Dear Kernel maintainers,
I think i'm encountering (for the first time in years !) a regression
with the "6.7.arch3-1" kernel (whereas no issues with
"6.6.10.arch1-1", on which i reverted).
I'm running a (up-to-date, and non-LTS) ARCHLINUX desktop, on a ASUS
B560-I motherboard, with 3 monitors (attached to a 4-HDMI outputs
card), plus an audio S/PDIF optic output at motherboard level.
With the latest kernel, the S/PIDF optic output of the motherboard is
NOT detected anymore (and i haven't been able to see / find anything
in the logs at quick glance, neither journalctl -xe nor dmesg).
Once reverted to 6.6.10, everything is fine again.
For example, in a working situation (6.6.10), i have :
cat /proc/asound/pcm
00-00: ALC1220 Analog : ALC1220 Analog : playback 1 : capture 1
00-01: ALC1220 Digital : ALC1220 Digital : playback 1
00-02: ALC1220 Alt Analog : ALC1220 Alt Analog : capture 1
01-03: HDMI 0 : HDMI 0 : playback 1
01-07: HDMI 1 : HDMI 1 : playback 1
01-08: HDMI 2 : HDMI 2 : playback 1
01-09: HDMI 3 : HDMI 3 : playback 1
Whereas while on the latest 6.7 kernel, i only had the 4 HDMI lines
(linked to a NVIDIA T600 card, with 4 HDMI outputs) and not the three
first ones (attached to the motherboard).
(of course i did several tests with 6.7, reboot, ... without any changes)
Any idea ?
Best regards
--
Serge.
This is the start of the stable review cycle for the 6.12.50 release.
There are 89 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.50-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.12.50-rc1
Niklas Neronin <niklas.neronin(a)linux.intel.com>
Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
Jason Gunthorpe <jgg(a)ziepe.ca>
iommufd: Fix race during abort for file descriptors
Thomas Zimmermann <tzimmermann(a)suse.de>
fbcon: Fix OOB access in font allocation
Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com>
fbcon: fix integer overflow in fbcon_do_set_font
Jinjiang Tu <tujinjiang(a)huawei.com>
mm/hugetlb: fix folio is still mapped when deleted
Eric Biggers <ebiggers(a)kernel.org>
kmsan: fix out-of-bounds access to shadow memory
Hans de Goede <hansg(a)kernel.org>
gpiolib: Extend software-node support to support secondary software-nodes
Jakub Acs <acsjakub(a)amazon.de>
fs/proc/task_mmu: check p->vec_buf for NULL
Zhen Ni <zhen.ni(a)easystack.cn>
afs: Fix potential null pointer dereference in afs_put_server
Nirmoy Das <nirmoyd(a)nvidia.com>
drm/ast: Use msleep instead of mdelay for edid read
Josua Mayer <josua(a)solid-run.com>
arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports
Josua Mayer <josua(a)solid-run.com>
arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes
Nobuhiro Iwamatsu <iwamatsu(a)nigauri.org>
ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
Masami Hiramatsu (Google) <mhiramat(a)kernel.org>
tracing: dynevent: Add a missing lockdown check on dynevent
Eric Biggers <ebiggers(a)kernel.org>
crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: improve VF MAC filters accounting
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: add mask to apply valid bits for itr_idx
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: add max boundary check for VF filters
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix validation of VF state in get resources
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix input validation logic for action_meta
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix idx validation in config queues msg
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: fix idx validation in i40e_validate_queue_map
Lukasz Czapnik <lukasz.czapnik(a)intel.com>
i40e: add validation for ring_len param
Amit Chaudhari <amitchaudhari(a)mac.com>
HID: asus: add support for missing PX series fn keys
Sang-Heon Jeon <ekffu200098(a)gmail.com>
smb: client: fix wrong index reference in smb2_compound_op()
Daniel Lee <dany97(a)live.ca>
platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
Adrián Larumbe <adrian.larumbe(a)collabora.com>
drm/panthor: Defer scheduler entitiy destruction to queue release
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
futex: Prevent use-after-free during requeue-PI
Zabelin Nikita <n.zabelin(a)mt-integration.ru>
drm/gma500: Fix null dereference in hdmi teardown
Hugh Dickins <hughd(a)google.com>
mm: folio_may_be_lru_cached() unless folio_test_large()
Hugh Dickins <hughd(a)google.com>
mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch"
Hugh Dickins <hughd(a)google.com>
mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
Dan Carpenter <dan.carpenter(a)linaro.org>
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
Vladimir Oltean <vladimir.oltean(a)nxp.com>
net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
Ido Schimmel <idosch(a)nvidia.com>
selftests: fib_nexthops: Fix creation of non-FDB nexthops
Ido Schimmel <idosch(a)nvidia.com>
nexthop: Forbid FDB status change while nexthop is in a group
Jason Baron <jbaron(a)akamai.com>
net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
Alok Tiwari <alok.a.tiwari(a)oracle.com>
bnxt_en: correct offset handling for IPv6 destination address
Sebastian Andrzej Siewior <bigeasy(a)linutronix.de>
vhost: Take a reference on the task in struct vhost_task.
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_sync: Fix hci_resume_advertising_sync
Petr Malat <oss(a)malat.biz>
ethernet: rvu-af: Remove slash from the driver name
Sidraya Jayagond <sidraya(a)linux.ibm.com>
net/smc: fix warning in smc_rx_splice() when calling get_page()
Wang Liang <wangliang74(a)huawei.com>
net: tun: Update napi->skb after XDP process
Stéphane Grosjean <stephane.grosjean(a)hms-networks.com>
can: peak_usb: fix shift-out-of-bounds issue
Vincent Mailhol <mailhol(a)kernel.org>
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol(a)kernel.org>
can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol(a)kernel.org>
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol(a)kernel.org>
can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
Sabrina Dubroca <sd(a)queasysnail.net>
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
Leon Hwang <leon.hwang(a)linux.dev>
bpf: Reject bpf_timer for PREEMPT_RT
Geert Uytterhoeven <geert+renesas(a)glider.be>
can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
James Guan <guan_yufei(a)163.com>
wifi: virt_wifi: Fix page fault on connect
Mark Harmstone <mark(a)harmstone.com>
btrfs: don't allow adding block device of less than 1 MB
Jiri Olsa <olsajiri(a)gmail.com>
bpf: Check the helper function is valid in get_helper_proto
Stefan Metzmacher <metze(a)samba.org>
smb: server: use disable_work_sync in transport_rdma.c
Stefan Metzmacher <metze(a)samba.org>
smb: server: don't use delayed_work for post_recv_credits_work
Christian Loehle <christian.loehle(a)arm.com>
cpufreq: Initialize cpufreq-based invariance before subsys
Jihed Chaibi <jihed.chaibi.dev(a)gmail.com>
ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
Peng Fan <peng.fan(a)nxp.com>
arm64: dts: imx8mp: Correct thermal sensor index
Peng Fan <peng.fan(a)nxp.com>
firmware: imx: Add stub functions for SCMI MISC API
Basavaraj Natikar <Basavaraj.Natikar(a)amd.com>
HID: amd_sfh: Add sync across amd sfh work functions
Or Har-Toov <ohartoov(a)nvidia.com>
IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
Aleksander Jan Bajkowski <olek2(a)wp.pl>
net: sfp: add quirk for FLYPRO copper SFP+ module
qaqland <anguoli(a)uniontech.com>
ALSA: usb-audio: Add mute TLV for playback volumes on more devices
Cryolitia PukNgae <cryolitia(a)uniontech.com>
ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
noble.yang <noble.yang(a)comtrue-inc.com>
ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
Heikki Krogerus <heikki.krogerus(a)linux.intel.com>
i2c: designware: Add quirk for Intel Xe
Benoît Monin <benoit.monin(a)bootlin.com>
mmc: sdhci-cadence: add Mobileye eyeQ support
Chris Morgan <macromorgan(a)hotmail.com>
net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
Marc Kleine-Budde <mkl(a)pengutronix.de>
net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info
Jiayi Li <lijiayi(a)kylinos.cn>
usb: core: Add 0x prefix to quirks debug output
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb-audio: Fix build with CONFIG_INPUT=n
Stefan Binding <sbinding(a)opensource.cirrus.com>
ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
Chen Ni <nichen(a)iscas.ac.cn>
ALSA: usb-audio: Convert comma to semicolon
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: specify that Apple Touch Bar is direct
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar
Kerem Karabay <kekrby(a)gmail.com>
HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Fix block comments in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com>
ALSA: usb-audio: Fix code alignment in mixer_quirks
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
firewire: core: fix overlooked update of subsystem ABI version
Alok Tiwari <alok.a.tiwari(a)oracle.com>
scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
-------------
Diffstat:
Documentation/admin-guide/laptops/lg-laptop.rst | 4 +-
Makefile | 4 +-
.../dts/intel/socfpga/socfpga_cyclone5_sodia.dts | 6 +-
.../boot/dts/marvell/kirkwood-openrd-client.dts | 2 +-
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 +-
arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 16 +-
arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi | 8 +
drivers/cpufreq/cpufreq.c | 20 +-
drivers/firewire/core-cdev.c | 2 +-
drivers/gpio/gpiolib.c | 21 +-
drivers/gpu/drm/ast/ast_dp.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi.c | 2 +-
drivers/gpu/drm/panthor/panthor_sched.c | 8 +-
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 12 +-
drivers/hid/amd-sfh-hid/amd_sfh_common.h | 3 +
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 4 +
drivers/hid/hid-asus.c | 3 +
drivers/hid/hid-multitouch.c | 45 +-
drivers/i2c/busses/i2c-designware-platdrv.c | 7 +-
drivers/infiniband/hw/mlx5/devx.c | 1 +
drivers/iommu/iommufd/fault.c | 4 +-
drivers/iommu/iommufd/main.c | 34 +-
drivers/mmc/host/sdhci-cadence.c | 11 +
drivers/net/can/rcar/rcar_can.c | 8 +-
drivers/net/can/spi/hi311x.c | 1 +
drivers/net/can/sun4i_can.c | 1 +
drivers/net/can/usb/etas_es58x/es58x_core.c | 3 +-
drivers/net/can/usb/mcba_usb.c | 1 +
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
drivers/net/dsa/lantiq_gswip.c | 21 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +-
drivers/net/ethernet/freescale/fec_main.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e.h | 3 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 26 +-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 110 +++--
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 +-
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 3 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
drivers/net/phy/sfp.c | 24 +-
drivers/net/tun.c | 3 +
drivers/net/wireless/virtual/virt_wifi.c | 4 +-
drivers/platform/x86/lg-laptop.c | 34 +-
drivers/ufs/core/ufs-mcq.c | 4 +-
drivers/usb/core/quirks.c | 2 +-
drivers/usb/host/xhci-dbgcap.c | 2 +-
drivers/usb/host/xhci-mem.c | 50 +-
drivers/usb/host/xhci.c | 2 +-
drivers/usb/host/xhci.h | 6 +-
drivers/video/fbdev/core/fbcon.c | 13 +-
fs/afs/server.c | 3 +-
fs/btrfs/volumes.c | 5 +
fs/hugetlbfs/inode.c | 10 +-
fs/proc/task_mmu.c | 3 +
fs/smb/client/smb2inode.c | 2 +-
fs/smb/server/transport_rdma.c | 22 +-
include/crypto/if_alg.h | 2 +-
include/linux/firmware/imx/sm.h | 12 +
include/linux/swap.h | 10 +
include/net/bluetooth/hci_core.h | 21 +
kernel/bpf/core.c | 5 +-
kernel/bpf/verifier.c | 6 +-
kernel/futex/requeue.c | 6 +-
kernel/trace/trace_dynevent.c | 4 +
kernel/vhost_task.c | 3 +-
mm/gup.c | 15 +-
mm/kmsan/core.c | 10 +-
mm/kmsan/kmsan_test.c | 16 +
mm/mlock.c | 6 +-
mm/swap.c | 51 +-
net/bluetooth/hci_event.c | 26 +-
net/bluetooth/hci_sync.c | 7 +
net/core/skbuff.c | 2 +-
net/ipv4/nexthop.c | 7 +
net/smc/smc_loopback.c | 14 +-
net/xfrm/xfrm_state.c | 3 +
sound/pci/hda/patch_realtek.c | 11 +
sound/usb/mixer_quirks.c | 545 +++++++++++++++------
sound/usb/quirks.c | 24 +-
sound/usb/usbaudio.h | 4 +
tools/testing/selftests/net/fib_nexthops.sh | 12 +-
80 files changed, 1037 insertions(+), 387 deletions(-)
Similarly to pci_dev_aer_stats_incr(), pci_print_aer() may be called
when dev->aer_info is NULL. Add a NULL check before proceeding to avoid
calling aer_ratelimit() with a NULL aer_info pointer, returning 1, which
does not rate limit, given this is fatal.
This prevents a kernel crash triggered by dereferencing a NULL pointer
in aer_ratelimit(), ensuring safer handling of PCI devices that lack
AER info. This change aligns pci_print_aer() with pci_dev_aer_stats_incr()
which already performs this NULL check.
Cc: stable(a)vger.kernel.org
Fixes: a57f2bfb4a5863 ("PCI/AER: Ratelimit correctable and non-fatal error logging")
Signed-off-by: Breno Leitao <leitao(a)debian.org>
---
- This problem is still happening in upstream, and unfortunately no action
was done in the previous discussion.
- Link to previous post:
https://lore.kernel.org/r/20250804-aer_crash_2-v1-1-fd06562c18a4@debian.org
---
drivers/pci/pcie/aer.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
index e286c197d7167..55abc5e17b8b1 100644
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -786,6 +786,9 @@ static void pci_rootport_aer_stats_incr(struct pci_dev *pdev,
static int aer_ratelimit(struct pci_dev *dev, unsigned int severity)
{
+ if (!dev->aer_info)
+ return 1;
+
switch (severity) {
case AER_NONFATAL:
return __ratelimit(&dev->aer_info->nonfatal_ratelimit);
---
base-commit: e5f0a698b34ed76002dc5cff3804a61c80233a7a
change-id: 20250801-aer_crash_2-b21cc2ef0d00
Best regards,
--
Breno Leitao <leitao(a)debian.org>
This is the start of the stable review cycle for the 6.1.154 release.
There are 61 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 24 Sep 2025 19:23:52 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.154-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.154-rc1
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
David Howells <dhowells(a)redhat.com>
crypto: af_alg: Convert af_alg_sendpage() to use MSG_SPLICE_PAGES
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: q6apm-lpass-dai: close graph on prepare errors
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: qcom: q6apm-lpass-dai: close graphs before opening a new one
Hans de Goede <hansg(a)kernel.org>
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
Philipp Zabel <p.zabel(a)pengutronix.de>
net: rfkill: gpio: add DT support
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
selftests: mptcp: connect: catch IO errors on listen side
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
mptcp: propagate shutdown to subflows when possible
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: dbc: Fix full DbC transfer ring after several reconnects
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: dbc: decouple endpoint allocation from initialization
Johan Hovold <johan(a)kernel.org>
phy: ti: omap-usb2: fix device leak at unbind
Rob Herring <robh(a)kernel.org>
phy: Use device_get_match_data()
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
selftests: mptcp: userspace pm: validate deny-join-id0 flag
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
mptcp: pm: nl: announce deny-join-id0 flag
Stefan Metzmacher <metze(a)samba.org>
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
David Howells <dhowells(a)redhat.com>
crypto: af_alg: Indent the loop in af_alg_sendmsg()
Qi Xi <xiqi2(a)huawei.com>
drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
Loic Poulain <loic.poulain(a)oss.qualcomm.com>
drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
Colin Ian King <colin.i.king(a)gmail.com>
ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ASoC: wm8974: Correct PLL rate rounding
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ASoC: wm8940: Correct typo in control name
Jens Axboe <axboe(a)kernel.dk>
io_uring: include dying ring in task_work "should cancel" state
Jens Axboe <axboe(a)kernel.dk>
io_uring: backport io_should_terminate_tw()
Praful Adiga <praful.adiga(a)gmail.com>
ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
selftests: mptcp: avoid spurious errors on TCP disconnect
Håkon Bugge <haakon.bugge(a)oracle.com>
rds: ib: Increment i_fastreg_wrs before bailing out
Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com>
KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
Thomas Fourier <fourier.thomas(a)gmail.com>
mmc: mvsdio: Fix dma_unmap_sg() nents value
Mohammad Rafi Shaik <mohammad.rafi.shaik(a)oss.qualcomm.com>
ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
Mohammad Rafi Shaik <mohammad.rafi.shaik(a)oss.qualcomm.com>
ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: fix the incorrect inode ref size check
Eugene Koira <eugkoira(a)amazon.com>
iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
Tao Cui <cuitao(a)kylinos.cn>
LoongArch: Check the return value when creating kobj
Huacai Chen <chenhuacai(a)kernel.org>
LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
H. Nikolaus Schaller <hns(a)goldelico.com>
power: supply: bq27xxx: restrict no-battery detection to bq27000
H. Nikolaus Schaller <hns(a)goldelico.com>
power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
Nathan Chancellor <nathan(a)kernel.org>
nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
Stefan Metzmacher <metze(a)samba.org>
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
Duoming Zhou <duoming(a)zju.edu.cn>
octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
Duoming Zhou <duoming(a)zju.edu.cn>
cnic: Fix use-after-free bugs in cnic_delete_task
Alexey Nepomnyashih <sdl(a)nppct.ru>
net: liquidio: fix overflow in octeon_init_instr_queue()
Tariq Toukan <tariqt(a)nvidia.com>
Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
Jakub Kicinski <kuba(a)kernel.org>
tls: make sure to abort the stream if headers are bogus
Kuniyuki Iwashima <kuniyu(a)google.com>
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
Hangbin Liu <liuhangbin(a)gmail.com>
bonding: don't set oif to bond dev when getting NS target destination
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
i40e: remove redundant memory barrier when cleaning Tx descs
Yeounsu Moon <yyyynoom(a)gmail.com>
net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
mptcp: set remote_deny_join_id0 on SYN recv
Jamie Bainbridge <jamie.bainbridge(a)gmail.com>
qed: Don't collect too many protection override GRC elements
Ioana Ciornei <ioana.ciornei(a)nxp.com>
dpaa2-switch: fix buffer pool seeding for control traffic
Miaoqian Lin <linmq006(a)gmail.com>
um: virtio_uml: Fix use-after-free after put_device in probe
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix invalid extref key setup when replaying dentry
Chen Ridong <chenridong(a)huawei.com>
cgroup: split cgroup_destroy_wq into 3 workqueues
Geert Uytterhoeven <geert+renesas(a)glider.be>
pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
Liao Yuanhong <liaoyuanhong(a)vivo.com>
wifi: mac80211: fix incorrect type for ret
Lachlan Hodges <lachlan.hodges(a)morsemicro.com>
wifi: mac80211: increase scan_ies_len for S1G
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
-------------
Diffstat:
Makefile | 4 +-
arch/loongarch/include/asm/acenv.h | 7 +-
arch/loongarch/kernel/env.c | 2 +
arch/um/drivers/virtio_uml.c | 6 +-
arch/x86/kvm/svm/svm.c | 3 +-
crypto/af_alg.c | 112 ++++++++-------------
drivers/gpu/drm/bridge/analogix/anx7625.c | 6 +-
.../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 +-
drivers/iommu/intel/iommu.c | 7 +-
drivers/mmc/host/mvsdio.c | 2 +-
drivers/net/bonding/bond_main.c | 1 -
drivers/net/ethernet/broadcom/cnic.c | 3 +-
.../net/ethernet/cavium/liquidio/request_manager.c | 2 +-
.../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 -
.../net/ethernet/marvell/octeontx2/nic/otx2_ptp.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 -
drivers/net/ethernet/natsemi/ns83820.c | 13 ++-
drivers/net/ethernet/qlogic/qed/qed_debug.c | 7 +-
drivers/pcmcia/omap_cf.c | 8 +-
drivers/phy/broadcom/phy-bcm-ns-usb3.c | 9 +-
drivers/phy/marvell/phy-berlin-usb.c | 7 +-
drivers/phy/ralink/phy-ralink-usb.c | 10 +-
drivers/phy/rockchip/phy-rockchip-pcie.c | 11 +-
drivers/phy/rockchip/phy-rockchip-usb.c | 10 +-
drivers/phy/ti/phy-omap-control.c | 9 +-
drivers/phy/ti/phy-omap-usb2.c | 24 +++--
drivers/phy/ti/phy-ti-pipe3.c | 14 +--
drivers/power/supply/bq27xxx_battery.c | 4 +-
drivers/usb/host/xhci-dbgcap.c | 94 ++++++++++++-----
fs/btrfs/tree-checker.c | 4 +-
fs/btrfs/tree-log.c | 2 +-
fs/nilfs2/sysfs.c | 4 +-
fs/nilfs2/sysfs.h | 8 +-
fs/smb/client/smbdirect.c | 4 +-
fs/smb/server/transport_rdma.c | 26 +++--
include/crypto/if_alg.h | 10 +-
include/uapi/linux/mptcp.h | 6 +-
io_uring/io_uring.c | 13 ++-
io_uring/io_uring.h | 13 +++
io_uring/poll.c | 3 +-
io_uring/timeout.c | 2 +-
kernel/cgroup/cgroup.c | 43 ++++++--
net/ipv4/tcp.c | 5 +
net/mac80211/driver-ops.h | 2 +-
net/mac80211/main.c | 7 +-
net/mptcp/pm_netlink.c | 7 ++
net/mptcp/protocol.c | 15 +++
net/mptcp/subflow.c | 4 +
net/rds/ib_frmr.c | 20 ++--
net/rfkill/rfkill-gpio.c | 22 +++-
net/tls/tls.h | 1 +
net/tls/tls_strp.c | 14 ++-
net/tls/tls_sw.c | 3 +-
sound/firewire/motu/motu-hwdep.c | 2 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/wm8940.c | 2 +-
sound/soc/codecs/wm8974.c | 8 +-
sound/soc/qcom/qdsp6/audioreach.c | 1 +
sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 36 +++++--
sound/soc/sof/intel/hda-stream.c | 2 +-
tools/testing/selftests/net/mptcp/mptcp_connect.c | 11 +-
tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 7 ++
tools/testing/selftests/net/mptcp/userspace_pm.sh | 14 ++-
64 files changed, 440 insertions(+), 272 deletions(-)
In i2c_amd_probe(), amd_mp2_find_device() utilizes
driver_find_next_device() which internally calls driver_find_device()
to locate the matching device. driver_find_device() increments the
reference count of the found device by calling get_device(), but
amd_mp2_find_device() fails to call put_device() to decrement the
reference count before returning. This results in a reference count
leak of the PCI device each time i2c_amd_probe() is executed, which
may prevent the device from being properly released and cause a memory
leak.
Found by code review.
Cc: stable(a)vger.kernel.org
Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller")
Signed-off-by: Ma Ke <make24(a)iscas.ac.cn>
---
Changes in v2:
- modified the missing initialization in the patch. Sorry for the omission.
---
drivers/i2c/busses/i2c-amd-mp2-pci.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-amd-mp2-pci.c b/drivers/i2c/busses/i2c-amd-mp2-pci.c
index ef7370d3dbea..60edbabc2986 100644
--- a/drivers/i2c/busses/i2c-amd-mp2-pci.c
+++ b/drivers/i2c/busses/i2c-amd-mp2-pci.c
@@ -458,13 +458,16 @@ struct amd_mp2_dev *amd_mp2_find_device(void)
{
struct device *dev;
struct pci_dev *pci_dev;
+ struct amd_mp2_dev *mp2_dev;
dev = driver_find_next_device(&amd_mp2_pci_driver.driver, NULL);
if (!dev)
return NULL;
pci_dev = to_pci_dev(dev);
- return (struct amd_mp2_dev *)pci_get_drvdata(pci_dev);
+ mp2_dev = (struct amd_mp2_dev *)pci_get_drvdata(pci_dev);
+ put_device(dev);
+ return mp2_dev;
}
EXPORT_SYMBOL_GPL(amd_mp2_find_device);
--
2.17.1