This is the start of the stable review cycle for the 6.1.151 release.
There are 101 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 10 Sep 2025 15:18:27 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.151-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.151-rc2
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo()
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE()
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo()
Aaron Kling <webgeek1234(a)gmail.com>
spi: tegra114: Use value to check for invalid delays
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
yangshiguang <yangshiguang(a)xiaomi.com>
mm: slub: avoid wake up kswapd in set_track_prepare
Chengming Zhou <zhouchengming(a)bytedance.com>
slub: Reflow ___slab_alloc()
Vlastimil Babka <vbabka(a)suse.cz>
mm, slub: refactor free debug processing
zhang jiao <zhangjiao2(a)cmss.chinamobile.com>
tools: gpio: remove the include directory on make clean
zhangjiao <zhangjiao2(a)cmss.chinamobile.com>
tools: gpio: rm .*.cmd on make clean
Colin Ian King <colin.i.king(a)gmail.com>
drm/amd/amdgpu: Fix missing error return on kzalloc failure
Hawking Zhang <Hawking.Zhang(a)amd.com>
drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Make flashing messages quieter
Lijo Lazar <lijo.lazar(a)amd.com>
drm/amdgpu: Skip TMR allocation if not required
Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com>
drm/amd/amdgpu: Fix style problems in amdgpu_psp.c
Tao Zhou <tao.zhou1(a)amd.com>
drm/amdgpu: remove the check of init status in psp_ras_initialize
Candice Li <candice.li(a)amd.com>
drm/amdgpu: Optimize RAS TA initialization and TA unload funcs
Michael Walle <mwalle(a)kernel.org>
drm/bridge: ti-sn65dsi86: fix REFCLK setting
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Set correct chip-select polarity bit
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Fix transmissions when using CONT
Vadim Pasternak <vadimp(a)nvidia.com>
hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
Wentao Liang <vulab(a)iscas.ac.cn>
pcmcia: Add error handling for add_interval() in do_validate_mem()
Chen Ni <nichen(a)iscas.ac.cn>
pcmcia: omap: Add missing check for platform_get_resource
Alex Deucher <alexander.deucher(a)amd.com>
Revert "drm/amdgpu: Avoid extra evict-restore process."
Aaron Erhardt <aer(a)tuxedocomputers.com>
ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: Check link_res->hpo_dp_link_enc before using it
Amir Goldstein <amir73il(a)gmail.com>
fs: relax assertions on failure to encode file handles
Stefan Binding <sbinding(a)opensource.cirrus.com>
ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
cpufreq: intel_pstate: Revise global turbo disable check
Aaron Kling <webgeek1234(a)gmail.com>
spi: tegra114: Don't fail set_cs_timing when delays are zero
Alexander Danilenko <al.b.danilenko(a)gmail.com>
spi: tegra114: Remove unnecessary NULL-pointer checks
Ronak Doshi <ronak.doshi(a)broadcom.com>
vmxnet3: update MTU after device quiesce
Jakob Unterwurzacher <jakobunt(a)gmail.com>
net: dsa: microchip: linearize skb for tail-tagging switches
Pieter Van Trappen <pieter.van.trappen(a)cern.ch>
net: dsa: microchip: update tag_ksz masks for KSZ9477 family
Chris Chiu <chris.chiu(a)canonical.com>
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
Luca Ceresoli <luca.ceresoli(a)bootlin.com>
iio: light: opt3001: fix deadlock due to concurrent flag access
David Lechner <dlechner(a)baylibre.com>
iio: chemical: pms7003: use aligned_s64 for timestamp
Josef Bacik <josef(a)toxicpanda.com>
btrfs: adjust subpage bit start based on sectorsize
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq/sched: Explicitly synchronize limits_changed flag handling
Jonathan Currier <dullfire(a)yahoo.com>
PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
Li Qiong <liqiong(a)nfschina.com>
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com>
net: pcs: rzn1-miic: Correct MODCTRL register offset
Vitaly Lifshits <vitaly.lifshits(a)intel.com>
e1000e: fix heap overflow in e1000_set_eeprom
Makar Semyonov <m.semenov(a)tssltd.ru>
cifs: prevent NULL pointer dereference in UTF16 conversion
Stanislav Fort <stanislav.fort(a)aisle.com>
batman-adv: fix OOB read/write in network-coding decode
John Evans <evans1210144(a)gmail.com>
scsi: lpfc: Fix buffer free/clear order in deferred receive path
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: drop hw access in non-DC audio fini
Qianfeng Rong <rongqianfeng(a)vivo.com>
wifi: mwifiex: Initialize the chan_stats array to zero
wangzijie <wangzijie1(a)honor.com>
proc: fix missing pde_set_flags() for net proc files
Edward Adam Davis <eadavis(a)qq.com>
ocfs2: prevent release journal inode after journal shutdown
Harry Yoo <harry.yoo(a)oracle.com>
mm: move page table sync declarations to linux/pgtable.h
Harry Yoo <harry.yoo(a)oracle.com>
x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
Ma Ke <make24(a)iscas.ac.cn>
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
Miaoqian Lin <linmq006(a)gmail.com>
ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
Cryolitia PukNgae <cryolitia(a)uniontech.com>
ALSA: usb-audio: Add mute TLV for playback volumes on some devices
Horatiu Vultur <horatiu.vultur(a)microchip.com>
phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
Kuniyuki Iwashima <kuniyu(a)google.com>
selftest: net: Fix weird setsockopt() in bind_bhash.c.
Qingfang Deng <dqfext(a)gmail.com>
ppp: fix memory leak in pad_compress_skb
Wang Liang <wangliang74(a)huawei.com>
net: atm: fix memory leak in atm_register_sysfs when device_register fail
Eric Dumazet <edumazet(a)google.com>
ax25: properly unshare skbs in ax25_kiss_rcv()
Alok Tiwari <alok.a.tiwari(a)oracle.com>
mctp: return -ENOPROTOOPT for unknown getsockopt options
Mahanta Jambigi <mjambigi(a)linux.ibm.com>
net/smc: Remove validation of reserved bits in CLC Decline message
Dan Carpenter <dan.carpenter(a)linaro.org>
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: decrement cleanup index before use
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: add a missing of_node_put
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: libertas: cap SSID len in lbs_associate()
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: cw1200: cap SSID length in cw1200_do_join()
Felix Fietkau <nbd(a)nbd.name>
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
Zhen Ni <zhen.ni(a)easystack.cn>
i40e: Fix potential invalid access when MAC list is empty
Liu Jian <liujian56(a)huawei.com>
net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
Sean Anderson <sean.anderson(a)linux.dev>
net: macb: Fix tx_ptr_lock locking
Fabian Bläse <fabian(a)blaese.de>
icmp: fix icmp_ndo_send address translation for reply direction
Miaoqian Lin <linmq006(a)gmail.com>
mISDN: Fix memory leak in dsp_hwec_enable()
Alok Tiwari <alok.a.tiwari(a)oracle.com>
xirc2ps_cs: fix register access when enabling FullDuplex
Kuniyuki Iwashima <kuniyu(a)google.com>
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
Phil Sutter <phil(a)nwl.cc>
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
Wang Liang <wangliang74(a)huawei.com>
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: cfg80211: fix use-after-free in cmp_bss()
Marek Vasut <marek.vasut(a)mailbox.org>
arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
Sungbae Yoo <sungbaey(a)nvidia.com>
tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
Peter Robinson <pbrobinson(a)gmail.com>
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
Pei Xiao <xiaopei01(a)kylinos.cn>
tee: fix NULL pointer dereference in tee_shm_put
Jiufei Xue <jiufei.xue(a)samsung.com>
fs: writeback: fix use-after-free in __mark_inode_dirty()
Yang Li <yang.li(a)amlogic.com>
Bluetooth: hci_sync: Avoid adding default advertising on startup
Timur Kristóf <timur.kristof(a)gmail.com>
drm/amd/display: Don't warn when missing DCE encoder caps
Lubomir Rintel <lkundrak(a)v3.sk>
cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
Filipe Manana <fdmanana(a)suse.com>
btrfs: avoid load/store tearing races when checking if an inode was logged
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix race between setting last_dir_index_offset and inode logging
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix race between logging inode and checking if it was logged before
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix oob access in cgroup local storage
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Move bpf map owner out of common struct
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Move cgroup iterator helpers to bpf.h
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Add cookie object to bpf maps
-------------
Diffstat:
Makefile | 4 +-
.../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 +
.../boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 +
arch/x86/include/asm/pgtable_64_types.h | 3 +
arch/x86/mm/init_64.c | 18 ++
drivers/acpi/arm64/iort.c | 4 +-
drivers/cpufreq/intel_pstate.c | 126 ++++-------
drivers/dma/mediatek/mtk-cqdma.c | 10 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 235 +++++++++++----------
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +-
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 5 -
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 5 -
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 5 -
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 5 -
.../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 8 +-
.../gpu/drm/amd/display/dc/link/link_hwss_hpo_dp.c | 7 +
drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +
drivers/hwmon/mlxreg-fan.c | 5 +-
drivers/i2c/busses/i2c-designware-pcidrv.c | 4 +-
drivers/iio/chemical/pms7003.c | 5 +-
drivers/iio/light/opt3001.c | 5 +-
drivers/isdn/mISDN/dsp_hwec.c | 6 +-
drivers/net/ethernet/cadence/macb_main.c | 28 +--
drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 20 +-
drivers/net/ethernet/intel/e1000e/ethtool.c | 10 +-
drivers/net/ethernet/intel/i40e/i40e_client.c | 4 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 +-
drivers/net/ethernet/xircom/xirc2ps_cs.c | 2 +-
drivers/net/pcs/pcs-rzn1-miic.c | 2 +-
drivers/net/phy/mscc/mscc_ptp.c | 18 +-
drivers/net/ppp/ppp_generic.c | 6 +-
drivers/net/usb/cdc_ncm.c | 7 +
drivers/net/vmxnet3/vmxnet3_drv.c | 5 +-
drivers/net/wireless/marvell/libertas/cfg.c | 9 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 5 +-
drivers/net/wireless/marvell/mwifiex/main.c | 4 +-
drivers/net/wireless/st/cw1200/sta.c | 2 +-
drivers/pci/msi/msi.c | 3 +
drivers/pcmcia/omap_cf.c | 2 +
drivers/pcmcia/rsrc_iodyn.c | 3 +
drivers/pcmcia/rsrc_nonstatic.c | 4 +-
drivers/scsi/lpfc/lpfc_nvmet.c | 10 +-
drivers/spi/spi-fsl-lpspi.c | 15 +-
drivers/spi/spi-tegra114.c | 18 +-
drivers/tee/optee/ffa_abi.c | 4 +-
drivers/tee/tee_shm.c | 6 +-
fs/btrfs/btrfs_inode.h | 2 +-
fs/btrfs/extent_io.c | 2 +-
fs/btrfs/inode.c | 1 +
fs/btrfs/tree-log.c | 78 ++++---
fs/fs-writeback.c | 9 +-
fs/notify/fdinfo.c | 4 +-
fs/ocfs2/inode.c | 3 +
fs/overlayfs/copy_up.c | 5 +-
fs/proc/generic.c | 38 ++--
fs/smb/client/cifs_unicode.c | 3 +
include/linux/bpf-cgroup.h | 5 -
include/linux/bpf.h | 60 ++++--
include/linux/pci.h | 2 +
include/linux/pgtable.h | 16 ++
include/linux/vmalloc.h | 16 --
kernel/bpf/core.c | 50 +++--
kernel/bpf/syscall.c | 19 +-
kernel/sched/cpufreq_schedutil.c | 28 ++-
mm/slub.c | 216 ++++++++++---------
net/atm/resources.c | 6 +-
net/ax25/ax25_in.c | 4 +
net/batman-adv/network-coding.c | 7 +-
net/bluetooth/hci_sync.c | 2 +-
net/bluetooth/l2cap_sock.c | 3 +
net/bridge/br_netfilter_hooks.c | 3 -
net/dsa/tag_ksz.c | 22 +-
net/ipv4/devinet.c | 7 +-
net/ipv4/icmp.c | 6 +-
net/ipv6/ip6_icmp.c | 6 +-
net/mctp/af_mctp.c | 2 +-
net/netfilter/nf_conntrack_helper.c | 4 +-
net/smc/smc_clc.c | 2 -
net/smc/smc_ib.c | 3 +
net/wireless/scan.c | 3 +-
net/wireless/sme.c | 5 +-
sound/pci/hda/patch_hdmi.c | 1 +
sound/pci/hda/patch_realtek.c | 5 +
sound/usb/mixer_quirks.c | 2 +
tools/gpio/Makefile | 4 +-
tools/testing/selftests/net/bind_bhash.c | 4 +-
86 files changed, 774 insertions(+), 560 deletions(-)
This is the start of the stable review cycle for the 5.4.299 release.
There are 45 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 09 Sep 2025 19:55:53 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.299-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.299-rc1
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
Roman Smirnov <r.smirnov(a)omp.ru>
cifs: fix integer overflow in match_server()
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Set correct chip-select polarity bit
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Fix transmissions when using CONT
Wentao Liang <vulab(a)iscas.ac.cn>
pcmcia: Add error handling for add_interval() in do_validate_mem()
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
Kees Cook <kees(a)kernel.org>
randstruct: gcc-plugin: Fix attribute addition
Kees Cook <kees(a)kernel.org>
randstruct: gcc-plugin: Remove bogus void member
Ronak Doshi <ronak.doshi(a)broadcom.com>
vmxnet3: update MTU after device quiesce
Jakob Unterwurzacher <jakobunt(a)gmail.com>
net: dsa: microchip: linearize skb for tail-tagging switches
Pieter Van Trappen <pieter.van.trappen(a)cern.ch>
net: dsa: microchip: update tag_ksz masks for KSZ9477 family
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
Chris Chiu <chris.chiu(a)canonical.com>
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com>
gpio: pca953x: fix IRQ storm on system wake up
Luca Ceresoli <luca.ceresoli(a)bootlin.com>
iio: light: opt3001: fix deadlock due to concurrent flag access
David Lechner <dlechner(a)baylibre.com>
iio: chemical: pms7003: use aligned_s64 for timestamp
Sean Christopherson <seanjc(a)google.com>
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq/sched: Explicitly synchronize limits_changed flag handling
Li Qiong <liqiong(a)nfschina.com>
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
John Evans <evans1210144(a)gmail.com>
scsi: lpfc: Fix buffer free/clear order in deferred receive path
Jann Horn <jannh(a)google.com>
mm/khugepaged: fix ->anon_vma race
Vitaly Lifshits <vitaly.lifshits(a)intel.com>
e1000e: fix heap overflow in e1000_set_eeprom
Stanislav Fort <stanislav.fort(a)aisle.com>
batman-adv: fix OOB read/write in network-coding decode
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: drop hw access in non-DC audio fini
Qianfeng Rong <rongqianfeng(a)vivo.com>
wifi: mwifiex: Initialize the chan_stats array to zero
Ma Ke <make24(a)iscas.ac.cn>
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
Cryolitia PukNgae <cryolitia(a)uniontech.com>
ALSA: usb-audio: Add mute TLV for playback volumes on some devices
Qingfang Deng <dqfext(a)gmail.com>
ppp: fix memory leak in pad_compress_skb
Wang Liang <wangliang74(a)huawei.com>
net: atm: fix memory leak in atm_register_sysfs when device_register fail
Eric Dumazet <edumazet(a)google.com>
ax25: properly unshare skbs in ax25_kiss_rcv()
Dan Carpenter <dan.carpenter(a)linaro.org>
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: decrement cleanup index before use
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: add a missing of_node_put
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: libertas: cap SSID len in lbs_associate()
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: cw1200: cap SSID length in cw1200_do_join()
Felix Fietkau <nbd(a)nbd.name>
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
Zhen Ni <zhen.ni(a)easystack.cn>
i40e: Fix potential invalid access when MAC list is empty
Fabian Bläse <fabian(a)blaese.de>
icmp: fix icmp_ndo_send address translation for reply direction
Miaoqian Lin <linmq006(a)gmail.com>
mISDN: Fix memory leak in dsp_hwec_enable()
Alok Tiwari <alok.a.tiwari(a)oracle.com>
xirc2ps_cs: fix register access when enabling FullDuplex
Kuniyuki Iwashima <kuniyu(a)google.com>
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
Phil Sutter <phil(a)nwl.cc>
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: cfg80211: fix use-after-free in cmp_bss()
Nathan Chancellor <nathan(a)kernel.org>
powerpc: boot: Remove leading zero in label in udelay()
-------------
Diffstat:
Makefile | 4 +--
arch/powerpc/boot/util.S | 4 +--
arch/x86/kvm/x86.c | 16 +++++++--
drivers/dma/mediatek/mtk-cqdma.c | 10 +++---
drivers/gpio/gpio-pca953x.c | 5 +++
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 5 ---
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 5 ---
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 5 ---
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 5 ---
drivers/iio/chemical/pms7003.c | 5 +--
drivers/iio/light/opt3001.c | 5 +--
drivers/isdn/mISDN/dsp_hwec.c | 6 ++--
drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 20 +++++++-----
drivers/net/ethernet/intel/e1000e/ethtool.c | 10 ++++--
drivers/net/ethernet/intel/i40e/i40e_client.c | 4 +--
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 +++++-
drivers/net/ethernet/xircom/xirc2ps_cs.c | 2 +-
drivers/net/ppp/ppp_generic.c | 6 ++--
drivers/net/vmxnet3/vmxnet3_drv.c | 5 +--
drivers/net/wireless/marvell/libertas/cfg.c | 9 +++--
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 5 +--
drivers/net/wireless/marvell/mwifiex/main.c | 4 +--
drivers/net/wireless/st/cw1200/sta.c | 2 +-
drivers/pcmcia/rsrc_iodyn.c | 3 ++
drivers/pcmcia/rsrc_nonstatic.c | 4 ++-
drivers/scsi/lpfc/lpfc_nvmet.c | 10 +++---
drivers/spi/spi-fsl-lpspi.c | 15 +++++----
fs/cifs/connect.c | 5 +++
kernel/sched/cpufreq_schedutil.c | 28 +++++++++++++---
mm/khugepaged.c | 14 +++++++-
mm/slub.c | 7 +++-
net/atm/resources.c | 6 ++--
net/ax25/ax25_in.c | 4 +++
net/batman-adv/network-coding.c | 7 +++-
net/bluetooth/l2cap_sock.c | 3 ++
net/dsa/tag_ksz.c | 22 ++++++++++---
net/ipv4/devinet.c | 7 ++--
net/ipv4/icmp.c | 6 ++--
net/ipv6/ip6_icmp.c | 6 ++--
net/netfilter/nf_conntrack_helper.c | 4 +--
net/wireless/scan.c | 3 +-
scripts/gcc-plugins/gcc-common.h | 32 ++++++++++++++++++
scripts/gcc-plugins/randomize_layout_plugin.c | 40 +++++++----------------
sound/pci/hda/patch_hdmi.c | 1 +
sound/pci/hda/patch_realtek.c | 1 +
sound/usb/mixer_quirks.c | 2 ++
46 files changed, 250 insertions(+), 132 deletions(-)
This is the start of the stable review cycle for the 5.10.243 release.
There are 52 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 09 Sep 2025 19:55:53 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.243-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.243-rc1
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
Roman Smirnov <r.smirnov(a)omp.ru>
cifs: fix integer overflow in match_server()
Taniya Das <quic_tdas(a)quicinc.com>
clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Set correct chip-select polarity bit
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Fix transmissions when using CONT
Wentao Liang <vulab(a)iscas.ac.cn>
pcmcia: Add error handling for add_interval() in do_validate_mem()
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
Fiona Klute <fiona.klute(a)gmx.de>
net: phy: microchip: force IRQ polling mode for lan88xx
Ioana Ciornei <ioana.ciornei(a)nxp.com>
net: phy: microchip: remove the use of .ack_interrupt()
Ioana Ciornei <ioana.ciornei(a)nxp.com>
net: phy: microchip: implement generic .handle_interrupt() callback
Kees Cook <kees(a)kernel.org>
randstruct: gcc-plugin: Fix attribute addition
Kees Cook <kees(a)kernel.org>
randstruct: gcc-plugin: Remove bogus void member
Gabor Juhos <j4g8y7(a)gmail.com>
arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
Ronak Doshi <ronak.doshi(a)broadcom.com>
vmxnet3: update MTU after device quiesce
Jakob Unterwurzacher <jakobunt(a)gmail.com>
net: dsa: microchip: linearize skb for tail-tagging switches
Pieter Van Trappen <pieter.van.trappen(a)cern.ch>
net: dsa: microchip: update tag_ksz masks for KSZ9477 family
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
Chris Chiu <chris.chiu(a)canonical.com>
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com>
gpio: pca953x: fix IRQ storm on system wake up
Luca Ceresoli <luca.ceresoli(a)bootlin.com>
iio: light: opt3001: fix deadlock due to concurrent flag access
David Lechner <dlechner(a)baylibre.com>
iio: chemical: pms7003: use aligned_s64 for timestamp
Sean Christopherson <seanjc(a)google.com>
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq/sched: Explicitly synchronize limits_changed flag handling
Li Qiong <liqiong(a)nfschina.com>
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
Jann Horn <jannh(a)google.com>
mm/khugepaged: fix ->anon_vma race
Vitaly Lifshits <vitaly.lifshits(a)intel.com>
e1000e: fix heap overflow in e1000_set_eeprom
Stanislav Fort <stanislav.fort(a)aisle.com>
batman-adv: fix OOB read/write in network-coding decode
John Evans <evans1210144(a)gmail.com>
scsi: lpfc: Fix buffer free/clear order in deferred receive path
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: drop hw access in non-DC audio fini
Qianfeng Rong <rongqianfeng(a)vivo.com>
wifi: mwifiex: Initialize the chan_stats array to zero
Ma Ke <make24(a)iscas.ac.cn>
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
Cryolitia PukNgae <cryolitia(a)uniontech.com>
ALSA: usb-audio: Add mute TLV for playback volumes on some devices
Qingfang Deng <dqfext(a)gmail.com>
ppp: fix memory leak in pad_compress_skb
Wang Liang <wangliang74(a)huawei.com>
net: atm: fix memory leak in atm_register_sysfs when device_register fail
Eric Dumazet <edumazet(a)google.com>
ax25: properly unshare skbs in ax25_kiss_rcv()
Dan Carpenter <dan.carpenter(a)linaro.org>
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: decrement cleanup index before use
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: add a missing of_node_put
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: libertas: cap SSID len in lbs_associate()
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: cw1200: cap SSID length in cw1200_do_join()
Felix Fietkau <nbd(a)nbd.name>
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
Zhen Ni <zhen.ni(a)easystack.cn>
i40e: Fix potential invalid access when MAC list is empty
Fabian Bläse <fabian(a)blaese.de>
icmp: fix icmp_ndo_send address translation for reply direction
Miaoqian Lin <linmq006(a)gmail.com>
mISDN: Fix memory leak in dsp_hwec_enable()
Alok Tiwari <alok.a.tiwari(a)oracle.com>
xirc2ps_cs: fix register access when enabling FullDuplex
Kuniyuki Iwashima <kuniyu(a)google.com>
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
Phil Sutter <phil(a)nwl.cc>
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: cfg80211: fix use-after-free in cmp_bss()
Peter Robinson <pbrobinson(a)gmail.com>
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
Pei Xiao <xiaopei01(a)kylinos.cn>
tee: fix NULL pointer dereference in tee_shm_put
Timur Kristóf <timur.kristof(a)gmail.com>
drm/amd/display: Don't warn when missing DCE encoder caps
-------------
Diffstat:
Makefile | 4 +--
arch/arm64/boot/dts/marvell/armada-3720-uDPU.dts | 9 +++--
.../boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 +
arch/x86/kvm/x86.c | 18 ++++++++--
drivers/clk/qcom/gdsc.c | 21 ++++++------
drivers/dma/mediatek/mtk-cqdma.c | 10 +++---
drivers/gpio/gpio-pca953x.c | 5 +++
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 5 ---
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 5 ---
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 5 ---
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 5 ---
.../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 8 ++---
drivers/iio/chemical/pms7003.c | 5 +--
drivers/iio/light/opt3001.c | 5 +--
drivers/isdn/mISDN/dsp_hwec.c | 6 ++--
drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 20 ++++++-----
drivers/net/ethernet/intel/e1000e/ethtool.c | 10 ++++--
drivers/net/ethernet/intel/i40e/i40e_client.c | 4 +--
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 +++++-
drivers/net/ethernet/xircom/xirc2ps_cs.c | 2 +-
drivers/net/phy/microchip.c | 30 ++--------------
drivers/net/phy/microchip_t1.c | 28 +++++++++++----
drivers/net/ppp/ppp_generic.c | 6 ++--
drivers/net/vmxnet3/vmxnet3_drv.c | 5 +--
drivers/net/wireless/marvell/libertas/cfg.c | 9 +++--
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 5 +--
drivers/net/wireless/marvell/mwifiex/main.c | 4 +--
drivers/net/wireless/st/cw1200/sta.c | 2 +-
drivers/pcmcia/rsrc_iodyn.c | 3 ++
drivers/pcmcia/rsrc_nonstatic.c | 4 ++-
drivers/scsi/lpfc/lpfc_nvmet.c | 10 +++---
drivers/spi/spi-fsl-lpspi.c | 15 ++++----
drivers/tee/tee_shm.c | 6 +++-
fs/cifs/connect.c | 5 +++
kernel/sched/cpufreq_schedutil.c | 28 ++++++++++++---
mm/khugepaged.c | 15 +++++++-
mm/slub.c | 7 +++-
net/atm/resources.c | 6 ++--
net/ax25/ax25_in.c | 4 +++
net/batman-adv/network-coding.c | 7 +++-
net/bluetooth/l2cap_sock.c | 3 ++
net/dsa/tag_ksz.c | 22 +++++++++---
net/ipv4/devinet.c | 7 ++--
net/ipv4/icmp.c | 6 ++--
net/ipv6/ip6_icmp.c | 6 ++--
net/netfilter/nf_conntrack_helper.c | 4 +--
net/wireless/scan.c | 3 +-
scripts/gcc-plugins/gcc-common.h | 32 +++++++++++++++++
scripts/gcc-plugins/randomize_layout_plugin.c | 40 +++++++---------------
sound/pci/hda/patch_hdmi.c | 1 +
sound/pci/hda/patch_realtek.c | 1 +
sound/usb/mixer_quirks.c | 2 ++
52 files changed, 302 insertions(+), 182 deletions(-)
Total jobs: 95
Total errors: 33 (34.74%)
LAVA errors: 0 (0.00%)
Test errors: 32 (33.68%)
Job errors: 0 (0.00%)
Infra errors: 1 (1.05%)
Canceled jobs: 0 (0.00%)
Device type: qrb5165-rb5
Total jobs: 19
Total errors: 6 (31.58%)
Error type: Test
Error count: 5 (26.32%)
Error: Device NOT found!
Count: 3 (15.79%)
IDs:
rb5-03:
8440761 8440776 8440778
Error: No match for error type 'Test', message 'Device NOT found after DUT booted up! adb wait-for-device timed out after 300s'
Count: 2 (10.53%)
IDs:
rb5-01:
8440734
rb5-03:
8440756
Error type: Infrastructure
Error count: 1 (5.26%)
Error: Connection closed
Count: 1 (5.26%)
IDs:
rb5-01:
8440743
Device type: sm8550-hdk
Total jobs: 30
Total errors: 17 (56.67%)
Error type: Test
Error count: 17 (56.67%)
Error: No match for error type 'Test', message 'tradefed - adb device lost[124d1c34]'
Count: 12 (40.00%)
IDs:
sm8550-hdk-01:
8439113 8439116 8439144 8439149 8439157
8439164 8439165 8439167 8439724 8439729
8439754 8439759
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 598 seconds'
Count: 3 (10.00%)
IDs:
sm8550-hdk-01:
8439111 8439147 8439150
Error: No match for error type 'Test', message 'Device NOT found after DUT booted up! adb wait-for-device timed out after 300s'
Count: 2 (6.67%)
IDs:
sm8550-hdk-01:
8439114 8439121
Device type: dragonboard-845c
Total jobs: 43
Total errors: 10 (23.26%)
Error type: Test
Error count: 10 (23.26%)
Error: No match for error type 'Test', message 'Device NOT found after DUT booted up! adb wait-for-device timed out after 300s'
Count: 7 (16.28%)
IDs:
db845c-03:
8434708 8434709
db845c-04:
8434703 8434705 8434753 8434789 8434790
Error: No match for error type 'Test', message 'tradefed - adb device lost[f3a58ae3]'
Count: 2 (4.65%)
IDs:
db845c-04:
8434682 8434788
Error: No match for error type 'Test', message 'tradefed - adb device lost[d966d3f5]'
Count: 1 (2.33%)
IDs:
db845c-03:
8434781
Device type: hi960-hikey
Total jobs: 3
Total errors: 0 (0.00%)
This is the start of the stable review cycle for the 6.1.151 release.
There are 104 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 09 Sep 2025 19:55:53 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.151-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.151-rc1
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo()
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE()
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo()
Aaron Kling <webgeek1234(a)gmail.com>
spi: tegra114: Use value to check for invalid delays
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
yangshiguang <yangshiguang(a)xiaomi.com>
mm: slub: avoid wake up kswapd in set_track_prepare
Chengming Zhou <zhouchengming(a)bytedance.com>
slub: Reflow ___slab_alloc()
Vlastimil Babka <vbabka(a)suse.cz>
mm, slub: refactor free debug processing
zhang jiao <zhangjiao2(a)cmss.chinamobile.com>
tools: gpio: remove the include directory on make clean
zhangjiao <zhangjiao2(a)cmss.chinamobile.com>
tools: gpio: rm .*.cmd on make clean
Colin Ian King <colin.i.king(a)gmail.com>
drm/amd/amdgpu: Fix missing error return on kzalloc failure
Hawking Zhang <Hawking.Zhang(a)amd.com>
drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
Mario Limonciello <mario.limonciello(a)amd.com>
drm/amd: Make flashing messages quieter
Lijo Lazar <lijo.lazar(a)amd.com>
drm/amdgpu: Skip TMR allocation if not required
Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com>
drm/amd/amdgpu: Fix style problems in amdgpu_psp.c
Tao Zhou <tao.zhou1(a)amd.com>
drm/amdgpu: remove the check of init status in psp_ras_initialize
Candice Li <candice.li(a)amd.com>
drm/amdgpu: Optimize RAS TA initialization and TA unload funcs
Ian Rogers <irogers(a)google.com>
perf bpf-utils: Harden get_bpf_prog_info_linear
Ian Rogers <irogers(a)google.com>
perf bpf-utils: Constify bpil_array_desc
Michael Walle <mwalle(a)kernel.org>
drm/bridge: ti-sn65dsi86: fix REFCLK setting
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Set correct chip-select polarity bit
Larisa Grigore <larisa.grigore(a)nxp.com>
spi: spi-fsl-lpspi: Fix transmissions when using CONT
Vadim Pasternak <vadimp(a)nvidia.com>
hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
Wentao Liang <vulab(a)iscas.ac.cn>
pcmcia: Add error handling for add_interval() in do_validate_mem()
Chen Ni <nichen(a)iscas.ac.cn>
pcmcia: omap: Add missing check for platform_get_resource
Alex Deucher <alexander.deucher(a)amd.com>
Revert "drm/amdgpu: Avoid extra evict-restore process."
Aaron Erhardt <aer(a)tuxedocomputers.com>
ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
Alex Hung <alex.hung(a)amd.com>
drm/amd/display: Check link_res->hpo_dp_link_enc before using it
Amir Goldstein <amir73il(a)gmail.com>
fs: relax assertions on failure to encode file handles
Stefan Binding <sbinding(a)opensource.cirrus.com>
ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller
Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com>
cpufreq: intel_pstate: Revise global turbo disable check
Aaron Kling <webgeek1234(a)gmail.com>
spi: tegra114: Don't fail set_cs_timing when delays are zero
Alexander Danilenko <al.b.danilenko(a)gmail.com>
spi: tegra114: Remove unnecessary NULL-pointer checks
Ronak Doshi <ronak.doshi(a)broadcom.com>
vmxnet3: update MTU after device quiesce
Jakob Unterwurzacher <jakobunt(a)gmail.com>
net: dsa: microchip: linearize skb for tail-tagging switches
Pieter Van Trappen <pieter.van.trappen(a)cern.ch>
net: dsa: microchip: update tag_ksz masks for KSZ9477 family
Chris Chiu <chris.chiu(a)canonical.com>
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
Qiu-ji Chen <chenqiuji666(a)gmail.com>
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
Luca Ceresoli <luca.ceresoli(a)bootlin.com>
iio: light: opt3001: fix deadlock due to concurrent flag access
David Lechner <dlechner(a)baylibre.com>
iio: chemical: pms7003: use aligned_s64 for timestamp
Josef Bacik <josef(a)toxicpanda.com>
btrfs: adjust subpage bit start based on sectorsize
Shakeel Butt <shakeel.butt(a)linux.dev>
memcg: drain obj stock on cpu hotplug teardown
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
cpufreq/sched: Explicitly synchronize limits_changed flag handling
Jonathan Currier <dullfire(a)yahoo.com>
PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
Li Qiong <liqiong(a)nfschina.com>
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com>
net: pcs: rzn1-miic: Correct MODCTRL register offset
Vitaly Lifshits <vitaly.lifshits(a)intel.com>
e1000e: fix heap overflow in e1000_set_eeprom
Makar Semyonov <m.semenov(a)tssltd.ru>
cifs: prevent NULL pointer dereference in UTF16 conversion
Stanislav Fort <stanislav.fort(a)aisle.com>
batman-adv: fix OOB read/write in network-coding decode
John Evans <evans1210144(a)gmail.com>
scsi: lpfc: Fix buffer free/clear order in deferred receive path
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: drop hw access in non-DC audio fini
Qianfeng Rong <rongqianfeng(a)vivo.com>
wifi: mwifiex: Initialize the chan_stats array to zero
wangzijie <wangzijie1(a)honor.com>
proc: fix missing pde_set_flags() for net proc files
Edward Adam Davis <eadavis(a)qq.com>
ocfs2: prevent release journal inode after journal shutdown
Harry Yoo <harry.yoo(a)oracle.com>
mm: move page table sync declarations to linux/pgtable.h
Harry Yoo <harry.yoo(a)oracle.com>
x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
Ma Ke <make24(a)iscas.ac.cn>
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
Miaoqian Lin <linmq006(a)gmail.com>
ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
Cryolitia PukNgae <cryolitia(a)uniontech.com>
ALSA: usb-audio: Add mute TLV for playback volumes on some devices
Horatiu Vultur <horatiu.vultur(a)microchip.com>
phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
Kuniyuki Iwashima <kuniyu(a)google.com>
selftest: net: Fix weird setsockopt() in bind_bhash.c.
Qingfang Deng <dqfext(a)gmail.com>
ppp: fix memory leak in pad_compress_skb
Wang Liang <wangliang74(a)huawei.com>
net: atm: fix memory leak in atm_register_sysfs when device_register fail
Eric Dumazet <edumazet(a)google.com>
ax25: properly unshare skbs in ax25_kiss_rcv()
Alok Tiwari <alok.a.tiwari(a)oracle.com>
mctp: return -ENOPROTOOPT for unknown getsockopt options
Mahanta Jambigi <mjambigi(a)linux.ibm.com>
net/smc: Remove validation of reserved bits in CLC Decline message
Dan Carpenter <dan.carpenter(a)linaro.org>
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: decrement cleanup index before use
Rosen Penev <rosenp(a)gmail.com>
net: thunder_bgx: add a missing of_node_put
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: libertas: cap SSID len in lbs_associate()
Dan Carpenter <dan.carpenter(a)linaro.org>
wifi: cw1200: cap SSID length in cw1200_do_join()
Felix Fietkau <nbd(a)nbd.name>
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
Zhen Ni <zhen.ni(a)easystack.cn>
i40e: Fix potential invalid access when MAC list is empty
Liu Jian <liujian56(a)huawei.com>
net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
Sean Anderson <sean.anderson(a)linux.dev>
net: macb: Fix tx_ptr_lock locking
Fabian Bläse <fabian(a)blaese.de>
icmp: fix icmp_ndo_send address translation for reply direction
Miaoqian Lin <linmq006(a)gmail.com>
mISDN: Fix memory leak in dsp_hwec_enable()
Alok Tiwari <alok.a.tiwari(a)oracle.com>
xirc2ps_cs: fix register access when enabling FullDuplex
Kuniyuki Iwashima <kuniyu(a)google.com>
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
Phil Sutter <phil(a)nwl.cc>
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
Wang Liang <wangliang74(a)huawei.com>
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
Dmitry Antipov <dmantipov(a)yandex.ru>
wifi: cfg80211: fix use-after-free in cmp_bss()
Marek Vasut <marek.vasut(a)mailbox.org>
arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
Sungbae Yoo <sungbaey(a)nvidia.com>
tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
Peter Robinson <pbrobinson(a)gmail.com>
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
Pei Xiao <xiaopei01(a)kylinos.cn>
tee: fix NULL pointer dereference in tee_shm_put
Jiufei Xue <jiufei.xue(a)samsung.com>
fs: writeback: fix use-after-free in __mark_inode_dirty()
Yang Li <yang.li(a)amlogic.com>
Bluetooth: hci_sync: Avoid adding default advertising on startup
Timur Kristóf <timur.kristof(a)gmail.com>
drm/amd/display: Don't warn when missing DCE encoder caps
Lubomir Rintel <lkundrak(a)v3.sk>
cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
Filipe Manana <fdmanana(a)suse.com>
btrfs: avoid load/store tearing races when checking if an inode was logged
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix race between setting last_dir_index_offset and inode logging
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix race between logging inode and checking if it was logged before
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix oob access in cgroup local storage
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Move bpf map owner out of common struct
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Move cgroup iterator helpers to bpf.h
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Add cookie object to bpf maps
-------------
Diffstat:
Makefile | 4 +-
.../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 +
.../boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 +
arch/x86/include/asm/pgtable_64_types.h | 3 +
arch/x86/mm/init_64.c | 18 ++
drivers/acpi/arm64/iort.c | 4 +-
drivers/cpufreq/intel_pstate.c | 126 ++++-------
drivers/dma/mediatek/mtk-cqdma.c | 10 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 235 +++++++++++----------
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +-
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 5 -
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 5 -
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 5 -
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 5 -
.../gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 8 +-
.../gpu/drm/amd/display/dc/link/link_hwss_hpo_dp.c | 7 +
drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +
drivers/hwmon/mlxreg-fan.c | 5 +-
drivers/i2c/busses/i2c-designware-pcidrv.c | 4 +-
drivers/iio/chemical/pms7003.c | 5 +-
drivers/iio/light/opt3001.c | 5 +-
drivers/isdn/mISDN/dsp_hwec.c | 6 +-
drivers/net/ethernet/cadence/macb_main.c | 28 +--
drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 20 +-
drivers/net/ethernet/intel/e1000e/ethtool.c | 10 +-
drivers/net/ethernet/intel/i40e/i40e_client.c | 4 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 +-
drivers/net/ethernet/xircom/xirc2ps_cs.c | 2 +-
drivers/net/pcs/pcs-rzn1-miic.c | 2 +-
drivers/net/phy/mscc/mscc_ptp.c | 18 +-
drivers/net/ppp/ppp_generic.c | 6 +-
drivers/net/usb/cdc_ncm.c | 7 +
drivers/net/vmxnet3/vmxnet3_drv.c | 5 +-
drivers/net/wireless/marvell/libertas/cfg.c | 9 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 5 +-
drivers/net/wireless/marvell/mwifiex/main.c | 4 +-
drivers/net/wireless/st/cw1200/sta.c | 2 +-
drivers/pci/msi/msi.c | 3 +
drivers/pcmcia/omap_cf.c | 2 +
drivers/pcmcia/rsrc_iodyn.c | 3 +
drivers/pcmcia/rsrc_nonstatic.c | 4 +-
drivers/scsi/lpfc/lpfc_nvmet.c | 10 +-
drivers/spi/spi-fsl-lpspi.c | 15 +-
drivers/spi/spi-tegra114.c | 18 +-
drivers/tee/optee/ffa_abi.c | 4 +-
drivers/tee/tee_shm.c | 6 +-
fs/btrfs/btrfs_inode.h | 2 +-
fs/btrfs/extent_io.c | 2 +-
fs/btrfs/inode.c | 1 +
fs/btrfs/tree-log.c | 78 ++++---
fs/fs-writeback.c | 9 +-
fs/notify/fdinfo.c | 4 +-
fs/ocfs2/inode.c | 3 +
fs/overlayfs/copy_up.c | 5 +-
fs/proc/generic.c | 38 ++--
fs/smb/client/cifs_unicode.c | 3 +
include/linux/bpf-cgroup.h | 5 -
include/linux/bpf.h | 60 ++++--
include/linux/pci.h | 2 +
include/linux/pgtable.h | 16 ++
include/linux/vmalloc.h | 16 --
kernel/bpf/core.c | 50 +++--
kernel/bpf/syscall.c | 19 +-
kernel/sched/cpufreq_schedutil.c | 28 ++-
mm/memcontrol.c | 9 +
mm/slub.c | 216 ++++++++++---------
net/atm/resources.c | 6 +-
net/ax25/ax25_in.c | 4 +
net/batman-adv/network-coding.c | 7 +-
net/bluetooth/hci_sync.c | 2 +-
net/bluetooth/l2cap_sock.c | 3 +
net/bridge/br_netfilter_hooks.c | 3 -
net/dsa/tag_ksz.c | 22 +-
net/ipv4/devinet.c | 7 +-
net/ipv4/icmp.c | 6 +-
net/ipv6/ip6_icmp.c | 6 +-
net/mctp/af_mctp.c | 2 +-
net/netfilter/nf_conntrack_helper.c | 4 +-
net/smc/smc_clc.c | 2 -
net/smc/smc_ib.c | 3 +
net/wireless/scan.c | 3 +-
net/wireless/sme.c | 5 +-
sound/pci/hda/patch_hdmi.c | 1 +
sound/pci/hda/patch_realtek.c | 5 +
sound/usb/mixer_quirks.c | 2 +
tools/gpio/Makefile | 4 +-
tools/perf/util/bpf-utils.c | 61 ++++--
tools/testing/selftests/net/bind_bhash.c | 4 +-
88 files changed, 822 insertions(+), 582 deletions(-)
After commit cbc654d18d37 ("bitops: Add __attribute_const__ to generic
ffs()-family implementations"), which allows GCC's value range tracker
to see past ffs(), GCC 8 on ARM thinks that it might be possible that
"ffs(rq) - 8" used here:
v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
could wrap below 0, leading to a very large value, which would be out of
range for the FIELD_PREP() usage:
drivers/pci/pci.c: In function 'pcie_set_readrq':
include/linux/compiler_types.h:572:38: error: call to '__compiletime_assert_471' declared with attribute error: FIELD_PREP: value too large for the field
...
drivers/pci/pci.c:5896:6: note: in expansion of macro 'FIELD_PREP'
v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
^~~~~~~~~~
If the result of the ffs() is bounds checked before being used in
FIELD_PREP(), the value tracker seems happy again. :)
Fixes: cbc654d18d37 ("bitops: Add __attribute_const__ to generic ffs()-family implementations")
Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
Closes: https://lore.kernel.org/linux-pci/CA+G9fYuysVr6qT8bjF6f08WLyCJRG7aXAeSd2F7=…
Signed-off-by: Kees Cook <kees(a)kernel.org>
---
Cc: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: Anders Roxell <anders.roxell(a)linaro.org>
Cc: Naresh Kamboju <naresh.kamboju(a)linaro.org>
Cc: lkft-triage(a)lists.linaro.org
Cc: Linux Regressions <regressions(a)lists.linux.dev>
Cc: Arnd Bergmann <arnd(a)arndb.de>
Cc: Dan Carpenter <dan.carpenter(a)linaro.org>
Cc: Ben Copeland <benjamin.copeland(a)linaro.org>
Cc: <lkft-triage(a)lists.linaro.org>
Cc: <linux-pci(a)vger.kernel.org>
Cc: <linux-kernel(a)vger.kernel.org>
---
drivers/pci/pci.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b0f4d98036cd..005b92e6585e 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5932,6 +5932,7 @@ int pcie_set_readrq(struct pci_dev *dev, int rq)
{
u16 v;
int ret;
+ unsigned int firstbit;
struct pci_host_bridge *bridge = pci_find_host_bridge(dev->bus);
if (rq < 128 || rq > 4096 || !is_power_of_2(rq))
@@ -5949,7 +5950,10 @@ int pcie_set_readrq(struct pci_dev *dev, int rq)
rq = mps;
}
- v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
+ firstbit = ffs(rq);
+ if (firstbit < 8)
+ return -EINVAL;
+ v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, firstbit - 8);
if (bridge->no_inc_mrrs) {
int max_mrrs = pcie_get_readrq(dev);
--
2.34.1
