Lkft-triage

lkft-triage@lists.linaro.org

22 participants
34222 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.185 release. There are 79 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.185-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.185-rc1 Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Sukrut Bellary <sukrut.bellary(a)linux.com> misc: fastrpc: Fix double free of 'buf' in error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Jakub Kicinski <kuba(a)kernel.org> tls: handle data disappearing from under the TLS ULP Sabrina Dubroca <sd(a)queasysnail.net> tls: fix lockless read of strp->msg_ready in ->poll Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Eric Dumazet <edumazet(a)google.com> net/packet: convert po->pressure to an atomic flag Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: convert bitmask definitions to use BIT() macro Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Yeoreum Yun <yeoreum.yun(a)arm.com> perf/core: Fix child_total_time_enabled accounting bug at task exit Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 26 +++ drivers/hid/hid-nintendo.c | 7 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/input/mouse/byd.c | 2 +- drivers/misc/fastrpc.c | 64 +++--- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/skb.c | 2 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/s390/cio/vfio_ccw_chp.c | 26 ++- drivers/s390/cio/vfio_ccw_cp.c | 30 ++- drivers/s390/cio/vfio_ccw_drv.c | 26 ++- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 27 +++ drivers/s390/cio/vfio_ccw_private.h | 9 +- drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/sc16is7xx.c | 222 ++++++++++---------- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/xfs_attr_item.c | 24 +-- fs/xfs/xfs_bmap_item.c | 18 +- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 91 +++++--- fs/xfs/xfs_dquot_item_recover.c | 20 +- fs/xfs/xfs_extfree_item.c | 43 ++-- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +-- fs/xfs/xfs_log_recover.c | 16 +- fs/xfs/xfs_refcount_item.c | 16 +- fs/xfs/xfs_rmap_item.c | 16 +- fs/xfs/xfs_trans.h | 1 - include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/netdevice.h | 6 +- include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/net/tls.h | 3 +- kernel/events/core.c | 121 +++++------ kernel/kcov.c | 90 ++++---- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 2 + net/bluetooth/rfcomm/core.c | 24 ++- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 +++++++++++++++++++++-------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/mptcp/pm_netlink.c | 36 ++-- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 79 ++++--- net/packet/internal.h | 2 +- net/tls/tls.h | 4 +- net/tls/tls_strp.c | 17 +- net/tls/tls_sw.c | 3 +- net/xfrm/xfrm_state.c | 4 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- 90 files changed, 1283 insertions(+), 670 deletions(-)

1 week, 6 days

[PATCH 6.12 00/77] 6.12.106-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.106 release. There are 77 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.106-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.106-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Eric Dumazet <edumazet(a)google.com> ipv4: start using dst_dev_rcu() Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Darrick J. Wong <djwong(a)kernel.org> xfs: namespace the maximum length/refcount symbols Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Ryan Wilbur <rwilbur633(a)gmail.com> serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Eric Dumazet <edumazet(a)google.com> inet: frags: save a pair of atomic operations in reassembly Eric Dumazet <edumazet(a)google.com> inet: frags: change inet_frag_kill() to defer refcount updates Eric Dumazet <edumazet(a)google.com> ipv4: frags: remove ipq_put() Eric Dumazet <edumazet(a)google.com> inet: frags: add inet_frag_putn() helper David Howells <dhowells(a)redhat.com> netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90(a)mail.toshiba> hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() Jordan Rhee <jordanrhee(a)google.com> gve: fix zero-length skb frag with header-split Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 ++- drivers/bluetooth/hci_aml.c | 18 ++++- drivers/gpio/gpio-ml-ioh.c | 36 ++++----- drivers/gpu/drm/xe/display/xe_fb_pin.c | 24 ++---- drivers/hid/hid-core.c | 11 ++- drivers/hid/hid-hyperv.c | 27 ++++++- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 64 +++++++++++++++- drivers/hid/hid-nintendo.c | 22 ++++-- drivers/hid/hid-sensor-custom.c | 21 ++--- drivers/hwmon/pmbus/ltc4286.c | 2 +- drivers/input/keyboard/atkbd.c | 23 +++++- drivers/input/mouse/byd.c | 2 +- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 6 ++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/ntb_netdev.c | 15 ++-- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++++++ drivers/nfc/microread/microread.c | 31 +++++++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 18 ++++- drivers/pci/controller/pci-host-generic.c | 11 +-- drivers/pci/ecam.c | 13 ++++ drivers/tty/serial/8250/8250_of.c | 41 ++++++++++ drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/sc16is7xx.c | 40 +++++----- fs/ext4/fast_commit.c | 16 +++- fs/ext4/xattr.c | 7 +- fs/netfs/buffered_read.c | 4 +- fs/netfs/read_collect.c | 2 +- fs/netfs/read_retry.c | 2 +- fs/ocfs2/xattr.c | 18 +++-- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++++ fs/xfs/libxfs/xfs_format.h | 4 +- fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/libxfs/xfs_refcount.c | 18 ++--- fs/xfs/scrub/agheader.c | 94 +++++++++++++++++------ fs/xfs/scrub/agheader_repair.c | 17 +++- fs/xfs/scrub/refcount.c | 2 +- fs/xfs/scrub/refcount_repair.c | 4 +- fs/xfs/xfs_attr_item.c | 32 ++++---- fs/xfs/xfs_bmap_item.c | 18 ++--- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 95 ++++++++++++++--------- fs/xfs/xfs_dquot_item_recover.c | 20 ++--- fs/xfs/xfs_exchmaps_item.c | 8 +- fs/xfs/xfs_extfree_item.c | 43 ++++++----- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +++---- fs/xfs/xfs_log_recover.c | 16 ++-- fs/xfs/xfs_refcount_item.c | 16 ++-- fs/xfs/xfs_rmap_item.c | 16 ++-- fs/xfs/xfs_trans.h | 1 - include/linux/netfs.h | 2 +- include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 ++ include/net/inet_frag.h | 6 +- include/net/ipv6_frag.h | 5 +- kernel/kcov.c | 90 +++++++++++----------- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/iso.c | 30 ++++++-- net/bluetooth/rfcomm/core.c | 24 +++++- net/ceph/osd_client.c | 5 +- net/ieee802154/6lowpan/reassembly.c | 27 ++++--- net/ipv4/icmp.c | 6 +- net/ipv4/inet_fragment.c | 33 ++++---- net/ipv4/ip_fragment.c | 54 ++++++------- net/ipv4/ip_output.c | 4 + net/ipv4/ipmr.c | 2 +- net/ipv4/route.c | 4 +- net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 27 ++++--- net/ipv6/reassembly.c | 29 +++---- net/mptcp/pm_netlink.c | 9 ++- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 9 +++ net/mptcp/protocol.h | 7 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 ++++- net/nfc/llcp_core.c | 15 +++- net/nfc/nci/ntf.c | 10 ++- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/ss/policydb.c | 57 ++++++++++++-- sound/drivers/dummy.c | 6 ++ sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/usb/mixer.c | 6 ++ sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++++++++++++--------- 99 files changed, 1128 insertions(+), 543 deletions(-)

1 week, 6 days

[PATCH 6.6 00/87] 6.6.154-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.154 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.154-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.154-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Christian Göttsche <cgzones(a)googlemail.com> selinux: make more use of str_read() when loading the policy Christian Göttsche <cgzones(a)googlemail.com> selinux: avoid unnecessary indirection in struct level_datum Christian Göttsche <cgzones(a)googlemail.com> selinux: use known type instead of void pointer Paul Moore <paul(a)paul-moore.com> selinux: fix style issues in security/selinux/ss/policydb.c Paul Moore <paul(a)paul-moore.com> selinux: fix style issues in security/selinux/ss/policydb.h Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Move period/buffer configuration print after platform open Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: Relocate and rework functionality for PCM stream freeing Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: sof: pcm: use snd_pcm_direction_name() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Ilya Bakoulin <Ilya.Bakoulin(a)amd.com> drm/amd/display: Fix BT2020 YCbCr limited/full range input Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: disable ASPM in some situations Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Eric Dumazet <edumazet(a)google.com> inet: frags: save a pair of atomic operations in reassembly Eric Dumazet <edumazet(a)google.com> inet: frags: change inet_frag_kill() to defer refcount updates Eric Dumazet <edumazet(a)google.com> ipv4: frags: remove ipq_put() Eric Dumazet <edumazet(a)google.com> inet: frags: add inet_frag_putn() helper Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: convert bitmask definitions to use BIT() macro Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Peter Zijlstra <peterz(a)infradead.org> perf: Unify perf_event_free_task() / perf_event_exit_task_context() Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 100 ++- drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- drivers/gpu/drm/amd/display/dc/basics/dc_common.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 34 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 4 +- .../drm/amd/display/dc/dce/dce_stream_encoder.c | 3 +- .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 3 +- .../display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c | 3 +- drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 6 +- .../amd/display/modules/info_packet/info_packet.c | 4 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 +- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 45 +- drivers/hid/hid-nintendo.c | 7 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 +- drivers/input/mouse/byd.c | 2 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 + drivers/nfc/microread/microread.c | 31 +- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 + drivers/s390/cio/vfio_ccw_chp.c | 26 +- drivers/s390/cio/vfio_ccw_cp.c | 43 +- drivers/s390/cio/vfio_ccw_cp.h | 2 + drivers/s390/cio/vfio_ccw_drv.c | 6 + drivers/s390/cio/vfio_ccw_ops.c | 4 + drivers/s390/cio/vfio_ccw_private.h | 4 + drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/qcom_geni_serial.c | 51 +- drivers/tty/serial/sc16is7xx.c | 222 +++--- fs/ext4/xattr.c | 7 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 + fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/xfs_attr_item.c | 24 +- fs/xfs/xfs_bmap_item.c | 18 +- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 95 ++- fs/xfs/xfs_dquot_item_recover.c | 20 +- fs/xfs/xfs_extfree_item.c | 43 +- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +- fs/xfs/xfs_log_recover.c | 16 +- fs/xfs/xfs_refcount_item.c | 16 +- fs/xfs/xfs_rmap_item.c | 16 +- fs/xfs/xfs_trans.h | 1 - include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/net/inet_frag.h | 6 +- include/net/ipv6_frag.h | 5 +- kernel/events/core.c | 161 ++--- kernel/kcov.c | 90 +-- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 137 +++- net/bluetooth/rfcomm/core.c | 24 +- net/ceph/osd_client.c | 5 +- net/ieee802154/6lowpan/reassembly.c | 27 +- net/ipv4/inet_fragment.c | 33 +- net/ipv4/ip_fragment.c | 48 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 27 +- net/ipv6/reassembly.c | 29 +- net/mptcp/pm_netlink.c | 9 +- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 9 + net/mptcp/protocol.h | 7 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 45 +- security/selinux/ss/avtab.h | 23 +- security/selinux/ss/conditional.c | 40 +- security/selinux/ss/conditional.h | 6 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/ebitmap.c | 4 +- security/selinux/ss/ebitmap.h | 5 +- security/selinux/ss/mls.c | 6 +- security/selinux/ss/policydb.c | 743 +++++++++++++-------- security/selinux/ss/policydb.h | 249 +++---- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/soc/sof/ipc3-pcm.c | 13 +- sound/soc/sof/ipc3-topology.c | 20 +- sound/soc/sof/ipc4-pcm.c | 35 +- sound/soc/sof/ipc4-topology.c | 18 +- sound/soc/sof/pcm.c | 157 +++-- sound/soc/sof/sof-audio.c | 36 - sound/soc/sof/sof-audio.h | 17 +- 115 files changed, 2047 insertions(+), 1291 deletions(-)

1 week, 6 days

[PATCH 5.15 00/76] 5.15.218-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.218 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.218-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.218-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Sean Christopherson <seanjc(a)google.com> KVM: x86: Retry page fault if MMU reload is pending and root has no sp Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Rename __direct_map() to direct_map() David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Split out TDP MMU page fault handling Chao Peng <chao.p.peng(a)linux.intel.com> KVM: Rename mmu_notifier_* to mmu_invalidate_* Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Retry page fault if root is invalidated by memslot update Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Yeoreum Yun <yeoreum.yun(a)arm.com> perf/core: Fix child_total_time_enabled accounting bug at task exit Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> misc: fastrpc: separate fastrpc device from channel context Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- arch/arm64/kvm/mmu.c | 10 +- arch/mips/kvm/mmu.c | 12 +- arch/powerpc/include/asm/kvm_book3s_64.h | 2 +- arch/powerpc/kvm/book3s_64_mmu_host.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_hv.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 2 +- arch/powerpc/kvm/book3s_hv_nested.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 8 +- arch/powerpc/kvm/e500_mmu_host.c | 4 +- arch/x86/kvm/mmu/mmu.c | 189 +++++++++++++---- arch/x86/kvm/mmu/paging_tmpl.h | 13 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 26 +++ drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/misc/fastrpc.c | 110 ++++++---- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/skb.c | 2 - drivers/net/can/slcan.c | 1 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/s390/cio/vfio_ccw_async.c | 16 ++ drivers/s390/cio/vfio_ccw_chp.c | 31 ++- drivers/s390/cio/vfio_ccw_cp.c | 31 ++- drivers/s390/cio/vfio_ccw_drv.c | 14 +- drivers/s390/cio/vfio_ccw_ops.c | 15 +- drivers/s390/cio/vfio_ccw_private.h | 7 +- drivers/tty/serial/amba-pl011.c | 8 +- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/xfs_buf_item_recover.c | 53 +++-- include/linux/can/core.h | 1 + include/linux/can/skb.h | 3 - include/linux/kvm_host.h | 60 +++--- include/linux/netdevice.h | 6 +- include/linux/pci-ecam.h | 3 + include/net/sch_generic.h | 1 + kernel/events/core.c | 121 +++++------ mm/huge_memory.c | 52 +++-- net/bluetooth/rfcomm/core.c | 24 ++- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 +++++++++++++++++++++-------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 57 +++++ net/mptcp/pm_netlink.c | 39 ++-- net/mptcp/protocol.h | 1 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 65 ++++-- net/sched/sch_api.c | 9 + net/xfrm/xfrm_state.c | 4 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- virt/kvm/kvm_main.c | 49 ++--- 80 files changed, 1314 insertions(+), 526 deletions(-)

1 week, 6 days

[PATCH 5.10 00/57] 5.10.267-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.267 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.267-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.267-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Weiming Shi <bestswngs(a)gmail.com> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Sasha Levin <sashal(a)kernel.org> Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback" Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer David Matlack <dmatlack(a)google.com> KVM: arm64: Retry fault if vma_lookup() results become invalid Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Amit Cohen <amcohen(a)nvidia.com> net: ipv4: Publish fib_nlmsg_size() Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> misc: fastrpc: separate fastrpc device from channel context Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept ------------- Diffstat: Makefile | 4 +- arch/arm64/kvm/mmu.c | 42 ++-- drivers/gpio/gpio-ml-ioh.c | 36 +-- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 16 ++ drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/misc/ims-pcu.c | 2 - drivers/misc/fastrpc.c | 110 ++++++--- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/dev.c | 2 - drivers/net/can/slcan.c | 1 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/s390/cio/vfio_ccw_cp.c | 22 +- drivers/s390/cio/vfio_ccw_drv.c | 7 + drivers/s390/cio/vfio_ccw_ops.c | 8 + drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/tty/serial/amba-pl011.c | 8 +- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/xfs_buf_item_recover.c | 53 ++-- fs/xfs/xfs_dquot.c | 3 +- include/linux/can/core.h | 1 + include/linux/can/dev.h | 1 - include/linux/can/skb.h | 2 - include/linux/netdevice.h | 6 +- include/net/sch_generic.h | 1 + kernel/events/core.c | 104 ++++---- mm/huge_memory.c | 52 ++-- net/bluetooth/rfcomm/core.c | 24 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 ++++++++++++++++++------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/fib_lookup.h | 1 + net/ipv4/fib_semantics.c | 69 ++++-- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 6 + net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 65 +++-- net/sched/sch_api.c | 9 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/xfrm_state.c | 4 +- tools/lib/bpf/libbpf.c | 2 + 62 files changed, 909 insertions(+), 392 deletions(-)

1 week, 6 days

犬、ネコ好きの新規ビジネス

by 日本ペットホテル協会

　　「ペット愛」溢れる、経営者様へ　　地域で愛犬を安心して預けられる　ペットホテル・トリミング事業を始めませんか。　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン “ONE LUKE” 　　　※経験や資格が無くても始められます　　■　開催方式　　　オンライン（申込後に参加方法をご案内）　　■　日程　　　8月26日（水）13:00-14:00 　　　9月7日（月）11:00-12:00 　　　9月8日（火）13:00-14:00 　■　定員　　　5名　　■　ご視聴・詳細はこちら　　　https://oneluke-fc-webinar.jp/lp/ 　　　お世話になります。　　ペットホテル・トリミングサロンの　フラチャイズ説明会のご案内でございます。　ペットホテルとトリミングサービスを提供する　ONE LUKE（ワンルーク）　　ワンちゃんが好きすぎる創業者が　ペットホテルに預けたときに感じた　不安や思ったことを施設づくりに活かしています。　　　例えばワンちゃんが泊まるときに、少しでも　広く、心地よく過ごして欲しいという思いから　鉄のゲージではなくオーダーで職人さんに　「お部屋」を作っていただいています。　　そうした愛犬家目線のきめ細かいサービスが支持され　利用した方は高い確率でリピートしてくれます。　　　日本ではいまや「8世帯に1世帯」がペットを飼うまでに　増えてきましたが、ペットホテルはまだまだ店舗数が　足りていないため、今後も成長が期待できます。　　　ここまでこの文章を読まれたということは、　あなたもワンちゃんが大好きなのではないでしょうか。　　ワンルークのFCオーナー様も愛犬家が多く、中には　ご自身が利用者だった、という方もいらっしゃいます。　　説明会にて詳しいビジネスモデルをお伝えしますので、　新規事業を探している愛犬家の経営者様は　この機会にぜひご参加ください。　　地域のペットライフを豊かにし、愛犬が安心して　過ごせる空間を一緒につくっていきましょう。　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン　　　“ONE LUKE（ワンルーク）” 　　■　ご視聴はこちら　　　https://oneluke-fc-webinar.jp/lp/ 　 *********************************************************************** 本メールのご不要な方には大変ご迷惑をおかけいたしました。お手数お掛けしますが、メール不要のお手続きは下記URLよりお願いいたします。 <メール停止フォーム> 　https://oneluke-fc-webinar.jp/mail/ *********************************************************************** 日本ペットホテル協会株式会社愛知県名古屋市千種区内山3丁目9-23 3F TEL:052-784-8416 ***********************************************************************

2 weeks, 2 days

[PATCH 6.6 000/160] 6.6.153-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.153 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 23 Aug 2026 14:28:27 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.153-rc2 Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() Paolo Abeni <pabeni(a)redhat.com> net: harmonize tstats and dstats Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Christoph Hellwig <hch(a)lst.de> m68k: use the coherent DMA code for coldfire without data cache Christoph Hellwig <hch(a)lst.de> dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Victor Nogueira <victor(a)mojatatu.com> net: sched: Add initial TC error skb drop reasons Victor Nogueira <victor(a)mojatatu.com> net: sched: Move drop_reason to struct tc_skb_cb Yan Zhai <yan(a)cloudflare.com> packet: add a generic drop reason for receive Jamal Hadi Salim <jhs(a)mojatatu.com> net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Add tcf_set_drop_reason for {__,}tcf_classify Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Make tc-related drop reason more flexible Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <cel(a)kernel.org> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add rekey tests Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm/pagewalk: split walk_page_range_novma() into kernel/user parts Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Guillaume Nault <gnault(a)redhat.com> vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. Guillaume Nault <gnault(a)redhat.com> vrf: Make pcpu_dstats update functions available to other modules. Jeremy Kerr <jk(a)codeconstruct.com.au> net: core,vrf: Change pcpu_dstat fields to u64_stats_t Breno Leitao <leitao(a)debian.org> vxlan: Do not alloc tstats manually Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: add space_info argument to btrfs_chunk_alloc() David Sterba <dsterba(a)suse.com> btrfs: add debug build only WARN Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Ilpo Järvinen <ij(a)kernel.org> tcp: fast path functions later Ilpo Järvinen <ij(a)kernel.org> tcp: Pass flags to __tcp_send_ack Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move smb_version_values to common/smbglob.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Felix Fietkau <nbd(a)nbd.name> net: move skb_gro_receive_list from udp to core Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: move vma_can_userfault out of line Chunyan Zhang <zhangchunyan(a)iscas.ac.cn> mm: userfaultfd: add pgtable_supports_uffd_wp() Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Matthew Wilcox (Oracle) <willy(a)infradead.org> iomap: hold state_lock over call to ifs_set_range_uptodate() Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Use a folio in ceph_page_mkwrite() Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Remove ceph_writepage() Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add test with a partially invalid iov Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: Provide pgtable_l5_enabled on rv32 Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix EQ leak in mana_remove on NULL port Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm/Kconfig | 1 + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig | 7 +- arch/m68k/Kconfig.cpu | 16 + arch/m68k/kernel/Makefile | 2 +- arch/m68k/kernel/dma.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/dma.c | 4 +- arch/openrisc/kernel/signal.c | 5 +- arch/parisc/Kconfig | 1 + arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/mm/init.c | 2 + arch/riscv/mm/pageattr.c | 8 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/crypto/qce/core.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 34 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/net/can/rcar/rcar_canfd.c | 28 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 + drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/veth.c | 4 +- drivers/net/vrf.c | 49 +- drivers/net/vxlan/vxlan_core.c | 45 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 17 +- drivers/s390/cio/vfio_ccw_cp.c | 53 +- drivers/s390/cio/vfio_ccw_cp.h | 8 + drivers/s390/cio/vfio_ccw_drv.c | 15 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 35 +- drivers/s390/cio/vfio_ccw_private.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/btrfs/block-group.c | 61 ++- fs/btrfs/block-group.h | 3 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/messages.h | 7 + fs/btrfs/space-info.c | 2 +- fs/btrfs/transaction.c | 5 +- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/addr.c | 54 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/iomap/buffered-io.c | 42 +- fs/smb/client/cifsglob.h | 27 - fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/transport.c | 8 +- fs/smb/common/cifsglob.h | 36 ++ fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2misc.c | 2 +- fs/smb/server/smb2ops.c | 32 +- fs/smb/server/smb2pdu.c | 88 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 +- fs/smb/server/smb_common.h | 43 +- fs/super.c | 22 +- fs/userfaultfd.c | 20 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/asm-generic/pgtable_uffd.h | 17 + include/linux/fs.h | 12 + include/linux/mm_inline.h | 7 +- include/linux/mmap_lock.h | 4 + include/linux/netdevice.h | 52 +- include/linux/pagewalk.h | 7 +- include/linux/userfaultfd_k.h | 19 +- include/net/dropreason-core.h | 21 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/pkt_cls.h | 16 + include/net/pkt_sched.h | 3 +- include/net/sch_generic.h | 2 - include/net/tcp.h | 58 +-- include/uapi/linux/ip_vs.h | 6 - kernel/dma/Kconfig | 9 + kernel/dma/direct.c | 12 +- kernel/fork.c | 12 +- kernel/trace/ftrace.c | 9 +- kernel/trace/ring_buffer.c | 23 +- mm/huge_memory.c | 49 +- mm/internal.h | 7 + mm/migrate_device.c | 5 +- mm/pagewalk.c | 82 ++- mm/ptdump.c | 10 +- mm/userfaultfd.c | 26 + mm/vmalloc.c | 49 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dev.c | 29 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 +- net/ipv4/bpf_tcp_ca.c | 2 +- net/ipv4/tcp_dctcp.h | 2 +- net/ipv4/tcp_input.c | 56 ++- net/ipv4/tcp_minisocks.c | 12 +- net/ipv4/tcp_output.c | 6 +- net/ipv4/udp_offload.c | 29 -- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++- net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 27 +- net/sched/act_api.c | 13 +- net/sched/cls_api.c | 32 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/tls/tls_sw.c | 7 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 28 +- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- tools/testing/selftests/net/tls.c | 549 +++++++++++++++++++++ 185 files changed, 2359 insertions(+), 942 deletions(-)

2 weeks, 2 days

[PATCH 5.10 000/235] 5.10.266-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.266 release. There are 235 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.266-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.266-rc1 Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Zhang Changzhong <zhangchangzhong(a)huawei.com> net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: smbus: Check for parent device before dereference Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: rdma write inline if qp has sufficient inline space Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: move ale selection in pdata Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usx2y: Fix potential leaks of uninitialized memory Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: scsi_debug: Rename zone type constants Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Use logical blocks as unit when querying zones Bart Van Assche <bvanassche(a)acm.org> scsi: sd: sd_zbc: Improve source code documentation Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> skbuff: introduce skb_pull_data Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li <xiubli(a)redhat.com> ceph: rename _to_client() to _to_fs_client() Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Paolo Abeni <pabeni(a)redhat.com> mptcp: fix subflow accounting on close Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: fix regression with GPIO configuration Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: remove obsolete out_thread label Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: sc16is7xx: Fill in rs485_supported Tomasz Moń <tomasz.mon(a)camlingroup.com> sc16is7xx: Properly resume TX after stop Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Remove unneeded test for ->setup() presence Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l: async: Set owner for async sub-devices Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman <david.plowman(a)raspberrypi.com> media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Return proper error codes instead of -1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Deepanshu Kartikey <kartikey406(a)gmail.com> drm/virtio: use uninterruptible resv lock for plane updates Christian König <christian.koenig(a)amd.com> dma-buf/drivers: make reserving a shared slot mandatory v4 Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN David Matlack <dmatlack(a)google.com> KVM: Introduce vcpu->wants_to_run Sean Christopherson <seanjc(a)google.com> KVM: x86: Move "apicv_active" into "struct kvm_lapic" Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield Sean Christopherson <seanjc(a)google.com> KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update() Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: clean up comments and whitespace Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: add write-fifo support Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix write implementation Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: refactor write-room handling Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Chunfeng Yun <chunfeng.yun(a)mediatek.com> usb: gadget: bdc: fix checkpatch.pl spacing error Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Sabrina Dubroca <sd(a)queasysnail.net> espintcp: use sk_msg_free_partial to fix partial send Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bryam Vargas <hexlabsecurity(a)proton.me> net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: avoid calling child->ops->dequeue(child) twice Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Maoyi Xie <maoyixie.tju(a)gmail.com> net: ipip: require CAP_NET_ADMIN in the device netns for changelink Liu Jian <liujian56(a)huawei.com> net: Add helper function to parse netlink msg of ip_tunnel_encap Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix race condition in reset_device sysfs callback Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: don't increment hash_offset twice Bryam Vargas <hexlabsecurity(a)proton.me> scsi: target: Bound PR-OUT TransportID parsing to the received buffer Maurizio Lombardi <mlombard(a)redhat.com> scsi: target: core: Generate correct identifiers for PR OUT transport IDs Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> scsi: target: core: pr: Initialize arrays at declaration time Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Abdun Nihaal <nihaal(a)cse.iitm.ac.in> scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip Gustavo Pimentel <Gustavo.Pimentel(a)synopsys.com> dmaengine: dw-edma: Improve the linked list and data blocks definition Gustavo Pimentel <Gustavo.Pimentel(a)synopsys.com> PCI: Add pci_find_vsec_capability() to find a specific VSEC Jarkko Sakkinen <jarkko(a)kernel.org> tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: use kvzalloc() for megabyte buffer in simple fallocate Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spi-nor: swp: Improve locking user experience Michael Walle <mwalle(a)kernel.org> mtd: spi-nor: Fix spi_nor_try_unlock_all() Tudor Ambarus <tudor.ambarus(a)microchip.com> mtd: spi-nor: Move Software Write Protection logic out of the core Michael Walle <michael(a)walle.cc> mtd: spi-nor: intel: remove global protection flag Michael Walle <michael(a)walle.cc> mtd: spi-nor: sst: remove global protection flag Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Maoyi Xie <maoyixie.tju(a)gmail.com> net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao <leitao(a)debian.org> 9p: skip nlink update in cacheless mode to fix WARN_ON Vasiliy Kovalev <kovalev(a)altlinux.org> net/9p: fix infinite loop in p9_client_rpc on fatal signal Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Ondrej Mosnacek <omosnace(a)redhat.com> lsm: use default hook return value in call_int_hook() Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Junrui Luo <moonafterrain(a)outlook.com> jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Harshad Shirwadkar <harshadshirwadkar(a)gmail.com> jbd2: add a helper to find out number of fast commit blocks Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Wentao Liang <vulab(a)iscas.ac.cn> mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata <petrm(a)nvidia.com> mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Ido Schimmel <idosch(a)nvidia.com> mlxsw: spectrum: Apply RIF configuration when joining a LAG David Howells <dhowells(a)redhat.com> rxrpc: Fix socket notification race David Howells <dhowells(a)redhat.com> rxrpc: Fix notification vs call-release vs recvmsg David Howells <dhowells(a)redhat.com> rxrpc: Fix recv-recv race of completed call Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Akhil R <akhilrajeev(a)nvidia.com> i2c: smbus: Use device_*() functions instead of of_*() Akhil R <akhilrajeev(a)nvidia.com> device property: Add fwnode_irq_get_byname Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Xiang Mei <xmei5(a)asu.edu> net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Jiasheng Jiang <jiashengjiangcool(a)gmail.com> media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization Fullway Wang <fullwaywang(a)outlook.com> media: mtk-vcodec: potential null pointer deference in SCP ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 41 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 4 +- arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/vmx/vmx.c | 9 +- arch/x86/kvm/x86.c | 19 +- crypto/ccm.c | 2 +- drivers/base/property.c | 29 ++ drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 8 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 77 ++-- drivers/dma/dw-edma/dw-edma-core.h | 20 +- drivers/dma/dw-edma/dw-edma-pcie.c | 180 ++++++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 76 ++-- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-tegra.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 + drivers/gpu/drm/virtio/virtgpu_plane.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/i2c/i2c-core-base.c | 2 +- drivers/i2c/i2c-core-smbus.c | 15 +- drivers/i2c/i2c-smbus.c | 5 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 7 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 6 + drivers/input/touchscreen/sur40.c | 23 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 7 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/Makefile | 2 +- drivers/mtd/spi-nor/core.c | 406 +---------------- drivers/mtd/spi-nor/core.h | 5 + drivers/mtd/spi-nor/intel.c | 16 +- drivers/mtd/spi-nor/sst.c | 30 +- drivers/mtd/spi-nor/swp.c | 426 +++++++++++++++++ drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 13 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 109 ++++- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 31 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 139 ++++-- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 4 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pci/pci.c | 30 ++ drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 5 +- drivers/scsi/sd_zbc.c | 79 +++- drivers/target/target_core_fabric_lib.c | 146 ++++-- drivers/target/target_core_internal.h | 5 +- drivers/target/target_core_pr.c | 54 +-- drivers/thunderbolt/domain.c | 30 ++ drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 71 ++- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/serial/keyspan_pda.c | 471 ++++++++++--------- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 24 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 33 +- fs/ceph/inode.c | 20 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 8 +- fs/ceph/xattr.c | 8 +- fs/cifs/smb2ops.c | 4 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/jbd2/journal.c | 10 +- fs/namei.c | 42 ++ fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 2 - include/linux/firmware.h | 3 + include/linux/fs.h | 28 ++ include/linux/i2c-smbus.h | 6 +- include/linux/jbd2.h | 9 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pci.h | 1 + include/linux/property.h | 1 + include/linux/skbuff.h | 2 + include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 9 +- include/net/act_api.h | 20 + include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/trace/events/rxrpc.h | 2 + include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/memory_hotplug.c | 15 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/9p/client.c | 2 + net/bluetooth/hidp/core.c | 25 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/osdmap.c | 9 +- net/core/pktgen.c | 43 +- net/core/skbuff.c | 28 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ipip.c | 41 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/mptcp/options.c | 21 +- net/mptcp/protocol.c | 4 +- net/mptcp/protocol.h | 14 + net/mptcp/subflow.c | 12 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_set_pipapo.c | 252 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 28 +- net/rxrpc/call_object.c | 27 +- net/rxrpc/recvmsg.c | 23 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/sch_api.c | 24 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 506 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- sound/usb/usx2y/usX2Yhwdep.c | 10 +- sound/usb/usx2y/usbus428ctldefs.h | 2 + sound/usb/usx2y/usbusx2y.c | 2 +- sound/usb/usx2y/usx2yhwdeppcm.c | 15 +- virt/kvm/kvm_main.c | 3 + 276 files changed, 4340 insertions(+), 2447 deletions(-)

2 weeks, 3 days

[PATCH 5.15 000/272] 5.15.217-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.217 release. There are 272 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.217-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.217-rc1 Easwar Hariharan <eahariha(a)linux.microsoft.com> jiffies: Cast to unsigned long in secs_to_jiffies() conversion Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Unlock reservations on dma_resv_reserve_fences() error Zack Rusin <zackr(a)vmware.com> drm/vmwgfx: Reserve fence slots on buffer objects in cotables Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: rdma write inline if qp has sufficient inline space Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Xin Long <lucien.xin(a)gmail.com> openvswitch: move key and ovs_cb update out of handle_fragments Xin Long <lucien.xin(a)gmail.com> net: sched: use skb_ip_totlen and iph_totlen Xin Long <lucien.xin(a)gmail.com> openvswitch: use skb_ip_totlen in conntrack Xin Long <lucien.xin(a)gmail.com> net: add a couple of helpers for iph tot_len Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Easwar Hariharan <eahariha(a)linux.microsoft.com> jiffies: Define secs_to_jiffies() Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: scsi_debug: Rename zone type constants Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() Bart Van Assche <bvanassche(a)acm.org> scsi: sd: sd_zbc: Introduce struct zoned_disk_info Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Use logical blocks as unit when querying zones Bart Van Assche <bvanassche(a)acm.org> scsi: sd: sd_zbc: Improve source code documentation Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li <xiubli(a)redhat.com> ceph: print cluster fsid and client global_id in all debug logs Xiubo Li <xiubli(a)redhat.com> ceph: rename _to_client() to _to_fs_client() Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Paolo Abeni <pabeni(a)redhat.com> mptcp: fix subflow accounting on close Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup MPJ subflow list handling Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: fix regression with GPIO configuration Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: remove obsolete out_thread label Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: sc16is7xx: Fill in rs485_supported Tomasz Moń <tomasz.mon(a)camlingroup.com> sc16is7xx: Properly resume TX after stop LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Remove unneeded test for ->setup() presence Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l: async: Set owner for async sub-devices Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman <david.plowman(a)raspberrypi.com> media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Return proper error codes instead of -1 Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Deepanshu Kartikey <kartikey406(a)gmail.com> drm/virtio: use uninterruptible resv lock for plane updates Christian König <christian.koenig(a)amd.com> dma-buf/drivers: make reserving a shared slot mandatory v4 Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Rename __direct_map() to direct_map() David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Split out TDP MMU page fault handling Chao Peng <chao.p.peng(a)linux.intel.com> KVM: Rename mmu_notifier_* to mmu_invalidate_* Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Sabrina Dubroca <sd(a)queasysnail.net> espintcp: use sk_msg_free_partial to fix partial send Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Bryam Vargas <hexlabsecurity(a)proton.me> net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: avoid calling child->ops->dequeue(child) twice Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> treewide: rename pinctrl_gpio_direction_output_new() Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Zihan Xi <xizh2024(a)lzu.edu.cn> net/sched: act_ct: preserve tc_skb_cb across defragmentation Haoxiang Li <haoxiang_li2024(a)163.com> net: ixp4xx_hss: fix duplicate HDLC netdev allocation Maoyi Xie <maoyixie.tju(a)gmail.com> net: ipip: require CAP_NET_ADMIN in the device netns for changelink Liu Jian <liujian56(a)huawei.com> net: Add helper function to parse netlink msg of ip_tunnel_encap Thomas Gleixner <tglx(a)kernel.org> locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: don't increment hash_offset twice Abdun Nihaal <nihaal(a)cse.iitm.ac.in> scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Jann Horn <jannh(a)google.com> bpf,fork: wipe ->bpf_storage before bailouts that access it Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove service debugfs entries during unregister Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Alan Borzeszkowski <alan.borzeszkowski(a)linux.intel.com> thunderbolt: Update property.c function documentation Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> thunderbolt: Remove usage of the deprecated ida_simple_xx() API Fan Wu <fanwu01(a)zju.edu.cn> can: esd_usb: kill anchored URBs before freeing netdevs Frank Jungclaus <frank.jungclaus(a)esd.eu> can/esd_usb2: Rename esd_usb2.c to esd_usb.c Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Ibrahim Hashimov <security(a)auditcode.ai> ksmbd: fix integer overflow in set_file_allocation_info() Jarkko Sakkinen <jarkko(a)kernel.org> tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: use kvzalloc() for megabyte buffer in simple fallocate Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Detach the private data and chip info structures Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spi-nor: swp: Improve locking user experience Michael Walle <mwalle(a)kernel.org> mtd: spi-nor: Fix spi_nor_try_unlock_all() Maoyi Xie <maoyixie.tju(a)gmail.com> net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao <leitao(a)debian.org> 9p: skip nlink update in cacheless mode to fix WARN_ON Michael Bommarito <michael.bommarito(a)gmail.com> ntfs3: validate split-point offset in indx_insert_into_buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Undo critial modificatins to keep directory consistency Pavel Skripkin <paskripkin(a)gmail.com> fs/ntfs3: Make ntfs_update_mftmirr return void Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Ondrej Mosnacek <omosnace(a)redhat.com> lsm: use default hook return value in call_int_hook() Wasim Nazir <wasim.nazir(a)oss.qualcomm.com> remoteproc: qcom: Fix leak when custom dump_segments addition fails Yogesh Lal <quic_ylal(a)quicinc.com> remoteproc: qcom: pas: Adjust the phys addr wrt the mem region Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: fix sparse warnings Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: replace kstrdup with kstrndup Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move prove_locking helper around Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin <tangbin(a)cmss.chinamobile.com> ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Eric Dumazet <edumazet(a)google.com> ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] Eric Dumazet <edumazet(a)google.com> net: dst: add four helpers to annotate data-races around dst->dev Eric Dumazet <edumazet(a)google.com> net: dst: annotate data-races around dst->output Eric Dumazet <edumazet(a)google.com> net: dst: annotate data-races around dst->input Eric Dumazet <edumazet(a)google.com> tcp: convert to dev_net_rcu() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Geetha sowjanya <gakula(a)marvell.com> octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao <sheng.zhao(a)bytedance.com> vduse: Use fixed 4KB bounce pages for non-4KB page size Wentao Liang <vulab(a)iscas.ac.cn> mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata <petrm(a)nvidia.com> mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Jiacheng Yu <yujiacheng3(a)huawei.com> fbcon: Use correct type for vc_resize() return value Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda: conexant: Remove mic bias threshold override Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Xiang Mei <xmei5(a)asu.edu> net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Jiasheng Jiang <jiashengjiangcool(a)gmail.com> media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization Fullway Wang <fullwaywang(a)outlook.com> media: mtk-vcodec: potential null pointer deference in SCP Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/mmu.c | 10 +- arch/mips/kvm/mmu.c | 12 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/include/asm/kvm_book3s_64.h | 2 +- arch/powerpc/kvm/book3s_64_mmu_host.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_hv.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 2 +- arch/powerpc/kvm/book3s_hv_nested.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 8 +- arch/powerpc/kvm/e500_mmu_host.c | 4 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/mmu/mmu.c | 154 ++++-- arch/x86/kvm/mmu/paging_tmpl.h | 6 +- crypto/ccm.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 10 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 90 ++-- drivers/dma/dw-edma/dw-edma-core.h | 33 +- drivers/dma/dw-edma/dw-edma-pcie.c | 83 ++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 38 +- drivers/dma/dw-edma/dw-edma-v0-core.h | 4 +- drivers/dma/dw-edma/dw-edma-v0-debugfs.c | 18 +- drivers/dma/dw-edma/dw-edma-v0-debugfs.h | 8 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-rockchip.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 17 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 12 +- drivers/gpu/drm/i915/display/intel_vrr.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 28 ++ drivers/gpu/drm/virtio/virtgpu_plane.c | 10 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 135 ++++-- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 5 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 21 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/iommu/amd/iommu.c | 3 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/swp.c | 30 +- drivers/net/can/usb/Kconfig | 15 +- drivers/net/can/usb/Makefile | 2 +- drivers/net/can/usb/{esd_usb2.c => esd_usb.c} | 5 +- drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 18 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 14 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 92 +++- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wan/ixp4xx_hss.c | 4 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 4 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 15 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/remoteproc/qcom_common.c | 31 +- drivers/remoteproc/qcom_common.h | 5 +- drivers/remoteproc/qcom_q6v5_pas.c | 20 +- drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 27 +- drivers/scsi/sd_zbc.c | 126 +++-- drivers/thunderbolt/domain.c | 36 +- drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/nhi.c | 6 +- drivers/thunderbolt/nvm.c | 4 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/switch.c | 20 +- drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 96 ++-- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/vdpa/vdpa_user/iova_domain.c | 91 ++-- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 120 ++--- drivers/video/fbdev/core/fbcon.c | 413 ++++++++-------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +++--- drivers/video/fbdev/core/fbcon_cw.c | 146 +++--- drivers/video/fbdev/core/fbcon_rotate.c | 44 +- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 +++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/acl.c | 6 +- fs/ceph/addr.c | 20 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 42 +- fs/ceph/inode.c | 14 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/metric.c | 5 +- fs/ceph/snap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 14 +- fs/ceph/xattr.c | 12 +- fs/cifs/smb2ops.c | 4 +- fs/crypto/policy.c | 2 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/connection.c | 23 +- fs/ksmbd/connection.h | 5 + fs/ksmbd/oplock.c | 8 +- fs/ksmbd/smb2pdu.c | 102 ++-- fs/ksmbd/smb2pdu.h | 9 - fs/ksmbd/smb_common.c | 43 +- fs/ksmbd/smb_common.h | 9 + fs/namei.c | 43 ++ fs/ntfs3/fsntfs.c | 20 +- fs/ntfs3/index.c | 44 +- fs/ntfs3/ntfs_fs.h | 2 +- fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/xfs_dquot.c | 3 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 50 +- include/linux/firmware.h | 3 + include/linux/fs.h | 33 ++ include/linux/ip.h | 21 + include/linux/jiffies.h | 13 + include/linux/kvm_host.h | 60 +-- include/linux/lsm_hooks.h | 1 + include/linux/mmc/sdio_ids.h | 2 +- include/linux/namei.h | 1 + include/linux/pinctrl/consumer.h | 13 +- include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 8 +- include/net/dst.h | 24 +- include/net/inet6_hashtables.h | 2 +- include/net/inet_hashtables.h | 2 +- include/net/ip.h | 11 +- include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/net/lwtunnel.h | 8 +- include/net/netfilter/nf_queue.h | 1 + include/net/route.h | 5 +- include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/fork.c | 21 +- kernel/locking/spinlock_rt.c | 27 +- kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/madvise.c | 3 +- mm/memory_hotplug.c | 15 +- mm/mincore.c | 3 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/bluetooth/hci_event.c | 2 - net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dst.c | 8 +- net/core/pktgen.c | 43 +- net/core/sock.c | 6 +- net/ipv4/icmp.c | 24 +- net/ipv4/igmp.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_output.c | 4 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ip_vti.c | 4 +- net/ipv4/ipip.c | 41 +- net/ipv4/netfilter.c | 4 +- net/ipv4/route.c | 10 +- net/ipv4/tcp_fastopen.c | 4 +- net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_metrics.c | 8 +- net/ipv4/xfrm4_output.c | 2 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/ipv6/tcp_ipv6.c | 10 +- net/mptcp/options.c | 8 +- net/mptcp/pm_netlink.c | 4 - net/mptcp/protocol.c | 127 +++-- net/mptcp/protocol.h | 29 +- net/mptcp/sockopt.c | 24 +- net/mptcp/subflow.c | 17 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_queue.c | 14 + net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nfnetlink_queue.c | 3 + net/netfilter/nft_set_pipapo.c | 260 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/openvswitch/conntrack.c | 39 +- net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 27 +- net/sched/act_ct.c | 41 +- net/sched/sch_api.c | 24 +- net/sched/sch_cake.c | 2 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 530 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 118 ++--- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- virt/kvm/kvm_main.c | 49 +- 358 files changed, 4765 insertions(+), 2894 deletions(-)

2 weeks, 3 days

[PATCH 6.1 000/303] 6.1.184-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.184-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.184-rc1 Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Edward Adam Davis <eadavis(a)qq.com> Bluetooth: hci_sock: Prevent race in socket write iter and sock bind Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Pedro Falcato <pfalcato(a)suse.de> RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Fix not using correct handle Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <cel(a)kernel.org> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Florian Westphal <fw(a)strlen.de> netfilter: conntrack: sctp: use nf log infrastructure for invalid packets Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Xin Long <lucien.xin(a)gmail.com> openvswitch: move key and ovs_cb update out of handle_fragments Xin Long <lucien.xin(a)gmail.com> net: sched: use skb_ip_totlen and iph_totlen Xin Long <lucien.xin(a)gmail.com> openvswitch: use skb_ip_totlen in conntrack Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Stanislav Fomichev <sdf(a)google.com> veth: Introduce veth_xdp_buff wrapper for xdp_buff Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Extract rcar_canfd_global_{,de}init() Biju Das <biju.das.jz(a)bp.renesas.com> can: rcar_canfd: Use devm_clk_get_optional() for RAM clk Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Invert reset assert order Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1 Gustavo A. R. Silva <gustavoars(a)kernel.org> Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings Kees Cook <keescook(a)chromium.org> overflow: Change DEFINE_FLEX to take __counted_by member Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Protect mgmt_pending list with its own lock Dr. David Alan Gilbert <linux(a)treblig.org> Bluetooth: MGMT: Remove unused mgmt_pending_find_data Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Jingbo Xu <jefflexu(a)linux.alibaba.com> erofs: maintain cookies of share domain in self-contained list Gao Xiang <xiang(a)kernel.org> erofs: tidy up internal.h Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE David Hildenbrand <david(a)redhat.com> mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Wentao Guan <guanwentao(a)uniontech.com> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Ferry Meng <mengferry(a)linux.alibaba.com> ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Felix Fietkau <nbd(a)nbd.name> net: move skb_gro_receive_list from udp to core Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li <xiubli(a)redhat.com> ceph: rename _to_client() to _to_fs_client() Xiubo Li <xiubli(a)redhat.com> ceph: pass the mdsc to several helpers Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: userspace: fix use-after-free in get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: use addr entry for get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: add mptcp_userspace_pm_lookup_addr helper Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: avoid code duplication to lookup endp Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus: access mei_device under device_lock on cleanup Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman <david.plowman(a)raspberrypi.com> media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Move to using intel_display in intel_hdcp Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Diogo Ivo <diogo.ivo(a)tecnico.ulisboa.pt> usb: typec: ucsi: Only enable supported notifications Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Vitor Soares <vitor.soares(a)toradex.com> drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Guangshuo Li <lgs201920130244(a)gmail.com> usb: musb: omap2430: Do not put borrowed of_node in probe Johan Hovold <johan(a)kernel.org> usb: musb: omap2430: clean up probe error handling Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN David Matlack <dmatlack(a)google.com> KVM: Introduce vcpu->wants_to_run Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: HCI: Remove HCI_AMP support Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Bluetooth: Remove usage of the deprecated ida_simple_xx() API Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Peng Fan <peng.fan(a)nxp.com> pmdomain: imx: Fix i.MX8MP power notifier Bryam Vargas <hexlabsecurity(a)proton.me> ata: libata-core: Reject an invalid concurrent positioning ranges count Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Crystal Wood <crwood(a)redhat.com> tracing/osnoise: Call synchronize_rcu() when unregistering Uladzislau Rezki (Sony) <urezki(a)gmail.com> tracing: Rename kvfree_rcu() to kvfree_rcu_mightsleep() Théo Lebrun <theo.lebrun(a)bootlin.com> net: macb: drop in-flight Tx SKBs on close Wentao Liang <vulab(a)iscas.ac.cn> ipmi: fix refcount leak in i_ipmi_request() Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Sabrina Dubroca <sd(a)queasysnail.net> espintcp: use sk_msg_free_partial to fix partial send David Howells <dhowells(a)redhat.com> tcp_bpf, smc, tls, espintcp, siw: Reduce MSG_SENDPAGE_NOTLAST usage David Howells <dhowells(a)redhat.com> siw: Inline do_tcp_sendpages() David Howells <dhowells(a)redhat.com> espintcp: Inline do_tcp_sendpages() David Howells <dhowells(a)redhat.com> tcp_bpf: Inline do_tcp_sendpages as it's now a wrapper around tcp_sendmsg Bryam Vargas <hexlabsecurity(a)proton.me> net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: avoid calling child->ops->dequeue(child) twice Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Sergio Paracuellos <sergio.paracuellos(a)gmail.com> gpio: mt7621: avoid corruption of shared interrupt trigger state Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> treewide: rename pinctrl_gpio_direction_input_new() Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Zihan Xi <xizh2024(a)lzu.edu.cn> net/sched: act_ct: preserve tc_skb_cb across defragmentation Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Thomas Gleixner <tglx(a)kernel.org> locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: don't increment hash_offset twice Heinz Mauelshagen <heinzm(a)redhat.com> dm: remove unnecessary braces from single statement blocks Heinz Mauelshagen <heinzm(a)redhat.com> dm: add missing empty lines Heinz Mauelshagen <heinzm(a)redhat.com> dm crypt: correct 'foo*' to 'foo *' Heinz Mauelshagen <heinzm(a)redhat.com> dm: fix trailing statements Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: avoid double increment of &use_bh_wq_enabled Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Jann Horn <jannh(a)google.com> bpf,fork: wipe ->bpf_storage before bailouts that access it Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Maoyi Xie <maoyixie.tju(a)gmail.com> net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao <leitao(a)debian.org> 9p: skip nlink update in cacheless mode to fix WARN_ON Muchun Song <muchun.song(a)linux.dev> mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> mm/vmemmap/devdax: fix kernel crash when probing devdax devices Mike Rapoport (IBM) <rppt(a)kernel.org> mm: move most of core MM initialization to mm/mm_init.c Michael Bommarito <michael.bommarito(a)gmail.com> ntfs3: validate split-point offset in indx_insert_into_buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Undo critial modificatins to keep directory consistency Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nft_objref: validate objref and objrefmap expressions Yue Haibing <yuehaibing(a)huawei.com> netfilter: nf_tables: Remove unused nft_reduce_is_readonly() Jeremy Sowden <jeremy(a)azazel.net> netfilter: bitwise: rename some boolean operation functions Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: drop unused 3rd argument from validate callback ops Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: pass context structure to nft_parse_register_load Wasim Nazir <wasim.nazir(a)oss.qualcomm.com> remoteproc: qcom: Fix leak when custom dump_segments addition fails Yogesh Lal <quic_ylal(a)quicinc.com> remoteproc: qcom: pas: Adjust the phys addr wrt the mem region Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: fix sparse warnings Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: replace kstrdup with kstrndup Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move prove_locking helper around Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Sumanth Korikkar <sumanthk(a)linux.ibm.com> s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: merge source files for CPU Measurement counter facility Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: remove in-kernel counting facility interface Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: move stccm_avail() Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: move cpum_cf_ctrset_size() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin <tangbin(a)cmss.chinamobile.com> ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Wentao Liang <vulab(a)iscas.ac.cn> mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata <petrm(a)nvidia.com> mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao <sheng.zhao(a)bytedance.com> vduse: Use fixed 4KB bounce pages for non-4KB page size Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Jiacheng Yu <yujiacheng3(a)huawei.com> fbcon: Use correct type for vc_resize() return value Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda: conexant: Remove mic bias threshold override Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Don't use PGD entries for the linear mapping Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: Provide pgtable_l5_enabled on rv32 Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Jason Gunthorpe <jgg(a)ziepe.ca> kernel/user: Allow user_struct::locked_vm to be usable for iommufd Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/mm/init.c | 11 +- arch/s390/include/asm/cpu_mcf.h | 112 ------ arch/s390/kernel/Makefile | 2 +- arch/s390/kernel/perf_cpum_cf.c | 272 ++++++++++++- arch/s390/kernel/perf_cpum_cf_common.c | 233 ------------ arch/s390/kernel/perf_pai_ext.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/s390/kvm/pci.c | 86 +++-- arch/s390/kvm/pci.h | 2 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 4 +- block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/bluetooth/btmrvl_main.c | 9 - drivers/bluetooth/btrsi.c | 1 - drivers/bluetooth/btsdio.c | 8 - drivers/bluetooth/btusb.c | 5 - drivers/bluetooth/hci_ldisc.c | 6 - drivers/bluetooth/hci_serdev.c | 5 - drivers/bluetooth/hci_uart.h | 1 - drivers/bluetooth/hci_vhci.c | 10 +- drivers/bluetooth/virtio_bt.c | 2 - drivers/char/ipmi/ipmi_msghandler.c | 8 + drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mt7621.c | 2 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/bridge/cdns-dsi.c | 11 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/i915/display/intel_display_core.h | 3 + drivers/gpu/drm/i915/display/intel_hdcp.c | 22 +- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/i915/i915_driver.c | 3 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/tegra/fb.c | 8 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++++-- drivers/infiniband/sw/siw/siw_qp_tx.c | 17 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 5 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 ++- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 21 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/iommu/amd/iommu.c | 3 +- drivers/md/dm-bufio.c | 9 + drivers/md/dm-cache-metadata.c | 6 + drivers/md/dm-cache-policy-internal.h | 3 + drivers/md/dm-cache-policy-smq.c | 2 + drivers/md/dm-cache-target.c | 12 +- drivers/md/dm-crypt.c | 20 +- drivers/md/dm-era-target.c | 10 +- drivers/md/dm-flakey.c | 4 +- drivers/md/dm-integrity.c | 182 +++++---- drivers/md/dm-io.c | 25 +- drivers/md/dm-ioctl.c | 18 +- drivers/md/dm-kcopyd.c | 2 + drivers/md/dm-log.c | 6 + drivers/md/dm-mpath.c | 3 + drivers/md/dm-rq.c | 2 + drivers/md/dm-snap-persistent.c | 23 +- drivers/md/dm-snap.c | 10 +- drivers/md/dm-stats.c | 24 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-sysfs.c | 1 + drivers/md/dm-table.c | 3 +- drivers/md/dm-thin-metadata.c | 5 +- drivers/md/dm-thin.c | 5 + drivers/md/dm-verity-target.c | 24 +- drivers/md/dm-verity.h | 2 +- drivers/md/dm-writecache.c | 54 ++- drivers/md/persistent-data/dm-array.c | 4 + drivers/md/persistent-data/dm-bitset.c | 1 + drivers/md/persistent-data/dm-block-manager.c | 7 +- drivers/md/persistent-data/dm-btree-internal.h | 1 + drivers/md/persistent-data/dm-btree-remove.c | 5 + drivers/md/persistent-data/dm-btree-spine.c | 6 +- drivers/md/persistent-data/dm-btree.c | 10 + drivers/md/persistent-data/dm-space-map-common.c | 6 + drivers/md/persistent-data/dm-space-map-disk.c | 12 +- drivers/md/persistent-data/dm-space-map-metadata.c | 3 + .../md/persistent-data/dm-transaction-manager.c | 1 + drivers/media/i2c/imx219.c | 47 +-- drivers/misc/mei/bus.c | 16 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/can/rcar/rcar_canfd.c | 177 +++++---- drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/ethernet/cadence/macb_main.c | 22 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++ .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 ++ drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 14 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 92 ++++- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/thunderbolt.c | 8 +- drivers/net/veth.c | 78 ++-- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 ++- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 15 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/remoteproc/qcom_common.c | 31 +- drivers/remoteproc/qcom_common.h | 5 +- drivers/remoteproc/qcom_q6v5_pas.c | 20 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 15 + drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/cio/vfio_ccw_ops.c | 7 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/soc/imx/imx8m-blk-ctrl.c | 27 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/tty/serial/max310x.c | 20 +- drivers/usb/gadget/function/f_tcm.c | 192 ++++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/musb/omap2430.c | 25 +- drivers/usb/typec/ucsi/ucsi.c | 95 +++-- drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/vdpa/vdpa_user/iova_domain.c | 161 +++++--- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 122 +++--- drivers/video/fbdev/core/fbcon.c | 420 ++++++++++----------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 148 ++++---- drivers/video/fbdev/core/fbcon_cw.c | 148 ++++---- drivers/video/fbdev/core/fbcon_rotate.c | 44 +-- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 164 ++++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 20 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 70 ++-- fs/ceph/debugfs.c | 4 +- fs/ceph/dir.c | 24 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 35 +- fs/ceph/inode.c | 14 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 51 ++- fs/ceph/mds_client.h | 5 +- fs/ceph/mdsmap.c | 5 +- fs/ceph/snap.c | 18 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 13 +- fs/ceph/xattr.c | 12 +- fs/crypto/policy.c | 2 +- fs/erofs/Kconfig | 15 + fs/erofs/decompressor_lzma.c | 3 +- fs/erofs/fscache.c | 44 +-- fs/erofs/internal.h | 87 ++--- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/namei.c | 43 +++ fs/ntfs3/index.c | 44 ++- fs/overlayfs/copy_up.c | 12 +- fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2pdu.c | 78 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 ++- fs/smb/server/smb_common.h | 15 +- fs/smb/server/smbacl.c | 27 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/ceph/mdsmap.h | 5 +- include/linux/firmware.h | 3 + include/linux/fs.h | 33 ++ include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/mm.h | 12 + include/linux/mmc/sdio_ids.h | 2 +- include/linux/namei.h | 1 + include/linux/overflow.h | 68 ++++ include/linux/pinctrl/consumer.h | 13 +- include/linux/sched/user.h | 2 +- include/linux/thunderbolt.h | 3 + include/linux/vfio_pci_core.h | 13 +- include/net/bluetooth/hci.h | 114 ------ include/net/bluetooth/hci_core.h | 48 +-- include/net/bluetooth/hci_sync.h | 4 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/netfilter/nf_tables.h | 11 +- include/net/netfilter/nft_fib.h | 4 +- include/net/netfilter/nft_meta.h | 3 +- include/net/netfilter/nft_reject.h | 3 +- include/uapi/linux/ip_vs.h | 6 - include/uapi/linux/netfilter/nf_tables.h | 10 +- include/uapi/linux/virtio_bt.h | 1 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 ++- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 9 + kernel/fork.c | 20 +- kernel/locking/spinlock_rt.c | 27 +- kernel/taskstats.c | 67 ++-- kernel/trace/ftrace.c | 6 +- kernel/trace/trace_osnoise.c | 4 +- kernel/trace/trace_probe.c | 2 +- kernel/user.c | 1 + lib/bootconfig.c | 65 ++++ lib/compat_audit.c | 12 +- mm/huge_memory.c | 49 ++- mm/internal.h | 4 + mm/madvise.c | 3 +- mm/migrate_device.c | 42 ++- mm/mincore.c | 3 +- mm/mm_init.c | 150 ++++++++ mm/page_alloc.c | 160 +------- mm/pagewalk.c | 10 + mm/sparse-vmemmap.c | 3 +- mm/vmalloc.c | 75 +++- net/bluetooth/hci_conn.c | 24 +- net/bluetooth/hci_core.c | 145 ++----- net/bluetooth/hci_event.c | 150 +------- net/bluetooth/hci_sock.c | 11 +- net/bluetooth/hci_sync.c | 373 +++++++++--------- net/bluetooth/l2cap_core.c | 21 +- net/bluetooth/mgmt.c | 367 +++++++++--------- net/bluetooth/mgmt_util.c | 49 +-- net/bluetooth/mgmt_util.h | 8 +- net/bridge/netfilter/nft_reject_bridge.c | 3 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 ++- net/ipv4/netfilter/nft_dup_ipv4.c | 4 +- net/ipv4/tcp_bpf.c | 21 +- net/ipv4/udp_offload.c | 29 -- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/netfilter/nft_dup_ipv6.c | 4 +- net/mptcp/options.c | 8 +- net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 +++-- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 48 +-- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++--- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_api.c | 6 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_bitwise.c | 38 +- net/netfilter/nft_byteorder.c | 2 +- net/netfilter/nft_cmp.c | 6 +- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_ct.c | 2 +- net/netfilter/nft_dup_netdev.c | 2 +- net/netfilter/nft_dynset.c | 4 +- net/netfilter/nft_exthdr.c | 2 +- net/netfilter/nft_fib.c | 3 +- net/netfilter/nft_flow_offload.c | 3 +- net/netfilter/nft_fwd_netdev.c | 9 +- net/netfilter/nft_hash.c | 2 +- net/netfilter/nft_immediate.c | 3 +- net/netfilter/nft_lookup.c | 5 +- net/netfilter/nft_masq.c | 7 +- net/netfilter/nft_meta.c | 8 +- net/netfilter/nft_nat.c | 11 +- net/netfilter/nft_objref.c | 41 +- net/netfilter/nft_osf.c | 3 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_queue.c | 5 +- net/netfilter/nft_range.c | 2 +- net/netfilter/nft_redir.c | 7 +- net/netfilter/nft_reject.c | 3 +- net/netfilter/nft_reject_inet.c | 3 +- net/netfilter/nft_reject_netdev.c | 3 +- net/netfilter/nft_rt.c | 3 +- net/netfilter/nft_set_pipapo.c | 259 ++++++++----- net/netfilter/nft_set_pipapo.h | 8 + net/netfilter/nft_socket.c | 3 +- net/netfilter/nft_synproxy.c | 3 +- net/netfilter/nft_tproxy.c | 7 +- net/netfilter/nft_xfrm.c | 3 +- net/openvswitch/conntrack.c | 39 +- net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 27 +- net/sched/act_ct.c | 41 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/sched/sch_cake.c | 2 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/smc_tx.c | 6 +- net/tipc/socket.c | 6 +- net/tls/tls_device.c | 4 +- net/tls/tls_sw.c | 5 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/espintcp.c | 42 +-- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/apparmor/net.c | 2 +- security/bpf/hooks.c | 3 + security/security.c | 47 ++- security/selinux/hooks.c | 95 +++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 70 ++-- security/smack/smack_netfilter.c | 4 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/pci/hda/patch_hdmi.c | 48 ++- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 118 +++--- sound/soc/sof/ipc3-control.c | 34 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- virt/kvm/kvm_main.c | 3 + 424 files changed, 5764 insertions(+), 4185 deletions(-)

2 weeks, 3 days

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage