Similarly to pci_dev_aer_stats_incr(), pci_print_aer() may be called
when dev->aer_info is NULL. Add a NULL check before proceeding to avoid
calling aer_ratelimit() with a NULL aer_info pointer, returning 1, which
does not rate limit, given this is fatal.
This prevents a kernel crash triggered by dereferencing a NULL pointer
in aer_ratelimit(), ensuring safer handling of PCI devices that lack
AER info. This change aligns pci_print_aer() with pci_dev_aer_stats_incr()
which already performs this NULL check.
Cc: stable(a)vger.kernel.org
Fixes: a57f2bfb4a5863 ("PCI/AER: Ratelimit correctable and non-fatal error logging")
Signed-off-by: Breno Leitao <leitao(a)debian.org>
---
- This problem is still happening in upstream, and unfortunately no action
was done in the previous discussion.
- Link to previous post:
https://lore.kernel.org/r/20250804-aer_crash_2-v1-1-fd06562c18a4@debian.org
---
drivers/pci/pcie/aer.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
index e286c197d7167..55abc5e17b8b1 100644
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -786,6 +786,9 @@ static void pci_rootport_aer_stats_incr(struct pci_dev *pdev,
static int aer_ratelimit(struct pci_dev *dev, unsigned int severity)
{
+ if (!dev->aer_info)
+ return 1;
+
switch (severity) {
case AER_NONFATAL:
return __ratelimit(&dev->aer_info->nonfatal_ratelimit);
---
base-commit: e5f0a698b34ed76002dc5cff3804a61c80233a7a
change-id: 20250801-aer_crash_2-b21cc2ef0d00
Best regards,
--
Breno Leitao <leitao(a)debian.org>
iommu/amd: fix amd iotlb flush range in unmap
This was fixed in mainline in 6b080c4e815ceba3c08ffa980c858595c07e786a,
but do not backport the full refactor.
Targeting branch lts linux-5.15.y.
AMD IOMMU driver supports power of 2 KB page size, it can be 4K, 8K,
16K, etc. So when VFIO driver ask AMD IOMMU driver to unmap a
IOVA with a page_size 4K, it actually can unmap a page_size of
8K, depending on the page used during mapping. However, the iotlb
gather function use the page_size as the range of unmap range,
instead of the real unmapped page size r.
This miscalculation of iotlb flush range will make the unflushed
IOTLB entry stale. It triggered hard-to-debug silent data corruption
issue as DMA engine who used the stale IOTLB entry will DMA into
unmapped memory region.
The upstream commit aims at changing API from map/unmap_page() to
map/unmap_pages() and changed the gather range calculation along
with it. It accidentally fixed this bug in the mainline since 6.1.
For this backport, we don't backport the API change, only port the
gather range calculation to fix the bug.
Cc: Nadav Amit <namit(a)vmware.com>
Cc: Joerg Roedel <joro(a)8bytes.org>
Cc: Will Deacon <will(a)kernel.org>
Cc: Robin Murphy <robin.murphy(a)arm.com>
Cc: Lu Baolu <baolu.lu(a)linux.intel.com>
Cc: iommu(a)lists.linux-foundation.org
Fixes: fc65d0acaf23179b94de399c204328fa259acb90
Signed-off-by: Zhichuang Sun <zhichuang(a)google.com>
---
drivers/iommu/amd/iommu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 714c78bf69db..d3a11be8d1dd 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -2121,7 +2121,8 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
r = (ops->unmap) ? ops->unmap(ops, iova, page_size, gather) : 0;
- amd_iommu_iotlb_gather_add_page(dom, gather, iova, page_size);
+ if (r)
+ amd_iommu_iotlb_gather_add_page(dom, gather, iova, r);
return r;
}
--
2.51.0.618.g983fd99d29-goog
The patch titled
Subject: mm/ksm: fix flag-dropping behavior in ksm_madvise
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-ksm-fix-flag-dropping-behavior-in-ksm_madvise.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Jakub Acs <acsjakub(a)amazon.de>
Subject: mm/ksm: fix flag-dropping behavior in ksm_madvise
Date: Wed, 1 Oct 2025 09:03:52 +0000
syzkaller discovered the following crash: (kernel BUG)
[ 44.607039] ------------[ cut here ]------------
[ 44.607422] kernel BUG at mm/userfaultfd.c:2067!
[ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)
[ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460
<snip other registers, drop unreliable trace>
[ 44.617726] Call Trace:
[ 44.617926] <TASK>
[ 44.619284] userfaultfd_release+0xef/0x1b0
[ 44.620976] __fput+0x3f9/0xb60
[ 44.621240] fput_close_sync+0x110/0x210
[ 44.622222] __x64_sys_close+0x8f/0x120
[ 44.622530] do_syscall_64+0x5b/0x2f0
[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 44.623244] RIP: 0033:0x7f365bb3f227
Kernel panics because it detects UFFD inconsistency during
userfaultfd_release_all(). Specifically, a VMA which has a valid pointer
to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.
The inconsistency is caused in ksm_madvise(): when user calls madvise()
with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,
it accidentally clears all flags stored in the upper 32 bits of
vma->vm_flags.
Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and
int are 32-bit wide. This setup causes the following mishap during the &=
~VM_MERGEABLE assignment.
VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000.
After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then
promoted to unsigned long before the & operation. This promotion fills
upper 32 bits with leading 0s, as we're doing unsigned conversion (and
even for a signed conversion, this wouldn't help as the leading bit is 0).
& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff
instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears
the upper 32-bits of its value.
Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the
BIT() macro.
Note: other VM_* flags are not affected: This only happens to the
VM_MERGEABLE flag, as the other VM_* flags are all constants of type int
and after ~ operation, they end up with leading 1 and are thus converted
to unsigned long with leading 1s.
Note 2:
After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is
no longer a kernel BUG, but a WARNING at the same place:
[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067
but the root-cause (flag-drop) remains the same.
Link: https://lkml.kernel.org/r/20251001090353.57523-2-acsjakub@amazon.de
Fixes: 7677f7fd8be7 ("userfaultfd: add minor fault registration mode")
Signed-off-by: Jakub Acs <acsjakub(a)amazon.de>
Acked-by: David Hildenbrand <david(a)redhat.com>
Acked-by: SeongJae Park <sj(a)kernel.org>
Cc: Xu Xin <xu.xin16(a)zte.com.cn>
Cc: Chengming Zhou <chengming.zhou(a)linux.dev>
Cc: Peter Xu <peterx(a)redhat.com>
Cc: Axel Rasmussen <axelrasmussen(a)google.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/mm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/mm.h~mm-ksm-fix-flag-dropping-behavior-in-ksm_madvise
+++ a/include/linux/mm.h
@@ -296,7 +296,7 @@ extern unsigned int kobjsize(const void
#define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
#define VM_HUGEPAGE 0x20000000 /* MADV_HUGEPAGE marked this vma */
#define VM_NOHUGEPAGE 0x40000000 /* MADV_NOHUGEPAGE marked this vma */
-#define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
+#define VM_MERGEABLE BIT(31) /* KSM may merge identical pages */
#ifdef CONFIG_ARCH_USES_HIGH_VMA_FLAGS
#define VM_HIGH_ARCH_BIT_0 32 /* bit only usable on 64-bit architectures */
_
Patches currently in -mm which might be from acsjakub(a)amazon.de are
mm-ksm-fix-flag-dropping-behavior-in-ksm_madvise.patch
The core scheduling is for smt enabled cpus. It is not returns
failure and gives plenty of error messages and not clearly points
to the smt issue if the smt is disabled. It just mention
"not a core sched system" and many other messages. For example:
Not a core sched system
tid=210574, / tgid=210574 / pgid=210574: ffffffffffffffff
Not a core sched system
tid=210575, / tgid=210575 / pgid=210574: ffffffffffffffff
Not a core sched system
tid=210577, / tgid=210575 / pgid=210574: ffffffffffffffff
(similar things many other times)
In this patch, the test will first read /sys/devices/system/cpu/smt/active,
if the file cannot be opened or its value is 0, the test is skipped with
an explanatory message. This helps developers understand why it is skipped
and avoids unnecessary attention when running the full selftest suite.
Signed-off-by: Yifei Liu <yifei.l.liu(a)oracle.com>
---
tools/testing/selftests/sched/cs_prctl_test.c | 23 ++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/sched/cs_prctl_test.c b/tools/testing/selftests/sched/cs_prctl_test.c
index 52d97fae4dbd..7ce8088cde6a 100644
--- a/tools/testing/selftests/sched/cs_prctl_test.c
+++ b/tools/testing/selftests/sched/cs_prctl_test.c
@@ -32,6 +32,8 @@
#include <stdlib.h>
#include <string.h>
+#include "../kselftest.h"
+
#if __GLIBC_PREREQ(2, 30) == 0
#include <sys/syscall.h>
static pid_t gettid(void)
@@ -109,6 +111,22 @@ static void handle_usage(int rc, char *msg)
exit(rc);
}
+int check_smt(void)
+{
+ int c = 0;
+ FILE *file;
+
+ file = fopen("/sys/devices/system/cpu/smt/active", "r");
+ if (!file)
+ return 0;
+ c = fgetc(file) - 0x30;
+ fclose(file);
+ if (c == 0 || c == 1)
+ return c;
+ //if fgetc returns EOF or -1 for correupted files, return 0.
+ return 0;
+}
+
static unsigned long get_cs_cookie(int pid)
{
unsigned long long cookie;
@@ -271,7 +289,10 @@ int main(int argc, char *argv[])
delay = -1;
srand(time(NULL));
-
+ if (!check_smt()) {
+ ksft_test_result_skip("smt not enabled\n");
+ return 1;
+ }
/* put into separate process group */
if (setpgid(0, 0) != 0)
handle_error("process group");
--
2.50.1
Greetings:
Sending via plain text email -- apologies if you receive this twice.
If this isn't the process for reporting a regression in a LTS kernel per https://www.kernel.org/doc/html/latest/admin-guide/reporting-issues.html, I'm happy to follow another process.
Kernel 6.1.149 introduced a regression, at least on our ARM Cortex A57-based platforms, via commit 8f4dc4e54eed4bebb18390305eb1f721c00457e1 in arch/arm64/kernel/fpsimd.c where booting KVM VMs eventually leads to a spinlock recursion BUG and crash of the box.
Reverting that commit via the below reverts to the old (working) behavior:
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 837d1937300a57..bc42163a7fd1f0 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1851,10 +1851,10 @@ void fpsimd_save_and_flush_cpu_state(void)
if (!system_supports_fpsimd())
return;
WARN_ON(preemptible());
- get_cpu_fpsimd_context();
+ __get_cpu_fpsimd_context();
fpsimd_save();
fpsimd_flush_cpu_state();
- put_cpu_fpsimd_context();
+ __put_cpu_fpsimd_context();
}
#ifdef CONFIG_KERNEL_MODE_NEON
It's not entirely clear to me if this is specific to our firmware, specific to ARM Cortex A57, or more systemic as we lack sufficiently differentiated hardware to know. I've tested on the latest 6.1 kernel in addition to the one in the log below and have also tested a number of firmware versions available for these boxes.
Steps to reproduce:
Boot VM in qemu-system-aarch64 with "-accel kvm" and "-cpu host" flags set -- no other arguments seem to matter
Generate CPU load in VM
Kernel log:
[sjc1] root@si-compute-kvm-e0fff70016b4:/# [ 805.905413] BUG: spinlock recursion on CPU#7, CPU 3/KVM/57616
[ 805.905452] lock: 0xffff3045ef850240, .magic: dead4ead, .owner: CPU 3/KVM/57616, .owner_cpu: 7
[ 805.905477] CPU: 7 PID: 57616 Comm: CPU 3/KVM Tainted: G O 6.1.152 #1
[ 805.905495] Hardware name: SoftIron SoftIron Platform Mainboard/SoftIron Platform Mainboard, BIOS 1.31 May 11 2023
[ 805.905516] Call trace:
[ 805.905524] dump_backtrace+0xe4/0x110
[ 805.905538] show_stack+0x20/0x30
[ 805.905548] dump_stack_lvl+0x6c/0x88
[ 805.905561] dump_stack+0x18/0x34
[ 805.905571] spin_dump+0x98/0xac
[ 805.905583] do_raw_spin_lock+0x70/0x128
[ 805.905596] _raw_spin_lock+0x18/0x28
[ 805.905607] raw_spin_rq_lock_nested+0x18/0x28
[ 805.905620] update_blocked_averages+0x70/0x550
[ 805.905634] run_rebalance_domains+0x50/0x70
[ 805.905645] handle_softirqs+0x198/0x328
[ 805.905659] __do_softirq+0x1c/0x28
[ 805.905669] ____do_softirq+0x18/0x28
[ 805.905680] call_on_irq_stack+0x30/0x48
[ 805.905691] do_softirq_own_stack+0x24/0x30
[ 805.905703] do_softirq+0x74/0x90
[ 805.905714] __local_bh_enable_ip+0x64/0x80
[ 805.905727] fpsimd_save_and_flush_cpu_state+0x5c/0x68
[ 805.905740] kvm_arch_vcpu_put_fp+0x4c/0x88
[ 805.905752] kvm_arch_vcpu_put+0x28/0x88
[ 805.905764] kvm_sched_out+0x38/0x58
[ 805.905774] __schedule+0x55c/0x6c8
[ 805.905786] schedule+0x60/0xa8
[ 805.905796] kvm_vcpu_block+0x5c/0x90
[ 805.905807] kvm_vcpu_halt+0x440/0x468
[ 805.905818] kvm_vcpu_wfi+0x3c/0x70
[ 805.905828] kvm_handle_wfx+0x18c/0x1f0
[ 805.905840] handle_exit+0xb8/0x148
[ 805.905851] kvm_arch_vcpu_ioctl_run+0x6c4/0x7b0
[ 805.905863] kvm_vcpu_ioctl+0x1d0/0x8b8
[ 805.905874] __arm64_sys_ioctl+0x9c/0xe0
[ 805.905886] invoke_syscall+0x78/0x108
[ 805.905899] el0_svc_common.constprop.3+0xb4/0xf8
[ 805.905912] do_el0_svc+0x78/0x88
[ 805.905922] el0_svc+0x48/0x78
[ 805.905932] el0t_64_sync_handler+0x40/0xc0
[ 805.905943] el0t_64_sync+0x18c/0x190
[ 806.048300] hrtimer: interrupt took 2976 ns
[ 826.924613] rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
SoC 0 became not ready
SoC 0 became ready
Thanks,
--
Kenneth Van Alstyne, Jr.
This is the start of the stable review cycle for the 6.12.50 release.
There are 89 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.50-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.12.50-rc1
Niklas Neronin <niklas.neronin(a)linux.intel.com>
Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
Jason Gunthorpe <jgg(a)ziepe.ca>
iommufd: Fix race during abort for file descriptors
Thomas Zimmermann <tzimmermann(a)suse.de>
fbcon: Fix OOB access in font allocation
Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com>
fbcon: fix integer overflow in fbcon_do_set_font
Jinjiang Tu <tujinjiang(a)huawei.com>
mm/hugetlb: fix folio is still mapped when deleted
Eric Biggers <ebiggers(a)kernel.org>
kmsan: fix out-of-bounds access to shadow memory
Hans de Goede <hansg(a)kernel.org>
gpiolib: Extend software-node support to support secondary software-nodes
Jakub Acs <acsjakub(a)amazon.de>
fs/proc/task_mmu: check p->vec_buf for NULL
Zhen Ni <zhen.ni(a)easystack.cn>
afs: Fix potential null pointer dereference in afs_put_server
Nirmoy Das <nirmoyd(a)nvidia.com>
drm/ast: Use msleep instead of mdelay for edid read
Josua Mayer <josua(a)solid-run.com>
arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports
Josua Mayer <josua(a)solid-run.com>
arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes
Nobuhiro Iwamatsu <iwamatsu(a)nigauri.org>
ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
tracing: dynevent: Add a missing lockdown check on dynevent
Eric Biggers <ebiggers(a)kernel.org>
crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: improve VF MAC filters accounting
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: add mask to apply valid bits for itr_idx
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: add max boundary check for VF filters
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix validation of VF state in get resources
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix input validation logic for action_meta
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix idx validation in config queues msg
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix idx validation in i40e_validate_queue_map
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: add validation for ring_len param
Amit Chaudhari <amitchaudhari(a)mac.com>
HID: asus: add support for missing PX series fn keys
Sang-Heon Jeon <ekffu200098(a)gmail.com>
smb: client: fix wrong index reference in smb2_compound_op()
Daniel Lee <dany97(a)live.ca>
platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
Adrián Larumbe <adrian.larumbe(a)collabora.com>
drm/panthor: Defer scheduler entitiy destruction to queue release
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
futex: Prevent use-after-free during requeue-PI
Zabelin Nikita <n.zabelin(a)mt-integration.ru>
drm/gma500: Fix null dereference in hdmi teardown
Hugh Dickins <hughd(a)google.com>
mm: folio_may_be_lru_cached() unless folio_test_large()
Hugh Dickins <hughd(a)google.com>
mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch"
Hugh Dickins <hughd(a)google.com>
mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
Dan Carpenter <dan.carpenter(a)linaro.org>
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
Ido Schimmel <idosch(a)nvidia.com>
selftests: fib_nexthops: Fix creation of non-FDB nexthops
Ido Schimmel <idosch(a)nvidia.com>
nexthop: Forbid FDB status change while nexthop is in a group
Jason Baron <jbaron(a)akamai.com>
net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
Alok Tiwari <alok.a.tiwari(a)oracle.com>
bnxt_en: correct offset handling for IPv6 destination address
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
vhost: Take a reference on the task in struct vhost_task.
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_sync: Fix hci_resume_advertising_sync
Petr Malat <oss(a)malat.biz>
ethernet: rvu-af: Remove slash from the driver name
Sidraya Jayagond <sidraya(a)linux.ibm.com>
net/smc: fix warning in smc_rx_splice() when calling get_page()
Wang Liang <wangliang74(a)huawei.com>
net: tun: Update napi->skb after XDP process
Stéphane Grosjean <stephane.grosjean(a)hms-networks.com>
can: peak_usb: fix shift-out-of-bounds issue
Vincent Mailhol <mailhol(a)kernel.org>
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol(a)kernel.org>
can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol(a)kernel.org>
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol(a)kernel.org>
can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
Sabrina Dubroca <sd(a)queasysnail.net>
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
Leon Hwang <leon.hwang(a)linux.dev>
bpf: Reject bpf_timer for PREEMPT_RT
Geert Uytterhoeven <geert+renesas(a)glider.be>
can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
James Guan <guan_yufei(a)163.com>
wifi: virt_wifi: Fix page fault on connect
Mark Harmstone <mark(a)harmstone.com>
btrfs: don't allow adding block device of less than 1 MB
Jiri Olsa <olsajiri(a)gmail.com>
bpf: Check the helper function is valid in get_helper_proto
Stefan Metzmacher <metze(a)samba.org>
smb: server: use disable_work_sync in transport_rdma.c
Stefan Metzmacher <metze(a)samba.org>
smb: server: don't use delayed_work for post_recv_credits_work
Christian Loehle <christian.loehle(a)arm.com>
cpufreq: Initialize cpufreq-based invariance before subsys
Jihed Chaibi <jihed.chaibi.dev(a)gmail.com>
ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
Peng Fan <peng.fan(a)nxp.com>
arm64: dts: imx8mp: Correct thermal sensor index
Peng Fan <peng.fan(a)nxp.com>
firmware: imx: Add stub functions for SCMI MISC API
Basavaraj Natikar <Basavaraj.Natikar(a)amd.com>
HID: amd_sfh: Add sync across amd sfh work functions
Or Har-Toov <ohartoov(a)nvidia.com>
IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
Aleksander Jan Bajkowski <olek2(a)wp.pl>
net: sfp: add quirk for FLYPRO copper SFP+ module
qaqland <anguoli(a)uniontech.com>
ALSA: usb-audio: Add mute TLV for playback volumes on more devices
Cryolitia PukNgae <cryolitia(a)uniontech.com>
ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
noble.yang <noble.yang(a)comtrue-inc.com>
ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
i2c: designware: Add quirk for Intel Xe
Benoît Monin <benoit.monin(a)bootlin.com>
mmc: sdhci-cadence: add Mobileye eyeQ support
Chris Morgan <macromorgan(a)hotmail.com>
net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
Marc Kleine-Budde <mkl(a)pengutronix.de>
net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info
Jiayi Li <lijiayi(a)kylinos.cn>
usb: core: Add 0x prefix to quirks debug output
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix build with CONFIG_INPUT=n
Stefan Binding <sbinding(a)opensource.cirrus.com>
ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
Chen Ni <nichen(a)iscas.ac.cn>
ALSA: usb-audio: Convert comma to semicolon
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: specify that Apple Touch Bar is direct
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Fix block comments in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Fix code alignment in mixer_quirks
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
firewire: core: fix overlooked update of subsystem ABI version
Alok Tiwari <alok.a.tiwari(a)oracle.com>
scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
-------------
Diffstat:
Documentation/admin-guide/laptops/lg-laptop.rst | 4 +-
Makefile | 4 +-
.../dts/intel/socfpga/socfpga_cyclone5_sodia.dts | 6 +-
.../boot/dts/marvell/kirkwood-openrd-client.dts | 2 +-
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 +-
arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 16 +-
arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi | 8 +
drivers/cpufreq/cpufreq.c | 20 +-
drivers/firewire/core-cdev.c | 2 +-
drivers/gpio/gpiolib.c | 21 +-
drivers/gpu/drm/ast/ast_dp.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi.c | 2 +-
drivers/gpu/drm/panthor/panthor_sched.c | 8 +-
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 12 +-
drivers/hid/amd-sfh-hid/amd_sfh_common.h | 3 +
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 4 +
drivers/hid/hid-asus.c | 3 +
drivers/hid/hid-multitouch.c | 45 +-
drivers/i2c/busses/i2c-designware-platdrv.c | 7 +-
drivers/infiniband/hw/mlx5/devx.c | 1 +
drivers/iommu/iommufd/fault.c | 4 +-
drivers/iommu/iommufd/main.c | 34 +-
drivers/mmc/host/sdhci-cadence.c | 11 +
drivers/net/can/rcar/rcar_can.c | 8 +-
drivers/net/can/spi/hi311x.c | 1 +
drivers/net/can/sun4i_can.c | 1 +
drivers/net/can/usb/etas_es58x/es58x_core.c | 3 +-
drivers/net/can/usb/mcba_usb.c | 1 +
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
drivers/net/dsa/lantiq_gswip.c | 21 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +-
drivers/net/ethernet/freescale/fec_main.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e.h | 3 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 26 +-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 110 +++--
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 +-
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 3 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
drivers/net/phy/sfp.c | 24 +-
drivers/net/tun.c | 3 +
drivers/net/wireless/virtual/virt_wifi.c | 4 +-
drivers/platform/x86/lg-laptop.c | 34 +-
drivers/ufs/core/ufs-mcq.c | 4 +-
drivers/usb/core/quirks.c | 2 +-
drivers/usb/host/xhci-dbgcap.c | 2 +-
drivers/usb/host/xhci-mem.c | 50 +-
drivers/usb/host/xhci.c | 2 +-
drivers/usb/host/xhci.h | 6 +-
drivers/video/fbdev/core/fbcon.c | 13 +-
fs/afs/server.c | 3 +-
fs/btrfs/volumes.c | 5 +
fs/hugetlbfs/inode.c | 10 +-
fs/proc/task_mmu.c | 3 +
fs/smb/client/smb2inode.c | 2 +-
fs/smb/server/transport_rdma.c | 22 +-
include/crypto/if_alg.h | 2 +-
include/linux/firmware/imx/sm.h | 12 +
include/linux/swap.h | 10 +
include/net/bluetooth/hci_core.h | 21 +
kernel/bpf/core.c | 5 +-
kernel/bpf/verifier.c | 6 +-
kernel/futex/requeue.c | 6 +-
kernel/trace/trace_dynevent.c | 4 +
kernel/vhost_task.c | 3 +-
mm/gup.c | 15 +-
mm/kmsan/core.c | 10 +-
mm/kmsan/kmsan_test.c | 16 +
mm/mlock.c | 6 +-
mm/swap.c | 51 +-
net/bluetooth/hci_event.c | 26 +-
net/bluetooth/hci_sync.c | 7 +
net/core/skbuff.c | 2 +-
net/ipv4/nexthop.c | 7 +
net/smc/smc_loopback.c | 14 +-
net/xfrm/xfrm_state.c | 3 +
sound/pci/hda/patch_realtek.c | 11 +
sound/usb/mixer_quirks.c | 545 +++++++++++++++------
sound/usb/quirks.c | 24 +-
sound/usb/usbaudio.h | 4 +
tools/testing/selftests/net/fib_nexthops.sh | 12 +-
80 files changed, 1037 insertions(+), 387 deletions(-)