 insertions(+), 1291 deletions(-)

1 month, 3 weeks

[PATCH 5.15 00/76] 5.15.218-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.218 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.218-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.218-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Sean Christopherson <seanjc(a)google.com> KVM: x86: Retry page fault if MMU reload is pending and root has no sp Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Rename __direct_map() to direct_map() David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Split out TDP MMU page fault handling Chao Peng <chao.p.peng(a)linux.intel.com> KVM: Rename mmu_notifier_* to mmu_invalidate_* Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Retry page fault if root is invalidated by memslot update Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Yeoreum Yun <yeoreum.yun(a)arm.com> perf/core: Fix child_total_time_enabled accounting bug at task exit Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> misc: fastrpc: separate fastrpc device from channel context Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- arch/arm64/kvm/mmu.c | 10 +- arch/mips/kvm/mmu.c | 12 +- arch/powerpc/include/asm/kvm_book3s_64.h | 2 +- arch/powerpc/kvm/book3s_64_mmu_host.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_hv.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 2 +- arch/powerpc/kvm/book3s_hv_nested.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 8 +- arch/powerpc/kvm/e500_mmu_host.c | 4 +- arch/x86/kvm/mmu/mmu.c | 189 +++++++++++++---- arch/x86/kvm/mmu/paging_tmpl.h | 13 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 26 +++ drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/misc/fastrpc.c | 110 ++++++---- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/skb.c | 2 - drivers/net/can/slcan.c | 1 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/s390/cio/vfio_ccw_async.c | 16 ++ drivers/s390/cio/vfio_ccw_chp.c | 31 ++- drivers/s390/cio/vfio_ccw_cp.c | 31 ++- drivers/s390/cio/vfio_ccw_drv.c | 14 +- drivers/s390/cio/vfio_ccw_ops.c | 15 +- drivers/s390/cio/vfio_ccw_private.h | 7 +- drivers/tty/serial/amba-pl011.c | 8 +- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/xfs_buf_item_recover.c | 53 +++-- include/linux/can/core.h | 1 + include/linux/can/skb.h | 3 - include/linux/kvm_host.h | 60 +++--- include/linux/netdevice.h | 6 +- include/linux/pci-ecam.h | 3 + include/net/sch_generic.h | 1 + kernel/events/core.c | 121 +++++------ mm/huge_memory.c | 52 +++-- net/bluetooth/rfcomm/core.c | 24 ++- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 +++++++++++++++++++++-------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 57 +++++ net/mptcp/pm_netlink.c | 39 ++-- net/mptcp/protocol.h | 1 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 65 ++++-- net/sched/sch_api.c | 9 + net/xfrm/xfrm_state.c | 4 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- virt/kvm/kvm_main.c | 49 ++--- 80 files changed, 1314 insertions(+), 526 deletions(-)

1 month, 3 weeks

[PATCH 5.10 00/57] 5.10.267-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.267 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.267-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.267-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Weiming Shi <bestswngs(a)gmail.com> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Sasha Levin <sashal(a)kernel.org> Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback" Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer David Matlack <dmatlack(a)google.com> KVM: arm64: Retry fault if vma_lookup() results become invalid Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Amit Cohen <amcohen(a)nvidia.com> net: ipv4: Publish fib_nlmsg_size() Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> misc: fastrpc: separate fastrpc device from channel context Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept ------------- Diffstat: Makefile | 4 +- arch/arm64/kvm/mmu.c | 42 ++-- drivers/gpio/gpio-ml-ioh.c | 36 +-- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 16 ++ drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/misc/ims-pcu.c | 2 - drivers/misc/fastrpc.c | 110 ++++++--- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/dev.c | 2 - drivers/net/can/slcan.c | 1 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/s390/cio/vfio_ccw_cp.c | 22 +- drivers/s390/cio/vfio_ccw_drv.c | 7 + drivers/s390/cio/vfio_ccw_ops.c | 8 + drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/tty/serial/amba-pl011.c | 8 +- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/xfs_buf_item_recover.c | 53 ++-- fs/xfs/xfs_dquot.c | 3 +- include/linux/can/core.h | 1 + include/linux/can/dev.h | 1 - include/linux/can/skb.h | 2 - include/linux/netdevice.h | 6 +- include/net/sch_generic.h | 1 + kernel/events/core.c | 104 ++++---- mm/huge_memory.c | 52 ++-- net/bluetooth/rfcomm/core.c | 24 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 ++++++++++++++++++------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/fib_lookup.h | 1 + net/ipv4/fib_semantics.c | 69 ++++-- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 6 + net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 65 +++-- net/sched/sch_api.c | 9 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/xfrm_state.c | 4 +- tools/lib/bpf/libbpf.c | 2 + 62 files changed, 909 insertions(+), 392 deletions(-)

1 month, 3 weeks

[PATCH 6.6 000/160] 6.6.153-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.153 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 23 Aug 2026 14:28:27 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.153-rc2 Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() Paolo Abeni <pabeni(a)redhat.com> net: harmonize tstats and dstats Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Christoph Hellwig <hch(a)lst.de> m68k: use the coherent DMA code for coldfire without data cache Christoph Hellwig <hch(a)lst.de> dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Victor Nogueira <victor(a)mojatatu.com> net: sched: Add initial TC error skb drop reasons Victor Nogueira <victor(a)mojatatu.com> net: sched: Move drop_reason to struct tc_skb_cb Yan Zhai <yan(a)cloudflare.com> packet: add a generic drop reason for receive Jamal Hadi Salim <jhs(a)mojatatu.com> net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Add tcf_set_drop_reason for {__,}tcf_classify Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Make tc-related drop reason more flexible Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <cel(a)kernel.org> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add rekey tests Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm/pagewalk: split walk_page_range_novma() into kernel/user parts Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Guillaume Nault <gnault(a)redhat.com> vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. Guillaume Nault <gnault(a)redhat.com> vrf: Make pcpu_dstats update functions available to other modules. Jeremy Kerr <jk(a)codeconstruct.com.au> net: core,vrf: Change pcpu_dstat fields to u64_stats_t Breno Leitao <leitao(a)debian.org> vxlan: Do not alloc tstats manually Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: add space_info argument to btrfs_chunk_alloc() David Sterba <dsterba(a)suse.com> btrfs: add debug build only WARN Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Ilpo Järvinen <ij(a)kernel.org> tcp: fast path functions later Ilpo Järvinen <ij(a)kernel.org> tcp: Pass flags to __tcp_send_ack Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move smb_version_values to common/smbglob.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Felix Fietkau <nbd(a)nbd.name> net: move skb_gro_receive_list from udp to core Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: move vma_can_userfault out of line Chunyan Zhang <zhangchunyan(a)iscas.ac.cn> mm: userfaultfd: add pgtable_supports_uffd_wp() Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Matthew Wilcox (Oracle) <willy(a)infradead.org> iomap: hold state_lock over call to ifs_set_range_uptodate() Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Use a folio in ceph_page_mkwrite() Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Remove ceph_writepage() Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add test with a partially invalid iov Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: Provide pgtable_l5_enabled on rv32 Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix EQ leak in mana_remove on NULL port Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm/Kconfig | 1 + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig | 7 +- arch/m68k/Kconfig.cpu | 16 + arch/m68k/kernel/Makefile | 2 +- arch/m68k/kernel/dma.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/dma.c | 4 +- arch/openrisc/kernel/signal.c | 5 +- arch/parisc/Kconfig | 1 + arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/mm/init.c | 2 + arch/riscv/mm/pageattr.c | 8 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/crypto/qce/core.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 34 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/net/can/rcar/rcar_canfd.c | 28 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 + drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/veth.c | 4 +- drivers/net/vrf.c | 49 +- drivers/net/vxlan/vxlan_core.c | 45 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 17 +- drivers/s390/cio/vfio_ccw_cp.c | 53 +- drivers/s390/cio/vfio_ccw_cp.h | 8 + drivers/s390/cio/vfio_ccw_drv.c | 15 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 35 +- drivers/s390/cio/vfio_ccw_private.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/btrfs/block-group.c | 61 ++- fs/btrfs/block-group.h | 3 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/messages.h | 7 + fs/btrfs/space-info.c | 2 +- fs/btrfs/transaction.c | 5 +- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/addr.c | 54 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/iomap/buffered-io.c | 42 +- fs/smb/client/cifsglob.h | 27 - fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/transport.c | 8 +- fs/smb/common/cifsglob.h | 36 ++ fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2misc.c | 2 +- fs/smb/server/smb2ops.c | 32 +- fs/smb/server/smb2pdu.c | 88 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 +- fs/smb/server/smb_common.h | 43 +- fs/super.c | 22 +- fs/userfaultfd.c | 20 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/asm-generic/pgtable_uffd.h | 17 + include/linux/fs.h | 12 + include/linux/mm_inline.h | 7 +- include/linux/mmap_lock.h | 4 + include/linux/netdevice.h | 52 +- include/linux/pagewalk.h | 7 +- include/linux/userfaultfd_k.h | 19 +- include/net/dropreason-core.h | 21 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/pkt_cls.h | 16 + include/net/pkt_sched.h | 3 +- include/net/sch_generic.h | 2 - include/net/tcp.h | 58 +-- include/uapi/linux/ip_vs.h | 6 - kernel/dma/Kconfig | 9 + kernel/dma/direct.c | 12 +- kernel/fork.c | 12 +- kernel/trace/ftrace.c | 9 +- kernel/trace/ring_buffer.c | 23 +- mm/huge_memory.c | 49 +- mm/internal.h | 7 + mm/migrate_device.c | 5 +- mm/pagewalk.c | 82 ++- mm/ptdump.c | 10 +- mm/userfaultfd.c | 26 + mm/vmalloc.c | 49 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dev.c | 29 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 +- net/ipv4/bpf_tcp_ca.c | 2 +- net/ipv4/tcp_dctcp.h | 2 +- net/ipv4/tcp_input.c | 56 ++- net/ipv4/tcp_minisocks.c | 12 +- net/ipv4/tcp_output.c | 6 +- net/ipv4/udp_offload.c | 29 -- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++- net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 27 +- net/sched/act_api.c | 13 +- net/sched/cls_api.c | 32 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/tls/tls_sw.c | 7 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 28 +- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- tools/testing/selftests/net/tls.c | 549 +++++++++++++++++++++ 185 files changed, 2359 insertions(+), 942 deletions(-)

1 month, 3 weeks

[PATCH 5.10 000/235] 5.10.266-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.266 release. There are 235 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.266-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.266-rc1 Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Zhang Changzhong <zhangchangzhong(a)huawei.com> net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: smbus: Check for parent device before dereference Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: rdma write inline if qp has sufficient inline space Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: move ale selection in pdata Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usx2y: Fix potential leaks of uninitialized memory Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: scsi_debug: Rename zone type constants Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Use logical blocks as unit when querying zones Bart Van Assche <bvanassche(a)acm.org> scsi: sd: sd_zbc: Improve source code documentation Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> skbuff: introduce skb_pull_data Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li <xiubli(a)redhat.com> ceph: rename _to_client() to _to_fs_client() Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Paolo Abeni <pabeni(a)redhat.com> mptcp: fix subflow accounting on close Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: fix regression with GPIO configuration Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: remove obsolete out_thread label Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: sc16is7xx: Fill in rs485_supported Tomasz Moń <tomasz.mon(a)camlingroup.com> sc16is7xx: Properly resume TX after stop Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Remove unneeded test for ->setup() presence Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l: async: Set owner for async sub-devices Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman <david.plowman(a)raspberrypi.com> media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Return proper error codes instead of -1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Deepanshu Kartikey <kartikey406(a)gmail.com> drm/virtio: use uninterruptible resv lock for plane updates Christian König <christian.koenig(a)amd.com> dma-buf/drivers: make reserving a shared slot mandatory v4 Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN David Matlack <dmatlack(a)google.com> KVM: Introduce vcpu->wants_to_run Sean Christopherson <seanjc(a)google.com> KVM: x86: Move "apicv_active" into "struct kvm_lapic" Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield Sean Christopherson <seanjc(a)google.com> KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update() Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: clean up comments and whitespace Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: add write-fifo support Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix write implementation Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: refactor write-room handling Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Chunfeng Yun <chunfeng.yun(a)mediatek.com> usb: gadget: bdc: fix checkpatch.pl spacing error Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Sabrina Dubroca <sd(a)queasysnail.net> espintcp: use sk_msg_free_partial to fix partial send Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bryam Vargas <hexlabsecurity(a)proton.me> net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: avoid calling child->ops->dequeue(child) twice Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Maoyi Xie <maoyixie.tju(a)gmail.com> net: ipip: require CAP_NET_ADMIN in the device netns for changelink Liu Jian <liujian56(a)huawei.com> net: Add helper function to parse netlink msg of ip_tunnel_encap Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix race condition in reset_device sysfs callback Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: don't increment hash_offset twice Bryam Vargas <hexlabsecurity(a)proton.me> scsi: target: Bound PR-OUT TransportID parsing to the received buffer Maurizio Lombardi <mlombard(a)redhat.com> scsi: target: core: Generate correct identifiers for PR OUT transport IDs Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> scsi: target: core: pr: Initialize arrays at declaration time Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Abdun Nihaal <nihaal(a)cse.iitm.ac.in> scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip Gustavo Pimentel <Gustavo.Pimentel(a)synopsys.com> dmaengine: dw-edma: Improve the linked list and data blocks definition Gustavo Pimentel <Gustavo.Pimentel(a)synopsys.com> PCI: Add pci_find_vsec_capability() to find a specific VSEC Jarkko Sakkinen <jarkko(a)kernel.org> tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: use kvzalloc() for megabyte buffer in simple fallocate Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spi-nor: swp: Improve locking user experience Michael Walle <mwalle(a)kernel.org> mtd: spi-nor: Fix spi_nor_try_unlock_all() Tudor Ambarus <tudor.ambarus(a)microchip.com> mtd: spi-nor: Move Software Write Protection logic out of the core Michael Walle <michael(a)walle.cc> mtd: spi-nor: intel: remove global protection flag Michael Walle <michael(a)walle.cc> mtd: spi-nor: sst: remove global protection flag Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Maoyi Xie <maoyixie.tju(a)gmail.com> net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao <leitao(a)debian.org> 9p: skip nlink update in cacheless mode to fix WARN_ON Vasiliy Kovalev <kovalev(a)altlinux.org> net/9p: fix infinite loop in p9_client_rpc on fatal signal Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Ondrej Mosnacek <omosnace(a)redhat.com> lsm: use default hook return value in call_int_hook() Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Junrui Luo <moonafterrain(a)outlook.com> jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Harshad Shirwadkar <harshadshirwadkar(a)gmail.com> jbd2: add a helper to find out number of fast commit blocks Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Wentao Liang <vulab(a)iscas.ac.cn> mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata <petrm(a)nvidia.com> mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Ido Schimmel <idosch(a)nvidia.com> mlxsw: spectrum: Apply RIF configuration when joining a LAG David Howells <dhowells(a)redhat.com> rxrpc: Fix socket notification race David Howells <dhowells(a)redhat.com> rxrpc: Fix notification vs call-release vs recvmsg David Howells <dhowells(a)redhat.com> rxrpc: Fix recv-recv race of completed call Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Akhil R <akhilrajeev(a)nvidia.com> i2c: smbus: Use device_*() functions instead of of_*() Akhil R <akhilrajeev(a)nvidia.com> device property: Add fwnode_irq_get_byname Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Xiang Mei <xmei5(a)asu.edu> net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Jiasheng Jiang <jiashengjiangcool(a)gmail.com> media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization Fullway Wang <fullwaywang(a)outlook.com> media: mtk-vcodec: potential null pointer deference in SCP ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 41 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 4 +- arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/vmx/vmx.c | 9 +- arch/x86/kvm/x86.c | 19 +- crypto/ccm.c | 2 +- drivers/base/property.c | 29 ++ drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 8 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 77 ++-- drivers/dma/dw-edma/dw-edma-core.h | 20 +- drivers/dma/dw-edma/dw-edma-pcie.c | 180 ++++++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 76 ++-- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-tegra.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 + drivers/gpu/drm/virtio/virtgpu_plane.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/i2c/i2c-core-base.c | 2 +- drivers/i2c/i2c-core-smbus.c | 15 +- drivers/i2c/i2c-smbus.c | 5 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 7 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 6 + drivers/input/touchscreen/sur40.c | 23 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 7 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/Makefile | 2 +- drivers/mtd/spi-nor/core.c | 406 +---------------- drivers/mtd/spi-nor/core.h | 5 + drivers/mtd/spi-nor/intel.c | 16 +- drivers/mtd/spi-nor/sst.c | 30 +- drivers/mtd/spi-nor/swp.c | 426 +++++++++++++++++ drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 13 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 109 ++++- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 31 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 139 ++++-- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 4 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pci/pci.c | 30 ++ drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 5 +- drivers/scsi/sd_zbc.c | 79 +++- drivers/target/target_core_fabric_lib.c | 146 ++++-- drivers/target/target_core_internal.h | 5 +- drivers/target/target_core_pr.c | 54 +-- drivers/thunderbolt/domain.c | 30 ++ drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 71 ++- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/serial/keyspan_pda.c | 471 ++++++++++--------- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 24 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 33 +- fs/ceph/inode.c | 20 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 8 +- fs/ceph/xattr.c | 8 +- fs/cifs/smb2ops.c | 4 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/jbd2/journal.c | 10 +- fs/namei.c | 42 ++ fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 2 - include/linux/firmware.h | 3 + include/linux/fs.h | 28 ++ include/linux/i2c-smbus.h | 6 +- include/linux/jbd2.h | 9 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pci.h | 1 + include/linux/property.h | 1 + include/linux/skbuff.h | 2 + include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 9 +- include/net/act_api.h | 20 + include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/trace/events/rxrpc.h | 2 + include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/memory_hotplug.c | 15 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/9p/client.c | 2 + net/bluetooth/hidp/core.c | 25 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/osdmap.c | 9 +- net/core/pktgen.c | 43 +- net/core/skbuff.c | 28 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ipip.c | 41 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/mptcp/options.c | 21 +- net/mptcp/protocol.c | 4 +- net/mptcp/protocol.h | 14 + net/mptcp/subflow.c | 12 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_set_pipapo.c | 252 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 28 +- net/rxrpc/call_object.c | 27 +- net/rxrpc/recvmsg.c | 23 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/sch_api.c | 24 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 506 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- sound/usb/usx2y/usX2Yhwdep.c | 10 +- sound/usb/usx2y/usbus428ctldefs.h | 2 + sound/usb/usx2y/usbusx2y.c | 2 +- sound/usb/usx2y/usx2yhwdeppcm.c | 15 +- virt/kvm/kvm_main.c | 3 + 276 files changed, 4340 insertions(+), 2447 deletions(-)

1 month, 3 weeks

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage August 2026